All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 2 posts ] 
Author Message
 Post subject: Salvaging something for corrupt recovered files
PostPosted: December 14th, 2017, 5:16 
Offline

Joined: December 14th, 2017, 5:15
Posts: 1
Location: United Kingdom
I recently realised that I'd overwritten some important photos on the original source and then foolishly "backed up" the redacted versions.

I've run some data recovery software on the hard drive and it has identified the exact file structure and files of the original drive. When I attempt to recover only a small portion of these are functioning files. The rest seem to be corrupted.

My question is, is there any chance of salvaging anything from these files or are they likely lost forever?

Any help much appreciated.

Thanks


Top
 Profile  
 
 Post subject: Re: Salvaging something for corrupt recovered files
PostPosted: December 16th, 2017, 11:01 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 142
Location: France
What kind of volume were those files on – NTFS, FAT32, other ?

You can try Photorec, which will “carve” every file it identifies based on its signature, with no regard to the filesystem's records which can be obsolete (in “File options” you can select which specific signatures you want it to search : for instance you can ask it to target JPG files only, if that's what you're looking for). It can get false-positives for certain file types, tough, even with JPG pictures the detection is not perfectly reliable (after all that's what the program was designed for originally, hence the name), but if it doesn't find the files you're looking for then you can be pretty confident (or dismayed) that they can't be recovered.

Recuva (in list display mode) tells you if a file which has been detected based on the volume's filesystem has been partially or totally overwritten, and by what other file – although it is not always reliable.

With R-Studio, you can right-click on any file in the recovery tree and select “View/edit” to open the hexadecimal viewer : if you don't see a valid header (for instance a JPG file always begins with “ÿØÿ”, or FF D8 FF), then at least the first sector has been overwritten. If the first sector has been overwritten, then it's virtually impossible to recover the file even partially (besides, if the first sector is overwritten there's a good chance that the rest is as well, as JPG files are quite small).
For further investigations : in the bottom left corner of the hex viewer, select the “properties” tab, then note the value given at the bottom in front of “Sector” (that's the first sector number). Then there are several methods I know of to determine what file currently occupies that sector :
– R-Studio using the “show files in hex editor” feature (but it's quite complicated)
– nfi.exe (command line tool)
– WinHex
– Defraggler (Piriform's defragmentation tool, which can provide a list of files occupying a given “block” – but so far it does not allow to directly input a sector number, I recently requested such a feature, which should be easy to implement)
(I provided detailed explanations here.)
Then with WinHex uou can open the recovered file (R) and the currently allocated file (A), search for a specific enough string from the begining of R inside A, then synchronize both windows and scroll down to verify how much of A is actually now part of what used to be R... and so on...


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group