Can you also give the bytes at offset 512?
Here are the 8 bytes at FO 512 for one of the recovered files that come back with unreadable encoding (text)
FD FF FF FF FE FF FF FF
I can see this is a problem already !
The first bytes are fine.
The file is probably either truncated, or fragmented, or partially overwritten
If I remember well, later versions of Word & Excel files have a second set of subheaders at offset 512, and should be EC A5 C1 00, and FD FF FF FF respectively.
Your FD FF FF etc is probably correct. It is data that can be seen in a MS Compund Document.
Fragmentation only happens on a cluster boundary. Offset 512 will therefore still be in the first cluster. I have not come across a hard drive with a cluster size of 1 sector. A single sector cluster is what you find on floppy disks amd posibly a small memory chip.
Reconstructing fragmented Word documents is possible but not easy. It is particulally difficult when there are a series of such documents as many of the jig saw pieces look the same, but are from different jigsaws. The best that can normally be done is to work just on the text and hope that the cluster boundaries are across a long word, or nice phrase, so both halves can be matched.
Your FD FF FF etc is probably correct. It is data that can be seen in a MS Compund Document.
Fragmentation only happens on a cluster boundary. Offset 512 will therefore still be in the first cluster. I have not come across a hard drive with a cluster size of 1 sector. A single sector cluster is what you find on floppy disks amd posibly a small memory chip.
Reconstructing fragmented Word documents is possible but not easy. It is particulally difficult when there are a series of such documents as many of the jig saw pieces look the same, but are from different jigsaws. The best that can normally be done is to work just on the text and hope that the cluster boundaries are across a long word, or nice phrase, so both halves can be matched.
Thank you for all your input. Very much appreciated.