Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there an app that can save all of the free clusters on a disk to a file?

In some circumstances, when a file gets deleted, the only way to try to recover it is to scan the disk (or partition) for a unique string or something that is known to be in the file. If the disk is fairly full, then it is much easier to scan the free clusters for the content of the missing file than it is to scan the whole disk.

Is there an app that can save free clusters to a file? Alternately, is there a data recovery app or disk viewer that can narrow a search to free clusters?

Thanks.

share|improve this question
    
It might be even better if the tool could save the clusters to separate files, then they could be combined as needed. –  Bobson Sep 29 '11 at 1:49
    
True, that would be good. Of course it would require manual analysis to make sure that each piece is from the right file. :-( –  Synetech Oct 15 '11 at 21:21
    
Good point. That could be especially hard for binary files. Oh well. :( –  Bobson Nov 21 '11 at 2:01

6 Answers 6

up vote 1 down vote accepted

Probably the user who posted this question already there will be found another way to resolve your concern but a few hours ago I discovered a way to save all the "empty" sectors (what would come to be the free space on a hard drive) to a file, for which should do the following:

  1. Download and install WinHex.
  2. Open the program, go to the Tools menu and choose "Open Disk" where then have to choose the drive (logical or physical) of which you want to clone the free space.
  3. In this step is necessary wait until the program make a snapshot of the open volume (although I'm not sure that this is indispensable).
  4. At the end should show a window with two panels, the upper panel contains a file browser and the bottom shows the binary content of the drive. In the file browser have to look for a special file called "Free space" (usually is the last file in the list, or one of the last).
  5. Only remains open this and save to another hard disk/flash drive with "Save As" (to avoid overwriting the free space itself).
share|improve this answer
    
Yes, I did figure out a solution using PhotoRec, but I also ended up writing my own program to do this. However, nice find! I just tried it and it worked very well. I compared the resulting file to one that my own program gave and they were identical. Again, nice find! It’s just too bad that WinHex isn’t free, otherwise it works well and is easy too. –  Synetech Dec 23 '13 at 7:30

Yes, there are apps that will only search for deleted files. I think Recuva is one, but I'm not 100% certain on that. I've never heard of a specific app that will only dump unallocated sectors or clusters to an image.

What you can also do is image the entire drive, then mount that image (since the filesystem will be intact), then wipe existing files with zeroes using a secure delete program (like bcwipe), and then let your file carving/recovery utility loose on anything that's left.

Depending on your platform (Windows, Unix, etc.), there are several ways to do this.

share|improve this answer
    
That would still take a long time. The goal is for example to search the 1GB of free space from a 10GB partition. –  Synetech Jan 6 '10 at 4:05

Download and burn Hiren's 10.1 preferably using a different pc than the one with missing files.

Once you have a copy of the disc, from the recovery set of programs run getdataback ntfs or getdataback fat32, depending on the drive format type.

When recovering the files make sure they are recovered to a drive different from the one you are recovering from and all should be well.

Best of luck!

share|improve this answer
    
From what I can tell, GDB doesn’t have the ability to search just the free space, so it would take a long time to search the whole thing. –  Synetech Jan 6 '10 at 4:12
    
Even with that being the case you are more likely to get a complete result doing an in depth scan anyway. if any data has been written to the drive after the deletions you will need to scan as thoroughly as possible to achieve the maximum amount of data recovery. You should consider taking a careful approach in retrieving the files as anything done in haste could make the matter worse. –  Kythos Jan 6 '10 at 4:37
    
Or just use the PhotoRec program you found and pull the files from your drive :P –  Kythos Jan 6 '10 at 4:39

Imaging free disk space on a drive won't work because file deletion takes place at the disk catalogue level (and in some cases, the sectors are overwritten with 0's). When you image a disk, you image the data and catalogue, but not the -- effectively -- magnetic residue.

share|improve this answer
    
I’m not sure why it would be impossible to simply cycle through all unused clusters and write them to a file, especially for FAT32. –  Synetech Jan 6 '10 at 4:13
    
Not impossible, but not standard nor expected behaviour. There might be an app for that, I just don't know it. A typical backup or imaging application treats space declared as "free" as free. Think of it like digging in not trash bins, but the city dump for an item you threw away. It's further than most people would go. –  gabrielk Jan 8 '10 at 5:19

I just downloaded about a dozen file-recovery apps and the very first one I tested did the trick.

I was quite surprised too because PhotoRec is billed as an app to recover photos from a camera card. However it was perfectly able to scan just the free disk space for text files (in my case a couple of dozen BAT files) and recover them in seconds.

Wow, way to go Christophe Grenier!

I have yet to find an app that can save unused clusters to a file, but this worked just fine as an alternative.

share|improve this answer
    
For the record, I’m not crazy about how PhotoRec is unable to recover the files’ filenames and timestamps and simply saves the clusters to a new, numerically named file. A few months ago, I tested a dozen undelete programs, many of which had better results, and at some of which could scan unused space. I’ll check the results and update the answer. –  Synetech Jul 26 '11 at 2:19

I am not sure of any free tool that does this (but would like one if anyone knows a good one!).

That aside, if you do not mind paying, I use R-Studio and it does exactly what you want, it allows you to make an offline image of an entire disk then scan that file for deleted files.

This program is brilliant... I personally use it on drives that are just out the freezer (the trick works!) so I can quickly make a full copy before it dies, then do the recovery in my own time.

share|improve this answer
    
Thanks, but the goal is to avoid scanning the entire drive. If I wanted to do that I could use any number of tools to search for a string on the drive either live, or using any number of imaging tools. –  Synetech Jan 6 '10 at 18:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.