| Author | Message | ||
     Stefan Fleischmann (Admin) |
Another powerful data recovery mechanism has been added, allowing to conveniently undelete files of any type, which previously would have required manual extra work. It is available for FAT12, FAT16, and FAT32 drives, starting with WinHex 10.2 Beta F. Whenever a logical drive is open and a cluster is visible that is allocated to a directory (and thus contains directory entries), you may now use a new command in the Access button menu ("Recover current directory") to replicate that currently displayed directory, with all its files and optionally its nested subdirectories, regardless of whether they are partially still existing or have been deleted. WinHex will save all this in a destination folder you specify (strongly recommended: on a different drive, to avoid overwriting other deleted or lost files). WinHex assumes that the files have not been overwritten and are not fragmented. This is crucial for a successful recovery. The file allocation table is not respected, since it is initialized by the OS in the relevant parts when a file is deleted. You need to carefully check the resulting files for consistency. Within such a cluster with directory entries, you may also point the cursor to a short filename entry (or short directory name) and use another command in the Access button menu to browse to that file or directory, or to recover that specific file or directory only. Remember, to find the right cluster with the directory entries in the first place, you could simply start with the root directory, use Tools | Disk Tools | List Directory Clusters, or search for the short name of a file or directory you lost via text search. During recovery, WinHex recreates the original hierarchical directory structure and restores the original file dates, times, and attributes. Long filenames are respected in favor of the short 8+3 equivalents where possible. The recovery is strictly read-only on the source disk. The data or file system on the source disk will not be altered in any way. | ||
| Jon B. Haugdahl |
Sir: Have tried your latest revision (102Beta F) and it seems the new features work fine. I have successfully recovered files and directories on both floppy and hard drives. I'm still playing around with it but I think you have a winner here. My OS is win98 se. | ||
| Stefan Fleischmann (Admin) |
Thanks, good to hear that! You may want to switch to Beta J (same URL as before). I have further refined the recovery algorithm a bit since Beta F. | ||
| naresh k naidu |
" ALL THE BEST " WINHEX TEAM | ||
| Prosenjit |
I want to recover MPEG files thru' raw scan. Please help me by providing specific file signature of MPEG files i.e, Start Pattern offset and end pattern | ||
| Stefan Fleischmann (Admin) |
I don't have any .mpeg files available right now, but you can find out just easily by opening some of these files in the hex editor. You will probably see some hex values common in all files somewhere at the beginning. That's the header. | ||
| Anonymous |
I am trying to use winhex 10.45 to recover .jpg files from a SmartMedia card that has been corrupted in some way. When I try File Retrieval, I get the message "0 headers were found ...". I tried both JPEG header values, cluster size = 2 sectors, a very large max file size, and a sector offset of 0. When I try to use the List Directory Clusters function, I get a read error. Using the Find Text function to search for ".jpg", I have found what appears to be a directory at 9240h. (The data maps well using the Root Directory Template, the file names are reasonable, and the Date created values correspond to the files that I wish to recover). When I view the data at this address, there is no function called "Recover current directory" in the Access menu. The only functions listed there are: - Boot directory - Boot directory (template) - FAT 1 - FAT 2 - Root directory - Root directory (template) - Search up - Search down Can explain why the Recover Current Directory function does not seem to be available? If I will need to recover the .jpg files individually,can you help me understand how I use the cluster number that I find in the directory entries? I have printed out the SmartMedia Format Introduction that you reference in the Knowledgebase. | ||
| Stefan Fleischmann (Admin) |
Is "cluster size = 2 sectors" consistent with what WinHex displays in the gray vertical details panel? By "sector offset" you are referring to "First cluster at offset"? 0 is probably wrong. Use Position | Go To Sector to go to cluster #2 and see which sector you are pointed to. The dot in a filename (such as in ".jpg") is not contained in a directory entry, so I am not sure why you found a directory entry anyway liket this. > there is no function called "Recover current directory" Please copy the entire cluster with the directory entries into a new file and send me this file by e-mail. That way I will most probably be able to find out why this Access button menu item is not offered by WinHex. When the cursor is within a 32-byte large short filename entry, there should be an additional Access button menu item with that filename, allowing to recover that particular file. If you wish to try recovering the .jpg files manually: use the above-mentioned Go To Sector command to go to a specific cluster number. Press Alt+1 or click to set the beginning of the block there. Then move by the file's size (or more) down. Press Alt+2 or right-click to set the block's end. Use Edit | Copy Block | Into New File to recreate that file on your hard disk. This assumes the file was stored in contiguous clusters. | ||
