Quick scan or deep scan? What each one does, and when to use it

Every recovery tool offers two modes, usually labelled something like quick and deep, and the naming makes them sound like the same scan at two speeds. They are not. They read different data, succeed in different situations, and give you results of very different quality.

Knowing which is which tells you what to expect before you start.

The quick scan reads the filesystem’s records

A filesystem keeps a catalogue: for every file, its name, its folder, its size, its dates, and the list of places on the drive where its contents live.

When you delete a file, that entry is usually not erased. It is marked unused. NTFS clears an “in use” flag in the MFT record. exFAT and FAT32 overwrite the first character of the name and release the cluster chain. In each case most of the record survives, sitting in place until something needs the space.

A quick scan reads those leftover records. That is why it gives you so much back:

• Real filenames, not carved-00001.jpg.
• The original folder structure.
• Correct sizes and dates.
• Fragmented files in one piece, because the record says where every piece was. This matters more than it sounds - see below.
• Speed. It reads a catalogue, not the whole disk. Minutes, not hours.

Its requirement is simple and absolute: those records must still exist. If the drive was reformatted, or the filesystem is too damaged to parse, there is nothing for it to read.

Quick scan covers NTFS, exFAT and FAT32 from Windows, and APFS and HFS+ from a Mac.

The deep scan reads the raw surface

A deep scan ignores the filesystem completely. It reads the drive sector by sector from beginning to end, looking for the signatures that mark the start of a known file type - the bytes FF D8 FF that begin every JPEG, the %PDF- that begins every PDF - then works out where each file ends and pulls it out.

This is called carving, and it depends on nothing but the data itself. Which is exactly why it works when nothing else does:

• After a format, quick or full-ish, because the contents were never touched.
• On a drive with no readable filesystem at all - RAW, corrupt, or one that no operating system will mount.
• On any filesystem, including ones nothing supports, because it never parses one.

What it costs you:

• No names. Files come back numbered, because there is no record to read a name from. A thousand recovered photos arrive as a thousand numbered photos.
• No folders and no dates, for the same reason.
• Only known file types. Carving needs to recognise the format. Photos (JPEG, PNG, GIF, BMP, HEIC), camera RAW (CR2, CR3, NEF, ARW, DNG, PEF, RAF), video (MP4, MOV, AVI, MKV, WEBM, MTS, MPEG), audio (MP3, FLAC, WAV, OGG) and documents and archives (PDF, DOCX, XLSX, PPTX, DOC, XLS, PPT, ZIP) are covered. An obscure proprietary format is not.
• Time. It reads every sector of the drive. A large disk is an overnight job on a phone.

Fragmentation: the real difference

This is the part that decides quality, and it is rarely explained.

A file is not necessarily stored in one continuous run. The filesystem puts it wherever there is space, so a large file written to a busy drive can be split into pieces scattered across the surface.

A quick scan does not care. The record lists every piece, in order, so the file is reassembled exactly.

A carve has no such list. It finds a header and has to guess where the file ends, and the natural guess is “keep reading forward until the end marker”. If the file was fragmented, reading forward runs straight into somebody else’s data, and you get a file that starts correctly and turns to noise partway through.

The app detects and reassembles fragmented JPEG, PNG, MP4 and MOV files rather than truncating them at the first break, which covers the formats people usually care most about. It is not a universal solution, and a badly fragmented file of another type can still come back incomplete. The quality label tells you which happened.

This is the single strongest argument for running the quick scan first, and for not formatting a drive before you recover it.

Which to run

Run the quick scan first, always. It is fast, and when it works the results are far better. There is no cost to trying it.

Run the deep scan when the quick scan finds nothing or misses what you wanted, the drive was formatted, or nothing will mount the drive at all.

You can run both. Files found by the quick scan keep their names; anything only the deep scan finds arrives numbered alongside them.

A useful middle case

Formatting a drive is not always the total loss it sounds like. When a drive is reformatted, the old filesystem’s records are often still physically present - the new, empty filesystem is small and only overwrites the start of the drive.

The app looks for those leftover records during a deep scan, which means files from a reformatted drive can sometimes come back with their original names rather than as numbered carvings. It depends on how much the new filesystem overwrote and what it was reformatted to, so treat it as a bonus rather than a promise.

One exception worth knowing: on APFS, a quick scan reaches back through the drive’s recent history only, and a Mac that reformats the drive erases those records for good.

Either way, preview before you pay

Both scans show every recoverable file as a full-size preview for free, and grade each one intact, partly overwritten or likely gone. That is the point at which you find out whether the recovery worked - before spending anything, not after.

Start with a free scan.