Recovering Zero-Sized Files

[Mustafa Mohamed]

It all started when I created an encrypted volume using TrueCrypt. It's basically a password-protected file that other files can be stored in. I stored the file in one of the partitions of an external USB hard disk drive. Did I mention that the file was HUGE?! In terms of numbers that would be about 200 GB!

 

During one of my occasional "tiding up" of the hard disk, I deleted several hundreds of gigabytes of files. Lucky enough, I accidently deleted that big fat 200 GB file. Unaware, I happily continued by doing the following:

 

• Emptied the recycle bin.
  
• Checked the hard disk with the "chkdsk" command.
  
• Defragmented the partition thrice.
  

 

Later after I discovered this, I head straight to Recuva for help. After DEEPLY scanning the hard disk partition, it could only find 58 files, 53 of which are useless recently deleted small files. The other five files had the following properties:

 

• Unidentified name (" ").
  
• Unknown path.
  
• No idea when they were last modified.
  
• Size: 0 bytes.
  
• State: Unrecoverable
  
• NO OVERWRITTEN CLUSTERS.
  

 

Now, I suspect that most likely the file is one (if not all) of them. The problem is when I try to recover it, it says it's unable to do so because of their size (if something has no size, it means it doesn't exists, right??). The weird thing is that they are NOT overwritten (possibly because I haven't used the HDD since and its outrageous size). What I'm curious to find out is:

 

How are they zero-sized and why can't their information be detected?

Is there any chance of recovering it (nothing uber-complicated please)?

 

Thanks in advance

[Augeas]

There are several things here. I would think that the defragging has very likely overwritten part, or parts, of the 200 gb file, making it unrecoverable, or rather recoverable but useless (even if you could find it). Defragging is a killer for recovering deleted files.

 

I'm surprised that a deep scan only returns 53 files. I would expect more like 53,000, but we don't know what else was in that partition or how it has been used. I wonder if the combination of defrag and huge files (and what else is on the disk) has caused that. Maybe there's only ever been 50-odd files on that partition. As far as I know a deep scan identifies files by reading the info at the start of the cluster. It only needs the first cluster to be overwritten to make the rest of the 200 gb file unidentifiable.

 

Zero-length files are quite common. It is not weird that they aren't overwritten as they have no clusters allocated to be overwritten.

 

Your chances of recovery? Not good, I would say. I don't think that there's anything else you can do with Recuva.

[Mustafa Mohamed]

There are several things here. I would think that the defragging has very likely overwritten part, or parts, of the 200 gb file, making it unrecoverable, or rather recoverable but useless (even if you could find it). Defragging is a killer for recovering deleted files.

 

I'm surprised that a deep scan only returns 53 files. I would expect more like 53,000, but we don't know what else was in that partition or how it has been used. I wonder if the combination of defrag and huge files (and what else is on the disk) has caused that. Maybe there's only ever been 50-odd files on that partition. As far as I know a deep scan identifies files by reading the info at the start of the cluster. It only needs the first cluster to be overwritten to make the rest of the 200 gb file unidentifiable.

 

Zero-length files are quite common. It is not weird that they aren't overwritten as they have no clusters allocated to be overwritten.

 

Your chances of recovery? Not good, I would say. I don't think that there's anything else you can do with Recuva.

 

Aha, so defragmentation has likely overwritten a cluster which is why the file can't be recognized and unrecoverable with Recuva. However, out of curiosity, I'm wondering if it's literally IMPOSSIBLE to recover it by other means. We (average users) often hear that specialized data recovery agencies can recover literally "anything" that was stored on a hard drive. From what I can see, this doesn't seem to be the case.

 

Nonetheless, I'd like some expert view on this rather than remarks from friends who have no idea what?s FAT or NTFS.

Augeas, I?m grateful for your help and time.

[Augeas]

Thanks for that MM. I didn't say that data recovery specialists couldn't recover your data, they could probably make some progress at least given time and money. They have the software and experience. There is probably some free software around like Winhex that could list all your clusters, all you have to do then is piece them together. But 200 gb is 50,000,000 4k clusters to sort out, so you can see the enormity of the job.

[Mustafa Mohamed]

Thanks for that MM. I didn't say that data recovery specialists couldn't recover your data, they could probably make some progress at least given time and money. They have the software and experience. There is probably some free software around like Winhex that could list all your clusters, all you have to do then is piece them together. But 200 gb is 50,000,000 4k clusters to sort out, so you can see the enormity of the job.

 

Thank you for your response. I've checked out WinHex and I was fascinated, particularly by the fact that it can view virtual memory. Interesting stuff ... As to regards to the lost file, I don't think I'll go any further. After all, it wasn't really important and has freed up some space on the hard disk. I guess it's a good lesson to stress the significance of backing up files.