Searchable File Extentions

Recuva
1

Hi,

I was wondering if anyone knew off hand or if there was a list somewhere about which file extensions Recuva supports and knows to look for? I've got a hard drive that was used for storage (so it had a ton of files on it) and the only partition that was on there got deleted and had Windows 8 installed over it.

A friend and I were able to find the old deleted partition with another file recovery program. And although it can find a good amount of file types, it can't look for ones we're really hoping to save. There's an option to add file signatures to it, but it's pretty in-depth and involves coding in RegEx and is way over our heads.

The file extensions we're looking to get to are .mts, .txt, .psd, .ttf, .otf and Adobe Premiere project files with extensions like .prproj, .plb, .ppj, and .prel

Does Recuva recognize those? Every time we scan the drive or access old partitions I'm nervous that we're possibly going to corrupt what's there. So I'm trying to feel things out with different programs before we run them over the drive.

Any advice would be greatly appreciated, thanks!

2

recuva does not limit itself by file type. if there, recuva should find any file type.

3

Hi Nergal, thanks for the reply!

Sounds good. Quick noobie followup question...can Recuva find and search through deleted partitions?

4

Just to qualify Nergal's post, in a Normal scan Recuva will find any and all file names held in the MFT. In a Deep scan Recuva will use a predetermined list of file signatures (I think there's a command to list these, someone else will know and hopefully pipe up).

Recuva needs to see the partition to do a recovery. If Windows can't see it then Recuva can't either.

Normally with a format I would suggest that you try a normal scan with show undeleted files checked. This will read the MFT past its current allocation and may pick up most of your missing files. However Win8 (especially if you've dine an upgrade and Windows.old still exists) does use up a huge amount of entries in the MFT so the results may not be so satisfying. But a scan is fairly fast and does no harm.

5

Hi,

I'm also interested in this: 'In a Deep scan Recuva will use a predetermined list of file signatures (I think there's a command to list these, someone else will know and hopefully pipe up).'

I noticed in the latest release notes: v1.47.948 (05 Jun 2013)

- Added file type filtering to Deep Scan.

can anyone help on how to set the predetermined list of file signatures for a deep scan?

a bit of background on why i'm interested in this:

a hard drive was re-formatted. I ran a deep scan on the hard drive and it returned all of the files I was looking for, HOWEVER, most of the files I'm interested in do not have common file extensions (and are not from common programs). the deep scan I ran recovered the .doc, .xls, .tiff etc files but not the following file extensions (they were recovered, but with the extension .sdk and i cannot look at them):

nb, stl, mxp, mcs, sav, spo, m

from the following programs:

mathematica (vs 9.0), any 3D program, 3 matic (vs 8.0), mimics (vs 16.0), spss (vs 21), spss (vs 21, output file), matlab

cleardot.gif

additionally, the deep scan did not return any docx files that had comment bubbles (comment under the review tab in word).

When i say 'did not return', the files are there (i know from the file size) but are returned with extension .sdk.

6

I know of no way to alter the list of file signatures, as far as I know it is hard coded in the prog. Look at http://www.piriform.com/docs/recuva/using-recuva/wizard-mode/the-deep-scan-option I don't know how up to date this list is.

I think .sdk files are from a graphics/cad type program: I assume Recuva is finding these from the MFT in the normal scan phase, and not in the deep scan.

Comments etc on Word files are I believe held separately from the docx file, so will be lost on recovery.

7

Hi Augeas,

thanks for the response. this is, unfortunately, what i had expected. looks like a lot of work has gone...

8
... but not the following file extensions (they were recovered, but with the extension .sdk and i cannot look at them):

Are you saying that you appear to have some of the files you were after, seemingly intact with correct sizes, but they've simply been tagged with the wrong file extension?

Have you tried changing the file extension to what you think the correct one to be? Changing file extensions can corrupt a perfectly good file, but that isn't always the case. Some files can survive file extension changes and carry on working as before.

If you recognize the recovered files sufficiently to tag them with the correct file extension, then copy a few of them (just in case you do find another solution) and try it.

Some programs will play a file even if it has the wrong extension ie I can change an .mp4 file to the .jpg image file extension and both MPlayer and Media Player Classic will still play it as an .mp4. They ignore the extension. Changing it back again does it no harm at all.

The point being that some programs aren't looking for file extensions, whereas some will ignore a perfectly good file if it has the wrong one. And changing to the right one may do the file no harm at all.

It may come to absolutely nothing, but you've got nothing to lose.