All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: Does a hdd store more data than what is reported as free
PostPosted: March 13th, 2019, 16:26 
Offline

Joined: April 16th, 2009, 23:36
Posts: 5
Location: India
Hi,

I filled a 2tb external drive to the brim (i.e with only 50mb or so of free space remaining), then proceeded to delete around 10GB of data from the drive. Then I wrote back 10GB of different data on the drive, leaving around 50mb of free space again.

However, running Recuva now shows me that it can recover multiple files (without overwritten clusters) that amount to more than 3-4gb! How is this possible? Since the previous data was overwritten by the new data, the old data shouldnt be recoverable, unless there is some extra free space that the hard disk doesnt show?

DM


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: March 14th, 2019, 3:43 
Offline

Joined: February 2nd, 2019, 1:21
Posts: 192
Location: Sri Lanka
there is no hidden space on hdd. sometime old structure data shows wrong amount. bec. some structure data remain without overwritten. (lost link)
so you can only 50mb data recover chances if file has header and full data length


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: March 14th, 2019, 11:25 
Offline

Joined: June 17th, 2017, 18:30
Posts: 37
Location: Russia
Technically speaking, on NTFS filesystem, funny things happen if you delete small files and then write large files. The threshold separating small files from large files is around 700 bytes on 512-byte-per-sector drives and around 3500 bytes on 4K-sector drives.

However this case is most likely caused by excessive optimism of Recuva.


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 5th, 2019, 15:54 
Offline

Joined: April 16th, 2009, 23:36
Posts: 5
Location: India
Ok, so I did a similar test again, I copied some random files onto a 2TB hard disk which had around 4GB of free space till there was a few MB remaining. then I deleted those random files. After that I again filled up the free space with some new files till there were a few MB remaining.
Attachment:
Clipboard01.jpg
Clipboard01.jpg [ 3.33 KiB | Viewed 9100 times ]


however, note that after that in recuva, I can recover a 47mb file! the file works fine.
Attachment:
File comment: 47Mb file recoverable with only 4Mb of free space on the drive?
Clipboard02.jpg
Clipboard02.jpg [ 45.02 KiB | Viewed 9100 times ]


where is the extra space coming from? Is it reserved by windows, or does it have something to do with reserved sectors?


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 5th, 2019, 16:24 
Offline

Joined: April 16th, 2009, 23:36
Posts: 5
Location: India
This is even stranger. I have 17Mb free, yet I can recover over 2Gb of data!

Attachment:
Clipboard01.jpg
Clipboard01.jpg [ 2.97 KiB | Viewed 9097 times ]

Attachment:
Clipboard02.jpg
Clipboard02.jpg [ 48.7 KiB | Viewed 9097 times ]


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 5th, 2019, 17:20 
Offline

Joined: April 16th, 2009, 23:36
Posts: 5
Location: India
Spildit wrote:
Do the recovered files compute the same "hash" as the original files ?

:D


yes...


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 5th, 2019, 17:53 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Each file is associated with metadata which define the file's properties, eg its name, size, location, creation date. I haven't studied NTFS in depth, but I suspect that these metadata may not be completely deleted when the associated file is deleted. At least this is the case with FAT file systems. If so, then the data recovery software may be overestimating the total recovered capacity by including these defunct metadata in its calculations. This means that any overwritten area could be included two or more times. Of course, any recovered file which incorporates overwritten areas will be corrupt.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 6th, 2019, 2:28 
Offline

Joined: February 2nd, 2019, 1:21
Posts: 192
Location: Sri Lanka
this is normall. but there are no extra room on drive. this is occurring after copying, deleting, copying, deleting lots of times. bec. some deleted stuctures hold wrong amount.

1st.
you calculate your all files.and compare with disk space and fill amount. it may be totally different for sure.

* you RUN defragment and check.
* you RUN checkdisk with error fixing. after you can check.

if you want to TEST furthur why this happening

1. you get a new hard drive like 1tb (fully hex 00)
2. you copy fully day at one time. (dont delete and copy again and again)
3. delete and get few space.
4. check.


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 6th, 2019, 9:02 
Offline

Joined: January 29th, 2012, 1:43
Posts: 982
Location: United States
After you delete the files, before writing new files, are you emptying the Recycle Bin? Deleted files are not deleted (or overwritten) if they are still in the Recycle Bin :wink:

Edit: removed comment about the standard size of the recycle bin, as it seems to vary.

_________________
http://www.hddsuperclone.com
Home of HDDSuperClone


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 6th, 2019, 9:35 
Offline
User avatar

Joined: June 16th, 2018, 12:09
Posts: 488
Location: Turkey
I saw 50 60 Tb or more for 1 tb drives.
Recovery Softwares calculating file size properties from file list tables that found when searching I guess. Not meaning that files not damaged. If you try to recover all that huge amount files, you would see mostly damaged files except Healy files.

_________________
A Recovery Service In Turkey . Veri Kurtarma Türkiye https://www.digitalverikurtarma.com
Donor Drives hdddonormarket.com


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 6th, 2019, 10:39 
Offline

Joined: February 2nd, 2019, 1:21
Posts: 192
Location: Sri Lanka
hi hdddonormarket

this error normally occurs due to overwritten data. every new file write in new sector of hard drive. sometimes NTFS file system keeps 2_3 blank sector gap from last file. so when you write a new file, some old files there canbe 2_3 sectors before from new file writing sector.
some files have meta data in this 1-3 sector. specially video files. like "mdat" normally video length keep this area. so when you write new file , old length data overwritten and comes new value.

so when you run recovery software it reading that wrong new values.


Top
 Profile  
 
 Post subject: Re: Does a hdd store more data than what is reported as free
PostPosted: April 13th, 2019, 2:20 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 309
Location: France
Quote:
However this case is most likely caused by excessive optimism of Recuva.

Actually Recuva has the very rare feature of assessing the state of each file detected during the filesystem analysis, and displaying messages like “no overwritten clusters detected” (in this case the file is generally 100% valid – although this assessment is not 100% reliable) or “this file is overwritten with XXXX.XXX" (in this case the file is most likely corrupted – but can still be readable if at least the begining is valid). Those messages are visible on the “Clipboard02.jpg” screenshot above (by the way PNG should be preferred for that kind of screenshot, better quality and sometimes smaller size).

Quote:
I saw 50 60 Tb or more for 1 tb drives.
Recovery Softwares calculating file size properties from file list tables that found when searching I guess. Not meaning that files not damaged. If you try to recover all that huge amount files, you would see mostly damaged files except Healy files.

This is especially true when enabling “raw file carving” with all possible file types checked (see what I just wrote in that other thread). Indeed, most of those files will be garbage – and some of them can be insanely HUGE. (Don't know what you mean by "healy files" though.)


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: jeanluc.ferre and 86 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group