What's the offset address?

[Fractalogic]

Hi!

 

I wonder... is it by any chance possible to figure out the offset address of the files that Recuva detects?

 

I'm looking at a very important file in the list. Recuva reports the size as 405 KB and it has no overwritten clusters. But I have a reason to believe that this file is larger than that. It's not a huge file, but it is certainly larger than what Recuva is reporting. I would like to go ahead and use another program to pick up some more raw data at this location. The reason the size is reported incorrectly is probably because the file system entry for the file has been damaged.

 

I suspect Recuva can't display this. Unless it has some kind of hidden feature or a command line mode (?). I have looked at the UI and could not find any such option. I would highly recommend that you implement this feature. This would be really useful in some situations to some people.

 

Thanks!

[Augeas]

Recuva gives the cluster offset addresses in Advanced Mode, Info panel. If you're suggesting that it shows the offsets of the fragments it can't detect, then that's an oxymoron.

[Fractalogic]

Ah! That's interesting. It shows the address for some files, but not for others.

 

Here is a PNG file info:

Size: 167 KB (171 372)
State: Not deleted
Creation time: 2015-04-03 19:06
Last modification time: 2015-04-03 19:06
Last access time: 2015-04-30 21:09
Comment: No overwritten clusters detected.
42 cluster(s) allocated at offset 76944

Here is some JPG file info:

Size: 544 bytes (544)
State: Not deleted
Creation time: 2015-07-16 11:58
Last modification time: 2015-07-16 11:58
Last access time: 2015-07-16 11:58
Comment: No overwritten clusters detected.

Why is that? Why does it tell the address for some but not for others? In this case both files have the same status (not deleted) and no overwritten clusters.

[Augeas]

Because the second file is small enough to be held entirely within the MFT record, so no clusters are allocated to it. It can be recovered, but it possibly isn't a jpg file. My guess is that it's an index file from the recycler, with a name beginning with $I.