Lost files

[trucker1948]

Hi I have 23,000 jpg lost files with files names like this (45496_10151286676933510_472967630_n[1] - Copy) or ( LostFile_JPG_798555952 - Copy ). A lot of the thumbnails show the picture including over 50% corrupted but when opened all you get is a colored square or oblong whatever the picture size was. Many are duplicated. I also have 5000+ which just show Infranview logo which for less than a second shows picture and nothing else. I was told to use a bulk rename program to change it to jpg but that did not work.I tried both Recuver & Find My Files and they both saved the recovered disk files the same way. Also both found over 7 million files on a 1tb drive. Any ideas what I can do to get files back. This is from my late wifes computer so very important also need files for Arbitration case.

[Hiroshe]

It's kind o hard to follow what's going on. You said all of the files are currupted, and you want to un-currupt them? Is that's the idea?

Or are they deleted, and you want to undelete them?

Before more files are screwed up, make a back up. You should already have a backup of all your files anyways.

[Ancient Dragon]

what operating system is the computer running? I used to have lots of corrupt files with all versions of MS-Windows XP and older -- have not had such problems with Windows 7 and 8.

[trucker1948]

I am using Windows 7 and all these files are off of my laptops hard drive which I attached to a slave computer that I was stripping down. I sent them to my wifes computer which is where I am checking them. I can send you a copy of what is happening if you want. i am trying to recover these files for 2 reasons. ! most of them are about my life with my wife who died 2 years ago. Also there might be stuff regarding a Medical Malpractice case I am working on. What happemed was I was using a Belkin Transfer lead between my laptop & my wifes laptop to backup my files. It said I had to download & run a program from Belkin on both computers, which I did but both crashed on restart. My wifes I got back doing system restore but mine wouldn't even go to safe mode. My email is [e-mail].

[trucker1948]

I used Find My Files & Recuva to recover what I have.

[Hiroshe]

We don't need anything outside of the technical details.

System restore was a mistake - but at least you still have your laptop which contains the original files.

As I said, MAKE A BACKUP of what you have. And after you get it back make a back up of everything important. Always keep the backup updated.

It seems like you don't know exactly what you're doing, so I would strongly suggest you get a professional to recover it for you.

On a computer that is working, make a Ubuntu boot disk with either a USB or CD. Then, boot up Ubuntu on your laptop that contained the original files without installing it. From there, you can access you hard drive, and you can back up the original files.

[trucker1948]

The system restore was on my wifes laptop so none of the lost files were effected by the restore. On the failed drive I used those programs on the advice of a data recovery company here in San Diego. In the past I have recovered many thousands of files at my last place of work but none came out like these have. I cannot back up the failed drive as it is not recognised and only the recovery programs are able to find it. I brought another hard drive which is double the crashed drive but i cannot back up on to it. No files have been saved to failed drive or attempted restore.

[Hiroshe]

I would strongly suggest you get a professional to do it for you, especially if you do not fully grasp the idea of how filesystems work on a bitwise level.

NEVER EVER WRITE to any failed drive. Even system restoring your wives computer was not a good idea untill all the files are safe. All professionals know this. If you do write, then the files could easily be lost forever. If you have already written, then there is a good chance that they are already lost forever.

I would be very carefull about 3rd party recovery/backup software, without first backing up an image of the disk. I almost never stray away from using what's already built into windows or linux when dealing with this stuff.

My recomendation is you use Ubuntu to save an IMAGE of the drive to the bigger external, and then proceed to try to recover the files. Making an image of the drive means a bitwise copy of the physical medium - ergo, it ignores the filesystem and backs up everything. Do this before anything else is wrecked!

My other recomandation is after that, use Ubuntu to inspect the crashed drive. See if it mounts. If it does, see if the files are on there. If it doesn't mount/the files arn't there, you can still scan the drive for images (bitwise scan for image file headers, again ignoring the files system).

Here are some usefull links:
Ubuntu
Drive imaging
Recovering files from a currupted partition

If you don't understand what's going on with these tools, I still urge you to get someone who knows what there doing in there. You only need to mess up once to loose your files forever.

[trucker1948]

Sorry I might have worded it wrong as when I restored Ginna's computer it was before any lost files were added to the hard drive. When Ginna's computer crashed it was while linking mine to Ginna's to transfer files as a backup. My problem I am not understanding is why a thumbnail is perfect but corrupt when opened up. I know some will not be recoverable and considering it found over 7 million files at a saving size of 5 times larger than the drive that crashed and the capacity of the drive I saved them to baffles me. All files have been multipled about 15 times. It seems as though it is stating a size that is incorrect and duplicating.

