| Author | Message | ||
     Stefan Fleischmann (Admin) |
It is possible to restore lost or logically deleted files (or more general: data) that are merely marked as deleted in the file system, but have not been physically erased (or overwritten). Open the logical drive where the deleted file resided on using the disk editor. Principally you can recreate such files by selecting the disk sectors that the files are still stored in as the current block and saving them using the menu command "Edit | Copy Block | Into New File". However, it might prove difficult to find these sectors. 1. In case you know a snippet of the file you are looking for (e.g. the characteristic signature in the header of a JPEG file or the words "Dear Mr. Smith" in a MS Word document), search it on the disk using the common search commands ("Find Text" or "Find Hex Values"). This is a very simple and safe way, and can be recommended to anyone. 2. In case you only know the filename, you will need some knowledge about the filesystem on the disk (FAT16, FAT32, NTFS, ...) to find traces of former directory entries of the file and thereby determine the number of the first cluster that was allocated to the file. Detailed information on file systems is available in the Knowledge Base. The following applies to all FAT variants: If the directory that contained the file (let's call that directory "D") still exists, you can find D on the disk using Tools | Disk Tools | List Directory Clusters. The factory template for FAT directory entries that comes with WinHex will then be helpful to find out the number of the first cluster that was allocated to the deleted file in that directory. Otherwise, if D has been deleted as well, you need to find D (using the directory entry template as well) starting with the parent directory that contained D. Deleted files and directories are marked with the character "å" (hexadecimal: E5) as the first letter in their name. | ||
| John Westover |
General question. I am trying to recover an image file I accidentally erased on my Fuji FinePix 40i camera. I can restore images that have been erased using the PC delete, but I cannot restore the image I erased using the camera menu. Can anyone help me? Regards, Westhurst. | ||
| Stefan Fleischmann (Admin) |
Especially with .jpg files, I recommend trying the approach described here. Good luck, and don't hesitate to post again if you have questions. | ||
| John Westover |
Further to my last message: I have discovered that the erase feature on the Fuji FinePix 40i camera actually removes the image data, unlike DOS type erasure that only changes the filename. This may be of interest to anyone trying to recover images erased in the camera. | ||
| Lem (Lem) |
I deleted a directory. How can I recover that directory and all it's contents. Or, does this mean I have to recover each file indiviually. IF so what is the header and footer for *.eps | ||
| Stefan Fleischmann (Admin) |
I'm afraid it would have be done individually for each file. One can easily find out a header of a certain file type (if one exists)by simply looking for common byte values or characters at the beginning of such files. My .eps files obviously all begin with "%!PS-Adobe" and end with "%%Trailer". So you could use 252150532D41646F6265 as the header (offset 0) and 2525547261696C65720A as the footer. Good luck. | ||
| Anonymous |
Stefan: I am interested in using WinHex for forensic investigation purposes, but am totally unfamiliar with what you describe as hexadecimal language (how does "%!PS-Adobe" become 252150532D41646F6265? Is there a resource you would recommend? | ||
| Stefan Fleischmann (Admin) |
I recommend you start with the "10-Step Hex Editing Course" in the Knowledge Base and the topic "Using a Hex Editor" in the program help. "25 21 50 53 2D 41 64 6F 62 65" are the 10 byte values in hexadecimal notation that correspond to the 10 ASCII characters "%!PS-Adobe". In a hex editor, the middle column is for hex values and the right column for the corresponding characteres. The File Retrieval command happens to take hexadecimal values to recognize characteristic file header signatures. | ||
| Jacques CULOT |
Hi Stefan , Can your program help me to recover files contained in a directory which has been accidentally erased? The OS is W2000 and the file system used is NTFS | ||
| Stefan Fleischmann (Admin) |
On an NTFS drive you could try recovering the files manually, or using Tools | Disk Tools | File Retrieval. This requires that the files have a characteristic file header. Please consult the program help for that topic. | ||
| Anonymous |
When changing local mail directories, Netscape overwrote all existing files with smaller files of the same name. Is there any way to recover the original files? | ||
| Stefan Fleischmann (Admin) |
