In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.
Forum rules
Please
do not post questions about data recovery cases here (use
this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
February 21st, 2016, 0:40
So, here's the thing:
This week a drive came in and this was the customer story:
Computer rebooted and ran chkdsk, upon starting outlook, he realized his .pst file has gone from 8GB to 0KB.
Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.
After imaging the disk I ran a raw recovery, but no .pst files except the 0KB one was found.
Should I just give up or try something else ?
February 21st, 2016, 3:56
In my experience, one that size will never be recovered. I guess you could look in the FOUND.000 folder at the .CHK files and see if there is an 8GB one, but I seriously doubt you will have luck with this one
February 21st, 2016, 4:46
DRUG wrote:Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.
why you think it is
overwritten, did customer use drive after this happen or create new data on the drive ?
atleast partial recovery should be possible. 8GB is alot sectors.
btw did you try more than 1 software for raw recovery ?
February 21st, 2016, 8:13
but a partial recovery on a .pst? is that going to be useful? I don't know the format, so maybe a tool can pull out individual .eml files or something, but it is probably going to be one of those jobs...
February 23rd, 2016, 11:16
I've cloned the disk with MRT, then scanned the image with r-studio, gdb, etc. Only found one, the 0KB file, i believe chkdsk did this :s
February 23rd, 2016, 11:33
Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?.
February 23rd, 2016, 11:41
data-medics wrote:Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?.
What's making me mad is that the file wasn't even deleted but somehow overwritten to go from 8GB to 0KB :'(
This was such a important client for us. MEH.
February 23rd, 2016, 20:52
Magical update.
After running all some other recovery software I was able to find at raw files some .pst's
They weird thing is that I have 2 pst folders, with 4x 3GB files and 4x 1GB files. (some of the files have recent e-mails, but that's no good enough, im not sure if its the software I'm using or something else, but I'll give it some more shots.)
Does anyone know a good pst viewer /scanner ?
February 23rd, 2016, 21:10
Zmail...
February 24th, 2016, 10:58
arvika wrote:Zmail...
ZMail -- open source email software used to send fake emails ?
February 24th, 2016, 13:04
http://www.z-a-recovery.com/extras/news.aspxBut they probably remove from download section - maybe close the project?
February 24th, 2016, 13:16
@arvika according to link..., I don't think it supports .PST files
February 24th, 2016, 14:37
It support pst file.
- Attachments
-
- zmeil21setup.zip
- (1.4 MiB) Downloaded 862 times
February 24th, 2016, 21:57
Oh, that's from ZAR!
I've tried it anyways, and after loading the files pops up a error message saying outlook can't open the files.
CHKDSK criminal.
February 25th, 2016, 6:34
http://www.techrepublic.com/blog/five-a ... air-tools/btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.
February 25th, 2016, 14:47
MindMergepk wrote:http://www.techrepublic.com/blog/five-apps/five-reliable-outlook-pst-file-repair-tools/
btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.
What is your idea ?
February 27th, 2016, 10:06
pm sent.
March 2nd, 2016, 10:32
Problem still not solved, I mean, not fully, 10% of the info recovered.
I might outsource this if someone feels like it.
March 6th, 2016, 9:05
i can take a look remotely.
PM me if interested.
Powered by phpBB © phpBB Group.