All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: o bytes file
PostPosted: July 28th, 2014, 4:43 
Offline

Joined: July 20th, 2011, 9:02
Posts: 91
Hello,

Major JPG files in folders showing 0 bytes .
Root folders size is 64 GB (as user says) but now showing only 4 gb.
Many jpg files showing 0 bytes file size. i tried raw recovery also but raw recovery also showing 4 gb data.

Any suggestions

Thanks in advance


Top
 Profile  
 
 Post subject: Re: o bytes file
PostPosted: July 28th, 2014, 7:29 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
If RAW recovery does pull out files, and the files are 0 bytes, I think game over.

Have you taken an image of the drive and looked at it in a HEX editor? Is there anything that looks like a complete jpeg header in there?

What happened to cause this? RAW recovery performed with what?

filesystem FAT/NTFS/other? I am not liking the sounds of it though :(


Top
 Profile  
 
 Post subject: Re: o bytes file
PostPosted: July 28th, 2014, 11:39 
Offline

Joined: July 20th, 2011, 9:02
Posts: 91
No raw recovery does not show files.If i check directly in specific folder its showing me files of 0 Bytes.
if i tried copy through DE its saying Saving process complete but that file does not appears in destination folder.
if opned directly says Error FillDirNew() -> Can't create map! Runs Count is not found or is equal to 0!
if i open this file in winhex shows empty(1.Jpg)
Cause : user saying while copying file i observed this issue.
File System NTFS


Attachments:
1.JPG
1.JPG [ 7.89 KiB | Viewed 5447 times ]
Top
 Profile  
 
 Post subject: Re: o bytes file
PostPosted: July 28th, 2014, 16:46 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 14945
Location: Australia
Locate the starting cluster/sector for DSC05918.JPG and then examine that sector in your hex editor.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: o bytes file
PostPosted: July 28th, 2014, 17:19 
Offline

Joined: July 20th, 2011, 9:02
Posts: 91
this is first sector


Attachments:
1.zip [275 Bytes]
Downloaded 330 times
2.JPG
2.JPG [ 156.64 KiB | Viewed 5427 times ]
Top
 Profile  
 
 Post subject: Re: o bytes file
PostPosted: July 28th, 2014, 20:40 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
maybe malware?


Top
 Profile  
 
 Post subject: Re: o bytes file
PostPosted: July 29th, 2014, 17:48 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 14945
Location: Australia
The way I would approach this problem would be to locate the file's INDX and MFT records, and then examine their structure. For example, there are separate fields for the file's real size and the space it actually occupies.

A 1-byte file would occupy one cluster, which is typically 4096 bytes. However, I don't know what to expect for a genuine 0-byte file under NTFS. Under FAT32 such files are not assigned to any cluster, so the actual occupied space is 0 bytes.

I would start by comparing a real 0-byte file against the suspect ones. To this end you could create such a file using the following command at the CMD prompt:

rem > zerobyte.bin

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group