| Anonymous |
To answer your questions: - In the gray vertical details panel, WinHex displays Bytes per Cluster = 1024 and Bytes per Sector = 512. From that, I assumed there were 2 sectors per cluster. - Yes, by "sector offset", I meant "First cluster at offset". When I use Position|Go To Sector and give a cluster value=2, I get a sector value=16781055. - Regarding the search for ".jpg", I was incorrect. My search was for "jpg". I used the Edit|Copy Sector function to copy the directory into a file. If you need the full cluster, I can send that. Let me know. - It's probably relevant to tell you that sometimes when I position at 9240h (e.g., using Find Text), I get a read error when I select the Access button. If I select the Access button again, I get the drop down menu that I listed in my first note. - Lastly, since one of the "directory" entries that I found shows the file starting at cluster 4, I used the Position|Go To Sector command with a cluster value = 4. The corresponding sector value is 16781059. When I select Ok, I get a WinHex "Invalid input" message. I just checked and I also get this error if I click Ok with cluster value = 2. I'll follow this with an email which has the file attached. | ||
| Anonymous |
Stefan, did you get the email that I sent with the copy of the directory sector? (This is related to the current thread under "New File Recovery Mechanism"). I sent it to sf@x-ways.com with a subject = "Sector containing directory (my userid)". I can send it to another userid if necessary. | ||
| Stefan Fleischmann (Admin) |
Your assumption on the sectors per cluster is correct. What is not correct any more is probably the information about the card in its boot sector. That's why WinHex encounters read errors and tells you an improbably sector number of 16781055 for cluster #2 (that would require a card size of more than 8 GB). My suggestion is - 1) Create a backup or an image of the entire card, just so you will be able to recreate the status quo in case the degree of data loss becomes any worse. 2) Copy the boot sector from a healthy card to the boot sector of the corrupt card. The close the corrupt card's edit window and open the card again. Locate cluster #2 the same way as before. That should work now. And now also both kinds of automatic data recovery should work. | ||
| Stefan Fleischmann (Admin) |
Yes, I got your e-mail, and the attachment shows the beginning of a valid directory cluster. | ||
| Dreamkilla (Dreamkilla) |
I'm having trouble recovering deleted jpgs. The methods above fail to solve my problem. When I use the File Retrieval function, I dont know what to say for the Cluster Size in Sectors field. I need the recovery procedure to be explained step by step. | ||
| Stefan Fleischmann (Admin) |
When you open a logical drive with the disk editor, WinHex will show you the cluster size in bytes in the vertical gray Details Panel. Divide that by the sector size in bytes, and you get the cluster size in sectors. That value should be pre-set by WinHex anyway in the File Retrieval dialog if you recover from a logical drive. If you need more information, please feel free to post again here or in the topic about .jpg file retrieval. | ||
| Dreamkilla (Dreamkilla) |
I am still unable to find any deleted files. I Don't even know where to look. If they are deleted, do they remain "hidden" in the same directory they used to be? | ||
| Stefan Fleischmann (Admin) |
You don't have to look for them yourself if you use the automatic File Retrieval feature. If you use the special recovery feature for FAT-formatted drives, however, yes, you first need to find the clusters allocated to the directory that contained the deleted files. Tools | Disk Tools | List Directory Clusters. Yes, the directory entries for the files remain disabled in the same directory. | ||
| Dreamkilla (Dreamkilla) |
I am not using a Fat drive and can not use the list directory clusters command | ||
| Stefan Fleischmann (Admin) |
Well, so the very first sentence applies: * You don't have to look for them yourself if you use the automatic File Retrieval feature. * | ||
| Dreamkilla (Dreamkilla) |
I am still unalbe to locate any jpg's, deleted or not. I find 0 matches everytime. | ||
| Stefan Fleischmann (Admin) |
In that case the settings in the File Retrieval dialog window are probably incorrect. Please check them for plausibility, and feel free to send me a screenshot of that window if you like, so I can have a look. | ||
| Dreamkilla (Dreamkilla) |
I sent a screen shot through email | ||
| Stefan Fleischmann (Admin) |
Got your screenshot. Of course, you must not have WinHex "Stop retrieval at sector" 19 if there are 78,108,024 sectors on your hard drive. Have it stop at sector 78108023 (= the last sector, numbering starts at 0). Also you may want to recover with a fixed file size (the usual size of your JPG files or more). Important: Don't re-create the files on the same drive where you recover them from! You were warned by the program not to do this. This might 1) overwrite the data from the files you lost (!) and 2) cause WinHex to recover files it already recovered (danger of a loop). It should be common sense not to use a drive where you want to recover files from any more. Keep in mind that any write operation by any program or by the operating system itself can destroy your data forever. The sectors formerly allocated to now lost files are often counted as free space on the drive, so they can be re-used with new data at any moment. | ||
| Kathie |
I am trying to retrieve deleted jpg files from a Smartmedia card. The images were taken with a Fuji 4700. Using "File Recovery by name" using either the jpg/jfif or jpf/exif headers finds 0 files. Using "File Recovery by type" does find the images and writes them to the destination drive, but then when I try to view or open them in any program, I get a message that the files are not valid jpg files. Any thoughts? Thank you! | ||
| Stefan Fleischmann (Admin) |
"File Recovery by Name" is not designed to work with any file headers. If you specify file headers, it won't work. You must specify filenames or filename patterns, like *.jpg or *.jpeg. If files recovered using "File Recovery by Type" (which does work with file header signatures) are invalid, they may have been stored in a fragmented, in discontiguous clusters, or have been partially overwritten. | ||
| Kathie |
Whoops, I did it right but wrote it backwards - I did use the headers with the "type" option, and the "name" option gave me the invalid jpg files. The answer still applies though - thanks! | ||
| Wolfgang Truckenbrodt (Mangopress) |
Due to the strange behavior of FOTOSTATION Imaging Software (there is no warning prior to delete operations with this program), I deleted some 1.600 JPEGs on drive C:. With the help of other data recovery software packages and thanks to my backups on CD I managed to save all but sixty pictures taken on a specific day which virtually disappeared from the file system. WINHEX Free Space and Find Text functions show some 200 JPEGs recognizable by the CANON D60 camera's date stamp. All are located in a contiguous space. All are of a different size (the uneven effect of image compression makes equal JPEG-sizes most unlikely). I backed up the Free Space in a .whx file and manually extracted some of the pictures starting at header FFD8FFE125FE45786966000049492A and ending at next same header minus 1. All files are perfectly readable by Photoshop, so I would like to automate the procedure for the remaining files. Unfortunately, File Recovery by Type fails. I get lost in the additional fields like Sector Size, Cluster Size, First Cluster which should not be applicable to operations on Free Space. Is there any chance to avoid the manual procedure? | ||
| Stefan Fleischmann (Admin) |
You can use File Recovery by Type even with disk space collected in a file. Sector size in bytes: 512 Cluster size in sectors: 1 First cluster at sector: 0 Stop retrieval at sector: file size divided by 512 You can either specify a fixed file size (the size of the largest file you expect) or use the header signature also as the footer. | ||
| Anonymous |
I cannot read the deleted file list in WINHEX. But I found the first cluster of the deleted file. What can I do? | ||
| Anonymous |
I cannot input 8GB size "max file size." in "file recover by type" | ||
| Stefan Fleischmann (Admin) |
"I cannot read the deleted file list in WINHEX." Sorry, I don't know what you mean by that. "But I found the first cluster of the deleted file. What can I do?" You can probably recover the file manually (see program help on data recovery, manual data recovery). Select the first and the following clusters as the block and then copy the block into a new file. "I cannot input 8GB size 'max file size.'" Yes, unfortunately that recovery method wouldn't work with such huge files. | ||
| Miguel (Miguel) |
I AM SHARING THE SAME PROBLEM AS "PROSENJIT" WHICH HE DECRIBES AS FOLLOWS "I want to recover MPEG files thru' raw scan. Please help me by providing specific file signature of MPEG files i.e, Start Pattern offset and end pattern." A SIGNATURE IN HEXADECIMAL FORMAT WITH A MAXIMUM OF 8 BYTES (i.e 1A 00 00 03 00 00 14 00) is required. AND THE SIGNATURE OFFSET SHOULD BE ZERO RELATIVE AND LESS THAN 512 BYTES. IF ANY BODY COULD PLEASE HELP. | ||
| Stefan Fleischmann (Admin) |
I looked at different MPEG files from different sources and found they have only as much as 000001 at offset 0 and 000001 at offset 12 in common. If your MPEG files are from the same source, it is highly likely that you can find a longer (and thus less likely to generate false positives) characteristic signature by examining the MPEG files you still have yourself. | ||
| Dinker (Dinker) |
