up vote 1 down vote favorite
share [g+] share [fb]

Is there an app that can save all of the free clusters on a disk to a file?

In some circumstances, when a file gets deleted, the only way to try to recover it is to scan the disk (or partition) for a unique string or something that is known to be in the file. If the disk is fairly full, then it is much easier to scan the free clusters for the content of the missing file than it is to scan the whole disk.

Is there an app that can save free clusters to a file? Alternately, is there a data recovery app or disk viewer that can narrow a search to free clusters?

Thanks.

link|improve this question
48% accept rate
It might be even better if the tool could save the clusters to separate files, then they could be combined as needed. – Bobson Sep 29 '11 at 1:49
True, that would be good. Of course it would require manual analysis to make sure that each piece is from the right file. :-( – Synetech Oct 15 '11 at 21:21
Good point. That could be especially hard for binary files. Oh well. :( – Bobson Nov 21 '11 at 2:01
feedback

5 Answers

up vote 0 down vote

Yes, there are apps that will only search for deleted files. I think Recuva is one, but I'm not 100% certain on that. I've never heard of a specific app that will only dump unallocated sectors or clusters to an image.

What you can also do is image the entire drive, then mount that image (since the filesystem will be intact), then wipe existing files with zeroes using a secure delete program (like bcwipe), and then let your file carving/recovery utility loose on anything that's left.

Depending on your platform (Windows, Unix, etc.), there are several ways to do this.

link|improve this answer
That would still take a long time. The goal is for example to search the 1GB of free space from a 10GB partition. – Synetech Jan 6 '10 at 4:05
feedback
up vote 0 down vote

Download and burn Hiren's 10.1 preferably using a different pc than the one with missing files.

Once you have a copy of the disc, from the recovery set of programs run getdataback ntfs or getdataback fat32, depending on the drive format type.

When recovering the files make sure they are recovered to a drive different from the one you are recovering from and all should be well.

Best of luck!

link|improve this answer
From what I can tell, GDB doesn’t have the ability to search just the free space, so it would take a long time to search the whole thing. – Synetech Jan 6 '10 at 4:12
Even with that being the case you are more likely to get a complete result doing an in depth scan anyway. if any data has been written to the drive after the deletions you will need to scan as thoroughly as possible to achieve the maximum amount of data recovery. You should consider taking a careful approach in retrieving the files as anything done in haste could make the matter worse. – Kythos Jan 6 '10 at 4:37
Or just use the PhotoRec program you found and pull the files from your drive :P – Kythos Jan 6 '10 at 4:39
feedback
up vote 0 down vote

Imaging free disk space on a drive won't work because file deletion takes place at the disk catalogue level (and in some cases, the sectors are overwritten with 0's). When you image a disk, you image the data and catalogue, but not the -- effectively -- magnetic residue.

link|improve this answer
I’m not sure why it would be impossible to simply cycle through all unused clusters and write them to a file, especially for FAT32. – Synetech Jan 6 '10 at 4:13
Not impossible, but not standard nor expected behaviour. There might be an app for that, I just don't know it. A typical backup or imaging application treats space declared as "free" as free. Think of it like digging in not trash bins, but the city dump for an item you threw away. It's further than most people would go. – gabrielk Jan 8 '10 at 5:19
feedback
up vote 0 down vote accepted

I just downloaded about a dozen file-recovery apps and the very first one I tested did the trick.

I was quite surprised too because PhotoRec is billed as an app to recover photos from a camera card. However it was perfectly able to scan just the free disk space for text files (in my case a couple of dozen BAT files) and recover them in seconds.

Wow, way to go Christophe Grenier!

I have yet to find an app that can save unused clusters to a file, but this worked just fine as an alternative.

link|improve this answer
For the record, I’m not crazy about how PhotoRec is unable to recover the files’ filenames and timestamps and simply saves the clusters to a new, numerically named file. A few months ago, I tested a dozen undelete programs, many of which had better results, and at some of which could scan unused space. I’ll check the results and update the answer. – Synetech Jul 26 '11 at 2:19
feedback
up vote 0 down vote

I am not sure of any free tool that does this (but would like one if anyone knows a good one!).

That aside, if you do not mind paying, I use R-Studio and it does exactly what you want, it allows you to make an offline image of an entire disk then scan that file for deleted files.

This program is brilliant... I personally use it on drives that are just out the freezer (the trick works!) so I can quickly make a full copy before it dies, then do the recovery in my own time.

link|improve this answer
Thanks, but the goal is to avoid scanning the entire drive. If I wanted to do that I could use any number of tools to search for a string on the drive either live, or using any number of imaging tools. – Synetech Jan 6 '10 at 18:40
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.