Recover from RecycleBin_tmp

[Ancient1966]

Hello, For some reason, last Sync went wrong and it deleted some important directories of my work folder. I tried to undelete from many applications but I always end the same. The files are there under a directory named: RecycleBin~5b04.ffs_tmp, with all the directory structure. The files seems perfect, with its type, it size, etc. But when I tried to open them, the seems corrupted. Tried several softwares and no one seems to repair the files. I understand that this directory was created for FFS the last sync. It was tmp into the Windows Recovery folder and then finally deleted. Well I recovered into anothe disk. How can I turn back into a normal directory with usable files?. I searched everywhere but didn´t find the answer. Some said that simply copying the files out of the RecycleBin directory and will work. But don´t. The undelete apps shows the majority of the files as perfectely recoverable. I think is the way FFS encrypted this file. Any help?. Tks.

[xCSxXenon]

FFS doesn't encrypt it. Pulling files out of the recycle bin manually usually doesn't work like that since there is extra data that Windows holds onto. You have to use the "restore" option from within Recycle Bin.
Look into versioning or a more robust backup system to avoid this in the future, such as a a 3rd/4th backup location

[Ancient1966]

Thanks for your answer Xenon. Truth is i need to solve what I have now. For sure on the future I will implement a more robust backup policy.
You said that I have to restore from the Recycle Bin: please elaborate. You mean the Windows folder, right?.
I thaugh that If I could enter this RecycleBin---tmp folder back into the Recycle Bin of Wndows, perhaps I have a chance. I tried to do it manually, but it seems that it keeps the external disk route where I save it from the recovery, and is not recognized by FFS.
Perhaps If someone help me understand how this RecycleBin---tmp works in FFS, I can undo the delete.
Don´t know if I am clear enough.

[therube]

RecycleBin_tmp

a directory named: RecycleBin~5b04.ffs_tmp, with all the directory structure

this RecycleBin---tmp folder

None of that sounds like a Windows $Recycle.Bin (at least through Win7).

So is this "RecycleBin" on a local Windows volume, or ... ?

[Ancient1966]

Hi Therube.
RecycleBin~5b04.ffs_tmp is the exact name of a directory that I found in a Recovery tool.
It is located in the drive I cant to recover from. (D:)
It has all the structure of subdirectories and files that I lost in the last sync of FFS.
The problem is that the files recovered are unreadable and unreparables.
Don´t understand why because every property of the files are good: health to recover, size, type, etc.
up tho this I think are FFS things.
As I read here, there this RecycleBin~5b04.ffs_tmp is the type of directory that the Windows makes once it delete from the windows Recyble Bin directory.
Hope this clarifies.

That is why I need or:
a)make those files recovered readables someway.
b)or make the windows Recyble Bin that I already have that RecycleBin~5b04.ffs_tmp on its structure and recover as a normal windows file.

Help Please!!!! I am really stucked with this.

[Ancient1966]

Is any way to get direct FSS help?

[Ancient1966]

Any Help Please?!
Is frustrating to lose all those files. See there and you can’t use any more. The deleted files are perfectly health, but for some reason somehting changed and I cant open anymore.
I am not sure what happened with the sync but I think is something related to delete things in one side and before the next sync delete other things in the other.

[Plerry]

RecycleBin~5b04.ffs_tmp (or anything like that) is not the place to (try to) recover files.

Depending on how you have set "Delete and Overwrite" in your Sync settings (F8), you should be able to find files that were deleted or overwritten by FFS in your systems Recycle Bin (=default setting) (so not in RecycleBin~5b04.ffs_tmp or the like), in your Versioning location, or they are lost Permanently.

[Ancient1966]

Plerry. Thas is may point. I need to recover from somewhere else because this already happened and, even if I set to "Retain deleted and overwritten fiels in the recycle bin", there is nothing there. I guess that was because FFS erased both side 80GB of information. The only place I found is here.
Here is more detail:

viewtopic.php?t=172#p43265

[therube]

It sounds like "RecycleBin~5b04.ffs_tmp" is some kind of machination of your (unnamed) "Recovery tool".

So what is this tool?

[Ancient1966]

I tried several: Recova, Undelete 360, Easus Recovery Data, Stellar, Tnorshare, DetDataBack. You name it.
I so frustrated.
Perhaps is the way Windows treats a directory that is in the Recyble Bin (Windows) when it delets and put some kind of encryptation there.

[Ancient1966]

Please note that I used only the free part of the payed ones. Cause there are so expensive and not sure if thery will recover the files. Or repair it. So if you have some idea on this could be too.

[xCSxXenon]

Please note that I used only the free part of the payed ones. Cause there are so expensive and not sure if thery will recover the files. Or repair it. So if you have some idea on this could be too.

As someone who does data recovery professionally, you likely aren't going to get anything back from that 80GB that was deleted. The "files" that seem intact likely hold the metadata only and the binary content is probably nonexistent, which means the file is also nonexistent. This is all before considering that the Windows Recycle Bin on your system likely won't hold 80GB anyway, but the size quota changes depending on the storage capacity available. You would have to confirm your specific size quota, but it is certainly moot at this point.

Tools that recover deleted files, like Recuva and most tools you will find, rarely work as it is. If the data was on an SSD, chances go down even more. If you are trying to recover files from the drive you are currently booted from, chances are exponentially lower, as the blocks where the files were stored can be overwritten since they are now "free" to be used for new data.

