FreeFileSync incident on 12 August 2026 – possible recovery of files from RecycleBin~*.ffs_tmp

[Novice31]

Hello,

I am trying to understand what happened during a FreeFileSync synchronization on **12 August 2026**, and especially whether some files can still be recovered.

The affected source was:

`D:\famille`

The FreeFileSync session started at approximately **17:21 on 12 August 2026** and ended with errors.

According to the FreeFileSync log:

* 33,622 elements were processed
* 12.6 GB were involved
* 17 errors occurred
* the synchronization lasted about 21 minutes
* several operations reported `ERROR_ACCESS_DENIED` or `SHARING_VIOLATION`
* the log contains failed `MoveFileEx` operations involving paths such as:
`D:\famille\Assu_Achats_eau_gaz_tel`
`D:\famille\Divers vacances`
`D:\famille\Véhicules\2026 04 DACIA Nouveau JOGGER Tof`
* some Excel files were also reported as locked because Microsoft Excel was using them.

For example, the log showed attempted moves such as:

`D:\famille\Assu_Achats_eau_gaz_tel`
→
`D:\RecycleBin~4a40.ffs_tmp\famille\Assu_Achats_eau_gaz_tel`

with `ERROR_ACCESS_DENIED: Access is denied. [MoveFileEx]`.

Those particular MoveFileEx operations were reported as errors, so they apparently did not complete at that time.

I later found another directory on D:

`D:\RecycleBin~25da.ffs_tmp`

It contains a large `famille` directory structure. However, I have not modified or deleted anything in it.

I also checked the normal Windows Recycle Bin and could not find the missing files there.

I have since used Windows File Recovery (WFR) to recover data to a **different physical drive (F:)**. It recovered 12,689 files. I have not restored anything back onto D:.

Interestingly, among the recovered files:

* 6,919 have a filename matching a file currently present in `D:\famille`
* 6,908 also have the same file size
* 54 were confirmed byte-for-byte identical using SHA-256.

I am therefore trying to determine whether there is still a way to recover **older versions or files that may have been moved/deleted during the 12 August FreeFileSync operation**, particularly from any `RecycleBin~*.ffs_tmp` structure or from the underlying NTFS filesystem.

I have deliberately avoided writing new data to D: during the recovery investigation.

My questions are:

1. Does the presence of `D:\RecycleBin~25da.ffs_tmp` indicate that FreeFileSync was interrupted while processing files?
2. Could files inside such a directory represent files that FreeFileSync intended to move to the Windows Recycle Bin?
3. Is there any FreeFileSync-specific method to reconstruct or recover files from such a directory?
4. Could the FreeFileSync database, logs, or synchronization metadata help determine exactly which files were supposed to be moved?
5. Given that the failed `MoveFileEx` operations were reported as errors, is it possible that some files were nevertheless moved elsewhere during the same synchronization?
6. Would you recommend using a forensic recovery tool such as DMDE, R-Studio or UFS Explorer to search the NTFS volume for previous versions of the missing files?

I would appreciate any advice before I perform any further recovery operation.

Thank you.