Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently I often edited a txt file with Notepad++ on Windows XP and gedit on Linux (Mint). During shutdown on windows, it seems, that file was corrupted. This is the second time that this happens and both corrupted files now start with INDX(.

Unfortunately I made a backup (with rsync) this morning, which also copied the corrupted file.

Perhaps this also could have anything to do with problems on the hard disk, but its more unlikely, because I checked it already with different tools on both hard disks.. (chkdsk, smart)

This is the start of the file-content: (if you need everything, please ask me)

INDX(                    (       è      U Ì                   ©c     h T     òã     ¼µ
share|improve this question
    
you are not using hibernation on windows, right? –  Michał Šrajer Aug 7 '11 at 14:10
    
@Michał Šrajer No, but it can be, that I tried it once. –  Joschua Aug 7 '11 at 14:15
add comment

1 Answer

up vote 1 down vote accepted

Stop writing data to the hard drive or you'll decrease the chance to recover anything...

First try How do I recover lost/inacessible data from my storage device?

If that doesn't help, WinHEX (paid) has a pretty good forensics mode.

share|improve this answer
    
I think this won't help me, because this only covers lost files or problems with the filesystem or hard disk, but neither of these seems to be the case, as I already checked if there are any problems and my file isn't lost - just corrupted. Thanks anyway! –  Joschua Aug 7 '11 at 16:11
    
@Joschua: That's just ignorant behavior, as you can recover it if it hasn't been overwritten by further usage. If you do not do this now, you will never manage to recover it. I also suggest you to use sync on shutdown to prevent faults like these, and use a tool like HD Tune as your HDD might be malfunctioning. –  Tom Wijsman Aug 7 '11 at 17:20
    
Ok, I will try PhotoRec in the hope that it also handles file corruption. Just as you said, I already stopped writing data to the hard drive. –  Joschua Aug 7 '11 at 18:04
1  
Hmm, didn't work :| I got a lot of files, but I couldn't find anything with grep. It seems I have to write everything again, Yay! :( One question: Do you know what this INDX( means? –  Joschua Aug 7 '11 at 22:20
1  
@Joschua: In the standard index header the four byte structure element, magicNumber contains the actual ASCII string "INDX" as a marker to denote the actual beginning of the index standard header. - Source: NTFS Forensics - It seems to me the original file record is pointing at a random location... –  Tom Wijsman Aug 8 '11 at 12:16
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.