Recovery Force® Data Recovery Forum

Hello,

I've a very specific problem and I am interested if there is still any hope to recover 3 specific files (I don't think so, but I'm not a pro in the data recovery field).

Problem:
I copied some data to a usb stick and after a few weeks to a hard drive. Afterwards I formatted the partition of the usb stick from NTFS to exFAT. At some point I realised that 3 of the copied files (archives) are damaged. (At this point I recalled that I ran chkdsk on the usb stick once because there were some errors)

Recovery Attempts

• First, I used 'recuva' to search for the files on the usb stick, but nothing could be found.

• Afterwards I tried 'recoverit' and 2 of the 5 archives could be found in the same folder structure. I also searched in the found.00X folders and in RAW files. Nothing.

• Then I used 'MiniTool Power Data Recovery' and all 5 archives could be found. However, the file size of the 3 archives is 0 byte. Searched again in the found.00X folder but all files have either 0 byte or are way too small for the 3 archives.

• As I still didn’t want to give up I used another program called ‘R-Studio’ and again all 5 archives were found but Recovery Chances for three archives are marked black “Zero-sized”.
  
  I checked these 3 files in more detail and found out following:
  File name, file extension, created/modified/accessed date is still displayed. In the ‘Hex View/Edit’ the Sector size has a value of 512, but no data in Offset (Sector, Position in sector).

(Note: the searching in the found.00X/Raw files has been done by [creation/...] date/file size/file extension/name)

My question now is: is the file name and the information of the dates only information of the MFT? Does that mean, that the important information (file content) is not connected anymore to this information or totally lost/destroyed?

Thanks in advance for any ideas!

tomato soup wrote: ↑Tue Apr 09, 2019 3:25 am My question now is: is the file name and the information of the dates only information of the MFT? Does that mean, that the important information (file content) is not connected anymore to this information or totally lost/destroyed?

I suspect that you may be finding parts of the MFT and INDX records, but not all of them, due to overwriting. The odds are, your files are not recoverable. If they are, you'll likely need to do a RAW recovery, based on the file signatures and being able to follow the paths of fragmentation. This is a lot easier said than done and, in most cases, a wasted effort if there has been any overwriting of the sectors where the file once was stored.

Ok, thank you for your information!

I'm sorry about what happened to you. I think after formatting, the first step is to remove the hard drive from the device if possible, or otherwise stop using it. Any actions, even installing a recovery app, risks overwriting the files you need.
I had similar problems before. As I formatted my hard drive, I realized that there were some important files. I tried many solutions to get them back.
It' s difficult to recover data id if there's any overwriting.

Don't even bother trying Bitwar Data Recovery, as they are just a spammers who make fake user posts, like this one, to make it look like they are a good data recovery program.