Dear Gurus,

XP launched a chkdsk at boot on one of my partitions. After that, I noticed that one file (mdp.xlsx) has been lost on this partition (i.e. not accessible via explorer).

I found these lines in the log of chkdsk (bootex.log)

"The file reference 0x3000000003d66 of index entry mdp.xlsx of index $I30
with parent 0x39e8 is not the same as 0x1000000003d66.
Deleting index entry mdp.xlsx in index $I30 of file 14824.
The file reference 0x3000000003d66 of index entry MDP~1.XLS of index $I30
with parent 0x39e8 is not the same as 0x1000000003d66.
Deleting index entry MDP~1.XLS in index $I30 of file 14824.
"

I have tried to recover this file by using R-studio demo with a scan on the partition. I selected the option "Search for Known file type" xlsx and xls.
However, it did not find the record of my file.

Is there a way to know where this file was stored (I mean the physical address of the sectors), to investigate (with an hex editor?) what is written there? Can one revert in some way the effect of chkdsk?

Thanks for any help.

There is some help on this one on the internet. You can do a search. You will find information such as this one on your problem.

http://www.ehow.com/how_5183262_restore-chk-files.html

http://recover.software.informer.com/do ... hkdsk-chk/

http://www.tomshardware.com/forum/59701 ... 0000-files

Use Google and search on this one. You will find a lot of information on this subject and should find your answer on how to get back what you are looking for on this one. This is only a few links that came up in a very quick search on this one.

_________________
Iorana Haraharaini

check the chkdsk folder that it should of created on your hard drive. The file may be there in a filcheck file. If it created one. These folders are hidden by default so you will need to change your windows options to show hidden folders.

if it is the it may be called something like filechk.001 if so try and open it in excel and see if it opens.

Thanks for your comments.

First CHKDSK did not create files containing my lost excel file.

However, I retrieved my file manually from my drive F:

1) I used R-studio demo to list any .xlsx file on my drive F.
2) I have noticed that the .xlsx files that are stored on another drive contain two occurences of the ASCII string: xl/worksheets/sheet1.xml. I used this pattern as a signature for any .xlsx file .
3) I thus scanned the drive F with the hex editor provided by R-studio demo, and looked for any occurence of this string.
4) I also scanned with the hex editor every xlsx file found in 1).
5) Comparing the adresses obtained in 3) and 4), I could determine which occurences of the string did not belong to an identified file.
6) Then looking closely at the remaining occurences, and comparing the records around them with the structure of a typical .xlsx file edited with the hex viewer, I could find the beginning and the end of each file record.
7) I finally saved these bytes in a new file which opened nicely with Excel.


All this took me 6 hrs.

I guess that all this worked fine because there were not too many xlsx files on my drive and because the file I was looking for was small (10 KB) and not fragmented.

Thanks again for your help

Good work

_________________
You don't have to backup all of your files, just the ones you want to keep.