Not entirely, the beginning of the old files were probably overwritten. You could try locating mail messages in a raw format on the drive (opened with the disk editor) by searching for exactly known text (such as "Dear Mr. Smith"). For more I recommend contacting a professional data recovery service such as Ontrack, ActionFront, Ibas, or Vogon. | ||
| Alicia |
I cannot access the 10-Step Hex Editing Course in the Knowledge Base. I am told it is nonexistent and am redirected to TriangleHard's home page. I'm entirely in the dark on how to retrieve lost files, my only knowledge being that it is possible. Does it matter what type of file was lost? I lost somewhere around 200 mp3 files. Would I need to retrieve them all seperately or could I simply find the file they were all held in together? Help would be greatly appreciated. | ||
| Stefan Fleischmann (Admin) |
That link may be dead again, but the chapter in the program help about data recovery still exists. Hopefully your files were stored on a disk with the FAT (or FAT32) file system. There is a special automated recovery for this. If the instructions in the program help leave any question unanswered, please do not hesitate to post here again. | ||
| Alicia |
Sorry... Where is the program help? | ||
| Stefan Fleischmann (Admin) |
This is what 99.9% of all Windows programs offer when pressing the F1 key. And there is also a menu entitled "Help" and an item "Contents" that you could try. Besides, in many dialog windows there are buttons entitled "Help" that offer context-sensitive help. And finally, everything described in the program help is also contained in the printable electronic manual. | ||
| Anonymous |
Hi Stefan Fleischmann (Admin) i have download demo winhex to recover excel File and it recover my exce file but i cant read excel file can you tell me how to do thank you very much my mail: nhuxuanquang@yahoo.com | ||
| Stefan Fleischmann (Admin) |
My guess is the Excel file was stored in a fragmented way, so the recovered contiguous clusters do not contain the complete file. | ||
| AKshay relan (Akshayrelan) |
i wana know the ascii characters hidden in a folder | ||
| Stefan Fleischmann (Admin) |
Could you please try to elaborate and rephrase your question? I do not understand. | ||
| Chris |
I think Akshay is referring to the ASCII values of a file. Well, if you have any *good* programming book, you should find a list of them at the back. Or you could come back and tell us what the symbols look like. Once you get the ASCII value, to access you'd have to enter using the ALT key with the ASCII value. eg. ALT+value Stefan, it looks like this guy made some folder in DOS using unusual ASCII characters. The common reason for doing this, is so that someone not familiar with the ASCII code will not be able to access the directory using Windows. Alright, Akshay! What is it you're hiding in there?  BTW, how is the weather in India? Regards, Chris | ||
| Oddicy (Oddicy) |
I accidently deleted a very important file on my HDD. I tried to undelete it with Norton's unerase but it told me: "the first cluster of the file has been overwritten. Unable to automa- tically unerase. Try manualy." or something like that. Can WinHex help me solve my problem. And how exactly this will going to happen... Thanx anyway! | ||
| Stefan Fleischmann (Admin) |
I recommend you try the instructions given in the first posting on this page. If this is a FAT-formatted drive, also try the automatic FAT file recovery method in WinHex (see program help). | ||
| Anonymous |
I've recovered most of my files, (jpgs from a digital camera.) but some won't open and the preview thumbnail only partially loads in my Windows browser. if i try and open them in photoshop, it say's there's a "compression error." is there a utility to fix these corrupt files or a setting in the file retrieval process to allow full retrieval of these files? | ||
| Stefan Fleischmann (Admin) |
Did you recover with the file retrieval function? In that case there is a slight chance that the files were simply recovered with a too small size. Otherwise I'm afraid the files were either fragmented, or have been partially overwritten already with new data. In that case I'm afraid there is nothing you could do. Of course, you could ask a dedicated data recovery service to try (see knowledge base for a link). | ||
| Michelle |
Hi I accidently deleted my images from my Smart Media Card for my Digital Camera. Is there a way to get them back? I typed in Undeleting Smart Media Card and was directed here. If you can send reply to my E-mail addy. Thanks. Michelle | ||
| Stefan Fleischmann (Admin) |
Yes, there is a way, as discussed here. | ||
| Dr. DivX |
Just wanted to post a thank you message - my power supply died and nuked my photos directory on my hard drive - taking out about 8000 digital photos as it went. I had most of them backed up on CDR but the most recent batch was feared lost forever until I struck upon the possibility of scrounging around on my Smartmedia cards for residual files and managed to retrieve some priceless family photos. Thanks a MILLION for running this website - you are the reason I absolutely love having the internet at my fingertips. Now if I can just figure out how to trim all the excess file size off my recovered pics... hm... (starts reading again). | ||
