Recuva never ends. Blue screen windows error.

[josemazcorro]

Hi there, I am having the same kind of problem with Recuva.

With me has not even shown when it is going to finish, and it has been more than 36 hours busy.

Right now I am scanning with HDtune as it was suggested here. But can someone help me clarify a couple of things?? The disk is recognized by windows, but I cannot access it. In the disk manager it says that the partion is "unknown (bitlocked encrypted)". But I never activated bitlocker. In fact the disk started to be damaged and I ran chkdsk and scandisk commands to try to repair it and then I had a blue error on my computer. I took out the disk to a case and I have seen once that Recuva recognized a lot of deleted files, when I ran a full scans (sorry, I just check everything there). Now I have been trying to make a full scan and it just taking so long without results. I think my disk might be more damaged than before. Maybe do to a sudden loose of power. I have tried so many times, that maybe one day, I just turn off the computer to disconnect the computer.

I almost giving up after almost 8 months for trying to recover 2 years of data. But I am wondering about this message "unknonw (bitlocked encrypted)" I read other people that had the same problem. Is windows randomly locking people's hard drives?!

I also tried non-deep scan, but it didn't give me much results. I think the disk in getting more and more damaged, eventhough I am just trying to recover it with Recuva.

Until now HDtunes shows a 2.1% of damage and is at position 20,000MB the scanning speed is around 40MB/s

202406190811; HD tunes, has finished, it says that it is fully damage. Still if anyone have some answers I will appreciate. Thanks and good luck with your drives. Btw, I usually don't trust Microsoft, it is too invasive since automatic updates started. I have seen them deleting files from my hard drives, Although, I don't think they are targeting people, it would seem silly and pointless (but they are indeed targeting some kind of files, no matter how you save them) but I think my harddrive got damage in part because the constant work of deleting their updates in my drive.

202406190824; I restart my computer and now, HDtune is saying that is the disk is has no damage until now.. position 10,000MB. This is just crazy. if anybody can help!?

 

Edited June 19 by josemazcorro

[josemazcorro]

Hi there, I am having the same kind of problem with Recuva.

With me has not even shown when it is going to finish, and it has been more than 36 hours busy. See post

Right now I am scanning with HDtune as it was suggested here. But can someone help me clarify a couple of things?? The disk is recognized by windows, but I cannot access it. In the disk manager it says that the partion is "unknown (bitlocked encrypted)". But I never activated bitlocker. In fact the disk started to be damaged and I ran chkdsk and scandisk commands to try to repair it and then I had a blue error on my computer. I took out the disk to a case and I have seen once that Recuva recognized a lot of deleted files, when I ran a full scans (sorry, I just check everything there). Now I have been trying to make a full scan and it just taking so long without results. I think my disk might be more damaged than before. Maybe do to a sudden loose of power. I have tried so many times, that maybe one day, I just turn off the computer to disconnect the computer.

I almost giving up after almost 8 months for trying to recover 2 years of data. But I am wondering about this message "unknonw (bitlocked encrypted)" I read other people that had the same problem. Is windows randomly locking people's hard drives?!

I also tried non-deep scan, but it didn't give me much results. I think the disk in getting more and more damaged, eventhough I am just trying to recover it with Recuva.

Until now HDtunes shows a 2.1% of damage and is at position 20,000MB the scanning speed is around 40MB/s

202406190811; HD tunes, has finished, it says that it is fully damage. Still if anyone have some answers I will appreciate. Thanks and good luck with your drives. Btw, I usually don't trust Microsoft, it is too invasive since automatic updates started. I have seen them deleting files from my hard drives, Although, I don't think they are targeting people, it would seem silly and pointless (but they are indeed targeting some kind of files, no matter how you save them) but I think my harddrive got damage in part because the constant work of deleting their updates in my drive.

202406190824; I restart my computer and now, HDtune is saying that is the disk is has no damage until now.. position 10,000MB. This is just crazy. if anybody can help!?

