Hello all,
I am new to this, so please bear with me.
I have an ipod classic 160Gb hard drive that I backed up my unbelievably important files to using FBackup.
I think the files are still there, but the size of the archive mysteriously and suddenly went from 30Gb compressed to about 4Gb compressed.
I have researched extensively on google and have downloaded over a dozen data recovery and zip repair programs but nothing is working as of yet. i did get a favorable response from AZR, which said all my files were recoverable, but I am trying (as the broke bast*rd I am) to avoid paying the $50 to upgrade.
I downloaded zip carver tools, but am unsure as to how to use them.
Can anyone point me in the right direction?
Thank you
-jw
If your files were unbelievably important, you backup to multiple locations
If you copy a 30GB file to a FAT32 disk, only 4GB will be saved - ie the maximum size of a FAT32 file. The other 26GB will be nowhere, ie recovery is not possible.
If your files were unbelievably important, you backup to multiple locations
If you copy a 30GB file to a FAT32 disk, only 4GB will be saved - ie the maximum size of a FAT32 file. The other 26GB will be nowhere, ie recovery is not possible.
The backup software (FBackup) made a split archive of the backup files…I was going into the archive with IzArc and pullin gout what I needed over the two months that intervened between my backing up the failing hard drive and my purchasing a new one.
somehow, the headers of the archive got messed up, but I think the majority of the data is still written on the drive.
I am currently making an image of the unallocated space on the ipod with AccessData FTK imager and there appears to be about 59Gb of data within the unallocated space.
I found this forum by finding Zip Carver tools (advanced ooXML recovery) thread and downloaded the package…from the documentation I hoped that I could recover most of the zip drive by re-creating the headers but am unsure as to how I go about doing this.
I am trying to figure this out and I'm sorry if I seem stupid to you who are more experienced, but I am desperately hoping for some gentle responses and guidance.
Thanks
The trouble with unallocated space is no structure, and the 59GB of data could have come from anywhere (only you know how the drive has been used).
FBackup does produce Zip files. These are easy to find by carving. However, carving does not handle any fragmentation which a 4GB file will almost certainly have.
To see if the files are still there, look at the end of the Zip file with a hex viewer, at this point there is a directory of all files in the Zip file. Can you see the ones you want.
Hello again,
sorry for the delay…I got called away for work. I really appreciate you taking the time to help me with this. Yes, at the end of the ZIP file I can see the files I want to recover.
I think the ZIP file which remains is the last part of the spanned files, because recovery attempts using third party software result in the same file listings, which comprise the patter part of the directory I am looking at.
I am completely new to this, so I do not know how to use a hex editor at all, but I think I am correct in seeing the files I want.
Here is an example, from the text portion of the hex editor view
Documents and Settings/James/My Documents/EMT files/excel files/august 2004 tour estimates.xlsPK..-…….)«./.=PÒ…..F..O……… …. ¼
and here is the hex for the same portion
44 6F 63 75 6D 65 6E 74 73 20 61 6E 64 20 53 65 74 74 69 6E 67 73 2F 4A 61 6D 65 73 2F 4D 79 20 44 6F 63 75 6D 65 6E 74 73 2F 45 4D 54 20 66 69 6C 65 73 2F 65 78 63 65 6C 20 66 69 6C 65 73 2F 61 75 67 75 73 74 20 32 30 30 34 20 74 6F 75 72 20 65 73 74 69 6D 61 74 65 73 2E 78 6C 73 50 4B 01 02 2D 00 14 00 00 00 08 00 29 AB 11 2F 12 3D 50 D2 0D 0E 00 00 00 46 00 00 4F 00 00 00 00 00 06 00 00 00 20 00 00 00 AD 81 A0 BC
The tools I posted are mostly suited for small zip archives (ie new office documents), and definetely not such huge stuff. The bytes you posted is from the central directory at the back of the file and is just pointers to the actual and individual file headers as is located before the central directory. You can manually extract (and decompress) data directly from those headers, but it is not a very easy process and if you don't know how to use a hex editor then don't even try. I posted some testing results in the main thread for the tools. I would suggest you try those marked as good. The trial versions will let you see if recovery will become success, but prevent the actual recovery (because it's trial).
How many files roughly are in the zip?
Thank you for your help. If I could only tell you how much time I have spent studying your documentation and trying to educate myself!!
When I try to run your Carver it requires a file to open, and the archive files don't show up in Explorer. I believe the data is still intact, but I somehow corrupted the local headers.
I ran your Carver tool on the backup catalog *.fkc that Fbackup made, and it gives me an attention window that says "there seems to be a good chunk of data from the start of the input file and to the first signature. If you really want to try brute force decompression here, copy the part from offset 0x00 to 0xFFFFFFFF and load it into inflate_raw_loop.exe"
There is about 40gB of data in the backup archive, but it includes system files and software…the files I want to recover probably only comprise about 10gB or less…I would guess there are well over 10,000 files I want, including small Word files, Excel files, pictures, a .pst file, etc.
I apologize for being so ignorant.
Thank you for taking the time to help.
One thing I don't understand is the "signature" you speak of…is that a text string?
It seems to me that if I could recreate the damaged file headers for the spanned zip files, then I wouldn't need to go in and recover my tiny word processing and spreadsheet files one by one.
If somehow I were able to get the big zip files to show up again properly, then wouldn't I be able to pick directories to restore using WinRAR or comparable?
I apologize if this is a stupid question.
Yeah, don't even try those tools on such big files. It will not work and was never built for such. From what you describe I'm confident most if not all of it intact and healthy, and can be recovered. Considering the massive amount you are dealing with, it feels like a boring manual task. However, it could be that it is just a few bytes that are mixed up in the header of the split stuff. I have limited experience with split archives, so cannot help much.
If the data is really that much worth to you, then those few $$ is nothing. Which of those tools did you try, and did you get any indication that any files are corrupt or otherwise non-recoverable?
The signatures, when talking about zip archives, are one of those indicating the start of either of the "sections" that a zip is built of. For instance LOcal File Headers (in front), Central Directory (after LFH) and Central Directory End (the very end of the archive).