Piriform
Recuva

How Recuva works

Windows uses the Master File Table (MFT) as an index to the files it stores on your hard drives. As we mentioned before, when you delete a file, it's faster for Windows to mark its MFT entry as 'deleted' than for Windows to overwrite the file itself, so the file is left on the hard drive.

Regular recovery process

When you first delete a file, Windows does not overwrite the MFT entry until it needs to reuse it.

Recuva scans the MFT for files marked as deleted. Since MFT entries for deleted files are still complete (including when the file was deleted, how big it is, and where it lives on the hard drive), Recuva can give you a comprehensive list of many files and help you to recover them.

As Windows finds the need to create new files, however, it will eventually reuse and overwrite these MFT entries as well as the spaces on the hard drive where the new files actually live. That's why Recuva can't recover every file - and that's why your best bet is to run Recuva as soon as you realize the file's been deleted.

Deep scan process

The deep scan process uses the MFT to look for files, as well as the contents of the drive. Recuva searches every cluster (block) of the drive to find file headers indicating the start of a file. These headers can tell Recuva the file name and its type (for example, that it's a JPG or a DOC file).

As a result, deep scans take a long time. There are thousands of file types and Recuva can identify the most important ones.

If the file is fragmented on the drive, however, Recuva will not be able to piece it back together.

Recuva's two-scan method

Recuva performs two scans whether you use the regular recovery or deep scan process. The first scan analyzes your computer and searches for files that Recuva can recover.  The second scan then analyzes those files to assess the chances of their successful recovery. 

If you stop the first scan while it's in progress, Recuva will not display any information about the files.  If you stop the second scan while it's in progress, you will be able to view the files Recuva has found, but the status information will not be as accurate as a full scan would provide.