[josemazcorro]

So, I said I checked all the options on recuva. Apparently one of them is securely delete files... I find it really counterintuitive that this program recovers and deletes. But anyways, I hope since it didn't end that I didn't damage the files anymore.

[nukecad]

I have merged all your posts about this into the one thread.

I have to be honest here and say that after 8 months of you working on this disk nobody now can have any idea on just what you have done with it up to now, and whether any of what you have done may have caused more damage than was the original issue.

You admit yourself that you believe that you are further damaging the drive.

Brutally honest - Just selecting all the available options in Recuva, and the whole tone of your posts, indicates that you do not know what you are doing with recovery software.
No criticism meant, recovery software isn't something that the average person would ever use.

You haven't even said what the original problem was 8 months ago.
You do mention "a sudden loose of power" is that what originally happened? You had a power cut that corrupted the disc?

My, perhaps brutal again, advice would be to stop playing about with it yourself and take it to someone who does know what they are doing, let them see what if anything may be left that can be recovered.
If that means that you would have to pay someone to look at it for you then ask yourself how much is the data on the drive worth to you.

 

[josemazcorro]

Thank you for your response,

the tone is indeed desperate, but.. I take off the deep scanning and now it does says an estimated time (5 hours).

About the deleting option, it seems to be an option to be applied only after the scan has fully done. Since this has not happened then the files are not deleted. It is although for me strange to have next to the recovery options. But I understand some people will want to restore their hard-drives after recover.

I am not an expert indeed, but I know by experience with Computer support, that it is difficult to get someone who gets how valuable personal data is. I totally get it, it is nobody's business to care of other's business. Data is simply too personal. So I thought this was the best way to handle it. I also have to say that, I have not been working on this for the last 8 months. I have always noticed that the disk was slow to read and start, I made backups just in case.. then 8 months ago, I saw that some icons on my taskbar disappeared, so I did a chkdsk and a scandisk, to see if there were errors (sadly I should have immediately backup first, but I thought I couldn't do any damage by scanning). Then I got this blue screen from windows, and a failure in the NFTS. I went to the professional, who maybe knows, but doesn't care.. (as I said is difficult to find someone who cares) but the first thing he told me.. ohh don't even try it, it is unrecoverable. I ask him, well at least take it out and I will try it myself.

The disk was recognizable, and Recuva even found around 90% of the files. (Sadly I couldn't recoverd those files at that time, because I needed more space in my computer, and I have been busy with work). I am still expecting some sectors from Windows OS are damaged, since I used to delete and delete automatic updates (once I got 24gb of updates from windows, because I forgot I was not in a metered connection!) anyways.. as I said now Recuva is running. And HDtune, did showed some errors. I hope this 5 hours will show some results. I have data from work, pictures, transcripts from school and things I cannot recover.

Anyways, thanks for reaching. My last chance is to send it to London for repair, I saw one company that seem to have a good reputation, that is a good try I guess. But as I said, safety is only ones, it is like trying to recover bitcoins, the only one who knows how to recover will recover and say, it was empty.

Well that is my experience around. But indeed there are some good fellows around.

 

Edited June 19 by josemazcorro

[josemazcorro]

The loose of energy, I mentioned, was because I disconnected by turning off the computer with the off button. Today I had to do it again, because the computer was not responding. There is no other option for that kind of failure right.. I mean computers are just computers, that is why I value people reaching, even if just your work man. It means something for people on the other side of the network.

Thanks, I hope this time I can recover some files! I will keep updating since I have the whole day for this, otherwise I have to wait until next week to try.

Edited June 19 by josemazcorro

[nukecad]

The Secure Delete option is there for people who do not want anything to be recovered from a drive. (Say one that they are selling or giving away).
They can check with Recuva if anything could be recovered from it, and if Recuva does find anything then they can tell Recuva to securely delete it so that it can't be found again by someone else.

Let me think about what you should try if you want to continue yourself.

[nukecad]

After thinking about what you have said then I would suggest that you try the following:

As I see what you are saying then the files that you are trying to recover have NOT been deleted, you just can't access them anymore.

