What sort of things affects the chances of recovering files?
- The file system - It is much easier to successfully recover a file from an NTFS-formatted drive than from a FAT-formatted one. Note that removable drives and media cards are nearly always formatted as FAT.
- Fragmentation - If a file is fragmented, you can recover it from an NTFS-formatted drive, but it may be less likely to be recovered. It is not possible to recover fragmented files from a FAT-formatted drive.
- The age of the file - Files that only existed for a few minutes before deletion are very likely to be overwritten with temporary files. If you create a file, then delete it immediately, Recuva will find it difficult to recover that file. Similarly, the longer ago that the file was deleted, the more likely it is to already have been overwritten by subsequent drive activity.
Can I recover a file that has been securely deleted?
Typically not. Once it's been securely deleted, it's gone forever.
How does the secure delete function work?
What types of files can Recuva not securely delete?
Recuva cannot delete files that are resident in the Master File Table (MFT), or files of zero size. Resident files are very small files (typically a few hundred bytes) which are so small that Windows stores them directly in the MFT. Zero byte files have no size and therefore have nothing to delete. Additionally, files in a file system that is encrypted or compressed cannot be securely deleted.
I've overwritten a file, but I can still see the Preview or Header info. Has the information been deleted?
This can happen when the file you deleted has already been overwritten with another file. Check the Preview pane to see if the file still contains the original content. The Header pane displays the first 128 bytes of the file, but it may not change if the first cluster of the file you deleted has already been overwritten with another file.
Why are files that have been securely deleted marked as being recoverable?
If you have used Recuva (or any other similar application) to erase files, the files may still be marked as being recoverable, but they are not. The file marker may still exist, but the contents of the file will be gibberish.