New answers tagged

0

A longer text file was overwritten with a shorter one with the same name How much shorter, give actual file sizes. As Thomas Weller correctly says, if small enough the data attribute of the text file will be what NTFS calls 'resident', while the larger file probably wasn't. Resident means it fits inside the 1 KB MFT entry alongside the meta data. If same ...


0

If all that happened was partition deletion or damage to partition table then: Things look bright. You are correct in this case nothing happened to your data or even the file system. If you like living on the edge you can even attempt to undelete the partition although that's a big no-no in data recovery. Or, extract all data and copy it to another drive. To ...


0

This is not a direct answer but it may be helpful none the less. I would like to suggest using better software to recover the files with in the first place. Basically file recovery software has two main strategies to recover files: File system based: The tool scans the drive for file system structures that point to files. Using the data it is possible to ...


1

I can not comment so I apologize for 'answering', but it seems to me you need error correction or even RR retries rather than guessing disguised as statistics. So for this you'd need a reader/adapter that dumps the NAND while bypassing the controller. See for example: http://www.flash-extractor.com/manual/read_retry/step_by_step/. Also if we compare C0 and ...


1

If the goal is data recovery then in-place repairs are not recommended. If you decide to try anyway, first clone the drive using something like ddrescue. This is my fist and final warning ;) Initial notes There is no way to repair a severely damaged file system in-place for the purpose of data recovery! First, if MFT is damaged there realistically is no way ...


1

Nowadays this is very often caused by TRIM. TRIM is an ATA command which allows the OS to inform the drive about ranges of LBA sectors the drive can use as it pleases. This is useful for SSD drives as those have a constant need for erased pages to write data to. In practice the sector ranges are not immediately erased, however they may be removed from LBA ...


1

A RAW image can be read by most serious data recovery tools. In professional data recovery, creation of a raw image file is the first thing to work towards. Many of the pro data recovery hardware imagers do just one thing: keep an unstable disk alive by stressing it as little as possible while creating a sector-by-sector image. Once we have the image the ...


1

I recover data to earn my bread and butter and have developed file recovery and was involved in developing file recovery software. Currently my what I do mainly is photo recovery (memory cards) and photo repair. I'd like to start explaining how in certain situations a raw scanner like PhotoRec can be successful while a fancy commercial tool isn't: File ...


Top 50 recent answers are included