Switch to full style
In-depth technology research: finding new ways to recover data, accessing firmware, writing programs, reading bits off the platter, recovering data from dust.

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...
Post a reply

Oh well

February 21st, 2016, 0:40

So, here's the thing:

This week a drive came in and this was the customer story:

Computer rebooted and ran chkdsk, upon starting outlook, he realized his .pst file has gone from 8GB to 0KB.
Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.

After imaging the disk I ran a raw recovery, but no .pst files except the 0KB one was found.

Should I just give up or try something else ?

Re: Oh well

February 21st, 2016, 3:56

In my experience, one that size will never be recovered. I guess you could look in the FOUND.000 folder at the .CHK files and see if there is an 8GB one, but I seriously doubt you will have luck with this one

Re: Oh well

February 21st, 2016, 4:46

DRUG wrote:Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.


why you think it is overwritten, did customer use drive after this happen or create new data on the drive ?

atleast partial recovery should be possible. 8GB is alot sectors.
btw did you try more than 1 software for raw recovery ?

Re: Oh well

February 21st, 2016, 8:13

but a partial recovery on a .pst? is that going to be useful? I don't know the format, so maybe a tool can pull out individual .eml files or something, but it is probably going to be one of those jobs...

Re: Oh well

February 23rd, 2016, 11:16

I've cloned the disk with MRT, then scanned the image with r-studio, gdb, etc. Only found one, the 0KB file, i believe chkdsk did this :s

Re: Oh well

February 23rd, 2016, 11:33

Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?. :lol:

Re: Oh well

February 23rd, 2016, 11:41

data-medics wrote:Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?. :lol:


What's making me mad is that the file wasn't even deleted but somehow overwritten to go from 8GB to 0KB :'(

This was such a important client for us. MEH.

Re: Oh well

February 23rd, 2016, 20:52

Magical update.

After running all some other recovery software I was able to find at raw files some .pst's

They weird thing is that I have 2 pst folders, with 4x 3GB files and 4x 1GB files. (some of the files have recent e-mails, but that's no good enough, im not sure if its the software I'm using or something else, but I'll give it some more shots.)

Does anyone know a good pst viewer /scanner ?

Re: Oh well

February 23rd, 2016, 21:10

Zmail...

Re: Oh well

February 24th, 2016, 10:58

arvika wrote:Zmail...


ZMail -- open source email software used to send fake emails ?

Re: Oh well

February 24th, 2016, 13:04

http://www.z-a-recovery.com/extras/news.aspx
But they probably remove from download section - maybe close the project?

Re: Oh well

February 24th, 2016, 13:16

@arvika according to link..., I don't think it supports .PST files

Re: Oh well

February 24th, 2016, 14:37

It support pst file.
Attachments
zmeil21setup.zip
(1.4 MiB) Downloaded 862 times

Re: Oh well

February 24th, 2016, 21:57

Oh, that's from ZAR!

I've tried it anyways, and after loading the files pops up a error message saying outlook can't open the files.

CHKDSK criminal.

Re: Oh well

February 25th, 2016, 6:34

http://www.techrepublic.com/blog/five-a ... air-tools/

btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.

Re: Oh well

February 25th, 2016, 14:47

MindMergepk wrote:http://www.techrepublic.com/blog/five-apps/five-reliable-outlook-pst-file-repair-tools/

btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.



What is your idea ?

Re: Oh well

February 27th, 2016, 10:06

pm sent. :)

Re: Oh well

March 2nd, 2016, 10:32

Problem still not solved, I mean, not fully, 10% of the info recovered.

I might outsource this if someone feels like it.

Re: Oh well

March 6th, 2016, 9:05

i can take a look remotely.
PM me if interested.
Post a reply