A computer components & hardware forum. HardwareBanter

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Go Back   Home » HardwareBanter forum » General Hardware & Peripherals » Storage (alternative)
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

a hairy file recovery problem



 
 
Thread Tools Display Modes
  #1  
Old July 11th 03, 05:39 PM
Brian Milliron
external usenet poster
 
Posts: n/a
Default a hairy file recovery problem

I am trying to recover a partially overwritten file and am looking for
any tools or tips to assist me in this. *Any* suggestions or advice
is appreciated.
This is how it went down...

I had a hard windows crash while in the midst of sending an email.
Normally this is not a problem and Eudora will even recover the draft
email for me. This time my outbox (including all sent emails for the
past 7 years!) was deleted. Scandisk ran on reboot, but I didn't
really pay attention to it at the time. I didn't realize what had
happened because I didn't go back into email right away, instead I
surfed the net and even downloaded a 3Mb file (Doh!). When I realzied
what happened I checked the scandisk log, my internet history file
size was being misreported (fixed) and 4096 bytes of lost file was
deleted. I was greatly hoping that my outbox would have been found as
a lost file, but as it was around 8Mb in size I don't that 4kb file
was it.

I am puzzled how a file append operation could end up deleting the
whole file, but that seems to be what happened. I spent all last
night unencrypting my hard drive so I could use hex tools to view the
raw data. At this point I am guessing that the FAT table entry was
removed or the directory size listing set to 0 bytes or some
combination of both. Probably the cache files from my internet
surfing and the download have overwritten around half of the file,
though maybe I'll be really lucky and they were put somewhere else.

I have some data recovery experience, though never with overwritten
files. I think my best chance (if any) is to try to recreate the
entry in FAT by hand, as arduous and time consuming a process as that
is. The only tool I currently have is the old DOS version of Norton
Utilities, including disk doctor and disk editor. I don't think they
support FAT32 however, so I need to find something that does. It
would be a simple undelete procedure except for the possible
overwriting (since it is text at least something should be salvagable)
but for the fact that the directory entry was altered. The last time
I used undelete it didn't show past versions of the same file, so if
the directory entry was overwritten by a file with the same name then
it couldn't be undeleted. Does anyone know of any tools that are up to
this task? At the very least there should be some new hex disk
viewers that can handle fat 32 right? I tried checking out nortons
new disk utilities ver 2002, but couldn't find any info on
capabilities on thier website.

Help please?
Much thanks,
Brian

PS - After looking through the entire usenet comp.* tree this is the
best group I could find for this question. If anyone knows a better
place to ask, please let me know.
 




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Please Help - Driver Update Problem Michael Enzweiler Nvidia Videocards 2 January 15th 05 04:34 PM
Nero help needed foghat Cdr 0 May 31st 04 08:23 PM
Precision 650/XP - Problem with open file dialog Christopher Muto Dell Computers 1 January 16th 04 06:47 PM
Help! - The dreaded buffer underrun XPG Cdr 5 August 31st 03 06:27 PM
Large file UDF problem ayosha Cdr 7 August 11th 03 08:36 AM


All times are GMT +1. The time now is 08:57 PM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2004-2024 HardwareBanter.
The comments are property of their posters.