nulled file

[serhiy]

hi all,

need guru consulting

have a file for example 1mb on ntfs with 8k cluster size

this file was (i think) overwritten with an empty one (0 size)

pc was shutted down

using live cd and raw data disk viewer i found first sector of file (original one not empty)

need help

can i recover this file?

[Augeas]

It's very unlikely.

 

If the original has been overwritten then using a hex editor you might find enough sectors from edit copes etc. However there are 2000 x 512 sectors in a 1 mb file so the task is considerable and the chances of success slight. Then these sectors would have to be assembled in the correct order. Data recovery companies will take this sort of work on, but it's not a job I would even consider.

[serhiy]

thanks for answer,

so, as i understend, there are no information in sector about adress of the next one,

this is an end of the story about 1 file.

however thanks alot.

[Augeas]

so, as i understend, there are no information in sector about adress of the next one,

 

No, the sector start and end positions are held in the Master File Table, and if that is lost or invalid then there's no way to find the sectors apart from looking at each sector and seeing if you can recognise the file.

 

The first sector of a file usually has a file signature which will identify the type of file, i.e. doc or png etc, and Recuva deep scan can find these, but only the first fragment will be found, as the file signature is in the first sector only. If you're lucky and the file is in one fragment then a deep scan might find what you are looking for.

[serhiy]

there are NO information in EACH sector about adress of the NEXT one.

in MFT information held about nulled file, so no chain info.

its pitty but nex sector belongs to another file, END OF THE WAY.

 

f...k