Jump to content

nulled file


Recommended Posts

hi all,

need guru consulting

have a file for example 1mb on ntfs with 8k cluster size

this file was (i think) overwritten with an empty one (0 size)

pc was shutted down

using live cd and raw data disk viewer i found first sector of file (original one not empty)

need help

can i recover this file?

Link to comment
Share on other sites

  • Moderators

It's very unlikely.


If the original has been overwritten then using a hex editor you might find enough sectors from edit copes etc. However there are 2000 x 512 sectors in a 1 mb file so the task is considerable and the chances of success slight. Then these sectors would have to be assembled in the correct order. Data recovery companies will take this sort of work on, but it's not a job I would even consider.

Link to comment
Share on other sites

  • Moderators

so, as i understend, there are no information in sector about adress of the next one,


No, the sector start and end positions are held in the Master File Table, and if that is lost or invalid then there's no way to find the sectors apart from looking at each sector and seeing if you can recognise the file.


The first sector of a file usually has a file signature which will identify the type of file, i.e. doc or png etc, and Recuva deep scan can find these, but only the first fragment will be found, as the file signature is in the first sector only. If you're lucky and the file is in one fragment then a deep scan might find what you are looking for.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.