A normal recovery scan looks only for deleted files,  that is not what you need here.

You need to do a scan for non-deleted files and recover those.

Follow the instructions in the link below, read it all carefully first but you can already see the drive so you can ignore the bits about a crashed or RAW drive.
In other words DON'T REFORMAT THE DRIVE, - you can already see it so it doesn't need to be reformatted.

https://community.ccleaner.com/topic/65824-recover-files-from-crashedreformatted-drive/#comment-345391

Following steps 1, then 3-11 there (not step-2 which is not needed) should find/recover the non-deleted files for you.
There is no guarantee that they won't still be bitlocked though, that's a different issue.

Note also what it says there about the original filenames, the recovered files will have numbers and not the original names.

 

 

[JamesRM]

I have just seen this thread; I'll try to help where I can, but those things are complex and there are many things to unpack here...

8 hours ago, josemazcorro said:

In the disk manager it says that the partion is "unknown (bitlocked encrypted)". But I never activated bitlocker.

...

Is windows randomly locking people's hard drives?!

Windows does not (out of the blue) activate it on its own, there is a recovery key (which is different from the BitLocker password) during activation for safeguarding... If it were actually activated, and you have a Microsoft account linked to your user in that machine perhaps they key is saved there? See here if that were the case: https://account.microsoft.com/devices/recoverykey

Some Windows machines do have BitLocker activated for the system drive after completing the initial set-up, but I don't know what prompts it and the same deal with the recovery key being presented (or saved online) applies. However, I do remember (several years back) some Linux and Android distributions for regular PCs enabling BitLocker on drives upon booting but not activating it (some bug must have been). If it sounds confusing, it is , but in essence, data would still be encrypted in that state, it's just the encryption key would have been saved in plaintext, BitLocker protection wouldn't be enforced.

 

First things first, that is not the system drive, is it? Have you used the drive since you realized your data wasn't there anymore? Access to that drive should be minimized, taking it offline and removing access to it via normal means to try to prevent the data from being overwritten. Can you post a screenshot of Disk Management when it is connected to a machine? You can open it via they Win+X menu or searching for it in Start. I'd like to know if it is recognized by Windows, how, and whether it has a drive letter assigned to it for starters.

Next, I don't know about "HDtune", but we'd need to know some details about that drive. Install (in a different drive) and run Hard Disk Sentinel ( https://www.hdsentinel.com/hard_disk_sentinel.php ), for example, you don't need the Pro version, what we're after should be displayed in the trial. Post a screenshot of the Overview and S.M.A.R.T. tabs for the drive we're interested in. I suggest you right click the somewhere in the S.M.A.R.T. tab and choose to view data in decimal, it's clearer that way, it should look something like this:

If HDSentinel can't show any data and you have the drive connected through a USB interface, that could be the problem, communication is different and not everything is exposed through USB, especially on consumer hardware.

 

 

I don't know if I'll be able to explain it in simple terms, but I'll give it a shot. When you (or something) delete a file, its data is generally still present in the drive exactly where it was, what actually happens is there is a table of sorts that lists every file in the volume and the entry for that file is removed from the list. The naive idea behind data recovery is to look at that table (or a mirror copy of it that also exists), to find out where the deleted files were stored in that volume, so that those sectors can be accessed directly to copy their contents somewhere else, "reconstructing" the file.

There are many problems that can make it useless, for example, when the file was deleted, the place where its contents were in the disk is marked as available, that's why isolation is needed, any new write to that disk can be to a sector that once held that file's data, leading to a partial recovery at best. Another example, if that structure I described which holds metadata is overwritten (formatting a drive doesn't overwrite it all, but because it creates an empty one some parts of it are lost), there goes the "easy" approach to data recovery and so-called deep scans are needed.

Recovering data is hard enough when the drive isn't failing, so let's hope yours is not, but there are more variables to take into account, like BitLocker or the model of drive it is. Generally, one shouldn't be working or applying fixes directly on the drive itself except for very specific cases, it would be imaged first (bit-by-bit copy of it into a file) and analysis and all would be done to that image instead, but that requires more space.

