1

So I have Windows 8. I SHIFT+ENTER accidentally deleted all pictures instead of half. I used global purpose "File Scavenger 3.2" program, which was always working perfect for last 5 years to restore files & images on HDD drives (I never done this on SSD, through). So I used it this time as well, it quickly found all deleted files, all they were in "good" condition, and immediately restored them. The file sizes looked ok, but only 15 of 200 had thumbnails in Windows Explorer. I use "Irfan View" to view images, and only those 15 I was able to open, for all others, when I tried to open it said "unknown file format, file empty or not found". It is the same with Windows Image Viewer. I tried to used "Stellar Phoenix JPEG Repair" and "JPEG Repair 2". None of them repaired anything. Just showed "invalid". I did checked other threads related to this topic, but I did not found any answers I needed. So maybe someone had similar situation and can recommend exact software, which worked for you to get images back.

  • Sorry to hear that. Have you tried Image Rescue? It is a paid program but they state that any file shown in the free preview is guaranteed to be recovered. If that does not work, try some more and please report back because I've never done this on an SSD either and all my photos are now on such drive for the master copy and primary backup (secondary and tertiary are on other types of media). – Itai Dec 15 '13 at 3:06
  • If you don't normally have your computer set to display the file extions of file names on your computer, change the setting so that you can see the complete file name including the extensions. Some recovery programs will incorrectly identify what type of file they have recovered and restoring the unreadable files can be as simple as changing the extensions to the proper one. – Michael C Dec 15 '13 at 4:34
  • It's all fine with extension. It's jpg. – KestutisIT Dec 15 '13 at 13:43
  • possible duplicate of Is there a way to recover corrupted JPEG files? – mattdm Oct 7 '14 at 14:10
3

An important detail that hasn't been mentioned thus far is how file deletion is (usually) done on SSDs. It is different than the traditional, spinning-disk, hard disk drives (HDDs).

As mentioned in AJ's answer, traditionally when you "delete" a file the operating system (Windows 8 in this case) simply tells the hard drive that the file is no longer needed and the hard drive marks that file as unneeded but doesn't actually remove the data. This is a "logical delete." Actually removing the data is a "physical delete." With file-recovery software you can recover a "logically deleted" file because the data may not be gone yet.

However, SSDs have a featured called TRIM which immediately follows a logical delete with a physical delete. This improves the performance of the SSD, but comes with the cost of making file recovery impossible. I don't use Windows much, but from what I can tell this feature is enabled by default.

Because of this the "files" that were recovered are almost assuredly just filled with junk and there's no remnant of the original data left.

You can check if this feature is currently enabled on Windows 8 by opening a command line and entering the following: fsutil behavior query disabledeletenotify which will tell you the value is either 0 or 1. 0 means TRIM is enabled (the variable name is "disabled", so 0 is NOT disabled).

I've made this mistake too. It's a harsh lesson about the importance of proper backups.

  • 1
    On top of TRIM, most SSDs also employ a lot of Wear Leveling techniques - I do not know if that would come into play here (it would require some filesystem awareness), but in any case, the crux here is that on a SSD, data recovery through Software is much harder than on an old HDD. – Michael Stum Oct 8 '14 at 1:49
  • Windows 8 is most definitely well aware of SSD's and their differences from 'spinning rust'. Wear levelling would cause an almighty mess which would make it an order of magnitude harder to recover any file over 4k in size. – James Snell Oct 27 '14 at 20:27
1

For what you are saying it looks as if the recovery software didn't do his job properly and just recovered wrong sectors or data.

If I were you I would try a more professional recovery software. I been using "ontrack recovery professional" and it has done a perfect job for plenty of memory cards and hard disks ( ssd and sata ) and it has a trial version to test it. I really hope you can recover you data.

  • Can you expand a bit more about the software you recommend? Why is this one "more professional", and why would that be better? – mattdm Oct 7 '14 at 12:05
  • I did recommend that software because almost a year ago ( that it was when I answered this question ) Fire Scavenger wasn't on par with the ontrack easyrecovery software ( now they have added quite a few features that then it didn't have ). In example, Ext2/3 Recovery, RAIDs, NAS, etc... But mainly I recommended ontrack over fileScavenger because just yet the recovery for NTFS has been improved on version 4, before this one the success rate ( talking just for own experiences ) of recovery was much better with ontrack than FileScavenger. – Fabman Oct 7 '14 at 12:36
  • Also The "Professional" term was added because then ontrack easyrecovery had support for more "professional" hard disk setups like RAIDs or NAS. – Fabman Oct 7 '14 at 12:37
0

If you recovered to the same drive that you originally deleted them on, you probably corrupted them yourself. The reason you can undelete a file is that the drive is simply marked as the space being available, no other data is actually changed. Thus, if you read where the file had been, the data is still there.

The problem with recovery is that when you recover a file, it has to write it somewhere in a new file. If this new file happens to make use of the space marked as available from one of the other files that you were recovering, that other file will be corrupted.

On a normal HDD the risk isn't that high if you have lots of free space because HDDs try to group files in to contiguous blocks to reduce file seeks, and thus will generally try to avoid the holes left by recently deleted files.

On SSDs however, that is turned on its head. For SSDs, the primary concern is not contiguous blocks (there is no seek time for solid state drives) but rather how many times the value has been changed on a particular area of the drive (because SSDs have a limited number of writes on each bit). If the files had been around for a while and had kept that part of the drive from being changed, it likely is now seen as the most ideal spot to write new data, thus making it highly likely that any restoration operation will result in corruption to other files being restored.

Unfortunately, after the data is actually overwritten, there is no practical way to recover it and you are up a creek with no paddle. The data is gone. (There may possibly be some special forensic ways to do it by taking the drive apart, but that would require specialized equipment and would cost thousands of dollars+ if it is even possible on SSDs.)

protected by mattdm Oct 7 '14 at 12:03

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.