I am trying to recover a chrome extension's data. Undelete programs aren't showing it. Windows 7 64-bit.
Using WinHex, I was able to search the disk and find the end of the file I need. (The end of the file has a timestamp, so I know this is the version I need.) This ending of the file is at 0x50C4430000 - 0x50C44328FF. (So 10,496 bytes, 10K.) The entire file should be around 350K.
Is there a way I can find where the other pieces of the file are so I can reconstruct them?
A screenshot of WinHex at the beginning offset is below. It's cluster 84,689,968. Because it's marked as free space, I'm worried the records for what cluster numbers go together might be wiped (overwritten.) If I'm using the right terms, I think I'm worried the MFT records for the file at the time it had this cluster no longer exists.
With it showing "Free space", does that mean finding the other sectors is hopeless? (Assuming I wouldn't be able to figure out what to search the entire disk for to find it.)
nfi says sector 677519764 (the starting offset sector number) isn't part of a file (says the same if given 677519744):
>nfi C 677519764 NTFS File Sector Information Utility. Copyright (C) Microsoft Corporation 1999. All rights reserved. ***Logical sector 677519764 (0x28622194) on drive C is not in any file.