Edited June 19 by JamesRM

[josemazcorro]

Thank you for your comments!

Recuva is still scanning, now it says 2 hours for completion. I don't know how the damaged was caused. I think some sectors where damaged since I bought it, because it was slow while copying and moving big amounts of files, and sometimes failed. Back then I tried to degrament and keep backups. I also used a program GWX to search and delete Windows Updates, and I think this constant writing and re-writting made it worse. I am speaking of basic sectors of the disk, and the use of cmd commands to grant permission to those sectors and delete large amount of files the files. Apart from that ransomware Wannacry virus, this universal automatic Windows Updates are all nasty and intrusive. Anyways, I think the combination of these two thinks made it fail. 


 

Here is a screenshot of Diskmanager. This is another thing I don't understand there is a partition on the D: Drive that amounts for 930gb and it says "unknown (bitlocker encrypter) if I open the bitlocker manager of windows, it says that is not active. I cannot send a screen because everything that try to access the drive just crash. I am in another computer, and the drive was the C: drive of my previous computer. So the drive in question is D:. And it is now on an external case connected through USB.

I don't have a HDTune screenshot or HDSentinel installed, but I can make a screenshot once Recuva finishes.

Thank you for the comments about the rewriting and overwriting, I should have made a backup as soon as I seen the icon's on my taskbar were disappearing. It is not so evident when you have just one reliable computer and you need to keep working. But yeah, it is done. I saw in one of the attempts of Recuva to recover, that there were a lot of files marked as deleted. Files that I normally had on my desktop. So I am searching for both deleted and undeleted ones. That is also strange, I also checked with one program iBoysoft Data Recovery, and it said it was locked with Bitlocker. I hope this is wrong or a misreading. It is anyways hard to recognized encrypted data I hope.



 

Edited June 19 by josemazcorro

[JamesRM]

1 hour ago, josemazcorro said:

it was slow while copying and moving big amounts of files, and sometimes failed

Hard drives come with spare sectors, when one of the sectors is damaged it is transparently (for the user) remapped to one in the spare region, speed consistency would take a hit in that situation, but there is a limited number of spares. We'll see it when we see the S.M.A.R.T. data for that drive.

1 hour ago, josemazcorro said:

constant writing and re-writting made it worse

Not necessarily, depending on its age it may just be worn out, they are mechanical machines after all.

1 hour ago, josemazcorro said:

D: Drive that amounts for 930gb and it says "unknown (bitlocker encrypter) if I open the bitlocker manager of windows, it says that is not active.

Yes, that volume most likely is in the state I mentioned earlier, having the encryption key saved in plaintext, new data written to that drive would still be encrypted, but there are no protectors; the "unknown" just part implies the filesystem signature is corrupted.

If you run this on an elevated CMD or PowerShell, what does it report back?

manage-bde -protectors d: -get

Because if there are no protectors BitLocker wouldn't be active per se. I believe you could disable encryption without going through BitLocker's activation (that's where you'd see the recovery key), but it would take a long time (given its size) and it would be unadvisable since you're trying to recover things.

 

Honestly, access to that volume should be restricted, right clicking the one shown as (D:) in the Disk Management console, choosing to change the drive letter and then removing it; any (proper) data recovery software shouldn't need to access it that way to analyze or recover data from it.

This is what I'd do, considering how things are looking like.

1. Stop that Recuva deep scan, it serves no purpose at this stage.
2. Look into the state BitLocker is in, things are quite different if it is in a suspended state (what I described above) vs. if it is fully activated and backed by TPM or TPM+PIN.
3. Limit access to that volume, no drive letter to it, no mount point either.
4. Assess drive health, there are various tools capable of it, HDS I mentioned earlier is just one of them, but I'd like to know what I'm dealing with.

Only afterwards I'd evaluate my options, there is no rush, it needn't be done today and can wait for another day, it is better to do things properly. Either way, Recuva is not the proper tool for the job, it may be okay to recover something you just deleted from the Desktop so to speak, but that's about it; it's just too limited.

