What's the quickest way to recover files with unsaved directories?

Recuva
1

Hi all...

I just opened a ticket wrt technical issues recovering files/directories, and I thought I'd start a topic here, in case anybody knows any tricks.

Here's what I said on the ticket:

Hi...

We had a problem with our mini-NAS: We had a Seagate Goflex 1TB drive (NTFS) that had been created and running under Windows 7 for several months, which we connected to a new Linksys E4200V2 via USB. Apparently we had several power glitches while running in this configuration, and the router lost a bunch of directory updates it was holding in memory (my best guess at this point). We might have lost some files too, but most of them appear to have been written to disk. We managed to recover a number of "undeleted" files using with their directory structure intact Recuva (free), but there are a bunch of other files we haven't found.

We bought the business version in the hopes that we could get some help using it that would speed up the process, as I've never used the product before and we're in time-critical mode.

I started a deep scan (which says it will take many hours), but I still don't know enough about the product to know the fastest way to retrieve the right files once I have the scan results, and I'm guessing there's going to be a lot to search through. Also, is there something I can do that would be faster than a deep scan? Will we be able to recover subdirectories that were saved but the higher-level directory wasn't (assuming the E4200 did this)?

We're a photography studio, and our process involves creating a new directory for each customer and filling it with photos (copied from the camera flash card), then running a product called ProSelect to create an album and let customers select their favorites and order products. Our orders are currently maintained manually on paper, using filenames of photos. When we run a deep scan, I'm guessing we're not going to get filenames (I've already recovered everything I could without a deep scan), but ProSelect saves low-res copies and filenames of the original images in its albums, so I'm hoping we can reconstruct the directory structure by comparing jpeg's with thumbs.

Albums are saved with an extension of .psa, supposedly "compressed", so I doubt that Recuva would be able to identify the type, but most of the unidentified file types will probably be lost albums. Is there some way I can search through the results for unidentified file types only? Some way to search by other
thinks
things, such as the last update date?

I don't know what the turnaround time on tickets is, but I've got to go buy an UPS, I'll be checking back in perhaps an hour or 2.

Thanks.

AK

Does anybody know any tricks that would help?

Thanks.

2
We bought the business version in the hopes that we could get some help using it that would speed up the process, as I've never used the product before and we're in time-critical mode.
Business version and Free version are the same what you paid for was direct developer help via the ticketing and email system.
started a deep scan (which says it will take many hours), but I still don't know enough about the product to know the fastest way to retrieve the right files once I have the scan results, and I'm guessing there's going to be a lot to search through. Also, is there something I can do that would be faster than a deep scan? Will we be able to recover subdirectories that were saved but the higher-level directory wasn't (assuming the E4200 did this)?
Deep Scan can take many hours (or even days) depending on the size of the drive and number of deleted files in the entire history of the device (no, sorry there is no "rough guide"). As far as I Know Recuva recongizes all file types. Your best best is to have the program in Advanced mode instead of Wizard mode and to (once the many hours are done) use the search box to filter for *.psa

BE SURE THAT THIS DRIVE REMAINS UNTOUCHED (NO WRITING TO OR READING FROM THE DRIVE DURING THE SCAN AND RECOVERY PERIOD). The more data accessed or modified on the drive during the period the less likely a recovery is possible and also, the more likely the results given by recuva (i.e. excellent and good readings for each file) will not match the actuallity of the files' state.

3

Just to add to Nergals advice, you can set up Recuva as follows ...

if you haven't tried this already, go into Recuva's Options and under the General tab, in the "View Mode" window select "Tree View", which will present the scanned files in a view hopefully matching their original location.

Much easier to target your search amongst the listed folders/files.

Now under the "Actions" tab, tick the "Restore Folder Structure" box.

This will restore files into the same folder structure they were in originally, albeit a copy of that folder structure on another drive or partition.

Hope that helps, and welcome to the forum by the way.

4

Thanks, both of you.

I've got about 40 30 minutes left now, so I'll be trying a few of the things suggested.

I'm making sure to make no changes to the drive I'm trying to recover, putting everything on my C: drive, not changing names or anything else that would risk re-saving a directory.

WRT using the search box, does the actual file include its own name, or just the directory block (or whatever) that has pointers to it? I suspect I could pull up headers from some files that retained their directory structure, so I know they're .psa types, and search for some appropriate character string. Or can I use Recuva to view the headers of files I've already recovered? I know I can open them with ProSelect, I tried.

Is there some way to get at and translate actual directory blocks that have been orphaned (assuming NTFS actually works that way)? Do directory blocks contain thumbs of pictures, or does Windows create those dynamically?

Thanks again, including for any further help.

