Turn off any applications you don't need, if you are trying to recover files from a media card, stop using that card immediately. Ideally install Recuva before you need it, as just browsing the internet and downloading the installer creates a huge number of temporary files and any one of them could over write the file you are trying to recover. When you need it, just Scan the drive the file was on.
Finding the file
Recuva will often find a huge number of files, so the first task is usually to identify the file you want to recover.
By file name
The easiest way to find a file is by its name. Press Scan and then type the name in the filter box. If you know the file name and it's not in the list, then don't give up, try the options below or see the FAQs.
By file type
If you don't know what the name is, but are certain of the type, then click on the filter box and select the type of file you are looking for. Alternatively, you can enter a specific filetype if you know it e.g. '.jpg' will display just the files ending with .jpg (JPEG photos)
By path
If you are not sure of the name but know where it was, then you can try entering part of the path. Note that if the file was placed in the Recycle Bin before it was deleted, then the path has probably been changed. Typing in 'recycle' will list all the files that were deleted from the recycle bin.
What to do if you can't find your fileUnderstanding the results
If you placed the file in the Recycle Bin before deleting it, then it is possible that it has been renamed by Windows – this is a standard feature. In this case, the best way to find your file, is to identify all the files in the Recycle bin and then sort by Last Modified or by Size. Files in the Recycle Bin are renamed in the following way
• Dc19.jpg
This is short for Disk c, the number is purely sequential. Windows does not change the file type.
When you've found your file, Recuva displays a variety of information about it. If it is an image file, you may have a preview. You also have Info and Header information.
Each file is given a Status – Excellent, Poor, Very poor, Unrecoverable. This is visible in the Status column in the list view or the Info tab. Files marked Excellent have the best chance of recovery but it's still possible a file marked Poor can still be recovered and vice versa.
Restoring the files
You can select the files you want to recover using the tick boxes, or the right click options. If possible, restore the files to a different drive, this increases the chance of a successful recovery.
Testing the files
Recuva will attempt to restore your deleted files, but it cannot analyze the contents of the file after it has recovered it and tell you if the recovery was 100% successful.
The only way to test if the file has been recovered successfully is by opening it with the originating applications – e.g. does it open properly in Word? If it fails to open in the originating application, then the recovery has almost certainly failed.
FAQs
What sort of things affects the chances of recovery?
Fragmentation – It is possible to recover fragmented files from NTFS, but this does affect the chance of a successful recovery. It is not possible to recover fragmented files from a FAT drive.
The age of the file – Files that have only existed for a few minutes and are then deleted, are very likely to be over-written with temporary files. This explains why if you create a file, then delete it immediately, Recuva will find it difficult to recover it. This is because the file will almost certainly be overwritten with a temporary system file.
File system – it is much easier to successfully recover a file from an NTFS drive than a FAT (note that removable drives and media cards are nearly always FAT).
Can I recover a file that has been securely deleted?
No. Once it's gone, it's gone.
How does the secure delete work?
Recuva deletes a file by writing over it between 1 - 35 times, depending on the deletion method you choose in Options. If the file has already been partially overwritten with other files, (see the Info tab) only the remaining clusters are over written. This is why, if you delete a file with Recuva you will not see an increase in the clusters over written. But believe us, the file has gone.
What types of files can't Recuva securely delete?
There are 2 types, Files that are resident in the MFT and files of zero size. Resident files are very small files (typically a few hundred bytes) that are so small Windows stores them directly in the MFT. Zero byte files are exactly that, they have no size and therefore have nothing to delete.
I've overwritten a file but can still see the Preview or Header info, why?
That's probably because the file you deleted has already been overwritten with another file. Look at the Preview, to see if it's really of the file you think it is. This will also be displayed in the Header. The Header displays the first 128 bytes of the file, so after deleting a file, the contents of the Header tab may not change if the first cluster has already been over written with another file.
Why are files that have been securely deleted marked as being recoverable?
If you have used Recuva (or any other similar app) to erase files, the files may still be marked as being recoverable, but they are not. It's like scribbling all over a jigsaw, the pieces are still the same shape and still join up, but you can no longer see the picture.
