Recoverd Word Document

Peter,

Looks like the document has not been recovered correctly.

Can you elaborate on the process you followed to recover the document.

Neil

The cool thing about word docs is that they are also in plain text within the cluster that they are saved in.

Load the recovered file into a hex editor "frhed" is free and works ok. If you start looking at hex offset A00, you should see the text of your document in ASCII format. I would start scanning the file in the hex editor looking for a large section of NULL characters (more than 32). If you find them. You will have found either the start or end of the ascii data section of your document (provided you actually recovered the document.)

A quick check would be to look for the hex string "d0cf11e0a1b11ae1". Word documents start with this header and have a trail of "Word.Document.800f4b2" in the last data block of the file. This will vary a little depending upon the release version of word used to create the document. Look for the header and find it first. If you do not find the header. You more than likely do not have the document.

Several other possibilities may exsist the document may be compressed and stored in an archive (zip, arc) format. Or the document could be encrypted - if file encryption, folder encryption or disk encryption was used. You will have to analyze the image and other files to determine which if any might apply.

My normal guess you be that the file was not recovered properly. You need to verify the procedures used and test those procedures in a know valid environment, first.

Hello Everyone

Many thanks for your replys and assistance, I will look at all the advise you have given and apply to the document recovered.

Best wishes and regards

Peter