Deleted Files Not Appearing

[Adam_B]

I'm looking for some guidance if possible. I bought Recuva something like eight years ago to recover files from a corrupted flash drive. It was very straight forward.

Today, I mistakenly shift-deleted many files from my Windows Downloads folder. I tried the old version of Recuva and then downloaded the latest version and nothing. None of the files appear in Recuva or Windows File Recovery. Mainly,

I see lots of Firefox temporary files. There are also some deleted files from years ago that are identified as in Excellent condition. Yet, none of the files I deleted a few hours ago appear. Many of the deleted files had been in the Downloads folder for years. There were maybe thirty music files among many other files. I don't see any of them.

It is making me think that I'm missing something fundamental. My drive is an M.2 NVMe SSD with GUID partitioning.

[Augeas]

Firstly, anything that has been shift/deleted from an SSD has a next to zero chance of being recovered by any recovery software.

When files are shift/del'd then the file names usually remain accessible in the MFT, as 'flagged as deleted' records, even though the data is unrecoverable. The only reason I can think of off-hand for the file names not being visible is that a number of new file allocations have taken place after the shift/del. This would overwrite (reuse) the flagged as deleted records in the MFT.

[Willy2]

How much free space do you have on your HD / SSD ? The less free space you have the more likely it is that the file entries are over written and the entries in e.g. the $MFT are overwritten by newer entries. It's because Windows will have to make do with a smaller $MFT with fewer entries.

Did you also "Shift Delete" the "Downloads" folder itself ?

[Adam_B]

Augeus & Willy, thanks for replying.

Augeus, can you point me in the direction of more information or share more on why "anything that has been shift/deleted from an SSD has a next to zero chance of being recovered by any recovery software?" I like to know how things work. I thought that the files would still be marked as deleted somewhere on the drive similar to a traditional mag disk.

Willy, there is about 80GB/240GB available. I realized what I had done immediately. There were hundreds of megs of data lost, much of it music files. I did not see any of these even as partial corrupted files. The recovery apps I downloaded were not big enough to have overwritten everything that was lost.

The Downloads folder is still there. I was sorting things in Downloads\Sort. I went to confirm that I already had copies of files in Downloads\Sort\Work, which just had four PDF's in it. When I returned to the window to the delete the Work folder, focus has changed to Sort. I didn't notice, and it was gone in a blink. I only kept one song b/c it was being played at the time, so was locked.

Scratching my head. I keep wondering if there's something simple I'm missing.

Edited August 8, 2023 by Adam_B
Grammar.

[nukecad]

On 09/08/2023 at 00:05, Adam_B said:

... can you point me in the direction of more information or share more on why "anything that has been shift/deleted from an SSD has a next to zero chance of being recovered by any recovery software?" I like to know how things work. I thought that the files would still be marked as deleted somewhere on the drive similar to a traditional mag disk.

It's actually more accurate to say that deleted files from an internal SSD have little to no chance of being recovered.
If it's an extenal SSD connected by USB then there is more chance of recovery.

The difference between recovery from HDDs and SSDs basicallly comes down to the TRIM command issued by the computer to SSDs.

Unlike a HDD where the file just gets marked as deleted, but the data remains on the drive until overwritten by new data, with a SSD you have to erase the data to empty the 'blocks' of memory so that new data can be written there - and it is the TRIM command that triggers the SSD to perform that 'garbage collection'.
A TRIM command usually gets issued by the computer when you delete something - so the data itself gets deleted almost immediately.

However because TRIM is an ATA command it cannot be issued through a USB connection.
The USB connected SSD will still 'garbage collect' to free up deleted data occasionally, but with no TRIM available from the computer then the data isn't erased immediately, and so may still be recoverable for a while.

This short article is a bit old now but explains it well without getting too technical: https://www.datanumen.com/blogs/ssd-vs-hdd-different-chances-recovering-deleted-files/

[Willy2]

Well. that article doesn't reflect my experiences with my SSD. I have regularly recovered files from my internal SSD. Perhaps my version of Windows doesn't support TRIM yet ?

I also have noticed that Windows does some odd things I can't explain, when I move files around om my SSD (with Piriform's Defraggler).

Did you enable "System Restore" ? That also has his own (and for me unknown) logic and also can gobble up A LOT OF diskspace (e.g. in the $ MFT).

[nukecad]

14 hours ago, Willy2 said:

Well. that article doesn't reflect my experiences with my SSD. I have regularly recovered files from my internal SSD. Perhaps my version of Windows doesn't support TRIM yet ?

It's more likely that you have turned TRIM off yourself (and forgotten?) after reading something like this which points up that you can't recover files after a TRIM and tells you how to turn TRIM off/on:
https://www.makeuseof.com/why-how-disable-trim-command/

TRIM should be enabled by default in Windows10/11, but the user can choose to turn it off and sacrifice  SSD performance to gain the chance of recovery.

(I also believe that some early SSDs didn't support TRIM anyway, so if yours is an older one it might not).