I hate to be the bearer of bad news, but unless you powered off and disconnected the drive as soon as the data was deleted, you are basically SOL. You would have a better chance at recovery if the partition was deleted instead of the data being deleted, which sounds backward, but also exemplifies why recovery is not as straightforward as we'd like it to be.

As I always recommend, maybe reach out to professionals who are familiar with this process to maximize recovery chances. This process requires giving the storage device away though, so you can't access anything else on it while waiting. Also, the best time to implement a more robust backup solution is yesterday, but the second best time is now. I use Windows' FileHistory, OneDrive, periodic manual backups, and more to ensure the worst-case scenario is that I lose maybe a few hours of work, if any. Even with all I have set up, it still isn't a guaranteed full recovery since there is a tiny chance all restoration methods fail at the same time, but the goal is to minimize the chances that all options fail at once.

[therube]

(Both greatly aged, but...)

Two observations: "deletion handling" is set to "recycle bin". This means that all files that are deleted and the old version of those files that are *updated* are placed there.
So it doesn't suprise to find an oudated version of a document in RecycleBin.ffs_tmp, since it was overwritten by a newer one during sync.

But here's a problem: "RecycleBin.ffs_tmp" is a temporary folder that should only be visible during sync and be moved into the real Windows Recycle Bin after sync. For some reason this failed

viewtopic.php?t=172#p626

RecycleBin.ffs_tmp is the folder where FreeFileSync puts the to be deleted/overwritten files before the whole folder is moved to the Windows Recycle Bin at the end of the sync. The fact that this folder exists means that he sync was somehow terminated externally. The hierarchical structure within this folder is still the original one

viewtopic.php?t=3857#p12921

That said, then RecycleBin~5b04.ffs_tmp is in fact probably directly related to FFS.

But, seemingly, as this directory tree was "recovered" (from what I gather) by one of these "undelete" utilities, & seemingly, or perhaps, the actual files were sent to the (real) $recycle.bin, what the undelete utility recovered was "bogus" data that only existed temporarily, where the real data (seemingly) ended up in $recycle.bin, which is where - perhaps, your actual data may lie?

Given (if) it were a directory that was deleted, that directory should have been added "wholesale" as a subdirectory to $recyle.bin, with the dirname as a GUID, but the file names with the dirname should be as original (as opposed to be a GUID name).

So in your Sync, did you have it set to use Recycle bin?
Did your sync complete, successfully (even if with unwanted results)?

[Ancient1966]

Hi Therube. Thanks for your comment.

Yes, I set to Recycle bin.
Yes, the sync the sync was complete. Succesful. As I commented before I been using this sync for more than a year withour any problem. But this was a disaster.

The info I lost has a lot of value and unfortunately the last backup was a couple of weeks ago.
So I really need to recover this.
This far, what I am understanding is that when FFS delete files, they send to Recycle bin windows folder. But if it is big enough, it will definitively erase that. So... as FFS make this tmp folder, with the structure nobody knows this far what is inside that, and save (in my case) 80GB of data, it is doing a real disaster. Cause if you can undelete this info because it is unusable (as seems to be in my case), the damage is much worst, because if FFS wouldn´t make that tmp folder, my date would be there intact. And I would recover with any undelete tool.
For me this nightmare has not sense at all.
Is the first time in my life I cant recover my lost info at all.
So frustrated.<
So I Insisted that it has to be a solution.
The data is there...

Thanks. Hope my answers helps with your help

[Ancient1966]

Is any way to contact people who developed this FFS?

[Zenju]

Recycle Bin deletion in FreeFileSync works as follows:
Instead of moving one file after another to the Windows Recycle Bin (which would be dog slow), FreeFileSync moves all these files to a temporary directory during sync (e.g. RecycleBin~5b04.ffs_tmp).
Just before the end of the sync, the files *inside* this directory are moved to the Windows Recycle Bin via a single API call (which is *much* faster). After that, the now empty RecycleBin~5b04.ffs_tmp is permanently deleted.

With regards to undeletion this means:
1. Either the files are still in the Recycle Bin, so you simply move them out,
2. or Windows decided to permantly delete some of them because the Recycle Bin hit its size limit. In this case undelete *might* work (to the extent that their data was not yet overwritten) for the [drive]:\$Recycle.Bin\<user SID> directory. However the original file names will be lost and changed to something cryptic (e.g. $ITN5FCC.txt), because this is what Windows Recycle Bin does, for some reason.
BTW: Linux' and macOS' recycle bin don't rename files, which is a lot smarter.

[Ancient1966]

Hi Zenju.
Some light at the end of the tunnel.
Thanks a lot for your cristal clear explanation.
Actually I discover today with the recover tool of the Recycle Bin windows folder, that there are thousands of that $xxxxx.xxx strange name files.
I have to analyze deeper. But most of those files are unrecognizable too.

So, following your explanation I would have 2 chances of undelete those files: recylcing windows directory or recylying FFS directory.

What I would be really useful here is to have a good repair tool. Cause for some reason I don’t understand yet, most files even they are healthy, including size, extension, etc, are not readable.
Most of the files are: mov, pdf, doc and jpg.

Thanks a lot!!

[Zenju]

It's probably 15 years since I last needed to restore deleted files. Back in the day "GetDataBack for NTFS" was the only tool that worked for me.