| Author | Message | ||
     Al Roka |
Please help me with the following project. Some kind of trojan harmed my 80GB Maxtor firewire drive. It resulted in a root directory which was recursive (each directory showed the complete root directory, and so on). I (stupidly)ran Norton Disk Doctor, and it found a 2nd FAT, and then it asked me several times if I wanted to convert directories into files. I stupidly (this was late at night) answered yes to some, and now I have about 4000 files on the drive that range from 2KB to about 200MB that are called ***_.NDD, plus a few directories that appear whole with lots of small files. The total size of all these files combined does not add up to the space taken up by the original files that are gone, which was probably around 20 gigs or so. There is also a directory that has thousands of unrelated small jpg files (which I am wondering if I should just back up and wipe so that they do not interfere with the project of recovering the other files?) The files I am trying to recover were two main kind of files. One type, text files, lots of them, was in a directory called c:/PNGN and the other was was a directory (whose name escapes me)with image files which were .jpg files from a digital camera, usually consisting of file sizes around 800-900k and some around 1.5MB. There were probably about 10 gigs of them. Can anyone recommend where to begin on this project? The text files are irreplaceable (of course) and included in the jpg files are some World Trade Center shots. I now own a registered single non-commercial copy of Winhex 10.4. Thanks to all. | ||
| Stefan Fleischmann (Admin) |
I recommend you search for the clusters with the directory entries of the text files. It would be best if you could remember one of the text files' names. For example, the directory entry of "abc.txt" would be "ABC TXT" (with 5 spaces). Use Search | Find Text. Proceed analogously for the other directory. When the cursor is in such a directory cluster, use the Access button's menu command "Recover current directory" to replicate all the file on a different drive. | ||
| Al Roka |
Thank you. I have experimented with the Recover Current Directory on a test drive on another machine, and it seems to work well. However, I am still curious about the following: 1) What is the effect of having run NDD and having all those .ndd files? Did that move files, or break them? Or are these original files that have been renamed and relocated? Should I perhaps just copy all of these .ndd files somewhere else and then wipe them out on the source disk, so that they do not interfere with other recovery efforts on other files that were not (were they?) turned into .ndd files? Again, I think that all of these were created by my original answer of "yes" to what I recall an NDD question was, about turning directories into files. 2) My two major directories, one containg .txt files, and the other the img jpg files, are gone. How will that affect this rescue effort? 3) Does it make sense to back up and then wipe with zeros the one directory with many small jpg files, so that it does not interfere? 4) I believe that I now recall the directory name of one of the major directories, e:\windows3. It is not there anymore. And it had lots of subdirectories under it, containing the missing img jpg files. Should I search for "windows3" using the technique described above, and then try to recover the img jpg files still there? (Or did that NDD process, creating the 4000 .ndd files mess everything up so that this is no longer useful?) I appreciate all your help, and am trying to get a bit more particularized information so that I can maximum information out of this hard drive. Finally, I notice that some choices are still greyed out, though I am registered. How do I turn my current registration into a higher level one which unlocks these features? Thanks again. | ||
| Stefan Fleischmann (Admin) |
1) Sorry, I cannot tell you about what NDD exactly does with these files in such a case. I would recommend against deleting them until data recovery is over. 2) Are the directory entries for these directories in the root directory gone only (not too bad), or the clusters with the directory entries of these directories themselves (worse)? 3) If you are going to use the "Recover current directory" approach on the two major directories, the existence of this directory will not interfere. Only if you are going to use the header-based approach Disk Tools | File Retrieval to recover the .jpg files, the small .jpg files will be recovered as well. If these small .jpg files are really irrelevant to you, yes, then you could wipe out the clusters with the directory entries of that directory (if you know exactly what you are doing and that you have located the correct cluster[s]). 4) Yes, you could search for "indows3" then. That leads you to the directory entry for that directory, in case that entry still exists. The Access menu lets you jump to the cluster with the directory entries of that directory, then. There you could choose "Recover current directory", with subdirectory included. I do not know whether or not NDD left the directory entries untouched. I hope this helps. |