| Stefan Fleischmann (Admin) |
You are very welcome. To get rid of the excess file size, if the files are intact otherwise, you could open them in any image editing software and save them again. Note that this leads to a small loss of picture quality in the case of .jpg files, because JPEG compression is not lossless in general, and each time a picture is saved it is compressed anew. | ||
| Anonymous |
I used a third party program to recover my deleted jpg images, but now the recovered images cannot be viewed. I think the images are still there, but it's corrupted somehow, so Internet Explorer cannot display them properly. I have heard some people say that a hex editor might be able to help. Is there any truth to this, and if so, how do I edit these jpg files in a way that lets me view these pics again? Any info is greatly appreciated. | ||
| Billmallin (Billmallin) |
This is more of a testimonial than a request... but I am so happy I had to share. A friend of mine came into town and we went to his first major-league baseball game. We took 60 pictures… great pictures! Got home put the smart media card in the reader… NOTHING! NADA! ZILTCH!!! ZIP!!! Needless to say we were more than pissed. Searched the Internet and found your product. Since all of the files are larger than 200K I simply bought the full version and let in run automatically. 3 pictures saved. Not good… though 3 is better than 0. I had several files saved, but only three were readable. After more reading on the site I found the following post from Stefan: _________________ Run WinHex and open your Smart Media (format specifications here) or Compact Flash memory card in the Disk Editor (menu Tools). Now you can use the File Retrieval function (menu Tools | Disk Tools) to automatically recover JPG files. With WinHex 10.5 this function has been renamed to "File Recovery by Type". As the file header, specify the hexadecimal values 45786966, standing for "Exif" (or 4A464946, standing for "JFIF", depending on the sub-format of the files) and a header offset of 6. You can either try specifying a footer (FFD9) or a fixed file size to recover (the usual size of your JPG files plus a generous safety margin, which does no harm). The other options should be filled with reasonable default values automatically. When you click OK, WinHex tries to find and restore all JPG files and saves them in the destination folder on your hard disk, where you can check them using your favorite image viewer program. __________________ Folks, this works! Tools | Disk Tools | Recover by type … then follow the directions Stefan posted above. I used 4A464946 at first and only got 3 pictures back. When I tried 45786966 as the file header, it retrieved them all. STEFAN… You are the MAN! | ||
| Stefan Fleischmann (Admin) |
Bill, thank you for your kind feedback! @Anonymous: Possibly the files were stored in a fragmented way (in discontiguous clusters). Manually recombining the clusters could help, but that's an awful task, especially if you don't know the file system fundamentals. If I were you, I would still give the WinHex functions File Recovery by Type and File Recovery by Name a try. | ||
| Anonymous |
I LOST MY PICTURES IN AN ACCIDENTAL FORMAT IN A FUJI FINEPIX 4900. IS THERE ANY WAY TO RECOVER?? | ||
| Stefan Fleischmann (Admin) |
If this format option was a quick, non-destructive one, very possibly yes. Please see here. | ||
| Anonymous |
Is there a way to restore deleted mail messages from the internet? I would like to recover all my messages from the beginning of the year 2002. They were all from the same email address. Thank you. J. | ||
| Stefan Fleischmann (Admin) |
Sorry, no, unless you have direct access to the mail server and its hard drive(s). | ||
| ka0tic r. brown |
Hi stefan...i just downloaded your program today...Here is the situation: i downloaded Key Thief Serv 2.0, i also created another file within the key thief folder so originally lets say, for example, my file would be e:\erase later\key thief\pics\meh\meh.jpg but now the pics folder is deleted so i am unable to link to the meh folder and im pretty sure the .jpgs and .mpgs are still there cuz they are pretty large and when i deleted the pics folder by accident it didnt take very long to erase. So im guessing it didnt erase any of the contents of the meh folder. I am wondering how i am able to just return everything back to the way it was before i uninstalled key thief and the pics folder so everything links up again....When i also search for the .jpgs and .mpgs files using the find folders on the start menu bar it cant find them probably cuz they are a broken link...thank you, your help is much appreciated ka0tic | ||
