ArtK

Thanks DennisD... The executables are identical to the ones from cgsecurity.org. The readme's also, and they say: "Some functionnalities are missing from these executables like the ability to list and copy files from a deleted or damaged NTFS partition." I'm going to try it as soon as this loooooong run of Recuva is done. BTW, I left it running overnight looking for any file with "SQLite" in the header, when I came in this morning it had a long list. I tried to change the view from list to tree, and it's locked up now "not responding". Resource monitor says it's using about 11.75% CPU and there's plenty free, so it's not in a hard loop. It's reading about 16MBytes/sec (and writing 0), so my guess is it's going back over the disk again. I suspect somebody unplugged it from my machine this morning before I got in (and replugged it after they were done) and it's resyncing its data, but just locked up and not responding makes it hard to be sure. I'm going to leave it running for a while, in case it does something useful. Is this a known issue? I suppose most people trying to recover data have complete custody of the drive involved, not to mention not working on a machine everybody else and his kid syster jumps onto when they're not there, so maybe nobody's had this problem before. I suppose with small removable drives it only locks up for a few seconds, but aren't there people with bigger drives (such as GoFlex)? And I assume if the file had been disconnected and reconnected, it could go out directly and check the accuracy of its pointers without re-scanning the whole drive? How long should I let this go before I cancel the process?

Thanks, DennisD... I've used TestDisk before, and I'm downloading TestDisk & PhotoRec 6.13 (15 November 2011). I note that the entry for windows 64-bit is crossed out, I'll check the release notes to see what it says about it. AK

Hi hazelnut... There was a response waiting for me when I got in this morning, basically to run the scan with "Scan contents", looking for the file type in the header. I've started a run searching for "SQLite" (the header is "SQLite format 3" but I figure the shorter the character string, the less time each compare will take). I also set the file mask to "*." with nothing after the dot so hopefully it won't bother scanning inside any file with an extension (which I assume it gets from the directory). This may be the quickest way to find what I'm looking for, but I did ask if there was any other way. I don't seem to have found any orphaned albums, which means I'm suspicious of ProSelect as I mentioned above. However, there does seem to be a message at the bottom of the Recuva window after a scan which says it ignored some files. I'm not sure why, and I'd like to be sure it's not ignoring the files I'm looking for. At least I have all the pictures it could find, and I suspect that's all that were written to disk. Unless/until I can recover the lost albums, I can't be sure whether it's everything, but it's probably all the pictures we have any chance of recovering. Thanks everyone for the help. AK

Thanks, Nergal... Most of the recovered files retained their names, but none of those without their subdirectory. They came back as files numbered [000001] thru [000386] in the "Unknown folder", which was sort of what I expected if they had been written to disk but the subdirectories that had pointers to them hadn't. All were shown as .jpg files except for a few .xml files and .dll files. There was also some stuff in the $RECYCLE.BIN, including a few albums, but all of these were older versions of albums that had been updated (and resaved to disk), as I would expect for a recycle bin. I can't tell for sure whether they were created while Windows 7 was managing the disk, or the E4200. As far as I can tell, I haven't recovered any of the lost albums, so I suspect they were being held in cache on the router when it had its power problem(s) (if that's what the problem actually was). I'm not certain why they didn't make it to disk the way the pictures did, but I suspect ProSelect isn't a very well-behaved application. When reading pictures from the NAS, the application would periodically go black for a dozen or so seconds, then come back. I suspect low-level disk I/O that doesn't get along with a slow network (802.11n 2.4GHz). Still, directory changes more than 5 hours old hadn't been saved to disk, so I also suspect a problem with the router's caching system as well. Given how we load the system, we shouldn't have lost more than the last save of any file, nothing more than an hour or so. I saved off any orphan file that looked even remotely useful on my C: drive, but I'd sure like to be sure that there isn't more out there that isn't showing up. Any ideas would be welcome. AK

Thanks, both of you. I've got about 40 30 minutes left now, so I'll be trying a few of the things suggested. I'm making sure to make no changes to the drive I'm trying to recover, putting everything on my C: drive, not changing names or anything else that would risk re-saving a directory. WRT using the search box, does the actual file include its own name, or just the directory block (or whatever) that has pointers to it? I suspect I could pull up headers from some files that retained their directory structure, so I know they're .psa types, and search for some appropriate character string. Or can I use Recuva to view the headers of files I've already recovered? I know I can open them with ProSelect, I tried. Is there some way to get at and translate actual directory blocks that have been orphaned (assuming NTFS actually works that way)? Do directory blocks contain thumbs of pictures, or does Windows create those dynamically? Thanks again, including for any further help. AK

Hi all... I just opened a ticket wrt technical issues recovering files/directories, and I thought I'd start a topic here, in case anybody knows any tricks. Here's what I said on the ticket: Hi... We had a problem with our mini-NAS: We had a Seagate Goflex 1TB drive (NTFS) that had been created and running under Windows 7 for several months, which we connected to a new Linksys E4200V2 via USB. Apparently we had several power glitches while running in this configuration, and the router lost a bunch of directory updates it was holding in memory (my best guess at this point). We might have lost some files too, but most of them appear to have been written to disk. We managed to recover a number of "undeleted" files using with their directory structure intact Recuva (free), but there are a bunch of other files we haven't found. We bought the business version in the hopes that we could get some help using it that would speed up the process, as I've never used the product before and we're in time-critical mode. I started a deep scan (which says it will take many hours), but I still don't know enough about the product to know the fastest way to retrieve the right files once I have the scan results, and I'm guessing there's going to be a lot to search through. Also, is there something I can do that would be faster than a deep scan? Will we be able to recover subdirectories that were saved but the higher-level directory wasn't (assuming the E4200 did this)? We're a photography studio, and our process involves creating a new directory for each customer and filling it with photos (copied from the camera flash card), then running a product called ProSelect to create an album and let customers select their favorites and order products. Our orders are currently maintained manually on paper, using filenames of photos. When we run a deep scan, I'm guessing we're not going to get filenames (I've already recovered everything I could without a deep scan), but ProSelect saves low-res copies and filenames of the original images in its albums, so I'm hoping we can reconstruct the directory structure by comparing jpeg's with thumbs. Albums are saved with an extension of .psa, supposedly "compressed", so I doubt that Recuva would be able to identify the type, but most of the unidentified file types will probably be lost albums. Is there some way I can search through the results for unidentified file types only? Some way to search by other thinks things, such as the last update date? I don't know what the turnaround time on tickets is, but I've got to go buy an UPS, I'll be checking back in perhaps an hour or 2. Thanks. AK Does anybody know any tricks that would help? Thanks.