Jump to content

Recuva recovers the file without the file extension


Javi_M

Recommended Posts

Hello!

With deep scan I recovered these 2 archives (picture 0):

0.png.df364cc66319f2e4c466aa43b4edd3d9.png

 

I know they are the "correct archives" I want to recover because when I open them with Notepad, it shows the directory where they were before deletion (pictures 1 and 2):

image.png.c279c4f3702c5a76ccbdadfcb4b18572.png2.png.f031075a682882f2b3d39c20948b14b1.png

I want the audios, pictures, and videos I had in those two folders before deleting said folders.

 

The 2 archives are very light and don't show file extension in Properties (pictures 3 and 4)

3.png.256292656c6e77e2bae86d2d6dfaadc4.png

4.png.d2fcc3eac12a789183918e1af9e643b7.png

 

As you can see, they are not heavy enough to contain the audios, pictures, and videos. I don't know how to open them or what I can do with them.

Thank you very much!

image.png

Edited by Javi_M
Link to comment
Share on other sites

  • Moderators

You cannot recover data from these files. They are Index files created when a file or folder is sent to the recycler. When a file is sent to the recycler it is renamed to $R followed by a set of random characters, followed by the original file extension, e.g. $Rhdxenv.doc. A matching file is created as $I followed by the same random characters and extension as the $R file. This file contains the original filename/path and file size, and the date and time that the file was moved to the Recycle Bin. When a folder is sent to the recycler it is renamed (as one $I file or two $ files?) in the same pattern as a file but without the extension.

These $I files look like they belong to a folder, and folders do not contain any user data. I think - and I'm not sure - that files sent to the recycler when a folder is deleted retain their original names, and only the folder is renamed to $I (and $R?).

I don't think a deep scan would find these files, as they don't have a known file signature in the header (I may be wrong, I haven't tried it). However they are found with a normal scan, and a deep scan runs a normal scan first.

I would look for files under their original names, which you probably have done so already, or files with names starting with $R, not $I.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.