| ka0tic |
BTW one of the names of the actual files is called huge.mpg and it was in the meh folder | ||
| Stefan Fleischmann (Admin) |
The file recovery features in WinHex are described in the program help. You didn't mention for which step exactly you are missing instructions in the program help. If you wish to recreate an entire directory structure (including deleted directories) and this is on a FAT file system, please read the chapter about "3) FAT file recovery". If you just would like to recover .jpg and .mpg files, both "File Recovery by Name" and "File Recovery by Type" should work for you. If you are unfamiliar with the low-level stuff, I recommend you use Davory rather than WinHex. | ||
| ka0tic |
also the name of another file is "Noches de Vicio en BUDAPEST (7.23).mpg" which was in the meh folder and is no longer accessible becuz of a problem between linking | ||
| ka0tic |
do you think you could give me the link to the "3) fat file recovery" im having trouble finding it. right now my file system is FAT32 and i will try file recovery in the morning thank you | ||
| Stefan Fleischmann (Admin) |
In WinHex: Help | Contents | Data Recovery (at the bottom) | 3) FAT file recovery | ||
| ianmo |
i have erased the smart media card photos using my olympus 2100, without any connection to my pc. i understand tt there is no guarantee whether winhex can help recover my data just have to try. is it is must to have a smart media card reader in order to do the recovery? can i use the camera software to help read the card? unfortunately it doesn't recognise the card as a drive. | ||
| Stefan Fleischmann (Admin) |
If WinHex does not recognize your card as a logical drive or physical disks, yes, you would need a card reader. | ||
| Dobo |
Hello, I have recently been on holls and got some cracking photos of some mates skinny dipping... Unfortunalty, the camera got wet at some point in the evening. When I put the card into the reader it starts to autoplay, but then descides not to do anything at all... when I try to access the drive it says no, can WH help me here? I have tried the method described but WH will not read the drive either... Should I format the card and try again with freshly formatted card that will read? Any ideas, greatly appreciated | ||
| Stefan Fleischmann (Admin) |
For physically damaged media rather contact a specialized data recovery service. If you want to try to format the card, make sure you use a fast, non-destructive formatting option. | ||
| Richard Caulder |
Boot sector damaged by Norton utilities run from cd, (no backup). WinXP will not run with the drive installed. I used Western Digital Data Lifeguard to copy the drive. XP would not run with the copy so I formated the copy. Now I am trying to use Davoy to recover my files from the copy. The original drive is unplugged. I do not know the names of most of my files. Many are located in a folder called "download" where I have copies of software I have purchesed online. I purchased Davoy. I have a drive identical to the one damaged. Is it possible for me to copy the boot sector from the good drive to the damaged one? Or, could I simply errase the boot sector of the damaged drive, so WinXP can do a nondestructive format? I do not know enough about programming to use Winhex with confidence. Please advise. | ||
| Stefan Fleischmann (Admin) |
In what way was the boot sector damanged? Were some of the bytes in the boot sector altered? Perhaps this can be repaired manually. Yes, I highly recommend simply replacing the damaged boot sector with a healthy boot sector if this is a FAT-formatted drive, if the healthy drive has exactly the same specifications (number of clusters, cluster size). For NTFS it would at least be worth an attempt. You could try running Davory on the formatted copy if the file system is the same as it was originally. *.* would be a supported filename mask, but actually Davory is rather meant to recover single important files. There is currently no need to format the original drive if you have an exact copy of it that was formatted already. | ||
| Steve G |
Stefan, My Windows 2k drive was repartioned accidently. It originally was NTFS format and now shows as FAT32. I have been able to retrieve my .doc, .ppt, .xls etc.. files however am so far unable to get at my tax return .tax (Turbo Tax) I have created new dummy .tax files and examined them in hex format. I see similarities in certain areas, specifically the first at offset 00000000 BUT that is not the only place with similar hex numbers. Is it common for the header to be the first hex number listed or is there another option you would suggest to find the .tax file? I tried running Davory also and it appears that only ran on the repartioned FAT32 section of the drive as the NTFS partion is unrecognized. I have tried calling Intuit for the file signature info but have had no success in geting it yet. Any suggestions? Thanks | ||
