Recovery tool doesn't find first cluster

[georges]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.

I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".

Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.

"DiskExaminer" showed, that the first cluster of all 4 files was not found.

The data must still be on this disk!

What can I do to get the files back?

Many thanks!

--
Georges

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Hi.

Georges wrote:

> By mistake, I deleted some files on my NTFS drive. After I noticed the
> mishap, I didn't use the drive anymore for write access. Since the files
> were too big for the recycle bin, they were not recoverable by "normal"
> means.
> ...

Nobody having ay idea?
I urgently need the files back within the next 24 hours. ;((

Thanks,

--
Georges

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Previously Georges <nospam@domain-not-valid.com> wrote:
> Hi.

> By mistake, I deleted some files on my NTFS drive. After I noticed the
> mishap, I didn't use the drive anymore for write access. Since the files
> were too big for the recycle bin, they were not recoverable by "normal"
> means.

> I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
> the disk and recover the data. However I was very surprized to see, that
> both tools got almost everything back, but 4 files could not be found.
> These files appeared in the list of files, but showed 0 Bytes. When I
> tried to recover them, it revealed that indeed, there file size became
> "empty".

> Until today, I thought that a deleted file could always be brought back
> to the surface (provided the disk was not written to after that), but
> apparently this is not quite correct.

> "DiskExaminer" showed, that the first cluster of all 4 files was not found.

> The data must still be on this disk!

> What can I do to get the files back?

First, if the files are important, make an image (sector-wise)
backup of the drive and work only on that copy. Otherwiese you
may do additional damage in your recovery atempts.

Arno

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Previously Georges Heinesch <nospam@domain-not-valid.com> wrote:
> Hi.

> Georges wrote:

>> By mistake, I deleted some files on my NTFS drive. After I noticed the
>> mishap, I didn't use the drive anymore for write access. Since the files
>> were too big for the recycle bin, they were not recoverable by "normal"
>> means.
> > ...

> Nobody having ay idea?
> I urgently need the files back within the next 24 hours. ;((

Then you should urgently acontact a professional data recovery
company. They might be able to help in this time frame,
but it will be paionfully expensive.

Arno

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Georges" <nospam@domain-not-valid.com> wrote in message
news:42f7e206$1@news.vo.lu...
> Hi.
>
> By mistake, I deleted some files on my NTFS drive. After I noticed the
> mishap, I didn't use the drive anymore for write access.

How was this accomplished?

>
> I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
> the disk and recover the data. However I was very surprized to see, that
> both tools got almost everything back, but 4 files could not be found.
> These files appeared in the list of files, but showed 0 Bytes. When I
> tried to recover them, it revealed that indeed, there file size became
> "empty".
>
> Until today, I thought that a deleted file could always be brought back
> to the surface (provided the disk was not written to after that), but
> apparently this is not quite correct.

Correct, your assumption was incorrect.

>
> "DiskExaminer" showed, that the first cluster of all 4 files was not
found.

What's that?

>
> The data must still be on this disk!

Says who? I wouldn't be that optimistic.

Joep

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Joep wrote:

>>By mistake, I deleted some files on my NTFS drive. After I noticed the
>>mishap, I didn't use the drive anymore for write access.
>
> How was this accomplished?

Fingetrouble!

>>I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
>>the disk and recover the data. However I was very surprized to see, that
>>both tools got almost everything back, but 4 files could not be found.
>>These files appeared in the list of files, but showed 0 Bytes. When I
>>tried to recover them, it revealed that indeed, there file size became
>>"empty".
>>
>>Until today, I thought that a deleted file could always be brought back
>>to the surface (provided the disk was not written to after that), but
>>apparently this is not quite correct.
>
> Correct, your assumption was incorrect.

If you know the interna of NTFS, please explain what could poiibly
overwrite declared empty clusters (the ones used by the deleted files)?

>>"DiskExaminer" showed, that the first cluster of all 4 files was not
>>found.
>
> What's that?

A disk examination program. It checks the NTFS entries.

>>The data must still be on this disk!
>
> Says who? I wouldn't be that optimistic.

I didn't write to the disk, and to the best of my knowledge, Windows
2000 didn't ether. There is no pagefile.sys on the disk, and it's a pure
data disk which contains only files not accessed by Windows (only by the
user).

Perhaps Windows accesses this partition for some other reason (write
access9, but I have no clue what this could possibly be. Hence my
article in this newsgroup. Perhaps someone knows what couöd have been
written to the disk.

Bye,

--
Georges

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Georges Heinesch <nospam@domain-not-valid.com> wrote
> Joep wrote

>>> By mistake, I deleted some files on my NTFS drive. After I noticed
>>> the mishap, I didn't use the drive anymore for write access.

