How to (I did) to recover CHK files

[Legendus]

Hello!

 

Firstly I want to thank to the moderators of the forum their work, really good work done here by then, thanks!

 

Well... this posts comes from the context I exposed here: http://forum.piriform.com/index.php?showtopic=31729

 

The next explanation will show how I did to recover the data from a HDD which has the filesystem corrupted (several folders were inaccessible).

 

What can you expect doing this?

What I obtained making this was the files recovered from the inaccessible folders.

 

What can not you expect doing this?

I didn't obtain the filesystem recovered (it went on going bad in the innacessible folders).

 

Material

• Recuva
  
• Unchk
  
• CHK-Mate
  
• Patiente (this is not on internet ) if you have to recover many files to recover as I had
  

 

Guide

1. 
    
   
2. First, run Recuva and close the wizard. Choose the HDD affected and enter in options (settings) (well...I runned it in Spanish, so I don't know the exact words in English). Once you are in settings, in the actions part, check all the scan options (I think probably it works with "deep scan" and "scan to found not deleted files", if you are file system is damaged).
   
3. Once you are done it, you can click "scan". For me...I tooks 5 hours...more or less. In my case, after scanning I could hibernate without loosing the scaning results, check this post for this information: http://forum.piriform.com/index.php?showtopic=31729.
   
4. Well...when the scan is finished. It is good to see the files in a tree view. For that, go to options / interface / visualization mode / tree view.
   
5. Now, you'll see your folder structure of your HDD. The folders, that are innacessible for you, are not going to appear probably. However, there will be 2 aditional folders: one is "FOUND.000" and ups....I don't remember the name of the other one (but you'll recognize it because they are in the root and you didn't have them before).
   
6. From the folder I don't remember the name, you'll can take the files that has been recovered nicely, even with the name of the file, extension and so on. However, from the FOUND.000 folder, you'll see the ".chk" files. So here....you receive 2 news....one good, one bad. The good one is that you have there the files. The bad one is that you have to work to recover them as they were before the "crash".
   
7. So well... let's go!
   
8. First thing I did is to pass the Unchk software with the "hard drive" depth scan mode. If you have too much files in that folder, it will take its time. After this, and depending of the type of files you are recovering, you'll have files that has been recovered as a copy of the chk original file with the extension found.
   
9. For example. Imagine that one of the files were a jpg. After using unchk over the fileXX.chk, which is the jpg file recovered by recuva, you'll find in that folder another file "fileXX.jpg".
   
10. So well. according to the filetypes that unchk recover and the nature of the files to recover, you'll have some of them (if you are lucky, all) recovered.
    

 

Well....then, what can we do with the rest?. Here my suggestion.

 

• 
   
  
• You can check the files by yourself. I mean, you can see the properties of each one as the property size. For example, imagine you have a file whose size is 700 MB, then, probably you'll think, this is a "avi" file. So well... make the test: copy the file and change its extension, then open and if it is a "avi" you'll have it recovered.
  
• Second change is to use CHK-Mate. Imagine you are a programmer, as I am, and you know that a lot of the files you are going to recover are ".c" files. Then you can install CHK-Mate. Once is intalled you should drag a normal ".c" file over the executable in order to make that the CHK-Mate learn how the ".c" files are. Then, if you pass CHK-Mate over the folder...it will be able to detect your ".c" files and recover them. (Of course, you can do the same using the method one (changing the extension and trying).
  
• Last suggestion. If you recover docx (maybe all the office formats) files. Probably unchk program will generate several zips with a "strange" content as:
  
  • Folders: _rels, docProps, word
    
  • File: [Content_Types].xml
    
  • If you have a zip with this content, what I suggest is to take the original chk file, copy, and rename the extension as "docx". Then open with Word, it should work as it worked with me.
    

 

Conclusion

This is not a complex way to accomplish the recover, but it is a hard work (boring often). For this, I suggest you to think about the importance of the lost files before start, because if you think they are not so important...maybe you should leave this idea.

 

I hope this guide will be useful for you. If you have any question you can contact me in this post or by private message.

 

Thanks!

[Legendus]

New suggestion I add to check the chk files. Reading a RSS I have seen an HEX file editor called PSPad. A good chance can be open the files with this editor and see the content in order to check the filetype or see something that can be distintive to know the file extension.