 

EDIT: For completeness, also report back with what the following outputs (also from an elevated prompt):

manage-bde -status d:

 

PS. You don't have any other working drive with at least 1 TB of free space, do you? 
PPS. I am afraid I don't share your opinion on Windows updates though, even if they aren't properly tested these days, perhaps instead of Patch Tuesday one could do "Patch Saturday" so to speak , but they are indeed useful.

Edited June 19 by JamesRM
Added extra command to better assess BitLocker status.

[nukecad]

@JamesRM
Please desist from hijacking help threads that are already actively on a course of progress.
Quite apart from being poor forum etiquette, Conflicting advice from different people can confuse the questioner being helped.

If you have something to add then do it respectfully, and preferably AFTER the current help has run it's course.

I was taking things in simple steps here with Jose, not trying to overload him all at once.
If you have read the full thread then you will see that we are not dealing with deleted files here, but files in a partion that has become bitlocked.

@josemazcorro
If you are running a scan for non-deleted files as detailed above then please continue with that scan and see what it can find for you.

 

 

 

[JamesRM]

5 minutes ago, nukecad said:

Please desist from hijacking help threads that are already in progress.

My bad! Sorry about that .

[Andavari]

Seems to be an occurrence of it happening for some reason in Windows when searching for in a search engine:
Windows bitlocked a drive when Bitlocker was not activated

This topic is about an HDD, however I know with some SSDs at end-of-life will do one of two things:
* Write-lock the drive making it read-only.
* Completely wipe the drive of all data.

[josemazcorro]

Thanks JamesR

I have to read your response carefully. Since I have to leave for work now. Indeed Recuva has not yet ended. Maybe I should stop it, but I really have to leave so, I might just leave it. I have enough harddrives that is not a problem.

But as I said, I will answer later and also for those other comments.

Thank you for the help

[nukecad]

Drives can indeed become bitlocked for a few different reasons, a failing drive, a change of hardware, a hardware fault, etc.,etc,

If it happens there are few way to try and unlock them, either with or without a bitlocker key; or you can try to get the data off them and onto another drive.

One of the ways of getting that data is file recovery of non-deleted files using a tool such as Recuva.
TBH I've never heard of anyone trying it with Recuva, but know that it can be done with other recovery softwares so don't see why Recuva shouldn't be able to.
(I have myself recovered non-deleted files from crashed drives, but I've not had a bitlocked one to try with yet).

As Jose's particular drive is a System/OS drive which is no longer in the original machine then the usual ways of trying to unlock it won't work because (most of) those methods rely on the BIOS of that original machine.

So while it is out of that original machine then recovery of the non-deleted files is the thing to try.

Whatever the result of the recovery attempt the next stage may well be to put the drive back into the original machine so that the unlocking methods can be tried.

But one step at a time, it's best not to rush these things.

[josemazcorro]

Hi there,

Sorry for the delay, I try to focus on this as much as I can, besides my job.

Recuva is still running, but now the estimated time went to 2days! (you can see it on the screenshots too)
I have some screenshots of my SSD.

 

 

The first two are from HD Sentinel. I put the data in decimals. There is indeed some reallocation of data to spare sectors.
The last screenshot is to check for Bitlocker protectors, there were not found.

I agree to the idea to keep Recuva running, it has taken so long already, that might be worthy just giving a try. Even-though I don't understand why is taking so long, last time I found many files in less than a day. The only thing I have done is that I disconnected the drive insecurely (but anyways if computer freezes..)

BTW. I was not trying to overload the disk by running HD Sentinel, I just open the program and it had already scan my drives, I thought there is an initial prompt. Then it crashed and I closed it (probably because Recuva is still running).

At this point I don't know what to do. I would appreciate any comments. Although it is indeed best to follow a rational route and with some more experience than mine of course.

Thank again

 

[JamesRM]

I can barely see the data in the screenshots , but it doesn't really matter, what's that, more than 10k sectors? Consumer grade drives are lucky to have half that, they typically have less.

