Jump to content

Recovered file sizes correct but won't open


Anjistar

Recommended Posts

Hello,

Could someone please explain to me whether it makes any difference that the file sizes on the recovered files are what I would expect - high quality jpg images, so 6-10Mb?

Recuva has found all my accidentally (stupidly) deleted photos but I can't open them with any programs.

Link to comment
Share on other sites

  • Moderators

Have you tried Irfanview?

That can sometimes open image files that other viewers can't.  It seems to be more tolerant of slight errors in the file header.

If it can open them then save-as will save a fixed version that other viewers can then open.

I recently recovered a bunch of jpgs and Irfanview opened them all but a few. Although some that it opened were only half the image with the other half grey, (that's just all that Recuva could get back of those ones).

*** Out of Beer Error ->->-> Recovering Memory ***

Worried about 'Tracking Files'? Worried about why some files come back after cleaning? See this link:
https://community.ccleaner.com/topic/52668-tracking-files/?tab=comments#comment-300043

 

Link to comment
Share on other sites

  • Moderators

That puts a different light upon it. It's probably some file system such as FAT or exFAT, or even something more exotic, so it's difficult to say what Recuva is extracting.

if you run Recuva again and look at the file headers then if  they contain zeroes or what looks like random data then you're probably not picking up valid file data, and recovery is more difficult.

 

Link to comment
Share on other sites

It's FAT32 file system. Some of the photos recovered have what look like the original numbers on them, original is eg 'P1046572.jpg', the recovered files with no preview have '_1046572.jpg'. Some have previews and those have numbers like '[000597].jpg'. The latter are full files and I can open them with Photoshop. 

Looking at the files in Recuva, some say 'State: Excellent, Comment:  No overwritten clusters detected'.

But I still can't open them and they don't generate a preview.

And Recuva just crashed on trying to save to a new folder

Edited by Anjistar
Additional info
Link to comment
Share on other sites

  • Moderators

Deleted files in FAT32 should have the first byte of the file name altered, which is why you are seeing files with names like '_1046572.jpg'. Weirdly enough some deleted files have the full unaltered name, I don't know why. Files with '[000597].jpg names are found using a deep scan and have a chance of being recovered successfully.

In FAT32 the root directory, and every other directory linked off it (where you and I and Recuva go to), have an entry for each file which holds the address of the first data cluster. The remaining clusters are chained together in the FAT. On file deletion the FAT chain is cleared so it can't be used for file recovery. Recuva follows the first cluster address in the directory and then reads forwards on the disk. This has problems as only the first extent of a file can be retrieved, thus a file with more than one extent may be unusable.

This first extent only recovery is a specific problem with the FAT file system. File extents are chained in the FAT, and the FAT entries for deleted files are zeroed. The first extent only recovery also applies to files found with a deep scan, which looks directly at the disk clusters. Only the first extent can be found as there is no mechanism to link multiple extents.

If you look at the Info pane in Recuva the allocated clusters is always (as far as I have seen) one count of clusters at a particular address. If this count (x cluster size) is less than the file size then you have missing extents. Unfortunately files with missing extents are unlikely to be viable, and missing extents are extremely difficult to find, certainly not with Recuva.

 

 

Link to comment
Share on other sites

28 minutes ago, Augeas said:

Deleted files in FAT32 should have the first byte of the file name altered, which is why you are seeing files with names like '_1046572.jpg'. Weirdly enough some deleted files have the full unaltered name, I don't know why. Files with '[000597].jpg names are found using a deep scan and have a chance of being recovered successfully.

In FAT32 the root directory, and every other directory linked off it (where you and I and Recuva go to), have an entry for each file which holds the address of the first data cluster. The remaining clusters are chained together in the FAT. On file deletion the FAT chain is cleared so it can't be used for file recovery. Recuva follows the first cluster address in the directory and then reads forwards on the disk. This has problems as only the first extent of a file can be retrieved, thus a file with more than one extent may be unusable.

This first extent only recovery is a specific problem with the FAT file system. File extents are chained in the FAT, and the FAT entries for deleted files are zeroed. The first extent only recovery also applies to files found with a deep scan, which looks directly at the disk clusters. Only the first extent can be found as there is no mechanism to link multiple extents.

If you look at the Info pane in Recuva the allocated clusters is always (as far as I have seen) one count of clusters at a particular address. If this count (x cluster size) is less than the file size then you have missing extents. Unfortunately files with missing extents are unlikely to be viable, and missing extents are extremely difficult to find, certainly not with Recuva.

 

 

Thank you for that very detailed, also comprehensible, reply.

I have gone over to the dark side with Easeus, which has had better results. Not perfect, but fairly satisfactory.

Many thanks for your help

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.