AK

5

usually the file retains its name AFAIK

6

Thanks, Nergal...

Most of the recovered files retained their names, but none of those without their subdirectory. They came back as files numbered [000001] thru [000386] in the "Unknown folder", which was sort of what I expected if they had been written to disk but the subdirectories that had pointers to them hadn't. All were shown as .jpg files except for a few .xml files and .dll files. There was also some stuff in the $RECYCLE.BIN, including a few albums, but all of these were older versions of albums that had been updated (and resaved to disk), as I would expect for a recycle bin. I can't tell for sure whether they were created while Windows 7 was managing the disk, or the E4200.

As far as I can tell, I haven't recovered any of the lost albums, so I suspect they were being held in cache on the router when it had its power problem(s) (if that's what the problem actually was). I'm not certain why they didn't make it to disk the way the pictures did, but I suspect ProSelect isn't a very well-behaved application. When reading pictures from the NAS, the application would periodically go black for a dozen or so seconds, then come back. I suspect low-level disk I/O that doesn't get along with a slow network (802.11n 2.4GHz). Still, directory changes more than 5 hours old hadn't been saved to disk, so I also suspect a problem with the router's caching system as well. Given how we load the system, we shouldn't have lost more than the last save of any file, nothing more than an hour or so.

I saved off any orphan file that looked even remotely useful on my C: drive, but I'd sure like to be sure that there isn't more out there that isn't showing up. Any ideas would be welcome.

AK

7

Hoping by now that you have received help from Piriform with this as you say you bought the business version.

Any more news ArtK?

8

Hi hazelnut...

There was a response waiting for me when I got in this morning, basically to run the scan with "Scan contents", looking for the file type in the header. I've started a run searching for "SQLite" (the header is "SQLite format 3" but I figure the shorter the character string, the less time each compare will take). I also set the file mask to "*." with nothing after the dot so hopefully it won't bother scanning inside any file with an extension (which I assume it gets from the directory). This may be the quickest way to find what I'm looking for, but I did ask if there was any other way.

I don't seem to have found any orphaned albums, which means I'm suspicious of ProSelect as I mentioned above.

However, there does seem to be a message at the bottom of the Recuva window after a scan which says it ignored some files. I'm not sure why, and I'd like to be sure it's not ignoring the files I'm looking for.

At least I have all the pictures it could find, and I suspect that's all that were written to disk. Unless/until I can recover the lost albums, I can't be sure whether it's everything, but it's probably all the pictures we have any chance of recovering.

Thanks everyone for the help.

AK

9

Keep in touch with Piriform for their help with this, after all, you have paid for Priority Support from them :)

We will keep our fingers crossed for you here in the hope that you manage to recover more.

10

When trying to recover important data, don't put all your eggs in one basket by using one data recovery program. Recuva is very very good, but there are other free programs out there which may pick up something Recuva has failed to.

A good example is PhotoRec (and it's sister program TestDisk), which scans a drive in a completely different way to other recovery programs. It may look like command line, but it isn't. It has a structured dialogue to follow, and it's only its lack of a traditional GUI which makes it look more complex than it is.

PhotoRec and TestDisk:

Well worth getting to grips with.

Also have a look at "MiniTool Power Data Recover". The free version has a 1gb recovery limit, but that would get a lot of images.

MiniTool Power Data Recover:

And here's a link to other highly recommended free recovery programs, which includes the ones mentioned above.

http://www.techmynd....ools-downloads/

Hope that helps.

:)

"Eggs in one basket"? I haven't used that one for years.

11

Thanks, DennisD...

I've used TestDisk before, and I'm downloading TestDisk & PhotoRec 6.13 (15 November 2011). I note that the entry for windows 64-bit is crossed out, I'll check the release notes to see what it says about it.

AK

12

There is a 64bit version, available from here and a few other locations. Not having x64 I can't try it.

http://www.afterdawn.com/software/desktop/file_recovery/testdisk_photorec_64bit.cfm

13

Thanks DennisD...

The executables are identical to the ones from cgsecurity.org. The readme's also, and they say: "Some functionnalities are missing from these executables like the ability to list and copy files from a deleted or damaged NTFS partition." I'm going to try it as soon as this loooooong run of Recuva is done.

BTW, I left it running overnight looking for any file with "SQLite" in the header, when I came in this morning it had a long list. I tried to change the view from list to tree, and it's locked up now "not responding". Resource monitor says it's using about 11.75% CPU and there's plenty free, so it's not in a hard loop. It's reading about 16MBytes/sec (and writing 0), so my guess is it's going back over the disk again. I suspect somebody unplugged it from my machine this morning before I got in (and replugged it after they were done) and it's resyncing its data, but just locked up and not responding makes it hard to be sure. I'm going to leave it running for a while, in case it does something useful.

