When any scan doesn't find lately deleted file

[RPT]

I'm trying to recover deleted files from a laptop NTFS system HDD but MiniTool Power Data Recovery or Recuva scan can't find even file names.
Is there any good explanation, why file names deleted 3 days ago can't be found?
Isn't file name info kept separate from data area and even when file can't be restored, it's name is still found?

Is there any preferred search method to recover deleted file(s)?

Deleted file was obviously in Windows My Documents Downloads folder, where an application was unzipped into it own folder, then application was run in this unpack folder and it created a database files to this folder. Now the folder was likely deleted and next day person, who deleted it, unzipped the original content to the same destination folder once again. Now I'm searching database file with unique name and extension, which was in this folder before and there is not any new file with the same name.

Does creating a new folder with the same name hides forever previous content of folder with the same name?

Thanks!

[drc]

I would suggest reading up on NTFS so that you understand what is going on under the hood

[RPT]

Thanks for the, but unfortunately IT specter is too wide to learn everything during one life we have got.
Therefore whenever reasonable, I don't feel embarrassed to ask help from specialist, whose knowledges are certainly much deeper.

[Vulcan]

Is there any good explanation, why file names deleted 3 days ago can't be found?

More investigation could be done by someone who has the disk in front of them, but the short answer is that in your case, yes - this result can occur due to the extra files which were created, after the file(s) which you wanted were deleted.

This is also why people are warned not to install recovery software into the same filesystem, from which they want to undelete files.

[RPT]

My assumption is that there is a lot of space for file names, which is separated of data area and therefore it is not easily understandable how file name can be lost so soon, when there has been created very limited amount of new file names.

[networks]

You need to tell us What version the OS is. Is the Hard drive one of the new Solid State Drives ? SSD.

Does creating a new folder with the same name hides forever previous content of folder with the same name? Yes in most cases that is what I have experienced.

[Vulcan]

@RPT: IMHO you seem to have the wrong "mental picture" / assumption of how this works. You need to understand about MFT handling in NTFS, as drc mentioned, and what happens to a file's metadata in the MFT, when you delete the file. In general terms, each new file which is created, can overwrite the file name (and other metadata) from a previously deleted file, so your results are no surprise. I'll stop here, since it seems you don't believe my help.

[RPT]

@RPT: IMHO you seem to have the wrong "mental picture" / assumption of how this works. You need to understand about MFT handling in NTFS, as drc mentioned, and what happens to a file's metadata in the MFT, when you delete the file. In general terms, each new file which is created, can overwrite the file name (and other metadata) from a previously deleted file, so your results are no surprise. I'll stop here, since it seems you don't believe my help.

I just expected to see at least file names, even if file content can't be restored.
But thanks Vulcanos - the wisdom I missed is just in your last message "each new file which is created, can overwrite the file name (and other metadata) from a previously deleted file"
Indeed I hoped that NTFS preserves some extra space for MFT, which aren't overwritten instantly, when there is more spare space.


BTW. Op system is plain XP and drive ordinary SATA.

[networks]

RPT I asked because win7 has a new habit of doing defrags on the fly quickly which complicates recovery. 2nd the new latest version of SSD drives clean house within 10sec of a file deletion thus no recovery there either. The MFT can't have 2 files identical names on the same dir at the same time. If you run recuva it sometimes shows both names and will indicate one of the filenames disk space has been overwritten. I get asked to do this type of recovery all the time by clients sometimes we get lucky and a deleted file with (1) at the end is found or a copy in the temp dir or if they sent via outlook a copy is in the outlook hidden temp dir lots of places to look

[laptokowiec]

Scan NTFS with DMDE.