cgsecurity.org

Hello all,

So I shift deleted two zip files (~17GB) by mistake. The SSD (500GB) had bitlocker, so I decrypted it then booted from a USB stick with systemrescuecd.

I ran photorec on the mounted NTFS partition and selected only zip files for recovery. I selected "Free" in the space related prompt. This resulted with 0 files recovered and the process took 1 min.

I tried again with the "Whole" option and noticed it started recovering a single zip file that filled up a 500gb external HDD then photorec complained there is no more space. I am not entirely sure what was that process doing. I tried reading the generated zip file but failed due to not being formatted correctly (makes sense as it wasn't complete).

Should I assume that those two zip files are not recoverable anymore? is there another process I am missing?

Any help is appreciated.

Thanks

Can you try using latest 7.1-WIP ?

It was version 7.1-WIP September 2018. I see the latest says December 2018, should I try that instead?

I just tried the December version and it was the same result. No files recovered when selecting "Free" space and a huge zip file was created that filled up the external HDD when selecting "Whole" space. Is the "Whole" option just copying everything available on the system? is it trying to recover any deleted files?

Try TestDisk, Advanced, Undelete. Do you see your lost files ?
When running PhotoRec, do not disable the other file family, does it still recover a huge zip file ?

Tried the undelete option in TestDisk earlier, it did recover lots of files, but mine were not included.

Running QPhotoRec with all files selected resulted in recovering some txt files and that is it. I'm currently trying with all files selected and the "Whole" space option from within Windows (and not system rescue cd). It has been running for maybe 15 hours and around 800,000 files were recovered (progress is 36%). I'm thinking to wait until this process ends and hopefully find my missing files.

Thanks