Allegro.cc - Online Community

Allegro.cc Forums » Off-Topic Ordeals » Dead man Walking

This thread is locked; no one can reply to it. rss feed Print
Dead man Walking
type568
Member #8,381
March 2007
avatar

Before asking the question, I thought it might be interesting for someone, to know my tale, which could also be a hint, that I'll go quite far to achieve the intended.

I moved to vista x64, from xp x_86.. Everything went quite ok, except for some booting issues with vista. In the last 3 days, I reinstalled it just like 7 times..

Of course, before moving, I backed up my xp, to a norton ghost image. Then, I found out, that I can setup a hardware raid, of two hard disks. I moved the necessary data to the third(hard disk), installed everything, then started to move the data to the partitions I need it to be at. Including the the backup image.. But, after moving it.. I accidentally deleted a wrong folder. Usually, I remove all limits, to the size of recycle bin, but after creating new partitions (or perhaps, after installing fresh windows) they were reset to default. So, the backup got unpaged.

I tried like 5 programs to recover it:

Ultimate Data Recovery - looks like nice tool, although not free, didn't help.
File Scavenger - about same
Recover My Files didn't help
Undelete - same as first two
Undudelete - didn't help
undelete plus - Looks like awesome program, but: It claims the file was overwritten.
Raid Data Recovery - Very slow download, I'll try it..

Undelete plus, claims the file had been overwritten. In any case, I want it back, even partially. The file is 15gb, and I understood my mistake straight away(thus seezing any further operations on the volume). The partition is separate, and wasn't accessed. So, either it was slightly damaged(well, it's vista, who knows what did it do..), or the the program just can't recover such a big file.

I also scanned the volume, from which I moved that file. The file there appears as "overwritten" too. Also, the largest file that the visible as "good", is about 4gb, few(actually, all) larger are also corrupted. All of the files, are placed on the partitions one after the other(I think), because they were written to freshly formatted volumes.

The most important thing for me, are the cookies which are in that ghost image, also getting some photos would be nice(really unlikely all to be damaged, the compression method was standard, files located at two partitions, and there are many of them). Also, recovering some images would be nice.
I need the coockies that badly, because a long time ago, when I registered on a Russian community site, similar to Hi5.com & facebook.com, I didn't want to connected my email to it.. So I registered with a fake one, which I have forgotten. And, that email is the "username" there. So, if cookies method fails, the only thing possible will be to shoot myself(either with a camera, or a handgun), holding a paper begging to send password to my real email. Perhaps they'll even do.. But..

If anyone has any suggestions, on how to get'em out of there, I'll be more than glad to hear them.

Thank you, for your time.

Edit:
Here, I found that cause for the files to be unrecoverable, really is their size.

So, I would like to know, if it is possible to find a tool, that would take two long integers, a partition and would output all data between them, to a file?

And, in case that IS possible, how would winrar react, to a file, with some junk at the end of it? And, the same question applies to Norton Ghost.

Thanks again..

Simon Parzer
Member #3,330
March 2003
avatar

It seems you are pretty much screwed. You have a 15 GB compressed(!) HD image which isn't intact. And what you are looking for are some cookies, text files <1kB. That's like a needle in a haystack. Even if it were 15 GB of individual files it would be hard to restore them and find the ones you need.

Quote:

Here [forum.sysinternals.com], I found that cause for the files to be unrecoverable, really is their size.

I don't see how that post has anything to do with your problem. Maybe you can elaborate?

Quote:

If anyone has any suggestions, on how to get'em out of there, I'll be more than glad to hear them.

Well... the usual things. Make sure you don't boot from the disk with the deleted files on it. Use a boot CD of some sort. Maybe do a full disk backup (RAW backup or how it's called, so that all sectors, even the "empty" ones get backed up), and then try to get your data from there. There are some Linux LiveCDs with the necessary tools. But as I stated before, it seems a bit hopeless.

type568
Member #8,381
March 2007
avatar

Quote:

Quote:
Here [forum.sysinternals.com], I found that cause for the files to be unrecoverable, really is their size.
I don't see how that post has anything to do with your problem. Maybe you can elaborate?

I am sorry, just giving all that thread was rude. The info I found in that thread, is that when a file is removed from an NTFS partition, under windows it doesn't always just "mark that space free", but also causes damage to some sector, that is responsible for location of that specified file, if it is a large file.

