| Author | Message | ||
     Stefan Fleischmann (Admin) |
It is possible to restore lost or logically deleted files (or more general: data) that are merely marked as deleted in the file system, but have not been physically erased (or overwritten). Open the logical drive where the deleted file resided on using the disk editor. Principally you can recreate such files by selecting the disk sectors that the files are still stored in as the current block and saving them using the menu command "Edit | Copy Block | Into New File". However, it might prove difficult to find these sectors. 1. In case you know a snippet of the file you are looking for (e.g. the characteristic signature in the header of a JPEG file or the words "Dear Mr. Smith" in a MS Word document), search it on the disk using the common search commands ("Find Text" or "Find Hex Values"). This is a very simple and safe way, and can be recommended to anyone. 2. In case you only know the filename, you will need some knowledge about the filesystem on the disk (FAT16, FAT32, NTFS, ...) to find traces of former directory entries of the file and thereby determine the number of the first cluster that was allocated to the file. Detailed information on file systems is available in the Knowledge Base. The following applies to all FAT variants: If the directory that contained the file (let's call that directory "D") still exists, you can find D on the disk using Tools | Disk Tools | List Directory Clusters. The factory template for FAT directory entries that comes with WinHex will then be helpful to find out the number of the first cluster that was allocated to the deleted file in that directory. Otherwise, if D has been deleted as well, you need to find D (using the directory entry template as well) starting with the parent directory that contained D. Deleted files and directories are marked with the character "å" (hexadecimal: E5) as the first letter in their name. | ||
| John Westover |
General question. I am trying to recover an image file I accidentally erased on my Fuji FinePix 40i camera. I can restore images that have been erased using the PC delete, but I cannot restore the image I erased using the camera menu. Can anyone help me? Regards, Westhurst. | ||
| Stefan Fleischmann (Admin) |
Especially with .jpg files, I recommend trying the approach described here. Good luck, and don't hesitate to post again if you have questions. | ||
| John Westover |
Further to my last message: I have discovered that the erase feature on the Fuji FinePix 40i camera actually removes the image data, unlike DOS type erasure that only changes the filename. This may be of interest to anyone trying to recover images erased in the camera. | ||
| Lem (Lem) |
I deleted a directory. How can I recover that directory and all it's contents. Or, does this mean I have to recover each file indiviually. IF so what is the header and footer for *.eps | ||
| Stefan Fleischmann (Admin) |
I'm afraid it would have be done individually for each file. One can easily find out a header of a certain file type (if one exists)by simply looking for common byte values or characters at the beginning of such files. My .eps files obviously all begin with "%!PS-Adobe" and end with "%%Trailer". So you could use 252150532D41646F6265 as the header (offset 0) and 2525547261696C65720A as the footer. Good luck. | ||
| Anonymous |
Stefan: I am interested in using WinHex for forensic investigation purposes, but am totally unfamiliar with what you describe as hexadecimal language (how does "%!PS-Adobe" become 252150532D41646F6265? Is there a resource you would recommend? | ||
| Stefan Fleischmann (Admin) |
I recommend you start with the "10-Step Hex Editing Course" in the Knowledge Base and the topic "Using a Hex Editor" in the program help. "25 21 50 53 2D 41 64 6F 62 65" are the 10 byte values in hexadecimal notation that correspond to the 10 ASCII characters "%!PS-Adobe". In a hex editor, the middle column is for hex values and the right column for the corresponding characteres. The File Retrieval command happens to take hexadecimal values to recognize characteristic file header signatures. | ||
| Jacques CULOT |
Hi Stefan , Can your program help me to recover files contained in a directory which has been accidentally erased? The OS is W2000 and the file system used is NTFS | ||
| Stefan Fleischmann (Admin) |
On an NTFS drive you could try recovering the files manually, or using Tools | Disk Tools | File Retrieval. This requires that the files have a characteristic file header. Please consult the program help for that topic. | ||
| Anonymous |
When changing local mail directories, Netscape overwrote all existing files with smaller files of the same name. Is there any way to recover the original files? | ||
| Stefan Fleischmann (Admin) |
Not entirely, the beginning of the old files were probably overwritten. You could try locating mail messages in a raw format on the drive (opened with the disk editor) by searching for exactly known text (such as "Dear Mr. Smith"). For more I recommend contacting a professional data recovery service such as Ontrack, ActionFront, Ibas, or Vogon. | ||
| Alicia |
I cannot access the 10-Step Hex Editing Course in the Knowledge Base. I am told it is nonexistent and am redirected to TriangleHard's home page. I'm entirely in the dark on how to retrieve lost files, my only knowledge being that it is possible. Does it matter what type of file was lost? I lost somewhere around 200 mp3 files. Would I need to retrieve them all seperately or could I simply find the file they were all held in together? Help would be greatly appreciated. | ||
