File Recovery - Empty File

[ratsima]

Hi, I had an external HDD failure but was lucky enough to be able to recover my data files with some file recovery software (I truly can't remember which). Or so I thought. It turns out that the recovery software had recovered the file titles and file sizes but it seems that there is actually no data in the files. At the time, I simply put the files on a new disk, not thinking to check them - stupid maybe, but there they were, titles and file sizes, that looked so much to me that they had been fully recovered.

Now I have a load of family files, especially avis and jpgs, which seem to be completely data free, just a load of zeros taking up disk space. I have some hard copies as "back up" for the jpgs but the avi files are a huge problem.

Has anyone ever heard of this before? I can only imagine that the recovery software has somehow "mapped" the backup of the bad disk but didn't actually do the backup. How is that possible without huge neon light warnings? NB the recovery of the bad disk was of course to a separate, new disk!

Secondly - and I realise i might be asking for divine intervention here - but has anyone got ANY suggestions about how to recover these avi files? A hex viewer shows these files as full of zeros only

[aedipuss]

delete and move on. all zeros are all zeros and no amount of time or money can recreate the lost data.

[ratsima]

Thanks Mr. Rex, I know, I know, divine intervention is unlikely (ok OK! Impossible!!!).

But I am still interested to hear if anyone knows why I ended up with tens of gigs of "empty" media files? During the same recovery exercise as the media files, there were a lot of text, doc, pdf etc files recovered and they were all fine. Only the media files were affected in this way (zero content). Some insight would help me delete and move on. Thanks for the input.

[davexnet]

recovery depends of whether the disk was NTFS or FAT32, whether the clusters were consecutive and whether the
disk has been written to since the problem occurred., and importantly, the nature of the HDD failure.
Did you try the software "recuvu"?

If your external drive is still accessible and you haven't written over it, try to recover some of the smaller files (jpg, for instance)

The reason why you ended up with all binary zeroes may have something to do with the nature of the HDD failure.
The usual recovery scenario usually involves some poor dude accidentally deleting important files; in this case the drive itself
is OK. IN my mind when the drive fails, all bets are off.

[greymalkin]

quick question...how did you come to find out they were just a load of zeroes? what program did you open them in to know assuredly that's what they were?

[jagabo]

It's quite common for file recovery software to screw up. Typically the first cluster worth of data (4k to 32k usually) is valid but the rest isn't. This is because when a file is erased the directory entry is marked free and the allocation table entries (a linked list of which clusters contain the file) are freed. The directory entry only points to the first cluster. There's no way of knowing where the rest of the file was because the allocation table entries are gone. Undelete programs usually just assume the following clusters contain the file -- which often isn't the case when a disk is fragmented.

[OrrinH]

And older, frequently used disks are often highly fragmented. Your chances are pretty slim, sadly. The larger the files, the harder it is to recover them.

I've also learnt this exact same lesson, it sucks. Always back up your important files.

[jagabo]

This is a good reason to defrag your system often.

[jman98]

If these files are really critical to you, you can pay a professional data recovery service to go through the trouble of trying to recover them for you. They might have more success than you will have with any tools you as a data recovery non-professional can find. But it will be EXPENSIVE and there is no guarantee they can recover everything but they might get some of your stuff back.

[jagabo]

If these files are really critical to you, you can pay a professional data recovery service to go through the trouble of trying to recover them for you.

They would have to go back to the original drive. Nothing can be recovered from the copies of the file he has now, if they are full of zeros.

[ratsima]

Many thanks for all the replies. Here's some additional info - worth it if it helps someone in the future.

It was an external HDD drive, USB connected. I only use laptops, all chunky data is stored on external HDDs of which I have about 8TB in total. I've been doing this stuff for a while, and lost external disks before and recovered about 99% of what I wanted. All HDDs are NTFS.

Before attempting recovery, I d/loaded several recovery utilities, including recuva, and looked at what they saw on the failed disk and how the proposed to recover the data they saw. I ended up using - I thin Easy Data Recovery - cos they offered a fairly good file tree recovery profile. Not sure though, I tested quite a few products.

