When you delete a file, it is only marked as “deleted” from within the Master File Table (MFT) of Windows as this makes the system aware of how it can write new data to that area of drive space, but outside of it being marked as “deleted” from within the MFT, the data itself will continue to exist on the drive, unless and until it is overwritten with new data.
The MFT is simply an index to the files that are stored on your hard drive, and more information can be found at https://en.wikipedia.org/wiki/NTFS#Master_File_Table
Regular recovery process:
When you first delete a file, Windows does not overwrite the MFT entry until it needs to reuse it.
Recuva scans the MFT for files marked as deleted. Since MFT entries for deleted files are still complete (including when the file was deleted, how big it is, and where it lives on the hard drive), Recuva can give you a comprehensive list of many files and help you to recover them.
As Windows finds the need to create new files, however, it will eventually reuse and overwrite these MFT entries as well as the spaces on the hard drive where the new files actually live. This means that the quicker you stop using your computer and run Recuva, the better your chances of recovering your files will be.
Deep scan process:
The deep scan process uses the MFT to look for files, as well as the contents of the drive. Recuva searches every cluster (block) of the drive to find file headers indicating the start of a file. These headers can tell Recuva the file name and its type (for example, that it's a JPG or a DOC file).
As a result, deep scans take a long time. There are thousands of file types and Recuva can identify the most important ones. Specifically, a Deep Scan has the ability to recover the following types of files:
- Graphics: BMP, JPG, JPEG, PNG, GIF, TIFF
- Microsoft Office 2007 (or newer): DOCX, XLSX, PPTX
- Microsoft Office (pre-2007): DOC, XLS, PPT, VSD
- OpenOffice: ODT, ODP, ODS, ODG, ODF
- Audio: MP3, MP2, MP1, AIF, WMA, OGG, WAV, AAC, M4A
- Video: MOV, MPG, MP4, 3GP, FLV, WMV, AVI
- Archives: RAR, ZIP, CAB
- Other file types: PDF, RTF, VXD, URL
If the file is fragmented on the drive, however, Recuva will not be able to piece it back together, and disk defragmentation is counter productive to the recovery operation. More information on what can affect the chances of recovering files can be found here.
Recuva's two-scan method:
Recuva performs two scans whether you use the regular recovery or deep scan process. The first scan analyzes your computer and searches for files that Recuva can try to recover. The second scan then analyzes those files to assess the chances of their successful recovery.
If you stop the first scan while it's in progress, Recuva will not display any information about the files. If you stop the second scan while it's in progress, you will be able to view the files Recuva has found, but the status information will not be as accurate as a full scan would provide.