| Stefan Fleischmann (Admin) |
That link may be dead again, but the chapter in the program help about data recovery still exists. Hopefully your files were stored on a disk with the FAT (or FAT32) file system. There is a special automated recovery for this. If the instructions in the program help leave any question unanswered, please do not hesitate to post here again. | ||
| Alicia |
Sorry... Where is the program help? | ||
| Stefan Fleischmann (Admin) |
This is what 99.9% of all Windows programs offer when pressing the F1 key. And there is also a menu entitled "Help" and an item "Contents" that you could try. Besides, in many dialog windows there are buttons entitled "Help" that offer context-sensitive help. And finally, everything described in the program help is also contained in the printable electronic manual. | ||
| Anonymous |
Hi Stefan Fleischmann (Admin) i have download demo winhex to recover excel File and it recover my exce file but i cant read excel file can you tell me how to do thank you very much my mail: nhuxuanquang@yahoo.com | ||
| Stefan Fleischmann (Admin) |
My guess is the Excel file was stored in a fragmented way, so the recovered contiguous clusters do not contain the complete file. | ||
| AKshay relan (Akshayrelan) |
i wana know the ascii characters hidden in a folder | ||
| Stefan Fleischmann (Admin) |
Could you please try to elaborate and rephrase your question? I do not understand. | ||
| Chris |
I think Akshay is referring to the ASCII values of a file. Well, if you have any *good* programming book, you should find a list of them at the back. Or you could come back and tell us what the symbols look like. Once you get the ASCII value, to access you'd have to enter using the ALT key with the ASCII value. eg. ALT+value Stefan, it looks like this guy made some folder in DOS using unusual ASCII characters. The common reason for doing this, is so that someone not familiar with the ASCII code will not be able to access the directory using Windows. Alright, Akshay! What is it you're hiding in there?  BTW, how is the weather in India? Regards, Chris | ||
| Oddicy (Oddicy) |
I accidently deleted a very important file on my HDD. I tried to undelete it with Norton's unerase but it told me: "the first cluster of the file has been overwritten. Unable to automa- tically unerase. Try manualy." or something like that. Can WinHex help me solve my problem. And how exactly this will going to happen... Thanx anyway! | ||
| Stefan Fleischmann (Admin) |
I recommend you try the instructions given in the first posting on this page. If this is a FAT-formatted drive, also try the automatic FAT file recovery method in WinHex (see program help). | ||
| Anonymous |
I've recovered most of my files, (jpgs from a digital camera.) but some won't open and the preview thumbnail only partially loads in my Windows browser. if i try and open them in photoshop, it say's there's a "compression error." is there a utility to fix these corrupt files or a setting in the file retrieval process to allow full retrieval of these files? | ||
| Stefan Fleischmann (Admin) |
Did you recover with the file retrieval function? In that case there is a slight chance that the files were simply recovered with a too small size. Otherwise I'm afraid the files were either fragmented, or have been partially overwritten already with new data. In that case I'm afraid there is nothing you could do. Of course, you could ask a dedicated data recovery service to try (see knowledge base for a link). | ||
| Michelle |
Hi I accidently deleted my images from my Smart Media Card for my Digital Camera. Is there a way to get them back? I typed in Undeleting Smart Media Card and was directed here. If you can send reply to my E-mail addy. Thanks. Michelle | ||
| Stefan Fleischmann (Admin) |
Yes, there is a way, as discussed here. | ||
| Dr. DivX |
Just wanted to post a thank you message - my power supply died and nuked my photos directory on my hard drive - taking out about 8000 digital photos as it went. I had most of them backed up on CDR but the most recent batch was feared lost forever until I struck upon the possibility of scrounging around on my Smartmedia cards for residual files and managed to retrieve some priceless family photos. Thanks a MILLION for running this website - you are the reason I absolutely love having the internet at my fingertips. Now if I can just figure out how to trim all the excess file size off my recovered pics... hm... (starts reading again). | ||
| Stefan Fleischmann (Admin) |
You are very welcome. To get rid of the excess file size, if the files are intact otherwise, you could open them in any image editing software and save them again. Note that this leads to a small loss of picture quality in the case of .jpg files, because JPEG compression is not lossless in general, and each time a picture is saved it is compressed anew. | ||
| Anonymous |
I used a third party program to recover my deleted jpg images, but now the recovered images cannot be viewed. I think the images are still there, but it's corrupted somehow, so Internet Explorer cannot display them properly. I have heard some people say that a hex editor might be able to help. Is there any truth to this, and if so, how do I edit these jpg files in a way that lets me view these pics again? Any info is greatly appreciated. | ||
| Billmallin (Billmallin) |
