All pictures are corrupted and only found at first recuva-run

[Michiel]

Hello, 

Yesterday I messed up bigtime!
I accidentaly deleted a lot of pictures from a friend. 

(I first copied them to a new location, and after that deleted the original.
So far so good, but then I accidentaly hit 'undo'.
It didn't undo the deleting (cause it was pemanent) so it did undo the copying!!!
And I could 're-do' because the original files where gone....!!!!#) 

I searched for a few minutes and then shut-down the laptop. Carefully not to install the "pending-update". 

At home I run recuva.
At first I was trilled, because I saw it was really recovering the files from exactly the 'old' folder-locations, I had lost, and the amount of pictures was about wright!!
But then all the files turned out to be corrupted.
I tried to open them with; windows, photoshop, irfanview, paintshop pro, easeuse and 'Stellar'. 
Also I tried renaming the extention (.jpg) manually and convert them. (offline and online)
But no succes! :(
The message I got; "File is corrupted or to big in size"

The first time recuva ran, it seemed to find all the files, but....
The second (and third and fourth, etc) time I ran recuva, it wasn't able to find the majority of the lost pictures anymore.
Only the first time it saw all the ca. 1000 pictures, all following tests only showed about 120 pictures. (all still corrupt)
Originally the pictures where in 2 folders. At the first runthrough recuva found the pictures in both folders, later on it only found one folder.

Strange thing is that in my perception nothing on the HD changed in between the loss of the pictures and running recuva.
So I dont understand why the files are all corrupted. I expected some to be corrupted, but defenitely not all, because there was no HD-writing afterwards.
I also dont understand why recuva could find all files at first, but not later on.

I hope someone has any ideas on how this could happen... (I purposely didn't run the updates at shutdown) 
And I hope someone has any advise on how I can try to 'repair' those corrupted files..., or a way to retreive them otherways.

I did use recuva as a portable app, to prevent overwriting.

Greetings and thanks in advance,

Michiel

[Nergal]

The very act of shuting down and starting up overwrite some.  The location you restored to may also be a factor (if you chose to restore them to the same drive they were lost from).  Just using portable is not enough if it is not placed on a separate drive from the drive being recovered from.  Finally, if you used, the same pc to download recuva that's some writing.

[nukecad]

12 hours ago, Michiel said:

I first copied them to a new location, and after that deleted the original.

First question - Were the deleted original files not in your recycle bin?
(Are they in there still?)

It isn't at all clear here just what you actually did.

For example:
"I first copied them ,,," - copied them from where?
From you own hard drive to a different folder on the same drive, or to a different drive?
Or maybe from the web to your HD? (Maybe from dropbox or similar?)

Were you using File Explorer to copy the files, or some other app?

Is your drive (either drive if you used more than one to copy) a HDD or SSD?
What Windows version are you using?

And then:

Quote

I searched for a few minutes and then shut-down the laptop. Carefully not to install the "pending-update". 

At home I run recuva.

Was that a pending Windows Update? Did it say pending download, or pending installation?
Were you on a metered connection until you got home? (That is usually what causes an update to be 'pending').
If it was then it would have started downloading/installing as soon as you rebooted at home (on a non-metered connection), overwriting the disc space where the deleted data may have been.
(Which is probably why Recuva then couldn't find it again after the update had finished downloading/installing).

Finally:

Quote

I accidentaly deleted a lot of pictures from a friend.

Can your friend not simply send them to you again?

[Andavari]

I wonder why Windows or any OS for that matter doesn't have enough smarts to protect against such a thing in 2022. I think a good amount of us have been subject to the copy elsewhere and unfortunately delete original scenario -- but also that's why it's so important to create backups on a minimum of three external backup drives (I have four), and perhaps also a "Cloud" copy too as soon as possible which has saved me more than once when moving around a huge amount of data.

[Michiel]

Thanks for your reactions.
 

-I copied files devided over a few sub-folders from one folder to another (on the same drive)
-After the copy was ready, I unintendedly deleted the original folder with Shift+Delete.
-Because during the copying some new sub-folders were created and others were merged, I couldn't easily see whether all files were copied correctly.
-The plan was compare a "new" or merged sub-folder, with its original, and when the files were all there, permanently delete the original.
-However, at one moment I wasn't aware that not the subfolder, but the "parent-folder" was selected. And so I permanently deleted the complet folder.

