Author Topic: Special File Recovery Software (Read 18858 times)

MerleOne · « **on:** November 21, 2011, 08:47 AM »

Hi,

Once again I lost a big file, a DVB-T recording of around 8GB, because I deleted it and emptied the trashcan. When I realized my mistake, I tried immediately many recovery software, such as Recuva, but also the excellent Active@FileRecovery Pro and also FileScavenger, they all see the deleted file, but with a size of ... 0. Smaller deleted files (1-2 GB) show their original size before deletion.

It already happened to me once, that is I deleted a big file and no recovery tool seems able to recover it, because the seen size equals zero. With smaller files, it works almost everytime (provided I act immediately).

Does anyone knows a file recovery software that also recovers "big" files, that was confronted to this issue, and found a solution ?

Thanks.

IainB · « **Reply #1 on:** November 21, 2011, 02:37 PM »

@MerleOne: Offhand I can't think of a piece of software that might be able to help recover this file - I would only suggest those proggies that you have apparently already used but to no avail. I don't understand why the 0byte size though.

There is something you could do to reduce the chance of such a thing happening in future though:

Never "empty recycle bin", but instead go into it using Windows explorer and carefully sort the files into "Size" and/or "Original Location", and delete them manually there once you are sure they are unwanted.
I always do this periodically - typically every few days - as I became a bit paranoid after doing what you have done. Once too often I mistakenly deleted something useful into the Recycle bin when I had been in a hurry.

If that fails for me, then there's always my backups to recover the file from. I run a backup of all my useful/work-related data on a daily or weekly basis, depending on how much work I have been doing. If I am on a busy project, then it's daily.

These are habits of working, drilled into me or learned by error years ago, to avoid potential problems or to make it easier to recover from a problem.
The cause of a lot of problems is usually "user error", and you cannot eliminate that unless you eliminate the user's involvement and automate everything...oh, but wait...

MilesAhead · « **Reply #2 on:** November 21, 2011, 03:03 PM »

What OS are you running?

If it's Vista or W7 and the file existed when you made the last restore point, there's a chance you can pick it out with Shadow Explorer

I don't know if there's anything similar that can look in XP restore points to pick out files.

Curt · « **Reply #3 on:** November 21, 2011, 04:41 PM »

Shadow Explorer
-MilesAhead (November 21, 2011, 03:03 PM)

A little tip, because I didn't notice this myself the first time I ran the program: the default view is the oldest shadow copy. You have to click the date, and scroll, to find the newest:

4wd · « **Reply #4 on:** November 21, 2011, 05:22 PM »

I've used GetDataBack on a 1TB HDD, (partition table went south), which had multi-GB video files. It recovered every single file.

Not quite the same scenario as you, deletion versus partition error, but it did also recover a LOT of deleted files off the same partition - I had to then sort through what was current and what was past $:-\$

Only catch is, it isn't free, (and at US$79 it's not cheap). During it's Demo period it will do everything the full version will do EXCEPT recover your files. It does tell you if they are recoverable, then you can purchase a license and copy them without scanning the drive again.

However, it's possibly one of the best programs I've ever used for recovery - far better than any of the free alternatives.

IainB · « **Reply #5 on:** November 21, 2011, 06:01 PM »

I didn't know about Shadow Copy or GetDataBack. Thanks.

Shadow Copy is apparently only in Win7 "Business" and "Ultimate" versions though. Bother. Mine is Home Premium.

GetDataBack looks very good. I see there are 2 separate versions - NTFS and FAT.

PhilB66 · « **Reply #6 on:** November 21, 2011, 06:14 PM »

I didn't know about Shadow Copy or GetDataBack. Thanks.

Shadow Copy is apparently only in Win7 "Business" and "Ultimate" versions though. Bother. Mine is Home Premium.

GetDataBack looks very good. I see there are 2 separate versions - NTFS and FAT.
-IainB (November 21, 2011, 06:01 PM)

Check out http://nicbedford.co...stemrestoreexplorer/

Stoic Joker · « **Reply #7 on:** November 21, 2011, 06:15 PM »

I've used GetDataBack on a 1TB HDD, (partition table went south), which had multi-GB video files. It recovered every single file.
-4wd (November 21, 2011, 05:22 PM)

It's been a hands down favorite of mine for years.

MilesAhead · « **Reply #8 on:** November 21, 2011, 06:41 PM »

Shadow Copy is apparently only in Win7 "Business" and "Ultimate" versions though. Bother. Mine is Home Premium.

ShadowExplorer works on my Vista Home Premium fine.

The data is still saved. It's just that Windows doesn't give you that "previous versions of files" in the property page. Basically ShadowExplorer was written as a way to get that backup file out of the shadow copy on flavors of Windows that don't have the option in the property page.

IainB · « **Reply #9 on:** November 21, 2011, 09:30 PM »

So, does this mean that Win7 Home Prem has the capacity for Shadow Copy, but it has been disabled as a feature?
This would presumably be what what passes for "marketing".

IainB · « **Reply #10 on:** November 21, 2011, 10:19 PM »

Just installed System Restore Explorer and Shadow Explorer.
Interesting. It seems that I am now able to answer my own Q above.
The Answer is "Yes".

I'm using Win7-64 Home Premium.

System Restore Explorer: mounted a selected Restore Point as some kind of a drive/volume, and that enabled me to use Windows Explorer and xplorer² to see and restore the Restore Point files. I could also view .JPG files, and delete a file in the TEMP directory of the Restore Point. The deleted file appeared in my Recycle bin.
Shadow Explorer: Gave its own explorer-like window, enabling me to see and restore, but not touch, individual files.

Very nice.

Thankyou very much @MilesAhead and @PhilB66.

It's nice to learn something new.

MerleOne · « **Reply #11 on:** November 22, 2011, 02:11 AM »

Thanks all for your quick replies. GetBackData is one tool I didn't try, so I'll try it next time it happens (and it will, eventually, despite the nice tips from IainB, because at one point I will forget to use them...). Regarding System restore, I forgot to mention the file was on an external USB drive, not monitored by SR.

Since the incident, I have reused the HDD to transfer other big files, so no use trying again. The file was not worth spending more time. It's just that NTFS seems to really well delete very big files, and this seemed strange.

MilesAhead · « **Reply #12 on:** November 22, 2011, 02:44 AM »

@IainB you're welcome. I like Shadow Explorer. No need to read a manual. Nice intuitive interface, and free. The author did a good job.

4wd · « **Reply #13 on:** November 22, 2011, 05:18 AM »

GetDataBack looks very good. I see there are 2 separate versions - NTFS and FAT.
-IainB (November 21, 2011, 06:01 PM)

R-Studio is another that is on par with GetDataBack and like it, it comes in two flavours for FAT and NTFS - actually it comes in a lot more flavours.

For US$50 you can have either the FAT/Ext2-4 or NTFS/Ext2-4 version, or for US$80 it'll do the lot, (including Mac filesystems), for local drives.

Demo mode will let you recover files up to 64kB.

MerleOne · « **Reply #14 on:** November 22, 2011, 06:51 AM »

Hi again,

I did the following test : I copied a 8 GB file onto a 500 GB USB external HDD, standard NTFS formatted. As expected, when I delete the test file and try to recover it, Active@FileRecoveryPro sees the deleted file, but with 0 size. I will try GetDataBack & R-Studio, and I'll report here.

Edited : with GetDataBack, I see the deleted file, but size is 0 and it seems unrecoverable. Trying with R-Studio... R-Studio does see a non zero file. Cannot try it further without purchasing a license. Will probably buy one because it does seem *very* powerful. If I do and if I can recover the file, I'll let you know. However, the size of the deleted file is slightly over the original one, so I suspect I won't recover an exact duplicate, kind of annoying.

Curt · « **Reply #15 on:** November 22, 2011, 07:54 AM »

R-Studio is another ...
-4wd (November 22, 2011, 05:18 AM)

I have not tried R-Studio, but I have their R-Drive Image. When I politely requested a new feature, I was simply told that the program had a trial period. (period!).

One good thing is, they run the same major version's number for several years.

4wd · « **Reply #16 on:** November 22, 2011, 06:07 PM »

Edited : with GetDataBack, I see the deleted file, but size is 0 and it seems unrecoverable.
-MerleOne (November 22, 2011, 06:51 AM)

Hmm, you're right. The files I originally recovered were all below 4GB but I would have thought they'd realise that NTFS could have over a 4GB filesize.

I just tested a ~6.5GB ISO on a external 640GB USB3 drive, same result as you - it was recovered with 0 filesize.

I'm now trying it with the Systemic file system damage option...this will take a while, ~1.5 hours, but hopefully it will trace through the linking in the file blocks and come up with something - I'll let you know in a couple of hours.

One other factor, (may be relevant, may not), my original recovery was using an internal SATA connected drive. I might see if that makes a difference.

Re: R-Studio, I can't comment on how effective it will be since I don't own it but maybe it would be a good idea to email them first, (and Runtime Systems also), asking specifically whether their software will recover a deleted 8GB file and whether they'll refund your money if it proves not to - at least that way you'll have an 'in writing' response from the company if it doesn't work. Though some companies can still be a.......s about these things.

Addendum: A little searching turned up a couple of items, this post on the Sysinternals forum and this question on Superuser which pointed to it, (answer 2 used PhotoRec for a 4GB recovery - who knows, it might be able to do the job).

Short of it is, if the file's fragmented you might not be very lucky and with a multi-GB file this is probably going to be truer more often than not.

A suggestion, some DVB recording programs allow for the cutting of the recording into 1 or 2GB blocks, (to compensate for FAT limits), perhaps your software can do the same - this should make any accidental deletion a lot more recoverable.

ADDENDUM 2: You'll have to strike GetDataBack off your list, I couldn't even find the deleted 6.5GB file after its rather exhaustive analysis search of the filesystem. That kind of restricts it to 4GB max I guess.

MerleOne · « **Reply #17 on:** November 23, 2011, 01:58 AM »

Thanks @4wd for taking the time to investigate and for the very interesting links. Got one answer from R-TT support forum. Goto : http://forum.r-tt.co...eted-file-t6396.html

The manual inspection gives me reason to think I mght be able to recover it, or the next one I delete like this.

4wd · « **Reply #18 on:** November 23, 2011, 04:17 AM »

It would be interesting to see if using PhotoRec and a identifier for the DVB transport stream could recover it.

Plus it's something that can be tried without laying money on the line.

I might give it a go with the same 6.5GB ISO and see what happens.

Well, it's only been running for 18 minutes, (with currently over an hour to go), but PhotoRec has managed to recover ~26GB of files including two DVB-T MPG format files of 6.32GB and 10.2GB. Both files seem to be complete and are playable - pretty impressive so far considering those two files must have been deleted at least a week ago.

ADDENDUM: After 2.5 hours it's recovered 6481 files, (txt, jpg, mpg, avi, javascript, png, gif, mp3, ogg and more), over 40GB of data.
It didn't pick out the test file I put on there, (DVD video ISO), possibly because the file identifiers it uses couldn't precisely match a specific signature - unlike the two big MPGs, which were actually DVB-T transport streams, (.ts). I probably could have specified a custom signature but frankly, if it can recover the two large files, (which was the primary query: large file recovery), I mentioned above at over a week or so since deletion and having had data written to the drive in the meantime......

I give it: 2 tums up

MerleOne · « **Reply #19 on:** November 23, 2011, 10:40 AM »

It would be interesting to see if using PhotoRec and a identifier for the DVB transport stream could recover it.

Plus it's something that can be tried without laying money on the line.

I might give it a go with the same 6.5GB ISO and see what happens.

Well, it's only been running for 18 minutes, (with currently over an hour to go), but PhotoRec has managed to recover ~26GB of files including two DVB-T MPG format files of 6.32GB and 10.2GB. Both files seem to be complete and are playable - pretty impressive so far considering those two files must have been deleted at least a week ago.

ADDENDUM: After 2.5 hours it's recovered 6481 files, (txt, jpg, mpg, avi, javascript, png, gif, mp3, ogg and more), over 40GB of data.
It didn't pick out the test file I put on there, (DVD video ISO), possibly because the file identifiers it uses couldn't precisely match a specific signature - unlike the two big MPGs, which were actually DVB-T transport streams, (.ts). I probably could have specified a custom signature but frankly, if it can recover the two large files, (which was the primary query: large file recovery), I mentioned above at over a week or so since deletion and having had data written to the drive in the meantime......

I give it: 2 tums up
-4wd (November 23, 2011, 04:17 AM)

Definitely something to try ! Thanks.

Addendum: : I just had a quick run of PhotoRec. It did recover many files, but for most of them it's garbage within, just as an exemple, a 500 MB file is seen as a link (.lnk). Still, if it recovery the desired file, it would be nice.

Curt · « **Reply #20 on:** February 15, 2012, 04:24 PM »

-the link from participant friedel goes to a .org page which has no link to the actual purchase prices for this program series; they must be found within the program or at the .com page http://www.remosoftware.com/buy :

INFO:

The first message during installation is this seldom seen text: >If you are using Windows 7/Windows Vista, you need to disable User Account Control (UAC) from your Control Panel to install this software.<

The average download speed for the 19MB installer was merely 158½KBps.

Innuendo · « **Reply #21 on:** February 16, 2012, 11:12 AM »

I'll be eagerly following this topic closely as I'm always looking for a better file recovery program. Most programs available are lackluster (as seen from people's experiences above).

Albert_Eines · « **Reply #22 on:** February 22, 2012, 05:22 AM »

Use Kernel for Windows Data Recovery software and recover deleted or lost files, folders from Windows partitions (FAT & NTFS). It doesn’t matter whether you have deleted the required data from Recycle Bin by using Shift+Delete keys, with this software it is easily possible to recover the data in all situation. The best aspect about this tool is it allows you to recover data also from deleted or corrupt partitions of Windows 95, 98, ME, NT, XP, 2000, 2003, Windows Vista.

Curt · « **Reply #23 on:** February 22, 2012, 08:43 AM »

Kernel for Windows Data Recovery
-Albert_Eines (February 22, 2012, 05:22 AM)

Kernel for Windows Data Recovery:
http://www.kerneldat....com/buy-online.html
$49

http://www.kerneldatarecovery.com/
We Expertise in Data Recovery Software, Hard Disk Data Recovery Software and File Recovery Software

Innuendo · « **Reply #24 on:** February 22, 2012, 09:36 AM »

Hmm...one post from Albert Eines today....and he registered his account today.

I think I smell spam.