| Author | Message | ||
     Devan Strong Username: shooter321 Registered: N/A |
hi everyone, thank you for your time. I'm kind of new to using win hex as a recovery program but the more I've been using it the more I like it. Anyways, maybe you can help me with a problem. I recently had a external drive which I deleted important files from. Once I did it i immediately noticed my mistake and didn't do anything else to it and have spent the last week trying to recovery it.I have recovered everything it seems but one folder which is seen in winhex but has no files in it yet I know there were. i have tried using winhex to recover the entire folder as I don't remember much about the data inside it but nothing is there. Is there another way to recover whatever data was inside? i know with files you might be able to look up by file signature to retrieve it but i;m not sure that would be possible with a folder as it is likely that all the data is stored in a different spot. | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
The 'file header signature search' is possible independently from a file system. The only disadvantage is, that only certain supported file types will be found and only the first fragment, if fragmented. There are additional recovery methods possible for NTFS file systems with the forensic edition of WinHex. Further recovery is available for Windows Vista systems. | ||
| shooter321 Username: shooter321 Registered: N/A |
Thanks for getting back so quick. so seeing as how I don't know what types of files were inside that folder. although I think there was a .tib file. what would you suggest should be the next thing to do to get the data back? | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
First: Add the definition for a TIB-file to 'file types signatures.txt'. Acronis True Image file tib \xB4\x6E\x68\x44 0 (make sure columns are separated by TAB's) Second: Run the carving. If you have a specialist license or higher: file header signature search, otherwise Recover files by type. Determine the file system type. For NTFS there are additional chances. | ||
| shooter321 Username: shooter321 Registered: N/A |
so I wasn't able to retrieve the right tib file and the ones I did retrieve were all corrupt and read to have o kb. is there a way to fix that and another way to search for the files in that folder? thanks again for your responses. | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
Who claims the files to have zero KB? WinHex? TIB files would not have 0 KB as a carving result. Which version of WinHex do you have actually? Fragmented files cannot be recovered completely with WinHex and "Carving" (or other tools). If the file system is FAT, then there is no chance for a full recovery. | ||
| shooter321 Username: shooter321 Registered: N/A |
as far as I know the file system is ntfs I'll double check tomorrow. I'm really new to winhex and trying to get a handle on it before buying it so i'm using the demo.When I recover the file by recover by the file type option. windows see it having 0 kb. | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
In this case I guess you entered a zero in the default size column instead of the offset column. You can open the signature table with Excel and check on this. If you have an NTFS file system it is important that you make a copy of $LogFile. This gets changed every time you mount that file system and it can happen that valuable information needed for recovery gets overwritten some time. | ||
| shooter321 Username: shooter321 Registered: 1-1997 |
okay the hd is ntfs. sorry to be asking this how exactly do you open the file signature in excel 2007? I done some researching but am not finding out how. | ||
| Alfons Kramer Username: admin3 Registered: 4-2004 |
In WinHex Specialist (and above) there is a button "signatures" which will start Excel. For other versions, locate the text file. From the context menu: open with ... | ||
| shooter321 Username: shooter321 Registered: 1-1997 |
hey thanks again. i did try that first before doing any research it didn't work it pulled up the file without any text information. since then I've tried another .tib file which were too large. I did pull up a text file to see what I should be looking for but nothing else. |