If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
a hairy file recovery problem
I am trying to recover a partially overwritten file and am looking for
any tools or tips to assist me in this. *Any* suggestions or advice is appreciated. This is how it went down... I had a hard windows crash while in the midst of sending an email. Normally this is not a problem and Eudora will even recover the draft email for me. This time my outbox (including all sent emails for the past 7 years!) was deleted. Scandisk ran on reboot, but I didn't really pay attention to it at the time. I didn't realize what had happened because I didn't go back into email right away, instead I surfed the net and even downloaded a 3Mb file (Doh!). When I realzied what happened I checked the scandisk log, my internet history file size was being misreported (fixed) and 4096 bytes of lost file was deleted. I was greatly hoping that my outbox would have been found as a lost file, but as it was around 8Mb in size I don't that 4kb file was it. I am puzzled how a file append operation could end up deleting the whole file, but that seems to be what happened. I spent all last night unencrypting my hard drive so I could use hex tools to view the raw data. At this point I am guessing that the FAT table entry was removed or the directory size listing set to 0 bytes or some combination of both. Probably the cache files from my internet surfing and the download have overwritten around half of the file, though maybe I'll be really lucky and they were put somewhere else. I have some data recovery experience, though never with overwritten files. I think my best chance (if any) is to try to recreate the entry in FAT by hand, as arduous and time consuming a process as that is. The only tool I currently have is the old DOS version of Norton Utilities, including disk doctor and disk editor. I don't think they support FAT32 however, so I need to find something that does. It would be a simple undelete procedure except for the possible overwriting (since it is text at least something should be salvagable) but for the fact that the directory entry was altered. The last time I used undelete it didn't show past versions of the same file, so if the directory entry was overwritten by a file with the same name then it couldn't be undeleted. Does anyone know of any tools that are up to this task? At the very least there should be some new hex disk viewers that can handle fat 32 right? I tried checking out nortons new disk utilities ver 2002, but couldn't find any info on capabilities on thier website. Help please? Much thanks, Brian PS - After looking through the entire usenet comp.* tree this is the best group I could find for this question. If anyone knows a better place to ask, please let me know. |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Please Help - Driver Update Problem | Michael Enzweiler | Nvidia Videocards | 2 | January 15th 05 04:34 PM |
Nero help needed | foghat | Cdr | 0 | May 31st 04 08:23 PM |
Precision 650/XP - Problem with open file dialog | Christopher Muto | Dell Computers | 1 | January 16th 04 06:47 PM |
Help! - The dreaded buffer underrun | XPG | Cdr | 5 | August 31st 03 06:27 PM |
Large file UDF problem | ayosha | Cdr | 7 | August 11th 03 08:36 AM |