——————————————————————————–
Hi all. Here is the scenario. A fella had a job pushed to his laptop (software delivery) and part of the job was to clean up after itself. The problem is the clean up deleted C\Temp and then created a new C\Temp. In the Original C\Temp was over 100 MSFT docs (ppt, xls, doc). I have been asked to see if I can recover these files. There was a lot of disk activity due to the job\install.
So far I have done the following with no luck with EnCase.
- Recovered Files
- Recovered Folders
- Case Processor - File Finder using MSFT file headers (this one brings backs hundreds of nonsensical data)
- I dont see any flagged deleted files
Any help will be much apprecieted.
Brian
Greetings,
Try PhotoRec. EnCase should have recovered some things. If PhotoRec works, I'd love to know why EnCase didn't.
-David
Greetings,
Try PhotoRec. EnCase should have recovered some things. If PhotoRec works, I'd love to know why EnCase didn't.
-David
David, Thank you for the suggestion. I tried PhotoRec and it recovered many files but all the encoding in the .doc is whacky. I can't read the files. Im using the same version of Office to open the files as the user has!
Any ideas why the encoding would be off?
Did the laptop have NTFS compression enabled?
Does your recovery search allow for that?
Greetings,
If you open the files up in something else, do they even look like an intact document? Both EnCase and PhotoRec will have problems recovering deleted files that are fragmented, which I should have mentioned earlier. "Will have problems recovering" really means "are unable to recover".
-David
When you say the encoding is "whacky", the font set is wrong or the files themselves are corrupt and returns "garbage" when viewing the document?
There was no compression involved. I have tried opening the files in other apps (Word Pad for example) and I get the same results, just a bunch of garbage. There is some legible text in the recovered file, although a very small amount. Im not really getting what I was hoping for.
I'll keep at it and see what else I can do. Thx all.
What are the first half dozen bytes of a .DOC file, in hex?
What are the first half dozen bytes of a .DOC file, in hex?
Here are the values for the headerD0 CF 11 E0 A1 B1 1A E1
Can you also give the bytes at offset 512?