>> How was this accomplished?

> Fingetrouble!

He meant how did you ensure that there was no write access to the drive ?

Thats not as easy to ensure as you might think.

>>> I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to
>>> analyse the disk and recover the data. However I was very surprized
>>> to see, that both tools got almost everything back, but 4 files
>>> could not be found. These files appeared in the list of files, but
>>> showed 0 Bytes. When I tried to recover them, it revealed that
>>> indeed, there file size became "empty".
>>>
>>> Until today, I thought that a deleted file could always be brought
>>> back to the surface (provided the disk was not written to after
>>> that), but apparently this is not quite correct.
>>
>> Correct, your assumption was incorrect.
>
> If you know the interna of NTFS, please explain what could poiibly
> overwrite declared empty clusters (the ones used by the deleted
> files)?
>
>>> "DiskExaminer" showed, that the first cluster of all 4 files was not
>>> found.
>>
>> What's that?
>
> A disk examination program. It checks the NTFS entries.
>
>>> The data must still be on this disk!
>>
>> Says who? I wouldn't be that optimistic.
>
> I didn't write to the disk, and to the best of my knowledge, Windows
> 2000 didn't ether. There is no pagefile.sys on the disk, and it's a
> pure data disk which contains only files not accessed by Windows
> (only by the user).
>
> Perhaps Windows accesses this partition for some other reason (write
> access9, but I have no clue what this could possibly be. Hence my
> article in this newsgroup. Perhaps someone knows what couöd have been
> written to the disk.
>
> Bye,

 

[joeP]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Georges Heinesch" <nospam@domain-not-valid.com> wrote in message
news:42fb4db2$1@news.vo.lu...
> >>
> >>Until today, I thought that a deleted file could always be brought back
> >>to the surface (provided the disk was not written to after that), but
> >>apparently this is not quite correct.
> >
> > Correct, your assumption was incorrect.
>
> If you know the interna of NTFS, please explain what could poiibly
> overwrite declared empty clusters (the ones used by the deleted files)?

Anything / everything can write to those clusters. It is also my observation
that those deleted last will be re-used first a lot of times.

>
> >>"DiskExaminer" showed, that the first cluster of all 4 files was not
> >>found.
> >
> > What's that?
>
> A disk examination program. It checks the NTFS entries.

Yes I figured it was something like that. URL please!

>
> >>The data must still be on this disk!
> >
> > Says who? I wouldn't be that optimistic.
>
> I didn't write to the disk, and to the best of my knowledge, Windows
> 2000 didn't ether.

Have you ever examined the amount of read/writes to volumes while doing
nothing? You'll be amazed.

> Perhaps someone knows what couöd have been
> written to the disk.

Does it matter?

--
Joep

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Rod Speed wrote:

>>>>By mistake, I deleted some files on my NTFS drive. After I noticed
>>>>the mishap, I didn't use the drive anymore for write access.
>
>>>How was this accomplished?
>
>>Fingetrouble!
>
> He meant how did you ensure that there was no write access to the drive ?

Oupss ...

> Thats not as easy to ensure as you might think.

Well, since the partition is not a system partition and there is no
pagefile.sys on it, I reckon that just not writing any file to the disk
would leave the deleted clusters (which used to be the deleted files)
intact.

I guess from your reaction, that you think there might have been
unintentional write access to the disk (not triggered by the user). If
so, please explain what could have been written to the disk by Windows 2000?

Many thanks,

--
Georges

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Joep wrote:

>>>>Until today, I thought that a deleted file could always be brought back
>>>>to the surface (provided the disk was not written to after that), but
>>>>apparently this is not quite correct.
>>>
>>>Correct, your assumption was incorrect.
>>
>>If you know the interna of NTFS, please explain what could poiibly
>>overwrite declared empty clusters (the ones used by the deleted files)?
>
> Anything / everything can write to those clusters. It is also my observation
> that those deleted last will be re-used first a lot of times.

I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were deleted.

>>>>"DiskExaminer" showed, that the first cluster of all 4 files was not
>>>>found.
>>>
>>>What's that?
>>
>>A disk examination program. It checks the NTFS entries.
>
> Yes I figured it was something like that. URL please!

http://www.runtime.org/diskexpl.htm

>>>>The data must still be on this disk!
>>>
>>>Says who? I wouldn't be that optimistic.
>>
>>I didn't write to the disk, and to the best of my knowledge, Windows
>>2000 didn't ether.
>
> Have you ever examined the amount of read/writes to volumes while doing
> nothing? You'll be amazed.

Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.

>>Perhaps someone knows what could have been
>>written to the disk.
>
> Does it matter?

Out of interest.

