Jump to content
CCleaner Community Forums
serhiy

nulled file

Recommended Posts

hi all,

need guru consulting

have a file for example 1mb on ntfs with 8k cluster size

this file was (i think) overwritten with an empty one (0 size)

pc was shutted down

using live cd and raw data disk viewer i found first sector of file (original one not empty)

need help

can i recover this file?

Share this post


Link to post
Share on other sites

It's very unlikely.

 

If the original has been overwritten then using a hex editor you might find enough sectors from edit copes etc. However there are 2000 x 512 sectors in a 1 mb file so the task is considerable and the chances of success slight. Then these sectors would have to be assembled in the correct order. Data recovery companies will take this sort of work on, but it's not a job I would even consider.

Share this post


Link to post
Share on other sites

thanks for answer,

so, as i understend, there are no information in sector about adress of the next one,

this is an end of the story about 1 file.

however thanks alot.

Share this post


Link to post
Share on other sites

so, as i understend, there are no information in sector about adress of the next one,

 

No, the sector start and end positions are held in the Master File Table, and if that is lost or invalid then there's no way to find the sectors apart from looking at each sector and seeing if you can recognise the file.

 

The first sector of a file usually has a file signature which will identify the type of file, i.e. doc or png etc, and Recuva deep scan can find these, but only the first fragment will be found, as the file signature is in the first sector only. If you're lucky and the file is in one fragment then a deep scan might find what you are looking for.

Share this post


Link to post
Share on other sites

there are NO information in EACH sector about adress of the NEXT one.

in MFT information held about nulled file, so no chain info.

its pitty but nex sector belongs to another file, END OF THE WAY.

 

f...k

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...

×
×
  • Create New...