Gurus,

A client had an external hard drive that was clicking in its enclosure, but behaving normally when connected to my imager. Imaged everything over with no problems, but now we are having file corruption issues with his .eps files (Adobe Illustrator). Some smaller files will open fine, but anything over say 5 MB is having issues. Tried opening them in Illustrator, IrfanView, and a freeware EPS viewer, with no luck. Anyone have any software that may be of use here?

Shawn

It sounds like they are actually corrupt, meaning the data contained in each file is either missing, mixed up filesystem wise, or file is made up of data not belonging to that file. I have found it difficult to do anything with this sort of damage, and only real solution is to get a better recovery. Those sort of formats need all their data.

With what did you image the drive? Were all sectors read without error? No Read Ignoring ECC sectors, right? When you look at the files in a hex editor, do the headers look right? What about other files, is it just the .eps files or are there other file extensions that are messed up?

_________________
Luke
Recovery Force Data Recovery

Imaged the drive with Atola Insight, some of the .eps files do open up, but most do not. I did look at the files in WinHex and Notepad and the header information looks ok. I am going to see about running the code in Ghost Script to see what errors I might get.

you could try and get into the files format and see if the files are in fact corrupt:
http://asecuritysite.com/forensics and in particular http://asecuritysite.com/forensics/eps
this site is awesome BTW.


don't know if this is any help - says validating .eps files is very loose:
http://echoone.com/filejuicer/ReadMe

or this tool may help:
http://www.osforensics.com/file-viewer.html

get into the weeds with resources and ideas from:
https://www.blackhat.com/presentations/bh-usa-08/Conti_Dean/BH_US_08_Conti_Dean_Visual_Forensic_Analysis.pdf
http://www.sans.org/reading-room/whitepapers/forensics/data-carving-concepts-32969

depends how far you want to go for the return you are going to get..