Help with DE

[mr_spokk]

Hi to you all
I need to get 3 documents out of a drive, the one marked in red on the picture.
The only place I can even see these documents are in DE...I have tryed GDB with no luck.
When I try to copy them from DE I only get a error, because there is no start and offset I'll think.
Is there any way to retrive those documents, any input is most welcome.

[img]

Best Regards

Bosse

Attachments

[darkforce1]

Try Winhex.

DF

[Starling]

I would advise you find documentation on structure of NTFS (here for example: http://downloads.sourceforge.net/linux- ... g_mirror=1) and see what's wrong with those MFT records you are trying to work with.

[sceggy]

Deleted files or corrupt $MFT!!!

$MFT sector results look interesting!!! Winhex would be a good starting point. Alternatively the post-ceding word files may have remnants or even "track changes" feature built-in, avoiding the need to recover?

scegs

[mr_spokk]

Thanks for your replys.
I found the files in Winhex, but as i'm a total newbee on that progam I need some help and guidens.
What would be the next action?

[img][/img]

Best Regards

Bosse

Attachments