After an unfortunate CHKDSK analysis which corrupted many files on a 3TB HDD (erroneously detected as 746 GB, probably because of a USB2 controler being incompatible with capacities over 2TB), I would like to make a precise comparison of those files (with their correct counterparts on a backup HDD), and extract the corrupted areas for further investigations, before deleting them.
So far, I proceeded like this :

  • Open both versions of the file in WinHex. Activate the “Synchronize & Compare” display.
  • Run a comparison at offset 0, save a report (mandatory with this software, no way to directly find the next difference) with the name of the file, specify a limit of 10000 errors (to avoid having too large reports).
  • Once it stops (having reached the end of the file or the limit of 10000 different bytes), open the TXT report, copy the offset of the first difference into WinHex's "Go to offset" menu. Mark the first error (which is always at a sector boundary) as the begining of a block.
  • Search the end of the corrupted area by scrolling down, or if it takes too long by adding 1MB or 100KB until I'm out and then scrolling up (I found no way to make this easier in WinHex). Mark the end of the last sector of the corrupted area as the end of the block.
  • Extract the block as a new file, with the pattern "Name_of_the_file [1111-2222]" where "1111-2222" are the begining-end offsets.
  • Resume the comparison at the end of the previously identified corrupted area, to search for others, until the end of the file...

Now, would there be a way to automate this painstaking and time-consuming process ? Are there other hexadecimal editors better suited for file comparisons ? Or could I use a script to get this done all at once ? I found a brilliant little command line tool called dsfok (DS File Ops Kit) which can extract a block of data between two offset values (among other functions which I haven't tested yet). So I would need another command line tool to perform the comparison and get those offset values, and tips to write a script to make those tools work together. Thanks.

  • 1
    Why do you care, if you have backups? – harrymc Oct 13 '17 at 6:54
  • Aside from the question why you would care if you have a backup; either find a tool that does not require that manual process or you could setup something like an AutoIt/AHK script to do it for you. – Seth Oct 13 '17 at 8:30
  • Well, good question... Out of curiosity I guess. I'm trying to understand how a “staple” tool like CHKDSK can screw up data which was perfectly fine all of its own, and how it does it at the filesystem level. I'm doing data recovery as an occasional, half-professional activity, and I'm trying to acquire new skills, when I get faced with unforeseen issues. I'm wondering : what could have been done if I had had no backup, or if someone had brought me a HDD in such a state, asking me to repair as much of the damaged files as possible ? Maybe it's a worthless endeavour but I'd like to try... – GabrielB Oct 13 '17 at 12:56
  • I have started to look into AutoIt, but so far I don't know how and if I could do what I want that way. For instance, how could I make it load each file from both HDDs in a loop ? How could I define the begining offset (read from the TXT file), and the ending offset of the block to extract (it would have to make WinHex find at least 5 equal bytes, and select the one before) ? It's a case where I wonder if I would save time and effort by trying something automated but entirely new, as opposed to doing it manually through a process I now know well and can do quite efficiently... – GabrielB Oct 14 '17 at 9:55

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.