This is more of a testimonial than a request... but I am so happy I had to share. A friend of mine came into town and we went to his first major-league baseball game. We took 60 pictures… great pictures! Got home put the smart media card in the reader… NOTHING! NADA! ZILTCH!!! ZIP!!! Needless to say we were more than pissed. Searched the Internet and found your product. Since all of the files are larger than 200K I simply bought the full version and let in run automatically. 3 pictures saved. Not good… though 3 is better than 0. I had several files saved, but only three were readable. After more reading on the site I found the following post from Stefan: _________________ Run WinHex and open your Smart Media (format specifications here) or Compact Flash memory card in the Disk Editor (menu Tools). Now you can use the File Retrieval function (menu Tools | Disk Tools) to automatically recover JPG files. With WinHex 10.5 this function has been renamed to "File Recovery by Type". As the file header, specify the hexadecimal values 45786966, standing for "Exif" (or 4A464946, standing for "JFIF", depending on the sub-format of the files) and a header offset of 6. You can either try specifying a footer (FFD9) or a fixed file size to recover (the usual size of your JPG files plus a generous safety margin, which does no harm). The other options should be filled with reasonable default values automatically. When you click OK, WinHex tries to find and restore all JPG files and saves them in the destination folder on your hard disk, where you can check them using your favorite image viewer program. __________________ Folks, this works! Tools | Disk Tools | Recover by type … then follow the directions Stefan posted above. I used 4A464946 at first and only got 3 pictures back. When I tried 45786966 as the file header, it retrieved them all. STEFAN… You are the MAN! | ||
| Stefan Fleischmann (Admin) |
Bill, thank you for your kind feedback! @Anonymous: Possibly the files were stored in a fragmented way (in discontiguous clusters). Manually recombining the clusters could help, but that's an awful task, especially if you don't know the file system fundamentals. If I were you, I would still give the WinHex functions File Recovery by Type and File Recovery by Name a try. | ||
| Anonymous |
I LOST MY PICTURES IN AN ACCIDENTAL FORMAT IN A FUJI FINEPIX 4900. IS THERE ANY WAY TO RECOVER?? | ||
| Stefan Fleischmann (Admin) |
If this format option was a quick, non-destructive one, very possibly yes. Please see here. | ||
| Anonymous |
Is there a way to restore deleted mail messages from the internet? I would like to recover all my messages from the beginning of the year 2002. They were all from the same email address. Thank you. J. | ||
| Stefan Fleischmann (Admin) |
Sorry, no, unless you have direct access to the mail server and its hard drive(s). | ||
| ka0tic r. brown |
Hi stefan...i just downloaded your program today...Here is the situation: i downloaded Key Thief Serv 2.0, i also created another file within the key thief folder so originally lets say, for example, my file would be e:\erase later\key thief\pics\meh\meh.jpg but now the pics folder is deleted so i am unable to link to the meh folder and im pretty sure the .jpgs and .mpgs are still there cuz they are pretty large and when i deleted the pics folder by accident it didnt take very long to erase. So im guessing it didnt erase any of the contents of the meh folder. I am wondering how i am able to just return everything back to the way it was before i uninstalled key thief and the pics folder so everything links up again....When i also search for the .jpgs and .mpgs files using the find folders on the start menu bar it cant find them probably cuz they are a broken link...thank you, your help is much appreciated ka0tic | ||
| ka0tic |
BTW one of the names of the actual files is called huge.mpg and it was in the meh folder | ||
| Stefan Fleischmann (Admin) |
The file recovery features in WinHex are described in the program help. You didn't mention for which step exactly you are missing instructions in the program help. If you wish to recreate an entire directory structure (including deleted directories) and this is on a FAT file system, please read the chapter about "3) FAT file recovery". If you just would like to recover .jpg and .mpg files, both "File Recovery by Name" and "File Recovery by Type" should work for you. If you are unfamiliar with the low-level stuff, I recommend you use Davory rather than WinHex. | ||
| ka0tic |
also the name of another file is "Noches de Vicio en BUDAPEST (7.23).mpg" which was in the meh folder and is no longer accessible becuz of a problem between linking | ||
| ka0tic |
do you think you could give me the link to the "3) fat file recovery" im having trouble finding it. right now my file system is FAT32 and i will try file recovery in the morning thank you | ||
| Stefan Fleischmann (Admin) |
In WinHex: Help | Contents | Data Recovery (at the bottom) | 3) FAT file recovery | ||
| ianmo |
i have erased the smart media card photos using my olympus 2100, without any connection to my pc. i understand tt there is no guarantee whether winhex can help recover my data just have to try. is it is must to have a smart media card reader in order to do the recovery? can i use the camera software to help read the card? unfortunately it doesn't recognise the card as a drive. | ||
| Stefan Fleischmann (Admin) |
If WinHex does not recognize your card as a logical drive or physical disks, yes, you would need a card reader. | ||
| Dobo |
Hello, I have recently been on holls and got some cracking photos of some mates skinny dipping... Unfortunalty, the camera got wet at some point in the evening. When I put the card into the reader it starts to autoplay, but then descides not to do anything at all... when I try to access the drive it says no, can WH help me here? I have tried the method described but WH will not read the drive either... Should I format the card and try again with freshly formatted card that will read? Any ideas, greatly appreciated | ||
| Stefan Fleischmann (Admin) |
For physically damaged media rather contact a specialized data recovery service. If you want to try to format the card, make sure you use a fast, non-destructive formatting option. | ||
| Richard Caulder |
Boot sector damaged by Norton utilities run from cd, (no backup). WinXP will not run with the drive installed. I used Western Digital Data Lifeguard to copy the drive. XP would not run with the copy so I formated the copy. Now I am trying to use Davoy to recover my files from the copy. The original drive is unplugged. I do not know the names of most of my files. Many are located in a folder called "download" where I have copies of software I have purchesed online. I purchased Davoy. I have a drive identical to the one damaged. Is it possible for me to copy the boot sector from the good drive to the damaged one? Or, could I simply errase the boot sector of the damaged drive, so WinXP can do a nondestructive format? I do not know enough about programming to use Winhex with confidence. Please advise. | ||
| Stefan Fleischmann (Admin) |
In what way was the boot sector damanged? Were some of the bytes in the boot sector altered? Perhaps this can be repaired manually. Yes, I highly recommend simply replacing the damaged boot sector with a healthy boot sector if this is a FAT-formatted drive, if the healthy drive has exactly the same specifications (number of clusters, cluster size). For NTFS it would at least be worth an attempt. You could try running Davory on the formatted copy if the file system is the same as it was originally. *.* would be a supported filename mask, but actually Davory is rather meant to recover single important files. There is currently no need to format the original drive if you have an exact copy of it that was formatted already. | ||
| Steve G |
Stefan, My Windows 2k drive was repartioned accidently. It originally was NTFS format and now shows as FAT32. I have been able to retrieve my .doc, .ppt, .xls etc.. files however am so far unable to get at my tax return .tax (Turbo Tax) I have created new dummy .tax files and examined them in hex format. I see similarities in certain areas, specifically the first at offset 00000000 BUT that is not the only place with similar hex numbers. Is it common for the header to be the first hex number listed or is there another option you would suggest to find the .tax file? I tried running Davory also and it appears that only ran on the repartioned FAT32 section of the drive as the NTFS partion is unrecognized. I have tried calling Intuit for the file signature info but have had no success in geting it yet. Any suggestions? Thanks | ||
| Reesah (Reesah) |
I accidentally deleted several photos that were saved in My Yahoo Photo Albumn. Is there any way to retrieve them. | ||
| Stefan Fleischmann (Admin) |
Steve: A unique signature by which files of a certain type can be recognized might be anywhere at the beginning of the files at a fixed offset. If you already found common byte values at offset 0, fine. Knowing the hex values and the offset enables you to use File Recovery by Type in WinHex to recover these .tax files. | ||
| Stefan Fleischmann (Admin) |
Reesah: I don't know what a "My Yahoo Photo Album" is. A collection of photos that resides on a Yahoo server? Sorry, WinHex and Davory only work on local hard drives. | ||
| Wayne Plumtree (Wayne384) |
Stefan, In "Help" under "FAT File Directory" you have the statement, "(Windows 2000 erases the upper 16 bits of the start cluster number when deleting files and directories.)" Could you provide a reference for this? I would like to read up on this characteristic of Windows 2000. Thanks for any information. Wayne | ||
| Stefan Fleischmann (Admin) |
I found out about this myself. I cannot provide any reference. You can reproduce and observe this easily with behaviour WinHex. It unnecessarily causes severe problems for data recovery on FAT32-formatted drives. BTW, this also holds true for Windows XP. | ||
| Daniel B. Sedory |
Stefan, RE: Wayne Plumtree's question about your note that Win2k erases the upper 16 bits of a FAT32's Starting Cluster number... I have done a great deal of research on this and have found that it will occur with any version of Win2kPro (original, SP2 or SP3) and most likely all Server versions as well, BUT ONLY if the file data is NOT retained by the Win2k RECYCLE BIN! In other words, you must have the FAT32 partition set up to never use Win2000's Recycle Bin, or ELSE you must use the SHIFT key + DELete key combination which makes sure that the file will NOT be saved in the Recycle Bin!! If you delete a file under normal methods (with a functioning Win2000 Recycle Bin), THIS WILL NOT OCCUR! I hope this is interesting enough for you to do some further testing on your own; in which case I'm sure you'll want to provide additional info in your next WinHex Help File about it ;-). PS: I would have made up a web page about this using screen shots of WinHex, but can not afford to buy a license having been out of work for a couple years now! I might be able to do this with the eval. version; not sure. Sincerely, Daniel B. Sedory http://thestarman.infotecbusiness.com/ (My UK/European Mirror site.) | ||
| Stefan Fleischmann (Admin) |
You are right, thanks. Strictly speaking, when sending/moving a file to the recycle bin, the upper 16 bits are not erased. When a file is deleted directly, the upper 16 bits are erased. | ||
| Daniel B. Sedory |
Stefan, A couple more notes to clarify things: It took me a while to notice what was happening since both of us apparently run our computers with the Recycle Bin set to keep files out of it (or at least those of FAT32 partitions). I got an e-mail from Wayne Plumtree who said that even if he removed a file from the Recycle Bin after deleting it, the upper 16 bits of the Starting Cluster number still remained the same. So, any files you delete MUST never be placed into the Recycle Bin for this to happen. Since the majority of 'users' always run Windows with the Recycle Bin active, there are probably only a few who would be affected by this phenomenon. Sincerely, Daniel B. Sedory http://thestarman.infotecbusiness.com/ | ||
| Anonymous |
stefan, zuerst ein riesen danke für dieses wundervolle strück software! re: undeleting files on ntfs "On an NTFS drive you could try recovering the files manually, or using Tools | Disk Tools | File Retrieval." i tried this and winhex recovered no files at all! btw why isnt it so easy anymore as it was with a special template (which i dont have anymore) by simply browsing the file table and just overwriting the first character (which indicates that the file is deleted) of a deleted-file entry? i think this template was for fat32 but isnt this possible with ntfs too? how does ntfs delete files? not by simply overwriting the first character of the file name? but anyway i cant find it for fat32 too anymore. where is it? | ||
| Stefan Fleischmann (Admin) |
> i tried this and winhex recovered no files at all! Meanwhile both methods are available for NTFS, File Recovery by Name and File Recovery by Type. > why isnt it so easy anymore as it was with a > special template (which i dont have anymore) by > simply browsing the file table and just > overwriting the first character (which indicates > that the file is deleted) of a deleted-file entry? That alone would never have worked, as (in the case of FAT) not only the directory entries (which you seem to call file table), but also the file allocation table would have to be changed. Anyway, the template for editing FAT directory entries is still included in WinHex. > i think this template was for fat32 but isnt > this possible with ntfs too? No. > how does ntfs delete files? not by simply > overwriting the first character of the file name? No, and neither does FAT. In FAT, the file allocation table has to be partially cleared to release the clusters allocated to that file. In NTFS the first character of the filename is not cleared, the FILE record is marked by other means as no longer in use, the reference to this FILE record is removed from the directory INDX record, the volume bitmap that indicates free clusters is updated, and possibly other things. > but anyway i cant find it for fat32 too anymore. > where is it? The name of that template is "FAT Directory Entry". | ||
| Mandy |
I wanted to move my photos to my computers hard drive tonight because I needed a clear flashcard and accidentally hit cut in the cameras files and then pasted them to my comp (where ive always copied and pasted before) Something went totally screwy and the paste only worked for around ten of 128 shots, but totally emptied all the photos off my flashcard. Ive tried both programs mentioned but they are both saying they cant read the sectors. Am I doing something wrong or am I out of luck? | ||
| Stefan Fleischmann (Admin) |
With such an error message you are most probably not doing anything wrong. I can only recommend, if available, to try the other kind of access as well (as a physical disk instead of as a logical drive, or vice-versa). | ||
| Mandy |
I wanted to move my photos to my computers hard drive tonight because I needed a clear flashcard and accidentally hit cut in the cameras files and then pasted them to my comp (where ive always copied and pasted before) Something went totally screwy and the paste only worked for around ten of 128 shots, but totally emptied all the photos off my flashcard. Ive tried both programs mentioned but they are both saying they cant read the sectors. Am I doing something wrong or am I out of luck? | ||
| Anonymous |
I accidently saved a Microsoft Works Document over another document that I needed. How can I recover this overwritten document? | ||
| Stefan Fleischmann (Admin) |
What was actually overwritten cannot be recovered any more. If the new file was smaller than the original one, the tail of the original one may still float around in currently unused drive space (until it is overwritten by some other newly created or growing file as well). At any rate, one of the temporary copies that MS Word creates when working with documents may still float around as well if you have opened the missing file lately. I recommend you try method 1 in my posting at the very beginning of this thread. With some luck you will find something and then be able to use copy & paste to recover raw text (without formatting). | ||
| Anonymous |
Hello, I hope you can help me, I currently have a Maxtor portable hard drive that holds all of my personal and business files, while installing a new usb connection (upgrading to 2.0), the system crashed and could not recognize my portable drive, after uninstalling the upgrading usb hub, my portable drive is no longer in a fat format, it now states it is raw, I know my files are still there. Is there a way to recreate the fat format without losing the data on the hard drive? | ||
| Stefan Fleischmann (Admin) |
Yes, this could be done manually using WinHex, with the necessary knowledge about the FAT file system. | ||
| Anonymous |
Thank you for the quick response, is there any documentation I can read to understand the fat file system. I know how to use a computer but do not know what makes it work. | ||
| Stefan Fleischmann (Admin) |
There is a link to the WinHex Knowledge Base in the left frame of this forum. | ||
| Anonymous |
Hi Stefan, I took ~130 photos with my new minolta dimage Z1 on saturday, and transferred them successfully to my laptop, but in attempting to delete a bad shot i accidently deleted the whole folder, but had already deleted them from the camera. i searched the net, and came across 'recover my files' and used that to search my c drive for the missing pictures, and retrieved the last 100 or so pics from the folder, so paid for registration and saved them. The software was unable to retrieve images for the first 25 or so pictures, but found files for these 25 that it recognised as Jpegs, with the correct sort of size (600-700kb), but was unable to open - i just got a white square with a red cross like on failed web images...the software said these files were overwritten (although it managed to find hundreds of older pictures that i'd intentionally deleted and it also said were overwritten). anyway i admitted defeat and went out on sunday and took 100 more pictures, and only when i was transferring these to my laptop did it occur to me that i could have searched the smart media card.... so i tried photorescue and that found the last 50 photos i took on saturday, but not the earlier ones - presumably as i'd over written the files by taking more pictures on sunday... is it possible 1) that there is anyway to retrieve these files from my camera still, or is it likely that they are overwritten and so gone forever 2) that winhex might be able to restore the JPEG files that had sensible sizes but wouldn't open? Thanks in advance for any advice.... | ||
| Stefan Fleischmann (Admin) |
1) Depends on the overall size of all files. 130 files with 700 KB each ~ 90 MB. 100 files with 700 KB each ~ 70 MB. Obviously 70 MB cannot fully overwrite 90 MB, so maybe 20 MB are still recoverable from your earlier 130 pictures. 2) Possible, yet unlikely. | ||
| Anonymous |
I know someone who went to a seminar, wrote down notes on a school laptop. Then they saved the files onto the school network. When they looked on the network, they weren't all there. So we need a way to recover the deleted files from the laptop. I believe they were spreadsheet files. Windows XP I think. WH would help here, right? -Thanks | ||
| Stefan Fleischmann (Admin) |
Yes, very possibly so. You could try to locate and recover the notes manually by searching for known text fragments on the drive, or you could try the automatic file recovery functions "by name" and "by type". | ||
| Anonymous |
could i use this downloadable version? Or would I need to purchase the full program? -Thanks | ||
| Stefan Fleischmann (Admin) |
The downloadable evaluation version allows to recover files up to 200 KB. | ||
| Keisha |
Hi Stefan, Unfortunately, I accidentally deleted some audio files from a CompactFlash memory card. Are they recoverable and if so, how? Thanx | ||
| Stefan Fleischmann (Admin) |
Principally in the same way as described at the top of this page for pictures, using Davory, method "File Recovery by Name" or "File Recovery by Type". Good luck. | ||
| ........... (Ron) |
Hi I am having trouble creating a directory on my target drive when trying to recover files by type or wildcard. once created and the files are recovered to that directory i cannot see it. as if the directory is hidden or not there. even when looking at that hd on its own i cannot see the recovery directory that was ceated when doing a recovery. PleaSE HELP.............URGENT | ||
| Stefan Fleischmann (Admin) |
Please either make sure yourself that the output folder exists before starting the recovery procedure or try Tools | Folder Options | View | Hidden files and folders | (O) Show hidden files and folders in Windows Explorer. At the moment I cannot explain why the output folder may be created with the "hidden" attribute. Please refrain from deliberately posting duplicates of the same message/problem. This forum is meant to be of high value for other users as well. | ||
| Anonymous |
Hello, My HDD went haywired and I lost an important volume file. Scandisk 'repaired' the drive but my file was whacked. Scandisk reported it as having 'lost clusters' and 'freed' the space. Now the file is truncated and worthless. Is there any chance I can reconstruct the file with WinHex? BTW, this was on a Win98 box (FAT32) and the drive was defragmented prior to this incident. - Thanks | ||
| Stefan Fleischmann (Admin) |
> Is there any chance I can reconstruct the file with WinHex? There is a chance to do this manually, yes. If the file was indeed not fragmented, and the data is still there, you could adjust the file size in the directory entry of this file (you may use the directory browser in WinHex to locate it), e.g. using the template "FAT Directory Entry". Then add the following clusters to the cluster chain by editing both copies of the file allocation table. For more information on how the FAT file system works, please refer to the WinHex knowledge base, or ask here if you have specific questions on this. | ||
| Anonymous |
hi stefan i wanna o how to errase HDD and how to make particion one just for win and scnd. for (like programs ) | ||
| Marius |
Hello. This is my "nightmare": Step1: "cut"/"Paste" from Memory Stick to PC Step2: system crash during transfer Step3: rescue from MS the deleted pictures (#sc00345.jpg ...) Step4: formatting MS and losing everything on it, unfortunatelly all headers. Question: I have all these non-viewable pictures on my HDD with correct sizes,corect extension but with no header.What can i do? Can i recover them by "building" the lost headers with WinHex? | ||
| Stefan Fleischmann (Admin) |
I don't know how file headers could get separated from the main parts of the files like this. However, the answer is probably that manual recovery with WinHex should be possible, then. | ||
| Steve |
I use win xp pro ntfs. I cloned c: onto a new partition d: in order to preserve data, to re-install win xp on c: as it was mis-behaving. After doing this I found that the documents folder on d: had disappeared thereby losing all my data. The new documents folder on c: did not contain this data, windows setup had deleted it all. The data still seems to be there as the "space used" on the partition is still the same as it was. Norton Utils "Cleanup", when started but not finally "OK'd" reports many mbytes of space can be recovered, this would seem to correspond to the space my data would occupy. Norton Un-delete utility cannot find these files to un-delete. Most of these files are MP3 and JPG so are quite large. Can WinHex help me? Thanks Steve | ||
| Stefan Fleischmann (Admin) |
Probably yes. I recommend you open the partition or the physical disk and try both File Recovery by Name and File Recovery by Type on it. .mp3 files cannot be retrieved by File Recovery by Type, though. | ||
| Amine Brikci-Nigassa |
Hi, A friend of mine lost all his DOC and XLS files (certainly due to a virus). I used a data recovery tool (GetDataBack) but it didn't find all the files, especially an important XLS one. In fact, it found it but with the wrong content. I think I'd rather look for lost files with the signature but my tool only knows the signatures of DOC, JPG, ... files and NOT XLS! Can you help me ? Do you think I should try to use the XLS file signature, and where can I find it ? Thanx | ||
| Stefan Fleischmann (Admin) |
You may want to try "File Recovery by Name" in Davory, where MS Word documents and MS Excel spreadsheets share the same signature. When the recovery has finished, rename all .doc files in the output folder to .xls and try to open them. With some luck, the file you are looking for is among them. | ||
| Anonymous |
Is there a list of typical file extension to common byte vaules and thier respective header and footer? (Example: .eps | "%!PS-Adobe" "%%Trailer" | 252150532D41646F6265 and 2525547261696C65720A) This would make using the file recovery much quicker for typically lost files. .doc, .xls, .pdf, .jpg, .gif, .mpg etc | ||
| Stefan Fleischmann (Admin) |
Sure, this exactly how File Recovery by Type works in WinHex and Davory. Both come with such a list that you can even customize to your own needs. WinHex: File Type Signatures.txt Davory: filetype.txt | ||
| Hesham Refaat (Stonefish) |
Dear Sir i think i had a virus on my PC we share docs on a network suddenly i found all my docs (excel, word , JPG ) has been resized to ZERO the file name is still available but with no data inside ...PLS this soo URGENT i need help in this | ||
| Stefan Fleischmann (Admin) |
You could try "File Recovery by Type" in either WinHex or Davory. | ||
| Hesham Refaat (Stonefish) |
Dear Sir I tried many times using WinHex and also Davory but nothing recovered ...the files has no headers and WinHex can't do anything tword this ...Pls Advice | ||
| Stefan Fleischmann (Admin) |
If so, the files (or fragments of them) can only be recovered manually. | ||
| Brian Sommsie |
Stefan, First, thanks for taking the time to answer these questions. here's the scoop: In a pinch, I purchased a new SmartMedia Card as well as a PCMCIA reader for my laptop. I inserted card into Fuji FinePixS302 Camera, formatted card and began taking pics. I was able to take, store, and view all pics on my camera. I inserted card into the reader on my computer and it didn't acknowledge that the card had any files; it just prompted me to format. I tried inserting the card back into the camera, and it gave the Card Not Initialized Error. Figuring that I was out of luck, I formatted the card on both the computer and the camera. I have not taken any new pics or used the card since formatting (so I hope that leaves me some chance of recovery). Any ideas on how to recover? Thanks so much for any help! | ||
| Stefan Fleischmann (Admin) |
As far as I know, FUJI cameras erase and format cards in such a way that files are irreversibly overwritten and destroyed. I wouldn't know how to recover your files. You could ask FUJI's technical support, though. | ||
| BJ |
Hiya! im trying to access a disk drive through winhex, but when i go to Edit Disk and try to choose it from the Logical Drives i get an error message. although i can access it through the Physical Drives. so in the Phys Drive is there a way to use the Tools | Disk Tools | List Directory Clusters? because i try to do it but its greyed out. i want to browse the HD using the Directory Cluster because there are many directories i want to recover. plus i dont really know how to use hex stuff. | ||
| Stefan Fleischmann (Admin) |
What you need to do is open the partition from within the physical disk, using the Access button menu. Plus I recommend using the latest version of WinHex. | ||
| BJ |
