2

I plugged in and turned on my computer (Windows 10) today and realized it had powered down in such a way that all of my applications had closed since I last used it. This included an unsaved document in MS Word 2016. I'm trying to recover that docx file.

The missing docx file does not show up under Recovery Files, under temporary files or anywhere else straightforward. So I thought I'd see if the upload cache would be a workable approach.

I found two resources discussing recovery of information from the cache (Alachkar & van Gorp, 2018: paper and presentation).

  • They mention an approach to recover a document from cache files using an appropriate FSD file, FSF file, and "CentralTable.accdb" Access database -- all of which are found in the OfficeFileCache folcer for Office (%LocalAppData%\Microsoft\Office\16.0\OfficeFileCache).

  • to quote:

    Another method of recovering documents from FSD-files is to use Microsoft Office. In case the FSF-, FSD- and CentralTable.accdb-file are available, the files are to be placed in the OfficeCacheFiles folder. If the value of column FFileSavedToServer is set to 0, the document can be opened through Microsoft Upload Center......Microsoft Office 2016 can be used to upload a file to OneDrive and generate CentralTable.accdb with records for one file. The columns FFileSavedToServer and FileEntryFileID should be set to 0 and to the GUID in the FSF-file’s name respectively

    -> I've tried this (i.e., modified the table and opened up the upload center app) and found it to do, well, nothing.

Maybe this isn't even a workable solution?

Question: Is there a way to recover a docx file from an FSD file?

This question had been previously asked on reddit and answers.microsoft.com, but they have not received useful answers.

Improve this question
2
  • You mean that the document was in memory and has never been saved at all?
    – harrymc
    Sep 10, 2020 at 19:49
  • @harrymc well, I was working on the document for quite some time the evening before and so it certainly would have overlapped many times with the 10 minute autorecover save function I have enabled. Word is tied to Office 365 + Sharepouint, so I assumed it was also possibly backing up there as well. In the end, I'm not sure what happened to this document. However, I'm interested in learning if my above approach (FSD to docx) is possible for my current situation as well as future scenarios. I added the context of my current file as the impetus for asking, but this is a much broader question. thx
    – theforestecologist
    Sep 10, 2020 at 20:22

1 Answer 1

Reset to default
0

The folder OfficeFileCache contains only one file - CentralTable.accdb. This is an Access database containing internal tables.

If you have Access, you may open the file and examine its contents, and perhaps find some traces of your data.

The article Extracting Office Upload Center Info with PowerShell contains a PowerShell script for listing the contents of the major tables: CacheProperties, EventClients, EventMetaInfo, IncomingEvents, MasterFile, OutgoingEvents, ServerTarget, Subcache.

You also find the research results of a Master thesis in github Microsoft-Office-Upload-Center-Cache-Files-Contribution-in-Forensics-Investigation, which might be of use.

As a further note, you could search your entire disk for files with the characters ~$, for perhaps finding the Word recovery file. An excellent search tool is Everything by voidtools.

Improve this answer
2
  • thanks for the answer. The masters thesis code belongs to the duo I cite in my question, but I haven't explored it too deeply yet. I had not seen the powershell link, so I'll look into that, too (and I guess learn how to use powershell :p). Also, FYI the OfficeFileCache folder also contains numerous FSF and FSD files (after Office files have tried to or successfully uploaded). I thought accdb was "Access DataBase" file :p.
    – theforestecologist
    Sep 11, 2020 at 19:08
  • Access it is (slip of the mind). My folder only contains the Access database, although I tried editing a file and killing Word. Perhaps it contains info about the other files. I found references to Office Recovery (trialware).
    – harrymc
    Sep 11, 2020 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .