Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The files and directories on one of my ntfs partition were wiped out last time. I used R-studio to scan the partition, and it did find many files, actually more than the capacity of the partition. This is because R-studio found files that were deleted even earlier. So I wonder if it is possible to specify those files and directories deleted last time instead of those deleted earlier for recovery?

R-studio has a free demo version, for which scanning is free,but recovery isn't. It is downloadable from http://www.data-recovery-software.net/Data_Recovery_Download.shtml Its manual is here http://www.r-tt.com/downloads/Recovery_Manual.pdf. I have tried my best to search for answers in the manual, but failed to find one. Their technical support is not as good as their software, and helpless usually in my opinion.

Thanks!

share|improve this question
    
Never used R-studio, so will just comment: You're finding more files (size wise) than there is space on the disk, because they're essentially overlapping each other (and possibly overlapping with still existing files as well). I'm not sure about R-studio, but most such tools should show you the file status (i.e. good/not overwritten, partially overwritten or lost completely). I'm not 100% sure and this might depend on your file system, but have you tried checking the "last changed" date? –  Mario Sep 13 '12 at 20:07
    
@Mario:Thanks! The files found can be sorted according to creation time, modification time, or access time. The files deleted can have very different creation time. Deletion time doesn't count as modification time or access time, since the shown modification and access times in R-studio for those found files are also very different, much earlier than the deletion time. I added links to the software, which can be tried freely and has a manual. –  SteveO Sep 13 '12 at 20:15
    
In my case I had defragmented and wiped free space not too long before I needed to use R-Studio, so I didn't end up with too many previously deleted files. As Mario said though, most of those files will be partial in any case, so you can easily discard them later. My personal strategy was to recover as much as possible, previously deleted or not. Since there's a limit to how much one can go on torturing a drive scanning it for hours, I decided to simply copy everything found to an external drive, where I could manually determine what to keep and what to throw away later at my leisure. –  Karan Sep 13 '12 at 21:43

1 Answer 1

No it is not (well, it might be, but highly unlikely).

What happens is that R-Studio examined the file-system (in the case of your NTFS disk, the MFT and saw a bunch of files that have been marked as deleted (their names are still there, but the system put a special flag on them indicating that they are deleted and the space they occupied is available for new files to use). When you write new files, they may overwrite the clusters that deleted files had previously used, but the new files will usually get their own, new entry in the MFT instead of overwriting the old ones (up until a point, then either the MFT gets expanded to make more room, or very old entries get reused, depending on your configuration).

As a result, when a program looks directly at the MFT, it may see a list of many old files that have been deleted a long time ago (which when added up will, can of course be larger than the total size of the disk). However this does not mean that you can recover them because the MFT is basically just a list of files that exist or have existed on the system; the actual contents of the files are stored on disk and once they are deleted, they may be overwritten by new files.

This is not as big of a problem if you have plenty of free space because the system may use space that has never been used before, but eventually, it will start reusing clusters that used to belong to files. Worse, when the drive gets full (like it was in your case with 97% full), the system will overwrite clusters from deleted files.

Therefore, even though you can see a list of files that you once had, their contents have been overwritten a long time ago and thus completely unrecoverable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.