And my hope, is the following: (Although, I see quite no method on doing that..). Locate begging of the file by it's magic number. I am quite sure, that the disk isn't fragmented (it is a whole chunk), and I approximately know it's size. I assume, that addition of some garbage to the end of the file, won't ruin it- it will just turn larger.

So, I am thinking of finding two tools: Scanning whole hard disk for data (to find that magic number), and another (or the same) tool to move the data starting at that magic number, plus following 20gb to a file. Saving it, mounting it.

I would love to hear any comments, regarding to the ways to achieve that, and regarding to the tools that could help me do that.

Edit:
Ah yes..

Quote:

Well... the usual things. Make sure you don't boot from the disk with the deleted files on it. Use a boot CD of some sort. Maybe do a full disk backup (RAW backup or how it's called, so that all sectors, even the "empty" ones get backed up), and then try to get your data from there. There are some Linux LiveCDs with the necessary tools. But as I stated before, it seems a bit hopeless.

Well, these files are on separate partitions.. I've no idea how to isolate them, I just don't touch them.. And I changed their names, so that I won't accidentally write something to them.

Thomas Fjellstrom
Member #476
June 2000
avatar

Yup, large files on windows can't be put in the Garbage for some strange reason, so they do a permanent delete (like if you SHIFT+Delete'ed it to begin with), which causes the OS and NTFS to detatch the space the file used from the inode (the structure an fs uses to store the file metadata), and reuse that inode for a new file later.

The easiest way to recover deleted files is to find the old inode, but in this case if anything ever reuses the inode the file you wanted to recover had, it makes it a billion times harder, and you then have to start scanning for a possible inode backup (they sometimes exist in other "blockgroups" on some FS types, and I think ntfs makes them now and again), or scanning for raw contents in free blocks, which not only takes forever, but is VERY error prone. And if the file was compressed with some lz like algorithm, you're screwed, there is no way to recover from that as far as I know.

If you know EXACTLY what you are looking for, say the header of the disk image file, try scanning for that in the free space, but note, you may have to scan for a partial header since something may have started allocating space in that area already (NTFS likes to scatter shit all over even if it doesn't have to).

--
Thomas Fjellstrom - [website] - [email] - [Allegro Wiki] - [Allegro TODO]
"If you can't think of a better solution, don't try to make a better solution." -- weapon_S
"The less evidence we have for what we believe is certain, the more violently we defend beliefs against those who don't agree" -- https://twitter.com/neiltyson/status/592870205409353730

type568
Member #8,381
March 2007
avatar

As I know, windows can put files of any size, in to the recycle bin, if the size of the recycler is unlimited manually, in the properties of that recycler.

All of the methods you mentioned, look very promising, but I haven't gotten any tools to accomplish these tasks. Would you suggest me anything?

Thanks for the reply though.

Thomas Fjellstrom
Member #476
June 2000
avatar

Quote:

Would you suggest me anything?

Unfortuneatly no. That sort of stuff deals with raw FS data, and youd have to know how to read that sort of info.

--
Thomas Fjellstrom - [website] - [email] - [Allegro Wiki] - [Allegro TODO]
"If you can't think of a better solution, don't try to make a better solution." -- weapon_S
"The less evidence we have for what we believe is certain, the more violently we defend beliefs against those who don't agree" -- https://twitter.com/neiltyson/status/592870205409353730

GullRaDriel
Member #3,861
September 2003
avatar

I had good results with Stellar Phoenix FAT32-NTFS Recovery tool.
A pity that it is not free, but in some case pire2pire is your friend.

It was successful where the other free tools (I tried all mentioned tools in that thread) were failing.

"Code is like shit - it only smells if it is not yours"
Allegro Wiki, full of examples and articles !!

type568
Member #8,381
March 2007
avatar

Awesome, thanks. I'll try those.

Oh, you meant the p2p as second, I thought it's another program. It looks like the Phoenix guy won't work in vista :(

That's a reason to install XP though, in my case.

Edit: Actually no, one of the scan options seems to be working. Too bad, in the place to limit file size, the maximum you can specify is 9999MB. I need over 15gb.

Found proper, latest version of Stellar, it didn't find t he file on one driver, and on the other it sees my dear 15gb friend as 0 bytes.

I'm unsure though, perhaps this program could help me to read raw data to a file.. Although, I dunno how exactly is the data read in NTFS.. Is it a kind of linked list? Then the method wouldn't work perhaps, or Stellar would automatically filter these pointers?

Go to: