Jump to content

rac2

Members
  • Posts

    4
  • Joined

  • Last visited

Reputation

0 Neutral
  1. After some Googling, I've discovered that Windows renames files in the Recycle Bin: In Windows Vista C:\$Recycle.Bin\<user sid>\$Rnnnnn.ext (for actual file data) C:\$Recycle.Bin\<user sid>\$Innnnn.ext (for index "metadata" info about a single deleted file) In Windows XP C:\Recycler\<user sid>\DCn.ext (for actual file data) C:\Recycler\<user sid>\INFO2 (for "metadata" info about all deleted files) See also http://conservativebooktalk.com/wp-content...recycle-bin.doc http://www.forensicfocus.com/downloads/for...recycle-bin.pdf
  2. Augeas comments appear to refer to Windows XP. After some Googling, I've discovered that Windows Vista saves Recycle Bin files using a different format and convention: C:\$Recycle.Bin\<user sid>\$Rnnnnn.ext (for actual file data) C:\$Recycle.Bin\<user sid>\$Innnnn.ext (for index "metadata" info about the deleted file) So it appears that on Windows XP, you should restore DCnn.ext files as Augeas suggests, while on Windows Vista you should restore $Rnnnnn.ext files. See also http://conservativebooktalk.com/wp-content...recycle-bin.doc http://www.forensicfocus.com/downloads/for...recycle-bin.pdf
  3. I have the same problem even after Deep Scan. Despite Recuva stating "Comment: No overwritten clusters detected," when opening any recovered .doc files with MS Word 2007, this error is displayed: Microsoft Office Word needs a converter to display this file correctly. This feature is not currently installed. Would you like to install it now? Similarly, opening recovered .xls files returns: The file you are trying to open, <filename>, is in a different format than specified by the file extension. Verify that the file is not corrupted and is from a trusted source before opening the file. Do you want to open the file now? I've not found a single recovered file that I can open. If there are "no overwritten clusters" and Recuva does not alter the recovered data, how is it that the files are corrupted?
  4. I have the same problem. Despite Recuva stating "Comment: No overwritten clusters detected," when opening any recovered .doc files with MS Word 2007, this error is displayed: Microsoft Office Word needs a converter to display this file correctly. This feature is not currently installed. Would you like to install it now? Similarly, opening recovered .xls files returns: The file you are trying to open, <filename>, is in a different format than specified by the file extension. Verify that the file is not corrupted and is from a trusted source before opening the file. Do you want to open the file now? I've not found a single recovered file that I can open. If there are "no overwritten clusters" and Recuva does not alter the recovered data, how is it that the files are corrupted?
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.