I was "cheated" by the software (still my fault though, not trying to blame anyone else) as it created a full disk tree on my new HDD - file folders, filenames, filesizes, filetypes etc. but didn't seem to actually copy any data into the file spaces. That is the weirdest thing I could imagine, setting up the whole file tree without actually copying in any data.

I have checked the file contents with HexView and Beyond Compare (which has a similar file bits'n'bytes viewer function). All data shown as zeros. I have checked hundreds of files and they don't show detailed info (eg resolution) as you would expect at the bottom of a Windows 7 file explorer window. Or show a preview with the preview function enabled. A HexView check shows the list of zeros, no ones in sight.

Given that the files are shown as zeros only, is it worth sending them for professional recovery? This is no longer a disk recovery issue, that was over a year ago. This is about finding that your large collection of files is just a set of "empty" files. Can a recovery organisation somehow make them not empty?

First 3 lines of a sample TIF file
00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . .
00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . .
00 00 00 00 00 00 00 00 00 00

First 3 lines of a sample JPG file
00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . .
00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . .
00 00 00 00 00 00 00 00 00 00 | . . . . . . . . . .

...and so on, only zeros for the whole file.

To be a better person, I copied all the "recovered" files to a second drive, stored the first drive and used part of the second. These were all archive media files (from an earlier part of my life) with no need for me to go and check occasionally. I trusted the software (I wont be making that mistake again anytime soon) and for reasons that I cannot express, my checking of the recovered files remained at a file explorer level, not actually eyeballing them. Thus I very carefully backed up and stored a load of empty crap.

I appreciate Jagabo's comments, they seem to recognise this for what it is. I have somehow ended up with a FAT map and not much else. That FAT map has shown my disk to be full of data, whereas it had none. In general though, my HDDs would be only mildly fragmented and I occasionally use Eraser to wipe free space (and thus perhaps the opportunity of finding fragments of files here and there!!) What a **** up! What an idiot! Read this story and weep.

Sorry about the long essay.........

[jagabo]

Given that the files are shown as zeros only, is it worth sending them for professional recovery?

If the entire file is just zeros -- of course not. They would need the original disk from which you "recovered" the files. If only the first part of the file is empty someone might be able to restore some of the and audio/video. But that would take an A/V file format expert, not a undelete expert.

I copied all the "recovered" files to a second drive, stored the first drive and used part of the second.

If you still have the original drive and haven't used it much there may be some hope.

[ratsima]

Thanks again, jagabo. Unfortunately, the drive the files were recovered to, the "first" drive, was a brand new drive.

So, I am going through all my drives again to see what is left there from previous files. I have been looking for a piece of recovery software that gives the option: recover this file or wipe/erase it? There are hundreds of files/file fragments, and I'd prefer to wipe/erase those that I definitely don't want to recover as I go.

Any ideas?

[ratsima]

Recuva for example, allows to to securely overwrite files it has found for recovery. But tho it overwrites the files, the file name remains in the MFT and therefore the list of files it finds. I want to reduce that list, how can I do that without trying to edit the MFT!!!

[jagabo]

When trying to recover files from a drive do not wipe or erase anything, do not use the drive at all, until you have recovered all the files you want. Two deleted files (or one current file and one deleted file) can refer to the same location on the disk. Wiping the data in one will result in the other being wiped too. Writing any new files to the drive may result in the data of old deleted files being overwritten.

[im2020]

In case it's a relevant response to any of the above, I needed to recover various jpg mpg and m2ts (AVCHD) files from a memory stick I use in a video camera. I had deleted them and/or overwritten them by mistake. Recuva gave me back a few and suggested that some others were there. Further research threw up a chargeable program called CnW (http://www.cnwrecovery.com/html/downloads.html). The free trial showed an almost complete list of recoverable files on the memory stick. So I took the plunge and paid $19.99 for the working version. It immediately found a multitude of fragments and then automatically rebuilt them into my lost files. Before and after the process I contacted the providers of CnW for email support. Each time they responded comprehensively and by return. For me it was money well spent.