okay.. i opened the partition using the access button. now what? i tried doing the Re-Scan Cluster Chains but it seems like it didnt do anything. i also noticed there is a lot of *** sector could not be read *** messages on the right collumn. is that a problem? this is the first time ive used WinHex so i have version 11.26. would there be like a walkthrough about this? or maybe some simplistic instructions? | ||
| Stefan Fleischmann (Admin) |
There should be no menu command "Tools | Disk Tools | List Directory Clusters" in WinHex 11.26 any more. It existed in earlier versions. > is that a problem? Well, bad sectors are a big problem, of course. And they may prevent WinHex from reading important file system data structures. > or maybe some simplistic instructions? Walkthrough? Instructions? For what exactly, please? WinHex can be used for thousand things, and obviously I cannot provide instructions for each and every conceivable purpose. When you buy a screwdriver, you won't get any instructions at all because a screwdriver can be used for a thousand different things as well. So far I only know you are trying to use a function named List Directory Clusters. If the drive is not too much damaged, you should see the directory browser (what is this?). You could then right-click a directory and use its context menu to get a list of the clusters it occupies. | ||
| BJ |
sorry i ment instructions for data recovery. so what version is that in the link you gave? because it doesnt look like mine. also the "Tools | Disk Tools | List Directory Clusters" that i said is actually "Tools | Disk Tools | List Clusters.." i figured that it was the same thing. so this is what i did. Tools | Disk Editor. then i went under Physical Media to HD1 which is the drive in question. The i went to Access | Partition 1 | Open. it opened up a new window with more hex code, but no directory browser. | ||
| Csaba Nagy (Csaba911) |
Hi As of my bad habit, replaced the second HD will the OS was running, until today every time worked. No I stuck with the previous drive fat table. The properties of the HD is correct, but if I open the explorer I got unreadable 300Gb large files, the drive is 20Gb. Just tried Partition Recovery 2.1.1 and according the report now I have a 12.7GB fat32 and 5.9Gb unallocated. Let me explain step by step what I have done. -windows XP running; -explorer open, exploring drive D; -unplugged the 13Gb drive; -plugged in the 20Gb drive; -hit F5 to refresh; -and got only junk on the screen; -rebooted the pc; -same result; Is there any way to fix this ? I have over 2000 personal photos and many home video on this drive! Please help me if you can. Thanks for reading. STEVE | ||
| BJ |
hmm? | ||
| Stephen D. Brady (Noleman84) |
Without having to resort to using Diskedit, I was wondering if you would provide me with the steps in MANUALLY recovering folders and files removed from a formatted (q) phyiscal device? I have WinHex 11.2 (Specialist) and I know that with the format function, the FAT is "zero'd" and the directory or directories is/are marked as deleted (hex E5). Is there any way that I can manually rebuild the FAT table? Recovering the deleted directories and files, I assume, would be just remove the E5 character, replacing it with another valid character (hex F6 (_)), but I need to make sure. Any help would be greatly appreciated…as always V/R noleman84@comcast.net | ||
| Stefan Fleischmann (Admin) |
> Is there any way that I can manually rebuild the FAT table? Manually? Sure. You can edit each and every byte in WinHex. The Details panel points out which entry exactly the cursor is currently located at. You could use the Access button menu to locate the beginning of both copies of the file allocation table. > Recovering the deleted directories and files, > I assume, would be just remove the E5 character ...plus set the corresponding entries in the FAT table to appropriate values, for the first cluster and all following clusters. However, I recommend you save yourself a lot of work and use the directory browser's or Access button menu's commands to conveniently copy directories and files off the drive. | ||
| ilana hayary (Ilanahayary) |
suddenly' it has dessapeared my unarrase protect from Norton: it is cesed to work, it was ok all the time ( I have it for a few months already). I have XP, Norton antivirus, and windows 2000. I always thought that I needed to errase all the files (somes times they are more than 1,000(!) and I delete all of them, because I don't want to have this tool fool. What am I doing wrong? Why this tool doesn't work anymore? Thanks in advance. ilana | ||
| Carol Maginn |
I accidently washed my pants with 500 photos on my scandisk compact flash card in the pocket of the pants. They didn't go in the drier though. I am worried sick as I have not yet been able to try the card since it is at my friends house. Do any of you know if my scandisk will be totally damaged and if the photos will be recoverable? | ||
| Chris Randle (Narny) |
This might raise your optimisim a little http://news.designtechnica.com/article5140.html The SanDisk site has a lot of stories, such as yours, with happy endings Go to www.sandisk.com and search for "survive". This story caught my eye as recounting situations similar to yours and a lot worse. http://www.sandisk.com/pressrelease/001219_toughness.htm | ||
| Amanda Harcourt (Manda) |
Please help! i need a miracle.. I accidently clicked the format button on my camera and now i have no photos left of my european trip! some of my happiest memories are now gone.. is there any way on this earth i can retrieve them? | ||
| Stefan Fleischmann (Admin) |
Please see these instructions. |