Page 1 of 1

Scan does not find deleted files

Posted: 13 Nov 2019, 22:40
by janc76
I permanently deleted a folder of about 500 photos by mistake a couple of weeks ago from my windows desktop. I know the chances are low they are still recoverable and neither Photorec nor Testdisk can find any of them when scanning the windows C partition. However, when I permanently delete a file from the desktop and run a testdisk scan right away it doesn't find the file either. It seems the only files that appear are system and browser temporaries. So I am wondering if I'm doing something fundamental wrong here. Any help is greatly appreciated.

Re: Scan does not find deleted files

Posted: 15 Nov 2019, 07:03
by cgrenier
If new data have been written on the previously allocated disk space, there is no way to recover them.
PhotoRec have better chance to recover your deleted pictures than TestDisk.
You have to be careful to store the recovered files on another disk than the source disk.

Re: Scan does not find deleted files

Posted: 18 Nov 2019, 15:19
by janc76
Here is what I do:

1. I delete a folder containing a bunch of .jpg files permanently with shift + del from the windows desktop.
2. Right after this I start Photorec, select my windows C:/ partition which contains the desktop folder.
3. As output folder I select a different partition D:/ and start the recover scan.
4. As a result Photorec restores 11 .exe and 6 .txt files but no .jpg.

This is what confuses me. Any explanation for this result?

Re: Scan does not find deleted files

Posted: 18 Nov 2019, 16:20
by recuperation
janc76 wrote: 18 Nov 2019, 15:19 Here is what I do:

1. I delete a folder containing a bunch of .jpg files permanently with shift + del from the windows desktop.
2. Right after this I start Photorec, select my windows C:/ partition which contains the desktop folder.
Wrong action. When dealing with a system partition you should have switched out your computer immediately using the power switch of the power supply or ripping off the power supply cable.
After that you would run Photorec on a different machine and connecting the drive in question to that machine - avoiding write activity on the drive with the deleted files.

Storing data on your system drive is not a good idea because the chances of recovery are low.

Re: Scan does not find deleted files

Posted: 24 Nov 2019, 14:47
by janc76
Thank you for that advice. So recovering data on a system partition is not possible under a running system, even if there is plenty of unallocated space on that partition?

Re: Scan does not find deleted files

Posted: 24 Nov 2019, 16:25
by recuperation
janc76 wrote: 24 Nov 2019, 14:47 So recovering data on a system partition is not possible under a running system, even if there is plenty of unallocated space on that partition?
The space that deleted files occupies gets freed upon deletion of files. The next write task of the system can eliminate your remains.

Running Testdisk or Photorec can cause swap activity - and gone they are - your valuable clusters!
Any system activity could trigger the use of the clusters you are looking for.
Depending on the allocation mechanism lots of free space does not protect you.

Re: Scan does not find deleted files

Posted: 04 Dec 2019, 13:47
by janc76
What irritates me is that Photorec doesn't recover any file at all. My disk is 120 GB and half of which is unallocated. When I delete about 20 jpgs it seems quite quite unlikely that system activity overwrites exactly all of those 20 file blocks with regards to the amount of about 60 GB unallocated space in total. If Photorec recovered only a few of the images because the others have been overwritten it would make sense to me.

Re: Scan does not find deleted files

Posted: 04 Dec 2019, 15:28
by recuperation
Delete a jpeg that you saved somewhere else on a non-system volume. Then run Photorec. What happens?

Re: Scan does not find deleted files

Posted: 02 Jan 2020, 22:51
by janc76
If I select my data partition D: (extended LBA) I can only run whole scan which recovers all files and not only deleted ones. The free option is disabled. Can you explain what the purpose of this option is and why it is disabled?

Anyway, I ran the scan on a blank USB stick and it worked as expected after a full format.

Re: Scan does not find deleted files

Posted: 03 Jan 2020, 09:34
by recuperation
janc76 wrote: 02 Jan 2020, 22:51 If I select my data partition D: (extended LBA) I can only run whole scan which recovers all files and not only deleted ones. The free option is disabled. Can you explain what the purpose of this option is and why it is disabled?
"Extended LBA" is just an Intel style label in partition organisation. Which file system has been used for d:?