recuvauser20

@Augeas Hi, I am sorry to reopen this thread. I had a txt which was kept opened in npp. suddenly the system got restarted, when the notepad++ was opened up, I saw [nul] repeated in the text file. I opened up in notepad it showed blank file. I used recuva to recover. I got a file with 0000 written when i opened up in sublime text editor I re-ran recuva with all options on, deep scan. I got a different file this time with all json key/value pair. I have splunk running on my machine. The recovered file has links with splunk all over. I couldn't understand why it shows these entries. My text file has nothing to do with splunk. this is an important i use. How do I recover this? why it has splunk entry all over? any ideas? i am trying to see if it gives me a location with some pointers so I can go to that location and view the file. Any help is appreciated. a few lines in the recovered file, "log_level":"INFO","component":"IOStats","data":{"device":"\\Device\\HarddiskVolume4","fs_type":"ntfs","mount_point":"C:","interval":"60","reads_ps":"0.317","writes_ps":"7.083","reads_kb_ps":"9352.348","writes_kb_ps":"216401.044","avg_total_ms":"15.604","cpu_pct":"10.52"}} "process":"splunkd","args":"service","process_type":"splunkd_server" "process":"mongod","args":"--dbpath=C:\\Splunk\\var\\lib\\splunk\\kvstore\\mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=C:\\Splunk\\var\\lib\\splunk\\kvstore\\mongo\\splunk.key Thanks