Recovery tool doesn't find first cluster

  • Thread starter Thread starter Georges
  • Start date Start date
G

Georges

Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.

I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".

Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.

"DiskExaminer" showed, that the first cluster of all 4 files was not found.

The data must still be on this disk!

What can I do to get the files back?

Many thanks!
 
Hi.
By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.
...
Click to expand...

Nobody having ay idea? ;)
I urgently need the files back within the next 24 hours. ;((

Thanks,
 
Previously Georges said:
Hi.
Click to expand...
By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.
Click to expand...
I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".
Click to expand...
Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.
Click to expand...
"DiskExaminer" showed, that the first cluster of all 4 files was not found.
Click to expand...
The data must still be on this disk!
Click to expand...
What can I do to get the files back?
Click to expand...

First, if the files are important, make an image (sector-wise)
backup of the drive and work only on that copy. Otherwiese you
may do additional damage in your recovery atempts.

Arno
 
Previously Georges Heinesch said:
Hi.
Click to expand...
Georges wrote:
Click to expand...
Nobody having ay idea? ;)
I urgently need the files back within the next 24 hours. ;((
Click to expand...

Then you should urgently acontact a professional data recovery
company. They might be able to help in this time frame,
but it will be paionfully expensive.

Arno
 
Georges said:
Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access.
Click to expand...

How was this accomplished?
I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".

Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.
Click to expand...

Correct, your assumption was incorrect.
"DiskExaminer" showed, that the first cluster of all 4 files was not
Click to expand...
found.

What's that?
The data must still be on this disk!
Click to expand...

Says who? I wouldn't be that optimistic.

Joep
 
Joep said:
How was this accomplished?
Fingetrouble!


Correct, your assumption was incorrect.
Click to expand...

If you know the interna of NTFS, please explain what could poiibly
overwrite declared empty clusters (the ones used by the deleted files)?
What's that?
Click to expand...

A disk examination program. It checks the NTFS entries.
Says who? I wouldn't be that optimistic.
Click to expand...

I didn't write to the disk, and to the best of my knowledge, Windows
2000 didn't ether. There is no pagefile.sys on the disk, and it's a pure
data disk which contains only files not accessed by Windows (only by the
user).

Perhaps Windows accesses this partition for some other reason (write
access9, but I have no clue what this could possibly be. Hence my
article in this newsgroup. Perhaps someone knows what couöd have been
written to the disk.

Bye,
 
Georges Heinesch said:
If you know the interna of NTFS, please explain what could poiibly
overwrite declared empty clusters (the ones used by the deleted files)?
Click to expand...

Anything / everything can write to those clusters. It is also my observation
that those deleted last will be re-used first a lot of times.
A disk examination program. It checks the NTFS entries.
Click to expand...

Yes I figured it was something like that. URL please!
I didn't write to the disk, and to the best of my knowledge, Windows
2000 didn't ether.
Click to expand...

Have you ever examined the amount of read/writes to volumes while doing
nothing? You'll be amazed.
Perhaps someone knows what couöd have been
written to the disk.
Click to expand...

Does it matter?
 
Rod said:
He meant how did you ensure that there was no write access to the drive ?
Click to expand...

Oupss ... ;)
Thats not as easy to ensure as you might think.
Click to expand...

Well, since the partition is not a system partition and there is no
pagefile.sys on it, I reckon that just not writing any file to the disk
would leave the deleted clusters (which used to be the deleted files)
intact.

I guess from your reaction, that you think there might have been
unintentional write access to the disk (not triggered by the user). If
so, please explain what could have been written to the disk by Windows 2000?

Many thanks,
 
Joep said:
Anything / everything can write to those clusters. It is also my observation
that those deleted last will be re-used first a lot of times.
Click to expand...

I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were deleted.
Yes I figured it was something like that. URL please!
http://www.runtime.org/diskexpl.htm


Have you ever examined the amount of read/writes to volumes while doing
nothing? You'll be amazed.
Click to expand...

Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.
Does it matter?
Click to expand...

Out of interest.

Thanks,

Bye,
 
Georges Heinesch said:
I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were
deleted.


Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.
Click to expand...

I have noticed the effect with a physical drive I use for video capture/PVR.

If you manually delete the file, once its been watched,
and then immediately decide that there was something
in it that you had not in fact watched, for some reason
you cant just undelete it using any of the normal recovery
programs like Easy Recovery Pro. You get the same
effect you are seeing, the name is visible, but 0 length.

I know for a fact that nothing has been written to that
drive by anything I am running between the delete and
the attempt to undelete the file, so its not at all clear
just what is happening there and I havent had a chance
to have a closer look at exactly what is going on there.
 
Rod said:
...
I have noticed the effect with a physical drive I use for video capture/PVR.

If you manually delete the file, once its been watched,
and then immediately decide that there was something
in it that you had not in fact watched, for some reason
you cant just undelete it using any of the normal recovery
programs like Easy Recovery Pro. You get the same
effect you are seeing, the name is visible, but 0 length.

I know for a fact that nothing has been written to that
drive by anything I am running between the delete and
the attempt to undelete the file, so its not at all clear
just what is happening there and I havent had a chance
to have a closer look at exactly what is going on there.
Click to expand...

You got exactly to the same point I did !
My lack NTFS knowledge doesn't allow me to dig further!

Bye,
 
Georges Heinesch said:
I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were deleted.


Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.


Out of interest.
Click to expand...

And by now you know how that answer was to dodge the question.
 
Back
Top