Jump to content

Can't recover large files


Blakjer

Recommended Posts

Hi, first post here. I did an accidental and I admit very stupid delete of a folder. Trying to recover using Recuva, I noticed that anything over a certain file size is unrecoverable. Several files with (very) large sizes (up to 40GB) are detected as 0 bytes and with no overwritten sectors. Nonetheless they are listed as unrecoverable.

 

The disk on which the files are located, is not a system disk (no OS, swapfiles, apps or whatsoever) and has not been touched after the deletion of the files, so these files should be recoverable.

 

The "smaller" files present in the deleted folder are recoverable, with the largest recoverable one being 3.9GB. The other files where over 3.9GB and not recoverable.

 

BTW, I tried the Pandora Recovery tool as well. Exact problem there, 0 bytes and 0% overwritten for the large files.

 

So, is there a fundamental problem with very large files?

Link to comment
Share on other sites

  • Moderators

Not really a problem with the recovery software but a characteristic of NTFS when it deletes large files. A large file may have many dataruns in its MFT record, so many that these are moved to extension MFT records, and possibly non-resident attribute clusters. When the file is deleted NTFS will progressively overwrite the data runsin the MFT extension records, effectively making the file length zero. Although the data clusters are probably still on disk, it is not really possible to recover them.

Link to comment
Share on other sites

Thanks for the info Augeas. So, this is bad news.

 

I understand your argument, I don't however understand then the version history of Recuva.

 

v1.25.409 (21 Mar 2009)

 

- Improved UI stability when working with very large files.

http://www.piriform.com/recuva/version-history

 

I guess the writer of this version history is very optimistic. I did some tests and as far as I can see, anything larger than 4GB is unrecoverable with Recuva and Pandora. I don't consider that very large. In these days 4GB is peanuts AFAIC.

 

Since this is a characteristic of NTFS as you say, I guess this means there are no recovery tools that will be able to restore the lost files. To be sure of this, am I correct?

 

If I was a forensic investigator I would probably be able to find the parts and patch them together. However I'm not, so I'm going to have a beer or two and probably more, to make my loss more bearable. Sigh.

 

But first one more question. You write "When the file is deleted NTFS will progressively overwrite the data runs in the MFT extension records". Why would NTFS do that? I thought the whole idea of not overwriting files after deletion, not even in the MFT, was to increase performance. For files over 4GB this doesn't apply?

Link to comment
Share on other sites

  • Moderators

'Improved UI stability' is over two years old, and I've no idea what it means (User Interface stability?). In tests I have done (for my own interest) I can find no pattern which says that particular sized files will suffer from this. I think it is only on files - of any size - that have MFT extension records. On one occasion I loaded an 800 mb file to my 10% used disk and it had over 4000 fragments (cluster runs), an external attribute cluster and I think 16 MFT extension records. When deleted that file went to size zero.

 

Once the the dataruns in the MFT records have been overwritten there's no recovery program - that I know of - that can recover the file.

 

Why does NTFS do this? I don't know. Deleting a file with many dataruns and extension MFT records is a complex business, so it could be to do with cluster/MFT record integrity in case of a crash. It's not the data that's overwritten, but the cluster lists held in the MFT records.

Link to comment
Share on other sites

Thanks for the explanation.

 

I found a post from an user also noticing the 4GB limit. See the thread title of http://forum.piriform.com/index.php?showtopic=30295&st=0&p=180997&hl="large%20files"&fromsearch=1entry180997 .

 

So could it be that anything over 4GB is always unrecoverable because they have/need too many info in the MFT etc and that files smaller that 4GB could potentially be unrecoverable if for whatever reason the metadata becomes to large?

 

I tried some more files on several disks (I have lots of them ;-) ) and I always get this 4GB limit. I will do some more tests just to satisfy my curiousity and to give me the feeling that I did learn something after all of my mistake ;-)

Link to comment
Share on other sites

  • Moderators

According to my tests it is (roughly speaking) the number of extents that causes the problem, not the actual file size (see my example above). Of course the chances are that the larger the file is the more extents it is likely to have (also roughly speaking - there are other factors involved).

 

There may be some other reason why 4 gb files show zero length, and according to Google others have had this problem too. Perhaps there is something else specific to 4 gb files. I don't have any files approaching 4 gb so I rarely see this phenomenon. Well never, actually.

 

There's this http://forum.easeus.com/viewtopic.php?t=18406&sid=37e0520a5700faf06704b889e4543576 and this http://forum.ntfs.com/discussion/29/recovering-large-4gb-deleted-files/p1 for example, but neither thread gives a detailed reason for the data loss. This thread does, of course!

Link to comment
Share on other sites

Thanks for this very informative discussion. And I do understand that it's not the actual filesize that is the culprit. On the other hand, if filesizes over a certain limit, by definition need more metadata than NTFS is willing to remember, than large filesizes are an issue.

 

So I guess the only party that can solve this is MicroSoft. To quote Bill Gates: "4GB ought to be enough for anybody." ;-)

 

And I know it's unlikely that he said that about the 640k limit, but I couldn't resist, since it might well apply here.

 

 

I don't have any files approaching 4 gb

Wait till you start with videofiles. They very easily go up to 40 GB and even more.

 

 

Surprisingly enough a customer support member of Easeus claims:

Normally, our product can recover files over 4GB.
.

See last post on page 1 of your link http://forum.easeus.com/viewtopic.php?t=18406&sid=37e0520a5700faf06704b889e4543576

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.