Quote:
You just need to corrupt a few bytes to make the archive unusable, so that 200kb could, in theory, be enough to corrupt a lot of files.
In this case, if I understand it correctly, “dada55” attempted to recover folders containing individual files, not compressed archives.
Quote:
Also, even if you are using some strange recovery software, you should wait for them to complete their scannint. Stopping it in the middle won´t bring good results, because the software may wait for doing some organization of its lists after the end of the scanning.
With Recuva in “quick scan” mode (and other softwares which have that option like GetDataBack) it only takes a few seconds, a minute at most, to scan the whole filesystem. In a case like this, where files were recently deleted, if the files are still recoverable, meaning, if they were not yet overwritten, the quick scan is enough in most situations. (Although I've discovered recently that
large files could be unrecoverable that way.)
A software which I use sometimes when I just need to recover a file I just deleted on Windows is HandyRecovery (the
1.0 version which was completely free) : it lets you browse the file tree while it is still building it, you can stop it as soon as it displays the wanted file, it will be able to recover it completely (unless it's been overwritten but then nothing will), and for a large partition with many many files on it and a huge MFT it can be way quicker than to wait for Recuva to complete its quick scan. Also the .exe can be run with no install, even from an external device.
Quote:
1) How bad is downloading small files prior to recovering? I understand overwriting makes most retail software struggle, but surely 200kb and a few Mbs of temporary browsing data can't overwrite 10+GB of pics?
Quote:
3) Why was it possible to recover so many old pictures and not a single one had a problem opening except the pics that I intended to restore?
Could be explained by Murphy's Law, or indeed if it's a SSD the Trim command is designed to overwrite the deleted files as a background process.
As to why you still can find old pictures, I couldn't say. Are you sure that they were actually deleted, that they weren't stored somewhere as (still allocated) temporary files ?
Quote:
2) I assume the first recovery software may have done some damage, but I had stopped the scan when it had only found about 20-30% of all the pics deleted and only attempted to recover some of those. Therefore even if it corrupted those files, the other pics found later should have been fine if that was the issue?
Any half decent recovery software should
not write
anything to the scanned drive – neither during the scan, nor after the completion when choosing the location where the files should be extracted, it shouldn't even let you attempt to write on it if you want to. But some of them are less than half decent...
Recently I tried to remotely help someone who had accidentally deleted an important Powerpoint file he was working on, which was stored only on a USB pen drive, 16GB capacity, about 8GB of free space which should be plenty ; he had tried a bunch of recovery softwares, to no avail. I made a quick scan with Recuva, which indicates if the deleted files have been overwritten and if so, by which file (it's not 100% reliable in my experience but most of the time it does provide accurate information) : the wanted file had been overwritten precisely by files extracted with one of those recovery softwares (which did not prevent him to do so), or, ironically, by files from a “FileHistory” directory, which is apparently related to an automatic recovery function in Windows 8+ (I'm still using Windows 7 so I didn't know about it). You'd think that it should have been unlikely, considering the large amount of free space, but it did happen. And even Recuva (which is otherwise an efficient tool) doesn't display a warning when the user attempts to recover a file on the same device and partition.
Quote:
4) Is there any way to still attempt to recover these photos without professional help? Just for completeness of the test.
Again, Recuva should tell you by which files the files you want have been overwritten, if any. It can also display the header of each file, which is the begining of the file in hexadecimal : with some experience, you instantly recognize if a JPEG file has a valid JPEG header or not. If there's garbage instead, or just zeroes, then nothing can be done, even by a professional, the original file is gone.
Alternatively, you can open some of the files in an hexadecimal editor, like WinHex (commercial) or HxD (free), and see what they look like inside. If the file is supposed to be a JPEG picture, first open a few valid JPEG files, you'll see that they always begin with the characters “ÿØÿ”, or “FF D8 FF” in hexadecimal. If a recovered JPEG file starts with anything else, then nothing can “fix” it. If the header is correct but the second half has been overwritten, you typically can see half of the picture, the rest appears as random strips of colors – and again, nothing can fix this.
Quote:
5) If this was a real data recovery, what software / method / steps would you have taken to increase chance of restoring the data?
Doing what you're doing right now is definitely a very good idea : test various methods when you
don't need them, so that you know what to do and don't panic when you actually need to recover something and failure is not an option !
Otherwise, you should sort out the good softwares from the crappy ones, know their strenghts and weaknesses, which type of situation best fits each of them, and have them installed on your computer from then on, preventively. You can also run some of them in “portable” mode, if you need to scan your system partition, but if you absolutely need a file which was deleted on your system partition, the best course of action is to shut down the computer immediately, and then scan the drive as an external device from another computer (or better yet, perform a complete image of the relevant partition and scan this instead of the drive itself), because each second you run the drive, data could be written at the exact spot where that file is / used to be.
For instance, Recuva is usually less efficient than R-Studio to rebuild a file tree (which is an advanced commercial software, as opposed to a freeware), but it completes its quick scan in a matter of seconds, whereas R-Studio can take hours, so if you just want to recover one file which has just been deleted it might be overkill, and even counterproductive if the drive is a SSD with Trim enabled : each second the wanted data could be wiped, so the quicker the scan the better. Photorec is designed to recover files in “raw file carving” mode, meaning, it does not rely at all on the filesystem and the metadata, it just extracts files based on their “signature”, which is their header / footer patterns, specific to each file type (one caveat, beyond the fact that you lose the original name as well as the timestamps, is that it's unlikely to fully recover fragmented files). If the files you want have been found by a recovery software with their actual names and sizes and timestamps, it means that the MFT records containing the metadata for those files and their exact locations are still there, but if they have been overwritten then Photorec will not be able to detect them because they no longer have any characteristic header, they now appear as random data (or empty data).