1 hour ago, josemazcorro said:

I don't understand why is taking so long

Because of the state that drive is in. Every sector read, if failed, leads to repeated reads of the same sector and after several repeated failures the controller of the drive marks it as bad and a remap event will follow soon (some disks expose the number of pending relocations via S.M.A.R.T. too).

Successfully remapped sectors are slower to read too, think of it as leaving a sticky note where your keys usually are, saying that they are somewhere else in the house without you ever remembering that they won't ever be there anymore (so every time you need them, you find the sticky note first before actually getting the keys).

Sectors that can't be remapped are lost. Perhaps in some forensic labs... and even then, with the close tracks are these days and SMR, there's little chance.

1 hour ago, josemazcorro said:

The last screenshot is to check for Bitlocker protectors, there were not found.

I figured as much, that volume doesn't have BitLocker activated. The key is saved in the clear, that's why you can read its contents without being asked to unlock the volume first. In other words, there's nothing protecting the volume nor the encryption key. The other command would tell you more about it if you are curious, but it bears no difference.

1 hour ago, josemazcorro said:

I was not trying to overload the disk by running HD Sentinel

Reading S.M.A.R.T. data doesn't overload anything, it's instantaneous, I asked questions because if it were me, I'd like to make informed decisions, diagnose first, act later.

Without knowing in which state a drive is, scans, especially those that read through it all, are not only premature but can also be detrimental as they'd keep straining the drive. Those reads would be better spent on creating an image (you can think of it as a virtual copy of the whole disk) or at least using a recovery program that allows one to save the data gathered during a scan, so that recovery can be done in batches (different days, different moments) without needing to read it all over again. They also allow for proper navigation through the volume structure, regardless of whether the files you want were deleted or not, as if it were Windows' Explorer.

And not every program does the same, nor in the same way; some may not need deep scans because they are able to work with the mirror of the table I mentioned yesterday, others need both, others even have crazy in-place fixes which I could hardly recommend (they wouldn't apply to your case anyway).

1 hour ago, josemazcorro said:

The only thing I have done is that I disconnected the drive insecurely (but anyways if computer freezes..)

It doesn't make much of a difference. Even on drives that are working properly, if they are configured to use write caching you lose just whatever changes weren't committed yet. Removable drives don't cache writes by default on Windows. 

Talking of removable drives, USB enclosures have bridge controllers that translate commands a drive understands (SATA in your case) to USB and vice-versa, but they not always map them all (for example, some NVMe to USB don't send TRIM/UNMAP to the connected SSDs) and aren't as reliable as having the drives connected directly, it is possible for some of those freezes to be cause by the translation being subpar. There is a lot of nuances if we were to really get into things.

 

Anyway, I don't mean to contradict the advice you are given, my opinion is just different, do what you feel is best, it's going to take time either way.

[josemazcorro]

Thank you!

Indeed I think, I would probably have to read the disk in parts, because of it's size and state, and I am releasing some space in my other drive to make an image. I didn't know this was possible, since the problem is also reading files right?

Sorry for the last screenshots, these are fine, I think.

Now I am readying estimated remaining lifetime 10days :O!!

@JamesRM which other command do you mean?

Thanks!

[JamesRM]

27 minutes ago, josemazcorro said:

I am releasing some space in my other drive to make an image. I didn't know this was possible

Not with Recuva, but given we are in CCleaner's forum I won't name competing software, even if they play in different leagues. Imaging software isn't hard to find though, some companies offer both imaging and recovery solutions, and even though their recovery products are usually paid offerings, several allow scans for free so people can assess things before comitting.

If you do attempt to create an image of that drive, make sure it is a "sector by sector" or "bit by bit" copy (or whatever other synonym for that the program uses), because you're interested in access / recovery, not back up. If the volume wasn't encrypted, the copy could still benefit from some lossless compression, making it smaller overall, but it is less effective on encrypted volumes.

37 minutes ago, josemazcorro said:

since the problem is also reading files right?