On itself not a big issue, as I had allready copied its contend, however out of habit, I pressed Ctrl-z.
-Because the "Shift-delete" can't be undone, Windows reverted to the latest action that could be undone, wich was  The copying....
So the 'Complete original "parent-folder" was gone and the copies as well!!!

I do know "Shift + Delete" wasn't my brightest choise, it was more out of a habbit, but I can't undo. (Just learn)
My "Ctrl+Z" reflex, exact same story.... 

 

I was "helping?" my friend on his computer, so the files are really gone.

Windows was online at that moment, and I do expect it was downloading updates in the background, which explains a lot.
It even did some updates yesterday dispite I disabled Windows-Update. (I set its startup-status OFF, and never pressed 'update and shutdown/restart')
 

Today I opened the .jpg's in a "file editor" and it's clear that the majority of code lines are gone (see picture).
Only some data on camera, objective, aperture, date, etc remain....
Something I find very odd, is that all the files are almost identically damaged. Something I wouldn't expect. I actually expected, the files to be all differend affected after some overwrithing.

Based on the code lines, I think it is quite fair to say these files can't be repaired...

Maybe I should consult a professional recover-company...

Thanks again for your reactions.

[Augeas]

Contents being set to zero on deletion is typical of an SSD. Confirmation of whether the drive is an SSD or HDD would help.

[nukecad]

12 hours ago, Augeas said:

Contents being set to zero on deletion is typical of an SSD. Confirmation of whether the drive is an SSD or HDD would help.

Agreed,

although all the other circumstances (especially combined) would have reduced the chances of recovery from a HDD -  if it's an SSD then the files have been zeroed anyway.

[Michiel]

Hi, Thanks, I didn't know that SSD or HD made a difference in these situations.

The Drive is indeed an SSD.
Does that mean that data deleted from a SSD can't be recovered? (or at least not in this way?)

[Michiel]

Now I think of it, it is actually quite logical...
Considering the hardware difference of the two drives (HDD and SSD)

Never realised this...

[Augeas]

For Windows and NTFS, for all practical purposes deleted files on an SSD cannot be recovered by any software. It's to do with the way the SSD controller manages file deletion.

[Michiel]

Does that also mean, that even professional 'data-recovering companie' can't get those files back from an SSD-drive?

[Augeas]

It's difficult to be definite, but yes is the overwhelming answer.

[nukecad]

I've seen recovery companies say they might be able to recover from a SSD, you'll even see other recovery apps saying they can in some circumstances.

But they are very limited circumstances - and once a TRIM has zeroed the SSD drive all bets are off.

For example one recovery app I looked at tells you ('hidden' in the middle of a big block of text):

Quote

When you use a TRIM-enabled SSD (all modern SSDs support TRIM), deleted files are removed immediately and can't be recovered

and then says to to disable TRIM before trying to recover, in other words it can't recover anything from a SSD that has already been TRIM'ed.

Another app also makes the point (this one in a highlighted box) of saying:

Quote

In fact, you won’t be able to recover your data even with the best data recovery tool for Windows and Mac once the TRIM command has been applied.

but it then goes on anyway to tell you how to try and recover using their app as if they hadn't just said that.

Of course they are hoping that you are desperate enough to ignore the warnings, in the vague hope of recovering something by buying their software.
To me that's just raising false hopes.

[Andavari]

There was a data recovery guy on YouTube that states differently, that "there's ways to get some files back" off flash based storage including SSDs, however his service is crazy expensive. Last time I saw him in a video was maybe two years ago and he was charging $300 USD per incident regardless of the amount of files, regardless if they were readable/usable, and even if he found nothing at all he was still owned the full $300 for attempting.

[nukecad]

Sounds like a con to me.

But those who have deleted/lost important data will clutch at straws if they think someone might be able to get it back; he's obviously preying on that.

The only reliable defence against losing data (on any kind of drive) is to make regular backups to a different drive. (Preferably more than one).