Recovery tool doesn't find first cluster

[Georges]

Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.

I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".

Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.

"DiskExaminer" showed, that the first cluster of all 4 files was not found.

The data must still be on this disk!

What can I do to get the files back?

Many thanks!

 

[Georges Heinesch]

Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.
...

Nobody having ay idea?
I urgently need the files back within the next 24 hours. ;((

Thanks,

 

[Arno Wagner]

Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access. Since the files
were too big for the recycle bin, they were not recoverable by "normal"
means.

I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".

Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.

"DiskExaminer" showed, that the first cluster of all 4 files was not found.

The data must still be on this disk!

What can I do to get the files back?

First, if the files are important, make an image (sector-wise)
backup of the drive and work only on that copy. Otherwiese you
may do additional damage in your recovery atempts.

Arno

 

[Arno Wagner]

Hi.

Georges wrote:

Nobody having ay idea?
I urgently need the files back within the next 24 hours. ;((

Then you should urgently acontact a professional data recovery
company. They might be able to help in this time frame,
but it will be paionfully expensive.

Arno

 

[Joep]

Hi.

By mistake, I deleted some files on my NTFS drive. After I noticed the
mishap, I didn't use the drive anymore for write access.

How was this accomplished?

I used "GetDataBack for NTFS" and "RECOVERY for Windows 3" to analyse
the disk and recover the data. However I was very surprized to see, that
both tools got almost everything back, but 4 files could not be found.
These files appeared in the list of files, but showed 0 Bytes. When I
tried to recover them, it revealed that indeed, there file size became
"empty".

Until today, I thought that a deleted file could always be brought back
to the surface (provided the disk was not written to after that), but
apparently this is not quite correct.

Correct, your assumption was incorrect.

"DiskExaminer" showed, that the first cluster of all 4 files was not

found.

What's that?

The data must still be on this disk!

Says who? I wouldn't be that optimistic.

Joep

 

[Georges Heinesch]

How was this accomplished?
Fingetrouble!


Correct, your assumption was incorrect.

If you know the interna of NTFS, please explain what could poiibly
overwrite declared empty clusters (the ones used by the deleted files)?

What's that?

A disk examination program. It checks the NTFS entries.

Says who? I wouldn't be that optimistic.

I didn't write to the disk, and to the best of my knowledge, Windows
2000 didn't ether. There is no pagefile.sys on the disk, and it's a pure
data disk which contains only files not accessed by Windows (only by the
user).

Perhaps Windows accesses this partition for some other reason (write
access9, but I have no clue what this could possibly be. Hence my
article in this newsgroup. Perhaps someone knows what couöd have been
written to the disk.

Bye,

 

[Rod Speed]

Joep wrote

Fingetrouble!

He meant how did you ensure that there was no write access to the drive ?

Thats not as easy to ensure as you might think.

 

[Joep]

If you know the interna of NTFS, please explain what could poiibly
overwrite declared empty clusters (the ones used by the deleted files)?

Anything / everything can write to those clusters. It is also my observation
that those deleted last will be re-used first a lot of times.

A disk examination program. It checks the NTFS entries.

Yes I figured it was something like that. URL please!

I didn't write to the disk, and to the best of my knowledge, Windows
2000 didn't ether.

Have you ever examined the amount of read/writes to volumes while doing
nothing? You'll be amazed.

Perhaps someone knows what couöd have been
written to the disk.

Does it matter?

 

[Georges Heinesch]

He meant how did you ensure that there was no write access to the drive ?

Oupss ...

Thats not as easy to ensure as you might think.

Well, since the partition is not a system partition and there is no
pagefile.sys on it, I reckon that just not writing any file to the disk
would leave the deleted clusters (which used to be the deleted files)
intact.

I guess from your reaction, that you think there might have been
unintentional write access to the disk (not triggered by the user). If
so, please explain what could have been written to the disk by Windows 2000?

Many thanks,

 

[Georges Heinesch]

Anything / everything can write to those clusters. It is also my observation
that those deleted last will be re-used first a lot of times.

I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were deleted.

Yes I figured it was something like that. URL please!
http://www.runtime.org/diskexpl.htm


Have you ever examined the amount of read/writes to volumes while doing
nothing? You'll be amazed.

Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.

Does it matter?

Out of interest.

Thanks,

Bye,

 

[Rod Speed]

I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were
deleted.


Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.

I have noticed the effect with a physical drive I use for video capture/PVR.

If you manually delete the file, once its been watched,
and then immediately decide that there was something
in it that you had not in fact watched, for some reason
you cant just undelete it using any of the normal recovery
programs like Easy Recovery Pro. You get the same
effect you are seeing, the name is visible, but 0 length.

I know for a fact that nothing has been written to that
drive by anything I am running between the delete and
the attempt to undelete the file, so its not at all clear
just what is happening there and I havent had a chance
to have a closer look at exactly what is going on there.

 

[Georges Heinesch]

...
I have noticed the effect with a physical drive I use for video capture/PVR.

If you manually delete the file, once its been watched,
and then immediately decide that there was something
in it that you had not in fact watched, for some reason
you cant just undelete it using any of the normal recovery
programs like Easy Recovery Pro. You get the same
effect you are seeing, the name is visible, but 0 length.

I know for a fact that nothing has been written to that
drive by anything I am running between the delete and
the attempt to undelete the file, so its not at all clear
just what is happening there and I havent had a chance
to have a closer look at exactly what is going on there.

You got exactly to the same point I did !
My lack NTFS knowledge doesn't allow me to dig further!

Bye,

 

[Folkert Rienstra]

I notied that the files wriiten to the disk last, were the ones
overwritten first! I can't remember the order in which they were deleted.


Everybody says what you say right now here. There are apparently many
write accesses to the disk. But so far, nobody could tell me what
exactly is written to the disk and why.


Out of interest.

And by now you know how that answer was to dodge the question.