0

I am trying to recover a chrome extension's data. Undelete programs aren't showing it. Windows 7 64-bit.

Using WinHex, I was able to search the disk and find the end of the file I need. (The end of the file has a timestamp, so I know this is the version I need.) This ending of the file is at 0x50C4430000 - 0x50C44328FF. (So 10,496 bytes, 10K.) The entire file should be around 350K.

Is there a way I can find where the other pieces of the file are so I can reconstruct them?

A screenshot of WinHex at the beginning offset is below. It's cluster 84,689,968. Because it's marked as free space, I'm worried the records for what cluster numbers go together might be wiped (overwritten.) If I'm using the right terms, I think I'm worried the MFT records for the file at the time it had this cluster no longer exists.

With it showing "Free space", does that mean finding the other sectors is hopeless? (Assuming I wouldn't be able to figure out what to search the entire disk for to find it.)

nfi says sector 677519764 (the starting offset sector number) isn't part of a file (says the same if given 677519744):

>nfi C 677519764
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.


***Logical sector 677519764 (0x28622194) on drive C is not in any file.

enter image description here

  • If its free space then I would assume it is not overwritten with other data, and just because it is marked as free space does not mean there is no data there. – Moab Jun 17 '18 at 2:36
  • Please clarify the "undelete programs" used. Different programs use different techniques. Generally speaking you don't recover other chunks starting from the last one, however it's useful to know what you tried. – Andrea Lazzarotto Jun 17 '18 at 12:24
  • @Moab agreed. What I'm wondering is if there's a way to find the other extents with it being marked as free space. I'm worried locations of other extents might be in the MFT records, and I'm worried if this is marked as free space, those MFT records are gone. – user1902689 Jun 17 '18 at 16:16
  • @AndreaLazzarotto Active Uneraser, DiskDigger, KickassUndelete, using both regular and deep scans for each of these. – user1902689 Jun 17 '18 at 16:18
  • OK please try with the trial version of Restorer Ultimate, or DMDE, or RecuperaBit (disclaimer: I am the author of RecuperaBit). These tools have much higher accuracy in retrieving MFT entries. – Andrea Lazzarotto Jun 17 '18 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.