Does a hdd store more data than what is reported as free

[fortfun]

Hi,

I filled a 2tb external drive to the brim (i.e with only 50mb or so of free space remaining), then proceeded to delete around 10GB of data from the drive. Then I wrote back 10GB of different data on the drive, leaving around 50mb of free space again.

However, running Recuva now shows me that it can recover multiple files (without overwritten clusters) that amount to more than 3-4gb! How is this possible? Since the previous data was overwritten by the new data, the old data shouldnt be recoverable, unless there is some extra free space that the hard disk doesnt show?

DM

[Dananjaya]

there is no hidden space on hdd. sometime old structure data shows wrong amount. bec. some structure data remain without overwritten. (lost link)
so you can only 50mb data recover chances if file has header and full data length

[Alexey]

Technically speaking, on NTFS filesystem, funny things happen if you delete small files and then write large files. The threshold separating small files from large files is around 700 bytes on 512-byte-per-sector drives and around 3500 bytes on 4K-sector drives.

However this case is most likely caused by excessive optimism of Recuva.

[fortfun]

Ok, so I did a similar test again, I copied some random files onto a 2TB hard disk which had around 4GB of free space till there was a few MB remaining. then I deleted those random files. After that I again filled up the free space with some new files till there were a few MB remaining.

Clipboard01.jpg (3.33 KiB) Viewed 10020 times

however, note that after that in recuva, I can recover a 47mb file! the file works fine.

47Mb file recoverable with only 4Mb of free space on the drive?

where is the extra space coming from? Is it reserved by windows, or does it have something to do with reserved sectors?

[fortfun]

This is even stranger. I have 17Mb free, yet I can recover over 2Gb of data!

Clipboard01.jpg (2.97 KiB) Viewed 10017 times

[fortfun]

Do the recovered files compute the same "hash" as the original files ?

yes...

[fzabkar]

Each file is associated with metadata which define the file's properties, eg its name, size, location, creation date. I haven't studied NTFS in depth, but I suspect that these metadata may not be completely deleted when the associated file is deleted. At least this is the case with FAT file systems. If so, then the data recovery software may be overestimating the total recovered capacity by including these defunct metadata in its calculations. This means that any overwritten area could be included two or more times. Of course, any recovered file which incorporates overwritten areas will be corrupt.

[Dananjaya]

this is normall. but there are no extra room on drive. this is occurring after copying, deleting, copying, deleting lots of times. bec. some deleted stuctures hold wrong amount.

1st.
you calculate your all files.and compare with disk space and fill amount. it may be totally different for sure.

* you RUN defragment and check.
* you RUN checkdisk with error fixing. after you can check.

if you want to TEST furthur why this happening

1. you get a new hard drive like 1tb (fully hex 00)
2. you copy fully day at one time. (dont delete and copy again and again)
3. delete and get few space.
4. check.

[maximus]

After you delete the files, before writing new files, are you emptying the Recycle Bin? Deleted files are not deleted (or overwritten) if they are still in the Recycle Bin

Edit: removed comment about the standard size of the recycle bin, as it seems to vary.

[HddDonorMarket]

I saw 50 60 Tb or more for 1 tb drives.
Recovery Softwares calculating file size properties from file list tables that found when searching I guess. Not meaning that files not damaged. If you try to recover all that huge amount files, you would see mostly damaged files except Healy files.

[Dananjaya]

hi hdddonormarket

this error normally occurs due to overwritten data. every new file write in new sector of hard drive. sometimes NTFS file system keeps 2_3 blank sector gap from last file. so when you write a new file, some old files there canbe 2_3 sectors before from new file writing sector.
some files have meta data in this 1-3 sector. specially video files. like "mdat" normally video length keep this area. so when you write new file , old length data overwritten and comes new value.

so when you run recovery software it reading that wrong new values.

[abolibibelot]

However this case is most likely caused by excessive optimism of Recuva.

Actually Recuva has the very rare feature of assessing the state of each file detected during the filesystem analysis, and displaying messages like “no overwritten clusters detected” (in this case the file is generally 100% valid – although this assessment is not 100% reliable) or “this file is overwritten with XXXX.XXX" (in this case the file is most likely corrupted – but can still be readable if at least the begining is valid). Those messages are visible on the “Clipboard02.jpg” screenshot above (by the way PNG should be preferred for that kind of screenshot, better quality and sometimes smaller size).

I saw 50 60 Tb or more for 1 tb drives.
Recovery Softwares calculating file size properties from file list tables that found when searching I guess. Not meaning that files not damaged. If you try to recover all that huge amount files, you would see mostly damaged files except Healy files.

This is especially true when enabling “raw file carving” with all possible file types checked (see what I just wrote in that other thread). Indeed, most of those files will be garbage – and some of them can be insanely HUGE. (Don't know what you mean by "healy files" though.)