Anjistar Posted February 6, 2023 Share Posted February 6, 2023 Hello, Could someone please explain to me whether it makes any difference that the file sizes on the recovered files are what I would expect - high quality jpg images, so 6-10Mb? Recuva has found all my accidentally (stupidly) deleted photos but I can't open them with any programs. Link to comment Share on other sites More sharing options...
Moderators nukecad Posted February 6, 2023 Moderators Share Posted February 6, 2023 Have you tried Irfanview? That can sometimes open image files that other viewers can't. It seems to be more tolerant of slight errors in the file header. If it can open them then save-as will save a fixed version that other viewers can then open. I recently recovered a bunch of jpgs and Irfanview opened them all but a few. Although some that it opened were only half the image with the other half grey, (that's just all that Recuva could get back of those ones). *** Out of Beer Error ->->-> Recovering Memory *** Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043 Link to comment Share on other sites More sharing options...
Anjistar Posted February 6, 2023 Author Share Posted February 6, 2023 Thank you. I have actually just tried Irfanview but without any luck. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted February 7, 2023 Moderators Share Posted February 7, 2023 Are you recovering from an SSD? Link to comment Share on other sites More sharing options...
Anjistar Posted February 7, 2023 Author Share Posted February 7, 2023 Scandisk SD card used for my camera. It's not very old and only has photo and video files on it and has never been used for anything else Link to comment Share on other sites More sharing options...
Moderators Augeas Posted February 7, 2023 Moderators Share Posted February 7, 2023 That puts a different light upon it. It's probably some file system such as FAT or exFAT, or even something more exotic, so it's difficult to say what Recuva is extracting. if you run Recuva again and look at the file headers then if they contain zeroes or what looks like random data then you're probably not picking up valid file data, and recovery is more difficult. Link to comment Share on other sites More sharing options...
Anjistar Posted February 7, 2023 Author Share Posted February 7, 2023 (edited) It's FAT32 file system. Some of the photos recovered have what look like the original numbers on them, original is eg 'P1046572.jpg', the recovered files with no preview have '_1046572.jpg'. Some have previews and those have numbers like '[000597].jpg'. The latter are full files and I can open them with Photoshop. Looking at the files in Recuva, some say 'State: Excellent, Comment: No overwritten clusters detected'. But I still can't open them and they don't generate a preview. And Recuva just crashed on trying to save to a new folder Edited February 7, 2023 by Anjistar Additional info Link to comment Share on other sites More sharing options...
Anjistar Posted February 7, 2023 Author Share Posted February 7, 2023 I ran Recuva again for just the ones I'm missing and got the same result, just the _104 numbers, though according to the program there are 56 fully recovered files (73 partly recovered). Still can't open any of them. Link to comment Share on other sites More sharing options...
Moderators Augeas Posted February 7, 2023 Moderators Share Posted February 7, 2023 Deleted files in FAT32 should have the first byte of the file name altered, which is why you are seeing files with names like '_1046572.jpg'. Weirdly enough some deleted files have the full unaltered name, I don't know why. Files with '[000597].jpg names are found using a deep scan and have a chance of being recovered successfully. In FAT32 the root directory, and every other directory linked off it (where you and I and Recuva go to), have an entry for each file which holds the address of the first data cluster. The remaining clusters are chained together in the FAT. On file deletion the FAT chain is cleared so it can't be used for file recovery. Recuva follows the first cluster address in the directory and then reads forwards on the disk. This has problems as only the first extent of a file can be retrieved, thus a file with more than one extent may be unusable. This first extent only recovery is a specific problem with the FAT file system. File extents are chained in the FAT, and the FAT entries for deleted files are zeroed. The first extent only recovery also applies to files found with a deep scan, which looks directly at the disk clusters. Only the first extent can be found as there is no mechanism to link multiple extents. If you look at the Info pane in Recuva the allocated clusters is always (as far as I have seen) one count of clusters at a particular address. If this count (x cluster size) is less than the file size then you have missing extents. Unfortunately files with missing extents are unlikely to be viable, and missing extents are extremely difficult to find, certainly not with Recuva. Link to comment Share on other sites More sharing options...
Anjistar Posted February 7, 2023 Author Share Posted February 7, 2023 28 minutes ago, Augeas said: Deleted files in FAT32 should have the first byte of the file name altered, which is why you are seeing files with names like '_1046572.jpg'. Weirdly enough some deleted files have the full unaltered name, I don't know why. Files with '[000597].jpg names are found using a deep scan and have a chance of being recovered successfully. In FAT32 the root directory, and every other directory linked off it (where you and I and Recuva go to), have an entry for each file which holds the address of the first data cluster. The remaining clusters are chained together in the FAT. On file deletion the FAT chain is cleared so it can't be used for file recovery. Recuva follows the first cluster address in the directory and then reads forwards on the disk. This has problems as only the first extent of a file can be retrieved, thus a file with more than one extent may be unusable. This first extent only recovery is a specific problem with the FAT file system. File extents are chained in the FAT, and the FAT entries for deleted files are zeroed. The first extent only recovery also applies to files found with a deep scan, which looks directly at the disk clusters. Only the first extent can be found as there is no mechanism to link multiple extents. If you look at the Info pane in Recuva the allocated clusters is always (as far as I have seen) one count of clusters at a particular address. If this count (x cluster size) is less than the file size then you have missing extents. Unfortunately files with missing extents are unlikely to be viable, and missing extents are extremely difficult to find, certainly not with Recuva. Thank you for that very detailed, also comprehensible, reply. I have gone over to the dark side with Easeus, which has had better results. Not perfect, but fairly satisfactory. Many thanks for your help Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now