7

I made a mistake and deleted a 6/7GB file on an external hard drive with NTFS and now I'm trying to undelete / recover it.

I tried with Recuva and the file is there but with filesize 0. it seems NTFS handles big files differently so I need a recovery software that knows how to deal with this, any tips?

Searching, I found this post: http://forum.sysinternals.com/undelete-big-files_topic11539_post52762.html#52762 that explains why big files in NTFS are deleted differently but offers no solution.

In case this is relevant (I see some recovery programs looking for signatures of files) the file was a truecrypt mounted disk, with extension .iso.

So, what's the solution?

Improve this question
4
  • I've had great luck with an app called getDataBack with NTFS. I'm pretty sure I've recovered files that size without difficulty (though I'm not certain, which is why this is a comment and not an answer). There is a demo version at the link I provided, but I don't know if there are functional limitations to that version. If you do recover the file, make sure to recover it onto a different disk!
    – Fopedush
    May 21, 2011 at 4:33
  • It finds the file with 0 file size :(
    – AlfaTeK
    May 21, 2011 at 15:03
  • I don't think it's the size that matters, it's whether or not it's very fragmented. Was your file very fragmented?
    – user541686
    May 21, 2011 at 23:29
  • @Mehrdad I don't know :\ from what I read it seems big files are treated in NTFS differently during deletion.
    – AlfaTeK
    May 22, 2011 at 0:44

4 Answers 4

Reset to default
7

Some points to note.

  1. Large files are usually deleted completely (recycle bin is not in the path),
    so, an Undelete is out of the question.

  2. Your steps would then typically be towards Recovery of the file from deleted and yet unused areas of your disk.

  3. Since, your disk is external I am assuming it is not used for storing other dynamic files.
    If you start using the disk (edit existing files or write new files) you will start walking over the deleted areas which contains your huge file.
    Effectively, permanently loosing any data that the tools discussed here will try to recover.

  4. That means, you have some chance of recovery along the lines discussed here.
    But, be wary, with 6-8 GB worth of data, you will typically not get all of it (since this file is very likely to be fragmented).

  5. How was the file created in the first place?
    If it was created slowly (like log files are appended to) it is likely to be very fragmented.

  6. Is it worth recovering this file partially?
    Because, your probability of complete file recovery is inversely proportional to the number of fragments it is broken into.

  7. Now, this might sound extreme, but if you are going to try different things to recover your large file from that external drive, and you are ready to invest in a second drive of the same size, I recommend you image that drive before starting recovery work on it. That way, you can try recovering your file from a copy of that image with different techniques you learn over time.

    • You might want to read this DataRecovery page at Ubuntu documentation
Improve this answer
1
  • thx for the tips, I know that but what I want is a program that can recover correctly the big files which seem to be handled differently in NTFS as per my link. Recuva and getdataback find the file with size = 0
    – AlfaTeK
    May 21, 2011 at 15:06
2

I was able to restore 4Gb file using PhotoRec (from testdisk-6.12 package) and custom signature for it. Initially I had investigated and tried a lot of "undelete" tools with equal result they show nothing or zero length file.

PhotoRec did find my file by signature and started to recover, the only with one problem, it wasn't able to find end of file continuing writing after the real file size (I stopped it when size was x4 larger).

After that knowing file size I just truncated it to required and rechecked signature at the end, fortunately it was exactly as expected :-)

Sequential verification hasn't found any issues with restored file so I am very happy in result.

P.S. I almost sure that my file wasn't fragmented.

Improve this answer
1

A year late, but Restorer Ultimate the paid version is a must. Get the demo and you can view all your files and if you are satisfied with what you see (It will tell you sizes and whatnot) then I would go for the full thing, I just got it and am recovering 20GB+ files that were high definition movies

Improve this answer
1

There are several people reporting success with R-Studio:

http://windowssecrets.com/forums/showthread.php/137552-Tools-for-undeleting-files-larger-than-4GB http://www.r-undelete.com/

Improve this answer

Not the answer you're looking for? Browse other questions tagged .