Jump to content
CCleaner Community Forums

Files deleted and immediately recovered, but full of 00h


Recommended Posts

If I delete a file with shift-del and then retrieve it using recuva, the content of the recovered file is full of 00h, with the same size as the original.

I have a disk with three partitions (C: D: E :) and this happens on all partitions.

I did some tests .... if I recover the file from the root of the disk (Ex: C: \ or D: \) the files with a size of 712 bytes or less are regularly recovered with their readable contents, 713 bytes or greater they are only full of 00h.

If, on the other hand, I delete and recover a file in any sub-folder, even files smaller than 712 bytes have 00h (I have not checked the lower limit at the moment).

Do you have any idea what the problem may be?

Windows 10 x64 home edition,

Link to post
Share on other sites
  • Moderators

The fact that the recovered file is full of 00h would suggest that you have used a secure deletion method above just shift+del?

However some very small files (under 1 KB) will/may be saved entirely in the MFT, which means that secure delete will not work on those and so they can later be recovered.

Link to post
Share on other sites
  • Moderators

I have to disagree Nukecad, shift/del is not, and has never been, a secure delete. The file's content is unchanged. It's true that small files can be, and probably are, held in their MFT record. In some cases, long file names etc, there is not enough room for even a small file and a separate cluster is used to hold the data.

Why is the O/P seeing 00's? I guess he or she's using an SSD. In which case kiss goodbye to recovering any of that data.

Link to post
Share on other sites

hello ... this has never happened to me with windows 7 ... I could easily recover accidentally deleted files.
However now if I try to recover files on another HD connected to this PC via USB, everything is fine.

Link to post
Share on other sites
  • Moderators
5 hours ago, Augeas said:

I have to disagree Nukecad, shift/del is not, and has never been, a secure delete.

I stand corrected, I had answered in haste.

Of course shift+del merely bypasses the recycle bin.

I should have said that the 00h was a strong indication that the files had been secure deleted, but as you say a SSD is a possibility.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...