Thanks,

Bye,

--
Georges

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Georges Heinesch <nospam@domain-not-valid.com> wrote:
> Joep wrote:
>
>>>>> Until today, I thought that a deleted file could always be
>>>>> brought back to the surface (provided the disk was not written to
>>>>> after that), but apparently this is not quite correct.
>>>>
>>>> Correct, your assumption was incorrect.
>>>
>>> If you know the interna of NTFS, please explain what could poiibly
>>> overwrite declared empty clusters (the ones used by the deleted
>>> files)?
>>
>> Anything / everything can write to those clusters. It is also my
>> observation that those deleted last will be re-used first a lot of
>> times.
>
> I notied that the files wriiten to the disk last, were the ones
> overwritten first! I can't remember the order in which they were
> deleted.
>
>>>>> "DiskExaminer" showed, that the first cluster of all 4 files was
>>>>> not found.
>>>>
>>>> What's that?
>>>
>>> A disk examination program. It checks the NTFS entries.
>>
>> Yes I figured it was something like that. URL please!
>
> http://www.runtime.org/diskexpl.htm
>
>>>>> The data must still be on this disk!
>>>>
>>>> Says who? I wouldn't be that optimistic.
>>>
>>> I didn't write to the disk, and to the best of my knowledge, Windows
>>> 2000 didn't ether.
>>
>> Have you ever examined the amount of read/writes to volumes while
>> doing nothing? You'll be amazed.
>
> Everybody says what you say right now here. There are apparently many
> write accesses to the disk. But so far, nobody could tell me what
> exactly is written to the disk and why.

I have noticed the effect with a physical drive I use for video capture/PVR.

If you manually delete the file, once its been watched,
and then immediately decide that there was something
in it that you had not in fact watched, for some reason
you cant just undelete it using any of the normal recovery
programs like Easy Recovery Pro. You get the same
effect you are seeing, the name is visible, but 0 length.

I know for a fact that nothing has been written to that
drive by anything I am running between the delete and
the attempt to undelete the file, so its not at all clear
just what is happening there and I havent had a chance
to have a closer look at exactly what is going on there.

>>> Perhaps someone knows what could have been
>>> written to the disk.
>>
>> Does it matter?
>
> Out of interest.

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Rod Speed wrote:

> ...
> I have noticed the effect with a physical drive I use for video capture/PVR.
>
> If you manually delete the file, once its been watched,
> and then immediately decide that there was something
> in it that you had not in fact watched, for some reason
> you cant just undelete it using any of the normal recovery
> programs like Easy Recovery Pro. You get the same
> effect you are seeing, the name is visible, but 0 length.
>
> I know for a fact that nothing has been written to that
> drive by anything I am running between the delete and
> the attempt to undelete the file, so its not at all clear
> just what is happening there and I havent had a chance
> to have a closer look at exactly what is going on there.

You got exactly to the same point I did !
My lack NTFS knowledge doesn't allow me to dig further!

Bye,

--
Georges

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Georges Heinesch" <nospam@domain-not-valid.com> wrote in message news:42fcf3c0$1@news.vo.lu
> Joep wrote:
>
> > > > > Until today, I thought that a deleted file could always be brought back
> > > > > to the surface (provided the disk was not written to after that), but
> > > > > apparently this is not quite correct.
> > > >
> > > > Correct, your assumption was incorrect.
> > >
> > > If you know the interna of NTFS, please explain what could poiibly
> > > overwrite declared empty clusters (the ones used by the deleted files)?
> >
> > Anything / everything can write to those clusters. It is also my observation
> > that those deleted last will be re-used first a lot of times.
>
> I notied that the files wriiten to the disk last, were the ones
> overwritten first! I can't remember the order in which they were deleted.
>
> > > > > "DiskExaminer" showed, that the first cluster of all 4 files was not
> > > > > found.
> > > >
> > > > What's that?
> > >
> > > A disk examination program. It checks the NTFS entries.
> >
> > Yes I figured it was something like that. URL please!
>
> http://www.runtime.org/diskexpl.htm
>
> > > > > The data must still be on this disk!
> > > >
> > > > Says who? I wouldn't be that optimistic.
> > >
> > > I didn't write to the disk, and to the best of my knowledge, Windows
> > > 2000 didn't ether.
> >
> > Have you ever examined the amount of read/writes to volumes while doing
> > nothing? You'll be amazed.
>
> Everybody says what you say right now here. There are apparently many
> write accesses to the disk. But so far, nobody could tell me what
> exactly is written to the disk and why.
>
> > > Perhaps someone knows what could have been written to the disk.
> >
> > Does it matter?
>
> Out of interest.

And by now you know how that answer was to dodge the question.

>
> Thanks,
>
> Bye,