My files turned XML Files

Recuva
1

HI!

My flashdrive has experienced an error, I cannot use my drive unless it is formatted. And since I have a 8gb data there I installed Recuva (free version) so that I can recover my files when I format it. After formatting, I started Recuva to identify the files that I have deleted. I saw my files but have extension of XML (ex. 2x2.jpg.xml). I thought it is normal, so I clicked "recover". I went to the destination folder where my files were located but found out that the files also have XML extension. How can I bring it back to its original extension? I have videos and documents there.

Please see attached files for my screenshot of both seen in Recuva and my recovered files.

post-75386-0-75512900-1455103427_thumb.png

2

anyone who has an idea?

3

before the XML extension is the correct one, I see some INI and JPG extensions.

have you tried renaming a file to remove the .XML and just leave the .JPG for example?

4

Yes, I tried to delete the XML extension but the file went corrupt and it cannot be use/open.

5

In Recuva Advanced mode, can you post a screenshot of the Info pane, where it shows the first 100 bytes of the file.

What's the file system on the flash drive, FAT32?

What's the cluster number(s) on the files - just one will do for now.

6

Please see the screenshot of the advance mode. System file is FAT32. Hoping I can recover them. Thank you.

post-75386-0-88832200-1456274754_thumb.png

7

Select a file and show us the file header and the cluster numbers (info and header views). And a larger Recuva window with as much info as possible please.

8

Maybe we ought to go back a step. What was used to format the drive? There are a few posts elsewhere where users either copying files or with encrypted files have had the .xml extension added. Does this apply in this case? Recuva does not alter file names or data at all.

As far as I know if a FAT32 drive is formatted the FAT tables are zeroed and rewritten, and the root directory at least would be rewritten with all user file info removed. So how did Recuva find those file names? The pic in post 1 shows the wizard being used, was a deep scan selected? The screenshot shows file names but no directory name info, those names must have come from a directory as they're not held in the file data.

Still need answers to post 7.

9

Hi I cannot upload all the screenshot, that is why I am uploading it one by one. This is a screenshot of Info tab

post-75386-0-89726700-1456469991_thumb.png

10

Perhaps have a read of this thread especially page 2.

http://answers.microsoft.com/en-us/office/forum/office_2007-outlook/my-pst-files-somehow-became-pstxml-files/62bb09ba-f443-4d60-9a1c-802e15529088?auth=1

Do you think this could be what happened to you?

11

Hi Hazelnut!

Thank you for the link, Yeah, my work computer has a symantec program in encrypting the files. Problem is, that computer is in my previous work. Do I have the chance to recover the original file? I have a close friend from my previous work, maybe he can give me the .exe file. It is always automatically installed whenever we plugged our devices to the computer.

12

Yes H, that's one of the threads that made me think it was encryption software. As this is messy - we have to get to post 11 to find that the o/p is trying to retrieve encrypted and possibly copyrighted files from a previous workplace - I'm pulling out of this thread.

As an aside, why is the Recuva window in the screenshot so small? Most of the relevant info, dates, sizes, state, cluster numbers, etc. is missing.