All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 19 posts ] 
Author Message
 Post subject: Oh well
PostPosted: February 21st, 2016, 0:40 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
So, here's the thing:

This week a drive came in and this was the customer story:

Computer rebooted and ran chkdsk, upon starting outlook, he realized his .pst file has gone from 8GB to 0KB.
Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.

After imaging the disk I ran a raw recovery, but no .pst files except the 0KB one was found.

Should I just give up or try something else ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 21st, 2016, 3:56 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
In my experience, one that size will never be recovered. I guess you could look in the FOUND.000 folder at the .CHK files and see if there is an 8GB one, but I seriously doubt you will have luck with this one


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 21st, 2016, 4:46 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 831
Location: Pakistan
DRUG wrote:
Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.


why you think it is overwritten, did customer use drive after this happen or create new data on the drive ?

atleast partial recovery should be possible. 8GB is alot sectors.
btw did you try more than 1 software for raw recovery ?

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 21st, 2016, 8:13 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
but a partial recovery on a .pst? is that going to be useful? I don't know the format, so maybe a tool can pull out individual .eml files or something, but it is probably going to be one of those jobs...


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 23rd, 2016, 11:16 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
I've cloned the disk with MRT, then scanned the image with r-studio, gdb, etc. Only found one, the 0KB file, i believe chkdsk did this :s

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 23rd, 2016, 11:33 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?. :lol:

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 23rd, 2016, 11:41 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
data-medics wrote:
Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?. :lol:


What's making me mad is that the file wasn't even deleted but somehow overwritten to go from 8GB to 0KB :'(

This was such a important client for us. MEH.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 23rd, 2016, 20:52 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
Magical update.

After running all some other recovery software I was able to find at raw files some .pst's

They weird thing is that I have 2 pst folders, with 4x 3GB files and 4x 1GB files. (some of the files have recent e-mails, but that's no good enough, im not sure if its the software I'm using or something else, but I'll give it some more shots.)

Does anyone know a good pst viewer /scanner ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 23rd, 2016, 21:10 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
Zmail...

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 24th, 2016, 10:58 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
arvika wrote:
Zmail...


ZMail -- open source email software used to send fake emails ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 24th, 2016, 13:04 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
http://www.z-a-recovery.com/extras/news.aspx
But they probably remove from download section - maybe close the project?

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 24th, 2016, 13:16 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1387
Location: isreal
@arvika according to link..., I don't think it supports .PST files


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 24th, 2016, 14:37 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
It support pst file.


Attachments:
zmeil21setup.zip [1.4 MiB]
Downloaded 862 times

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 24th, 2016, 21:57 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
Oh, that's from ZAR!

I've tried it anyways, and after loading the files pops up a error message saying outlook can't open the files.

CHKDSK criminal.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 25th, 2016, 6:34 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 831
Location: Pakistan
http://www.techrepublic.com/blog/five-a ... air-tools/

btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 25th, 2016, 14:47 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
MindMergepk wrote:
http://www.techrepublic.com/blog/five-apps/five-reliable-outlook-pst-file-repair-tools/

btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.



What is your idea ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: February 27th, 2016, 10:06 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 831
Location: Pakistan
pm sent. :)

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: March 2nd, 2016, 10:32 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal
Problem still not solved, I mean, not fully, 10% of the info recovered.

I might outsource this if someone feels like it.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Oh well
PostPosted: March 6th, 2016, 9:05 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 831
Location: Pakistan
i can take a look remotely.
PM me if interested.

_________________
Data Recovery Pakistan


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 19 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 15 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group