| Reesah (Reesah) |
I accidentally deleted several photos that were saved in My Yahoo Photo Albumn. Is there any way to retrieve them. | ||
| Stefan Fleischmann (Admin) |
Steve: A unique signature by which files of a certain type can be recognized might be anywhere at the beginning of the files at a fixed offset. If you already found common byte values at offset 0, fine. Knowing the hex values and the offset enables you to use File Recovery by Type in WinHex to recover these .tax files. | ||
| Stefan Fleischmann (Admin) |
Reesah: I don't know what a "My Yahoo Photo Album" is. A collection of photos that resides on a Yahoo server? Sorry, WinHex and Davory only work on local hard drives. | ||
| Wayne Plumtree (Wayne384) |
Stefan, In "Help" under "FAT File Directory" you have the statement, "(Windows 2000 erases the upper 16 bits of the start cluster number when deleting files and directories.)" Could you provide a reference for this? I would like to read up on this characteristic of Windows 2000. Thanks for any information. Wayne | ||
| Stefan Fleischmann (Admin) |
I found out about this myself. I cannot provide any reference. You can reproduce and observe this easily with behaviour WinHex. It unnecessarily causes severe problems for data recovery on FAT32-formatted drives. BTW, this also holds true for Windows XP. | ||
| Daniel B. Sedory |
Stefan, RE: Wayne Plumtree's question about your note that Win2k erases the upper 16 bits of a FAT32's Starting Cluster number... I have done a great deal of research on this and have found that it will occur with any version of Win2kPro (original, SP2 or SP3) and most likely all Server versions as well, BUT ONLY if the file data is NOT retained by the Win2k RECYCLE BIN! In other words, you must have the FAT32 partition set up to never use Win2000's Recycle Bin, or ELSE you must use the SHIFT key + DELete key combination which makes sure that the file will NOT be saved in the Recycle Bin!! If you delete a file under normal methods (with a functioning Win2000 Recycle Bin), THIS WILL NOT OCCUR! I hope this is interesting enough for you to do some further testing on your own; in which case I'm sure you'll want to provide additional info in your next WinHex Help File about it ;-). PS: I would have made up a web page about this using screen shots of WinHex, but can not afford to buy a license having been out of work for a couple years now! I might be able to do this with the eval. version; not sure. Sincerely, Daniel B. Sedory http://thestarman.infotecbusiness.com/ (My UK/European Mirror site.) | ||
| Stefan Fleischmann (Admin) |
You are right, thanks. Strictly speaking, when sending/moving a file to the recycle bin, the upper 16 bits are not erased. When a file is deleted directly, the upper 16 bits are erased. | ||
| Daniel B. Sedory |
Stefan, A couple more notes to clarify things: It took me a while to notice what was happening since both of us apparently run our computers with the Recycle Bin set to keep files out of it (or at least those of FAT32 partitions). I got an e-mail from Wayne Plumtree who said that even if he removed a file from the Recycle Bin after deleting it, the upper 16 bits of the Starting Cluster number still remained the same. So, any files you delete MUST never be placed into the Recycle Bin for this to happen. Since the majority of 'users' always run Windows with the Recycle Bin active, there are probably only a few who would be affected by this phenomenon. Sincerely, Daniel B. Sedory http://thestarman.infotecbusiness.com/ | ||
| Anonymous |
stefan, zuerst ein riesen danke für dieses wundervolle strück software! re: undeleting files on ntfs "On an NTFS drive you could try recovering the files manually, or using Tools | Disk Tools | File Retrieval." i tried this and winhex recovered no files at all! btw why isnt it so easy anymore as it was with a special template (which i dont have anymore) by simply browsing the file table and just overwriting the first character (which indicates that the file is deleted) of a deleted-file entry? i think this template was for fat32 but isnt this possible with ntfs too? how does ntfs delete files? not by simply overwriting the first character of the file name? but anyway i cant find it for fat32 too anymore. where is it? | ||
| Stefan Fleischmann (Admin) |
> i tried this and winhex recovered no files at all! Meanwhile both methods are available for NTFS, File Recovery by Name and File Recovery by Type. > why isnt it so easy anymore as it was with a > special template (which i dont have anymore) by > simply browsing the file table and just > overwriting the first character (which indicates > that the file is deleted) of a deleted-file entry? That alone would never have worked, as (in the case of FAT) not only the directory entries (which you seem to call file table), but also the file allocation table would have to be changed. Anyway, the |