Is this a known issue? I suppose most people trying to recover data have complete custody of the drive involved, not to mention not working on a machine everybody else and his kid syster jumps onto when they're not there, so maybe nobody's had this problem before. I suppose with small removable drives it only locks up for a few seconds, but aren't there people with bigger drives (such as GoFlex)? And I assume if the file had been disconnected and reconnected, it could go out directly and check the accuracy of its pointers without re-scanning the whole drive? How long should I let this go before I cancel the process?

14

Hi Art.

I wish I had some definitive answers for you, but I haven't I'm afraid.

Recuva seeming to hang when attempting to change the view setting may simply be down to the size of the drive, and the program taking a long time to assimilate the new view. I personally have no experience of recovering stuff from a drive that large, so I'm only guessing really.

Maybe a question for the devs.

With a smaller drive I would have started the scan again with the settings adjusted beforehand, but because Recuva doesn't save a scan in any way to enable it to be stopped then restarted from where you left off, doing that with a large drive means another painfully long wait.

Guessing isn't gonna help you, so I suggest the priority support you're entitled to. The devs probably will have knowledge of how Recuva deals with large drives in different situations.

Sorry I couldn't be of more help.

15

Hi all...

I just opened a ticket wrt technical issues recovering files/directories, and I thought I'd start a topic here, in case anybody knows any tricks.

Here's what I said on the ticket:

Hi...

We had a problem with our mini-NAS: We had a Seagate Goflex 1TB drive (NTFS) that had been created and running under Windows 7 for several months, which we connected to a new Linksys E4200V2 via USB. Apparently we had several power glitches while running in this configuration, and the router lost a bunch of directory updates it was holding in memory (my best guess at this point). We might have lost some files too, but most of them appear to have been written to disk. We managed to recover a number of "undeleted" files using with their directory structure intact Recuva (free), but there are a bunch of other files we haven't found.

We bought the business version in the hopes that we could get some help using it that would speed up the process, as I've never used the product before and we're in time-critical mode.

I started a deep scan (which says it will take many hours), but I still don't know enough about the product to know the fastest way to retrieve the right files once I have the scan results, and I'm guessing there's going to be a lot to search through. Also, is there something I can do that would be faster than a deep scan? Will we be able to recover subdirectories that were saved but the higher-level directory wasn't (assuming the E4200 did this)?

We're a photography studio, and our process involves creating a new directory for each customer and filling it with photos (copied from the camera flash card), then running a product called ProSelect to create an album and let customers select their favorites and order products. Our orders are currently maintained manually on paper, using filenames of photos. When we run a deep scan, I'm guessing we're not going to get filenames (I've already recovered everything I could without a deep scan), but ProSelect saves low-res copies and filenames of the original images in its albums, so I'm hoping we can reconstruct the directory structure by comparing jpeg's with thumbs.

Albums are saved with an extension of .psa, supposedly "compressed", so I doubt that Recuva would be able to identify the type, but most of the unidentified file types will probably be lost albums. Is there some way I can search through the results for unidentified file types only? Some way to search by other
thinks
things, such as the last update date?

I don't know what the turnaround time on tickets is, but I've got to go buy an UPS, I'll be checking back in perhaps an hour or 2.

Thanks.

AK

Does anybody know any tricks that would help?

Thanks.

I had a similar problem.....purchased a new 3TB Seagate External HD...transferred 1.2 GB of data......shortly afterwards started to get "corrupted file"

messages and had difficulty in accessing data...now even though uner Properties the usage is shown as 1.2 GB only a small amout of data is available

and my largest file of 1GB doesnt appear at all now even in "corrupted and inaccessible" form.

I did a deep Recuva scan and only a small amount of data was recoverd.

The 1GB file has to be there as its shown as used capacity...the issue is how to access it......I need advice as to how to use Recova for this purpose.

Thanks in anticipation.

16

I had a similar problem.....purchased a new 3TB Seagate External HD...transferred 1.2 GB of data......shortly afterwards started to get "corrupted file"

messages and had difficulty in accessing data...now even though uner Properties the usage is shown as 1.2 GB only a small amout of data is available

and my largest file of 1GB doesnt appear at all now even in "corrupted and inaccessible" form.

I did a deep Recuva scan and only a small amount of data was recoverd.

The 1GB file has to be there as its shown as used capacity...the issue is how to access it......I need advice as to how to use Recova for this purpose.

Thanks in anticipation.

Please start your own thread and don't piggy back on another (most likely unreleated) issue.