Can I use this utility to fix FAT16. In my case, I get a message that says that the FAT on the disk is corupted when I boot up in DOS mode. Thanks | ||
| Stefan Fleischmann (Admin) |
With sufficient knowledge about the FAT file system you may indeed be able to use WinHex to repair it manually, but WinHex and Davory cannot repair a file system automatically. They can only recover data/files. | ||
| Durgesh Kulkarni |
How do i recover data from NTFS of Win2K/XP | ||
| Stefan Fleischmann (Admin) |
Please read the topic "Data recovery" in the program help of WinHex ( http://www.x-ways.net/winhex/ ), or try Davory ( http://www.x-ways.net/davory/ ). There are several ways. | ||
| prabuddha |
I try to convert .swf fill into .fla documentation so now i extacting HexaValues from .swf fill and also can be abale to identify the tabels of hex-vals, so i want to know how i re-create the jpgs by using that Hex values of jpg if you have a solution for do that please send me ,I am patiently waiting for a favorable response. | ||
| donnie gerhart (Donnie) |
My HDD appears to have lost the connection between the MBRs partition information and the FAT32 table (and/or even the backup FAT32 table). How can I use your tool to find the primary and secondary FAT tables? Once found, how can a recreate the link from them to the MBR? Cheers, Donnie | ||
| Stefan Fleischmann (Admin) |
You will need knowledge about hard disk partitioning and the FAT32 file system. | ||
| megan kearney |
hi i have a casio exilm camera EX-Z40. the camera played up and turned itself half off after saying card error. anyway when i managed to get it back on it had wiped my memory card. how can i get these photos back......thank you! | ||
| Stefan Fleischmann (Admin) |
Maybe by following these instructions. | ||
| vincent (Vincent) |
hello my name vincent i have a problem with photo's repair my story; i have a camera and there are photo's on the memory card,my friend have accidentelly format the photo's i have a recovery program from camera photo's recovery to pc the problem is only that the file name is clusters jpeg and i wanted vieuw in a photo program the can't loaded. is there a program that i can cluster jpeg repair it and than the photo's send to print the size photo's are 1600 by 200 jpeg files it's just tumbnails cant only vieuw the photo's i can't not zoom the photo's who can help me plaese? my e-mail adress are vjelsma@lycos.nl | ||
| Stefan Fleischmann (Admin) |
Please try these instructions. | ||
| J Harris |
Hi, I have a bit of a problem I wonder if you can supply some advice to rectify please. I have an XP Pro O/S which failed [NTLDR disappeared] and the recovery console was unable to repair. This resulted in blanking my MBR as well as recognition of my drive [relegated to "unknown"]. I have work and data I need to access but can't get anything to recognise it [even resetting the drive to "slave" and adding it to a working XP Pro hard drive]. Any ideas or suggestions? [...and yes, I realise backup is a good idea and every other system I have is "Ghosted" / backed up but this single drive's backup has been irretrievably damaged as I learned just a little too late!] Thanks and best wishes J Harris alpha.sys@ntlworld.com | ||
| Jens Kirschner (Admin3) |
If only your MBR (= sector 0 of the hard drive) has been wiped, WinHex/X-Ways Forensics should be able to find the lost partition on the drive, unless the volume's boot sector (= sector 0 of THAT partition) has been wiped, as well. Once found, it can be accessed in WinHex/Forensics the same as any existing partition. Simply access the drive as a physical medium with "auto-detect deleted partitions" enabled in your general options. | ||
| Jens Kirschner (Admin3) |
If your boot sector has been wiped, you might still search for the backup boot sector shortly after the original start of the partition for FAT32 or at the end of the original partition for NTFS and copy it to the expected position (for the first partition in a hard drive usually sector 63) using WinHex. | ||
| J Harris |
Hello again, Thanks for the suggestions - MBR and boot sector seems to have been thoroughly wiped [no possibility of a virus since the system is stand alone and internet free]... A working O/S System only recognised it as unknown / unallocated drive - but reassigning sector zero to Fat32 [its original format type] allowed it to be detected when reassigned as a slave drive to a working O/S drive. Winhex is running to check for partitions and has found traces of my Fat32 partition... I am hopeful I will be able to find my beloved data by binding the Fat32 / partition data - thanks to your advice and the very wonderful Winhex prog. My thanks to you all for your time and help! best wishes J Harris alpha.sys@ntlworld.com | ||
| J Harris |
