Scan does not find deleted files

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
janc76
Posts: 5
Joined: 13 Nov 2019, 22:23

Scan does not find deleted files

#1 Post by janc76 »

I permanently deleted a folder of about 500 photos by mistake a couple of weeks ago from my windows desktop. I know the chances are low they are still recoverable and neither Photorec nor Testdisk can find any of them when scanning the windows C partition. However, when I permanently delete a file from the desktop and run a testdisk scan right away it doesn't find the file either. It seems the only files that appear are system and browser temporaries. So I am wondering if I'm doing something fundamental wrong here. Any help is greatly appreciated.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Scan does not find deleted files

#2 Post by cgrenier »

If new data have been written on the previously allocated disk space, there is no way to recover them.
PhotoRec have better chance to recover your deleted pictures than TestDisk.
You have to be careful to store the recovered files on another disk than the source disk.

janc76
Posts: 5
Joined: 13 Nov 2019, 22:23

Re: Scan does not find deleted files

#3 Post by janc76 »

Here is what I do:

1. I delete a folder containing a bunch of .jpg files permanently with shift + del from the windows desktop.
2. Right after this I start Photorec, select my windows C:/ partition which contains the desktop folder.
3. As output folder I select a different partition D:/ and start the recover scan.
4. As a result Photorec restores 11 .exe and 6 .txt files but no .jpg.

This is what confuses me. Any explanation for this result?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Scan does not find deleted files

#4 Post by recuperation »

janc76 wrote: 18 Nov 2019, 15:19 Here is what I do:

1. I delete a folder containing a bunch of .jpg files permanently with shift + del from the windows desktop.
2. Right after this I start Photorec, select my windows C:/ partition which contains the desktop folder.
Wrong action. When dealing with a system partition you should have switched out your computer immediately using the power switch of the power supply or ripping off the power supply cable.
After that you would run Photorec on a different machine and connecting the drive in question to that machine - avoiding write activity on the drive with the deleted files.

Storing data on your system drive is not a good idea because the chances of recovery are low.

janc76
Posts: 5
Joined: 13 Nov 2019, 22:23

Re: Scan does not find deleted files

#5 Post by janc76 »

Thank you for that advice. So recovering data on a system partition is not possible under a running system, even if there is plenty of unallocated space on that partition?

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Scan does not find deleted files

#6 Post by recuperation »

janc76 wrote: 24 Nov 2019, 14:47 So recovering data on a system partition is not possible under a running system, even if there is plenty of unallocated space on that partition?
The space that deleted files occupies gets freed upon deletion of files. The next write task of the system can eliminate your remains.

Running Testdisk or Photorec can cause swap activity - and gone they are - your valuable clusters!
Any system activity could trigger the use of the clusters you are looking for.
Depending on the allocation mechanism lots of free space does not protect you.

janc76
Posts: 5
Joined: 13 Nov 2019, 22:23

Re: Scan does not find deleted files

#7 Post by janc76 »

What irritates me is that Photorec doesn't recover any file at all. My disk is 120 GB and half of which is unallocated. When I delete about 20 jpgs it seems quite quite unlikely that system activity overwrites exactly all of those 20 file blocks with regards to the amount of about 60 GB unallocated space in total. If Photorec recovered only a few of the images because the others have been overwritten it would make sense to me.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Scan does not find deleted files

#8 Post by recuperation »

Delete a jpeg that you saved somewhere else on a non-system volume. Then run Photorec. What happens?

janc76
Posts: 5
Joined: 13 Nov 2019, 22:23

Re: Scan does not find deleted files

#9 Post by janc76 »

If I select my data partition D: (extended LBA) I can only run whole scan which recovers all files and not only deleted ones. The free option is disabled. Can you explain what the purpose of this option is and why it is disabled?

Anyway, I ran the scan on a blank USB stick and it worked as expected after a full format.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Scan does not find deleted files

#10 Post by recuperation »

janc76 wrote: 02 Jan 2020, 22:51 If I select my data partition D: (extended LBA) I can only run whole scan which recovers all files and not only deleted ones. The free option is disabled. Can you explain what the purpose of this option is and why it is disabled?
"Extended LBA" is just an Intel style label in partition organisation. Which file system has been used for d:?

Locked