@Augeas Hi, I am sorry to reopen this thread. I had a txt which was kept opened in npp. suddenly the system got restarted, when the notepad++ was opened up, I saw [nul] repeated in the text file. I opened up in notepad it showed blank file. I used recuva to recover. I got a file with 0000 written when i opened up in sublime text editor
I re-ran recuva with all options on, deep scan. I got a different file this time with all json key/value pair. I have splunk running on my machine. The recovered file has links with splunk all over. I couldn't understand why it shows these entries. My text file has nothing to do with splunk. this is an important i use. How do I recover this? why it has splunk entry all over? any ideas? i am trying to see if it gives me a location with some pointers so I can go to that location and view the file.
Any help is appreciated.
a few lines in the recovered file,
"log_level":"INFO","component":"IOStats","data":{"device":"\\Device\\HarddiskVolume4","fs_type":"ntfs","mount_point":"C:","interval":"60","reads_ps":"0.317","writes_ps":"7.083","reads_kb_ps":"9352.348","writes_kb_ps":"216401.044","avg_total_ms":"15.604","cpu_pct":"10.52"}}
"process":"splunkd","args":"service","process_type":"splunkd_server"
"process":"mongod","args":"--dbpath=C:\\Splunk\\var\\lib\\splunk\\kvstore\\mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=C:\\Splunk\\var\\lib\\splunk\\kvstore\\mongo\\splunk.key
Thanks