Anybody got a resolution for this? Having successfully reconstructed my hard drive, the following problems remain... 1] System type is now classed as unknown ["RAW" UNDER PROPERTIES BUT HEALTHY, ONLINE YET DEVOID OF FILE SYSTEM TYPE UNDER COMPUTER MANAGEMENT] and the drive is indicated as unformatted within "MY COMPUTER" 2] Text verification of all files up to my crash are clearly definable but am unable to get a single file retreived [I assume due to fragmentation of files before the system crash]... can this drive be restored somehow? 3] The entire boot sector and the associated copies seem damaged - will instituting a new MBR help or hinder? 4] Should I define a new partiton to the whole drive - will any data still be recoverable after this? Any suggestions would be gratefully received thanks again J Harris | ||
| john barnes |
IM in uni I have to use winhex to do the following:- In the zip file winhex tutorial there are eight files (I have these on my comp). how do I do this though .... What type of files are they? Can you find out the original name of the file? When were they created / modified? Can you restore their file extensions and open the files? | ||
| Rob Campbell Username: rbcampbell Registered: N/A |
I accidentally deleted some jpeg files several months ago while moving them to a different drive. A computer "expert" ran a virus scan on the entire hard drive and somehow scrambled the files. Although I am able to read the name of the files using several types of photo editor software ...ie Photoshop, Paitshop pro, the images will not open. The files are showing as full size JPEGS @ 2.5 mb Does anyone have any ideas as to how to get these files to open? I took the hard drive to a local computer shop and they cloned the hard drive and attempted to get the files to open. I'm sure that they did not specialize in data recovery but I was told that it didn't look good. The person who originally damaged the files won't return my calls (go figure) so I'm not exactly sure what he did to scramble the headers or files. Any advice would be appreciated. | ||
| Ross Johnson Username: ross_winpro_net Registered: N/A |
> Any advice would be appreciated. Do NOT use the source drive directly at all anymore (e.g. do not boot from it). Use a clone/recovery method that protects the drive. Use WinHex to examine the correctly cloned drive (i.e. physical clone not logical clone), this should allow you to thoroughly investigate and recover any remaining JPGs. > I accidentally deleted some jpeg files ... a virus scan on the entire hard drive and somehow scrambled the files You are not clear here. If the files were deleted first then yes (until recovered) they can suffer severe damage from continued use of the drive, including a virus scan, defrag etc. You did not mention how/where you are able to see the filenames now (e.g. was a recovery performed directly on the source or the clone or were files recovered from either to a destination drive?) > I am able to read the name of the files using several types of photo editor software ...ie Photoshop I am not sure how Photoshop can read the file names if they are deleted or are these recovered files that other software (e.g. Explorer) can also read the filenames? Ross@WinPro.net | ||
| harveywood@live.co.uk Username: harvey Registered: N/A |
Can anyone explain to me how to replace a header on a jpg file? I get the message 'invalid jog marker' in Photoshop. I havce winhex but cant use it. I get the messagfe 'no file headers' when using automatic fix. I have corrupted jpg and tiff files to try and recover. Ihvae tried changing extensions, different programs to no avail. I have tried to copy the top section of a good file to a bad file but cant get it to paste in. 'Help please' | ||
| T Walton Username: trwalton10 Registered: N/A |
I have some excel files that I am trying to recover from a hard drive that I wiped and reformatted. I am trying to use x-ways forensics to recover the files. Some of the files show up and I can open without a problem but some files say that the files are corrupted. When I try to recover the files in excel it just tells me that the files are not recoverable. Is there any way to reciover these files or are they lost? There is nothing wrong with the hard drive just that I reformatted on top of the files. | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Are these files listed in the directory browser in X-Ways Forensics with their original name, and is the file system NTFS? Then X-Ways Forensics knows if these files were fragmented and reads the correct clusters accordingly, and the explanation is that the files were at least partially overwritten, and you can't do anything about it unfortunately. Otherwise the files were probably fragmented originally and X-Ways Forensics does not know about this, and the only way to recover the files would be to manually find and concatenate the fragments (theoretically possible to do for someone who knows his stuff and has a lot of time). | ||
| Charles Snipes Username: chuckfl Registered: N/A |
Stefan replied with the exact right answer (as always) while I was still typing...  Unfortunately, you have a detailed software data recovery job involving reading of the old MFT... or what may be left of it. Charles Snipes BS, CCE http://www.datatriangle.com | ||
| hassan abou khalil Username: camou Registered: N/A |
hi! i need help  i deleted my "Documents" folder and i dont know how to get him back!! please can u help me ? |