Jump to content
CCleaner Community Forums
jpcummins

Deleted files only

Recommended Posts

I am thinking of downloading and installing the Recuva Free Version.  But before I do I want to know if when running a search if Recuva identifies only the deleted files or all files, which would include the existing files?  It seems to me that when I did have Recuva installed that when I ran a search Recuva identified all files.  If Recuva identifies all files, including existing files, why would this be helpful to someone only looking for files that are deleted?  As you can tell from my question I am not very experienced when it comes to trying to recover a deleted file.  But if someone can answer my question I would appreciate it very much.  Thanking you in advance.

John

 

Share this post


Link to post
Share on other sites

There is an option in Advanced Mode to select non-deleted (live) files. This is unchcked by default.

Share this post


Link to post
Share on other sites

I am confused as I don't recall, when I had Recuva installed, ever utilizing options in Advanced Mode.  However, I do remember the scans I did perform containing non-deleted files.  It would appear that if I wanted to see non-deleted files I would need to select by checking the option in Advanced Mode.  Is there a way of scanning for only deleted files in Recuva?  The reason I remember so well my previous scans containing non-deleted files the scans displayed thousands of files and as the computer was fairly new I knew there couldn't have been that many files deleted.  One last question, is it easier to find deleted files in the paid version of Recuva than the Free?  Sorry for being such a problem and thanks for your reply.

John 

Share this post


Link to post
Share on other sites

It's common in new installation to see very many deleted files from the install. Non-deleted files will have Non-Deleted (or whatever the description is) as their status. To stop showing non-deleted files uncheck the box in Advanced mode/Options/Actions. Free and Pro versions act the same.

Share this post


Link to post
Share on other sites

I did download and install the free version of Recuva.  And, while I have been successful in finding a few specific deleted files with the path/file name option, I have questions regarding a Deep Scan.  Any help would be appreciated and I would thank you in advance.  1)  Can a Deep Scan be saved and searched at a later date?  2)  Can a Deep Scan be searched by actual file name?  For some reason I seem to recall seeing that a Deep Scan only shows the deleted files by number and extension, such as 00001.jpg, not by actual file name.  If so, that would mean having to look at each file until the one being searched for is found and at least for me that would be way too time-consuming.  Again, thanks!

John    

Share this post


Link to post
Share on other sites

1) It has no ability save scans. Once you exit the program it's gone, starting the program again means starting over from the beginning.

Share this post


Link to post
Share on other sites

2) A deep scan does not return file names, as it looks directly at the device's clusters which do not contain file name or path information. A deep scan runs a normal scan first so the file names from that will be displayed first.

Share this post


Link to post
Share on other sites

If a Normal Scan and a Deep Scan finds the exact same number of deleted files my understanding of a Deep Scan has been only partially correct and this is starting to make a little sense to me.  If I can please ask a couple more questions, 1)  Why doesn't Recuva allow for the Deep Scan to be saved to be used later?  2)  If a Deep Scan is selected when it is finished is it easy to distinguish which is the result of the Normal and Deep scans, is there a break or is it all together.  I appreciate all replies and would thank you in advance.

John 

Share this post


Link to post
Share on other sites

1) Who knows?

2) A normal scan will have file names and path if available. A deep scan will have files identified as [000123].jpg etc. These will follow the normal scan results.

Share this post


Link to post
Share on other sites

1) I would guess that's because the scanned drive may be later modified by having new files written to it, which would make any saved scan invalid.

So having to rescan would be the safer option than a possibly invalid saved scan, and not a real problem in the past.
But with todays larger drives a rescan can take a lot longer.

Share this post


Link to post
Share on other sites

Augeas, I know a normal scan indicates a file by its name and path if available; and also a deep scan indicates a file by a number and extension.  But both scans will find the same number of deleted files, right?  And nukecad, what you are saying makes sense; but the number of hours a deep scan takes makes it prohibitive to me.  I want to thank both of you for replying.  I guess the three cardinal rules of computing; backup, backup, backup is  right.  Again, thank you both very  much.  I can be so dense.

John

Share this post


Link to post
Share on other sites
18 hours ago, nukecad said:

1) I would guess that's because the scanned drive may be later modified by having new files written to it, which would make any saved scan invalid.

 

 

Especially with modern versions of Windows (no so much on old versions like WinXP). For instance modern versions of Windows like Win10 will write to an drive even if it were on an external drive of any type (USB Flash Drive, SD Memory Card, Portable Hard Drive or SSD) modern versions of Windows create a System Volume Information folder that consumes a few small bytes. Now imagine if that overwrites a very small portion of a file you wish to restore.

Share this post


Link to post
Share on other sites

A normal and a deep scan will not find the same number of files (although with an SSD it will be close). A normal scan looks at the records in the MFT that are flagged as deleted. These records contain the file's name and cluster addresses, among other things. A deep scan will run a normal scan first, and then look at all the unallocated clusters on the device. When a specific file signature is found at the start of a cluster (and Recuva checks about 20 of the most common) this cluster and those following are presented as a file suitable for recovery. So there will always be more files found in a deep scan, unless the devce is an SSD and TRIM has wiped the clusters.

There is no difference between saving the results of a scan and leaving Recuva open and acting on the results some time later. I would expect (and hope) that Recuva would check the state of clusters before overwriting them, even if it's only a few seconds after the scan has been run. Recovery is not so much of a problem, as it is not a destructive process and invalid data can be tolerated.

Share this post


Link to post
Share on other sites

One final question; if I were to accomplish a deep scan and I located the deleted file I wanted to restore by its file name from the files in the normal scan, is there an easy way to then find that same file, that now has only a number and extension, from the deep scan files?  I am to the point now that I need to do a little experimenting.  It has been very good of you to not only answer my questions but to share your knowledge and expertise with me.  Thank you so much.

John

Share this post


Link to post
Share on other sites

No, there is no easy way, or even a difficult way I can think of.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...