Recuva

Description

When Windows marks a file as deleted, it does not delete the underlying data. On an NTFS drive, the operating system will update the Master File Table to indicate that the space is available for reuse, but the actual bytes the file occupied will not be erased from the drive until new data gets written over them. On a FAT drive, the first character of the filename entry is changed to indicate that the cluster chain is free. In both cases the content is sitting intact, invisible to the user and to the file system, until something else claims that space. Recuva exploits this gap. It reads the file table for entries that are flagged as deleted, finds the cluster addresses that those entries point to, and displays the data for recovery before it is overwritten and made unreadable.

Piriform released Recuva on August 7th, 2007, about two years after establishing the company in London. By that point, Piriform’s first product — CCleaner, a system cleaning utility — had built up a loyal user base and a certain problem: It sometimes deleted files that people wanted to keep. Forum requests for a companion recovery tool mounted, and Piriform responded with Recuva as a free standalone utility. The name is pronounced “recover,” the extra letter dropped to follow the naming pattern that Piriform used throughout its product lineup.

Piriform developed Recuva in C++ to have direct access to Windows disk APIs and used the wxWidgets library for the interface. The first release dealt with simple recovery from FAT and NTFS file systems using a simple wizard. In 2009, Piriform introduced Deep Scan, which went beyond the file table and scanned raw disk clusters for file signatures — the identifying byte sequences that indicate the start of a JPEG, MP3, ZIP or other known format. Deep Scan locates files with overwritten directory entries at the expense of scanning time and loss of original filenames and folder paths.

Subsequent versions added support for 64-bit Windows, better support for virtual folder display, better support for scanning network drives, and support for Ext2, Ext3, and Ext4 — the Linux file systems — as of version 1.5.3. The portable version, which runs without installation from a USB drive, seemed like a good solution to a very real danger: if any software is installed on the same drive as deleted files, it can easily overwrite the very data the user is trying to recover.

HOW RECOVERY WORKS

The reliability of any recovery attempt is almost entirely dependent on what has happened to the drive after the deletion. Every write operation on the volume — program launches, browser activity, temporary files, system processes — competes for the same free space the deleted file occupies. An active Windows installation writes all the time in the background; the longer the time between deletion and recovery attempt, the greater the likelihood that something has landed on top of the target data.

Recuva’s standard scan reads the MFT on NTFS drives, or the directory entries on FAT drives, builds a list of deleted file records, works out the cluster addresses stored in those files, and attempts to read the data at those locations. Results are color coded: green for files with clusters not overwritten and recovery likely, orange for files with partial overwriting and recovery may yield incomplete or corrupted recovery and red for files the scan deemed unrecoverable.

Deep Scan ignores the file table altogether, and scans unused disk space cluster by cluster, and checks each one for known file signatures. When it finds a match, it reads that cluster and the ascending sequence of clusters following it, reassembling the file from raw storage. Deep Scan recovers only the first contiguous extent of each file — it has no mechanism for following a fragmented file’s cluster chain, since the chain data lived in the directory entry that no longer exists. Files found in this way are given generic numbered filenames instead of their originals, and they appear as Excellent condition regardless of actual recoverability, as the condition indicator is that of overwriting by live files, not inherent file integrity.

One constraint is placed on solid-state drives: the TRIM command, which SSDs use to maintain write performance, tells the drive to zero out blocks the operating system marks as free. On a TRIM enabled SSD deleted data can be lost from the physical storage almost immediately after the Recycle Bin has been emptied, so there will be nothing for any recovery tool to find.

CURRENT FEATURES

The Recuva wizard takes you through three setup questions — file type, original location, and whether to enable Deep Scan — before launching. File types include pictures, music, documents, video, compressed archives, email, and a catch-all option. Locations include the Recycle Bin, a specific folder, removable device, CD or DVD, or an open-ended search of the entire drive. Users who do not complete the wizard go directly to the main interface.

Advanced mode features three tabs in addition to the file list: Preview displays the file contents for supported file formats before recovery, so that the file found can be verified to be what the user was looking for; Info displays technical details such as cluster numbers, file size and deletion time where available; Header displays the raw bytes at the beginning of the file for format check.

Recuva recreates the original folder structure when sufficient directory metadata remains. The virtual folder view is an organization of the found files by their recovered path instead of a flat list, which is practical when a scan returns thousands of results. Sorting by filename, size, modification date, or recovery state allows further narrowing of results.

The secure overwrite function is the reverse of recovery: it permanently erases selected files by overwriting their disk space with random data patterns based on US Department of Defense standards, so that recovery of the files is no longer possible. Users who discover a sensitive file they would like confirmed-deleted instead of just recoverable can overwrite it directly from Recuva’s interface.

File system support for FAT12, FAT16, FAT32, exFAT, NTFS, and NTFS5 on Windows, Ext2, Ext3, and Ext4 on Linux partitions mounted under Windows Recovery from memory cards, USB flash drives, external hard drives and MP3 players is the same as internal drives, as long as Windows recognizes the device. Recovery from optical discs is done within the limitations of read-only media. Virtual hard drive support — the ability to mount and scan VHD or VMDK files — is available in the Professional version but not the free version.

PIRIFORM ACquisition and Development Pace

Avast Software bought Piriform in July 2017 for an undisclosed sum of money, at which point Piriform’s products combined served more than 130 million monthly active users. The acquisition brought Recuva, CCleaner, Defraggler and Speccy under the ownership of Avast. Gen Digital later acquired Avast in a merger which was closed in 2022.

Recuva’s update frequency slowed down significantly after 2017. Between 2016 and 2021 development was effectively put on hold, with no significant feature releases. Updates resumed in 2022, however, and were focused on compatibility with newer Windows versions and security patches, rather than new functionality. The latest major version is 1.54.120 in June 2024. Critics of the post-acquisition trajectory point out that Recuva is still able to perform its core task but has fallen behind competitors on the newer file formats, SSD-specific recovery techniques and interface modernization.

PRICING AND EDITIONS

The free version has no functional limitations on recovery: no limit on the number of files, no limit on the size of the files, no requirement to buy before saving recovered files. It covers the core workflow — wizard, standard scan, Deep Scan, preview, recovery, secure overwrite — for personal use without cost.

Recuva Professional adds virtual hard drive support, automatic background updates, and priority email support. It costs $19.95 as a single-PC home license, and comes with a 30-day refund guarantee. There is a Business Edition for commercial environments that adds drive imaging capabilities and licensing terms that cover commercial use. CCleaner Professional Plus, Piriform’s bundle product, has Recuva Professional bundled with CCleaner Professional, Defraggler Professional, and Speccy Professional at a discounted price.