Recovery of deleted files is done automatically by the SleuthKit when Autopsy runs it.
You can, however, choose to ignore orphan files in FAT file systems, where orphan files are defined in this context as deleted files that still have file metadata in the file system, but that cannot be accessed from the root directory. Note that FAT file system orphan files are not ignored by default, and recovering them can take some time. The setting is not a module setting, it is a data source processor setting on the “Select Data Source” page of the “Add Data Source” wizard, if you select “Disk Image or VM File” on the “Select Type of Data Source to Add” page of the wizard. You might want to think about this if you are examining FAT file systems.
When you apply an extension based file filter to an ingest job, all files with the specified extension(s) will be passed through the filter and included in the analysis, whether deleted or not. Note that the conditions (name, folder name, modified time) in a file filter rule are AND’ed together to determine which files satisfy the rule, and the rules are OR’ed together to determine which files pass through the filter.
If you cancel an ingest job, whatever has been written into the case database and the text index up to that point is what you get - the partial results are not deleted.
To cancel an ingest job, use the progress bars in the lower right hand corner of the main application window. There may be multiple tasks to cancel, including a separate keyword search task. There will likely be a slight to modest delay while the current tasks finish what they were doing. This is because you cannot force kill threads of execution in Java and Autopsy is primarily a Java application; you can only notify tasks running in threads that they should terminate as soon as it is safe to do so. It is conceivable that a “stuck” analysis task may not respond to a cancellation request. If this happens, your only recourse is to kill the process that owns the thread, i.e., shut down Autopsy. If this happens it is unfortunate, but not the end of the world if you are just trying to cancel an ingest job. It is also possible in rare circumstances for the Autopsy process itself to become become hung and for you to be unable to shut it down without resorting to the Task Manager. Note that it is easy to do this on Windows 10; in older versions of the Task Manager you will need to kill off the Solr server process spawned by the Autopsy process separately. Unfortunately, if it comes to this, the Solr server process will be identified only as Java™ Platform SE Binary, and some discernment is required. Of course, in such an extremity, it may be an option to simply reboot the machine.