Lost file but visible with Recuva

Hi,

I have kind of a weird problem and i am kinda desperate for help!

Last week i was working on an excel file. I saved it afterwards. Today i was trying to open the file but windows told me the file didnt exist. I checked the recycle bin and found it was not deleted. I did a windows search through my entire system....could not be found. And last i did a search on the content (to see if i hadnt accidentally renamed the document) but no luck.

Finally i started Recuva to see if i deleted the document and could recover it. But again i couldnt find it.

Now the weird part.

I decided to run a scan for non deleted files! And there it was:

Filename: XXXX.xls

Path: D:\user\Desktop

Size: 214 KB (218.624)

State: Not deleted

Creation time: 21-10-2010 14:23

Last modification time: 21-10-2010 14:23

Last access time: 7-10-2010 13:09

Comment: No overwritten clusters detected.

2 cluster(s) allocated at offset 8593340

29 cluster(s) allocated at offset 9537833

23 cluster(s) allocated at offset 10100292

So in fact it was not deleted, the windows file system just doesnt see it for some reason.

I tried to recover, however i just got some weird stuff back!

How on earth is this possible and is there a way to recover this file?

your help would be greatly appreciated cause i am lost!

Kind regards Brax.

Hi Brax,

As far as I know, Recuva in normal mode scans the MFT (sequentially?) and displays a list of thsoe records that have the delete bit set. If you opt for scan for non-deleted files then Recuva displays all records in the MFT.

So it appwars that there is a record in the MFT for your file which isn't flagged as deleted, but isn't seen by Explorer. I wonder if there's some corruption in the MFT record for the containing folder, or somewhere in its structure.

Try copying the entire folder to a flash drive or other partition, and see if this has copied the 'lost' file. This fits in the category of more hope than science, but it's quick start.

I would test what you have originally recovered, on a flash drive or other partition. You say it's weird, but can it be opened by Excel and the data is weird, or is it unopenable? If unopenable, can you look at it with Wordpad and see if there are any identifiable contents such as column headers, etc. that you recognise as belonging to your file?

If it is rubbish then you could schedule and run a chkdsk. I don't know whether this will cure all MFT ills, but it's worth a try.

If that's a failure then you could run a Recuva deep scan. This will take ages to run, but you might pick up a not-too-old edit or saved copy of the file which is better than nothing.

Thanks for you response Augeas,

I will try the things you suggested and let you know if it worked.

As for the "recovered"file. I am able to open it with excel, however its contents show nothing familiar.

Regards, Brax

Ok,

I got the file back with CHKDSK, however, it's contents were not even remotely comparable to the stuff i put in there. In short, i have to start all over. It still puzzles me how this is even possible and what has actually happened. In any case, thanks for your help. Unfortunately i am back to square one. Just one of these days i guess!

;-)

Kind regards, Brax

Ah well, some you win, some not. Did you try the deep scan? If you do find any copies then recover them all and look at them afterwards.

It is a mystery how this happened. NTFS is quite a stickler for not losing data, but Google shows a lot of hits for corrupted MFT so it can and does happen from time to time.