While saving a file in a text editor (Notepad++), the application crashed. Windows (XPsp3) now reports the file as zero bytes.
I ran Recuva and it sees the file as 364KB (the original size), and says it's not deleted. However, when I go to restore the file to another drive, only the zero byte file is created.
If this post takes my attachment, it's just a screenshot from the results list.
![post-69670-0-51683000-1401940955_thumb.png]()
So apparently, Recuva is using some other information for the filesize than Windows is. Is there any way to use that discrepancy to get my file back?
If anyone has any suggestions, I'd really appreciate it. I do have a back up, but it's several hard hours of work old. I'd love to get it back if possible.
When Explorer displays the file's attributes it reads the directories, and uses the info held in the owning directory (it would take too long to examine every file individually). When Recuva runs a normal scan it looks at the file's record in the Master File Table. It appears as if this is where the discrepancy is occurring. The file's record in the MFT also holds the file size in several places, I don't know which value Recuva uses. Possibly when it's recovering an undeleted file it uses the directory info.
Perhaps a chkdsk will resolve the inconsistency, I don't know. I don't think it will make your position worse.
Alternatively you could find and read the sectors with WinHex or something similar, and copy them to a new file and edit that, but that is not novice stuff and will take some time. If you do try this I've found HxD to be a very friendly hex editor. This would depend on the file being in one extent, which is not at all guaranteed.
I'd try chkdsk first.
I assume you ran Recuva with Scan for Non-deleted Files checked. You could also try a deep scan to see if there are any edit copies, but this again depends on the file to be in one extent.