Yes, it is. If you leave HDS opened it'll take snapshots of the drive's S.M.A.R.T. every day, giving you relevant statistical insights. For example, you've been running a scan on the disk for a while and will continue to read that disk one way or another, if the number of relocated sectors increases, things are getting worse (but there is nothing you can do about it).

Your drive being a 2.5'' 5400 RPM one is bound to be slow, but that wouldn't worry me, I'd just have to wait longer; it being old, having been used a lot and having so many damaged sectors would however, there's no telling how long it'll keep working, nor whether the data it holds is uncorrupted. If you ever completed a full scan, it'd have forced every sector to be read, relocating data if at all possible (there is some error correcting logic in the drives) and remapping those sectors if there were spares.

I don't know about that particular model, no idea if you can trust those 12k relocations took place.

1 hour ago, josemazcorro said:

estimated remaining lifetime 10days

Yeah... it doesn't surprise me , even on perfectly healthy disks, if the way it estimates the remaining time is just by dividing the amount left to read between the read speed at a given moment, it would increase if only because there are disks inside, tracks closer to the edge of the disk have higher speeds compared to those near the middle (short stroking drives was a thing years ago, for some reason...).

In your case, things just compound, plenty of damaged sectors and remaps.

[Andavari]

With it being a previous OS/system drive undoubtedly with the NTFS file system that doesn't help matters.

[josemazcorro]

I see.. I am almost done with releasing space in my other drive.

It has been a problem to release this space, since my NAS was not being recognized, maybe some driver which maybe is not there because I don't have all the Windows Updates.. Although this computer usually does recognize the NAS (not on network connection of course).

Anyways, Recuva suddenly ended the scan. I hope it was not because my computer entered in low battery mode. But I have been able to find many unimportant files :P (like Program Files Folder, which I don't really need) anyways, so as I understand there is no way in Recuva to mark these files, to avoid scanning them again? I am thinking to recover them, but it could be nice to mark them so to make a deep scan, last time I find many other files which are much more interesting (although maybe these sectors are already damaged). 

 

[JamesRM]

9 hours ago, josemazcorro said:

my NAS was not being recognized

...

Recuva suddenly ended the scan

Man, you can't catch, can you?

9 hours ago, josemazcorro said:

there is no way in Recuva to mark these files, to avoid scanning them again?

Not to my knowledge, scans in Recuva are all or nothing. In any case, if you are not interested in the files it presented you with after that scan, why consider recovering them? I thought you would try to prioritize the things that are important for you.

9 hours ago, josemazcorro said:

last time I find many other files which are much more interesting

Hard to say what is going on remotely to be honest, there are just too many possibilities for any sort of educated guess. The previous scan might have read more of the disk, with those files being in the part it didn't read this time, SATA ↔ USB translation might have failed to report the right content on some weak sectors, the disk could have deteriorated more since that previous scan (data previously recoverable, not being so anymore), ...

If you still have Recuva opened, look through what it shows, there is nothing to lose and perhaps you overlooked something you deem important; and while it is unlikely as hell, the disk being idle might be relocating new sectors, when controllers mark one as damaged the relocation event doesn't happen immediately.

10 hours ago, Andavari said:

With it being a previous OS/system drive undoubtedly with the NTFS file system that doesn't help matters.

Not necessarily! NTFS internals are well understood these days, and there's journaling, redundant metadata structures, transaction logs, ... it would be way worse if it had been a FAT32 or exFAT volume. The big problem here is the reliability of that drive, it seems to be in pretty bad shape .

[nukecad]

OK,

As it appears that the original questioner is drip feeding details, and that JamesRM perststs on interfering despite being asked not to do so then I am no longer going to give advice on this thread.

 

[Andavari]

7 hours ago, JamesRM said:

Not necessarily! NTFS internals are well understood these days, and there's journaling, redundant metadata structures, transaction logs, ... it would be way worse if it had been a FAT32 or exFAT volume. The big problem here is the reliability of that drive, it seems to be in pretty bad shape .

I meant as in the security aspect of it when messing around with it outside of the OS and even OS installation that created it and has "ownership" over it.