[Hiroshe]

Ok, what your saying is contradictory and unclear. Answer the follwoing questions:

1. Your computer originally contained the pictures, correct?

2. When you tried to transfer the files over, both computers crashed, correct?

3. You used system restore on your wifes computer, correct?

4. Your own computer is unbootable, even in safe mode correct?

5. Which recovery program did you use specifically?

6. Which computer did you use the recovery program on?

7. Did you recover the files to the same drive that failed? (A very bad idea. You NEVER write to the drive that failed in any sort of way.)

8. Have you done ANY KIND OF WRITTING to the disk to your own computer since the file transfer? If you have, exactly what did you write/recover to the disk?

9. Have you followed my suggestion to make an image of the drive? Have you followed my suggestion to check if the drive mounts in Ubuntu? Have you followed my suggestion to use foremost to recover the pictures to antoher drive?

10. Have you considered getting a professional to do it for you? Or do you insist that you know what your doing and you'll do it yourself?

[trucker1948]

Hi I put the recovery program on the slave computer without the failed drive attached I tried Find My Files first as I was told that was the best of the 2. Then I connected the failed drive and scanned it putting files on slave computer spare hard drive. The scan took 92 hours for Find My Files to complete. After seeing the pictures and other currupted files I transfered them to a slave drive differant to failed drive. I then reformated the slave computer after all recovered files were on the other drive. Then I tried Recuva and that is what is on slave computer now. Recuva took just over 24 hours. I put all the recovered files on to the slave drives ( 1 for each recovery ) connected to the slave computer which only has the operating program Windows 7 and the recovery program and nothing else. I have made an image of the drive onto another new hard drive. I have never saved anything to the failed drive and it is the same as when removed from laptop. My biggest problem since my wife died is money and a professional recovery firm has quoted a minimum of $300 but it could be considerably higher that is why I am trying to do it myself. I have always been confident in any repairs I have done to restore or fix computers in the past but this one is beating me because of my comments above. Your first 4 comments are correct.

[Hiroshe]

What is "Find My Files"? I looked it up on google, and I connot find the program you're reffering to. Did you mean http://www.recovermyfiles.com/ ?

Ok, I think what you're saying is that YOUR hdd is unultered in any sort of way. Good.

This "recurva" thing and this "Find my Files" thinamabober or whatever. Both of them gave you currupted images?

Is there a currupted image that is not private in any kind of way? Can you post that? I can open it up in a hex editor and check how it is altered from a normal picture of that format.

[trucker1948]

Yes sorry it is Recover My Files I am an idiot. None of my files are really personal so I will find 2 one that will not open and a currupted one.

It wouldn't let me upload one of these types of file LostFile_JPG_808138136 - Copy that do not show as a thumbnail but here is what a lot look like or if you email me at either [e-mail] or [e-mail] I can send you one from there. I really appreciate any help anyone can give because this is beating me and with 5 weeks to go to Arbitration I am panicing abit.

[Hiroshe]

First file:
There are 3 SOI at 0%, 54% and 98%.
There is 1 SOF at 0%.
There are 2 SOF2 at 44% and 99%.
Several DHT at 99%
No DRI.
1 SOS at 0%, 3 SOS from 81% to 83%, several at 99%.
RSTn at 47%, 80% and 83%.
EOI at 100%

Second file:
There were 3 SOI at 0%, 96% and 97%.
There are 2 SOF at 0% and 97%.
There are no SOF2.
4 DHT at 0%, 1 at 97%.
No DRI.
1 SOS at 0%, 1 SOS at 98%.
Several RSTn at 98% - 99%
EOI at 100%

Third file:
Again 3 SOI at 0%, 85% and 87%.
There is one SOF at 0%.
There are no SOF2.
4 DHT at 0%.
No DRI.
1 SOS at 0%.
RSTn at 69%, 70%,. 2 at 71%, 83%.
EOI at 100%

What a mess. It looks like each picture is a mix of 2 or 3 other images. It looks like you're image recovery program just looked for the header and the EOI, and copied everything just like that.

That rasises the question of why the images are so fragmented? This bulk renamer could have been the cause it if was multithreaded. I beleive windows uses a 64k fifo stack for writting information to the hard drive (off the top of my head). Even with a nice filesystem, you would expect a few fragments, possibly often enough to split up images 2-3 times.

The fragmentation could also have been caused somewhere in the files history. Have you ever used a bulk convert on the files? Have you moved them in batch from somewhere?

Or was it the recovery software itself trying to be smart by following a potentially currupted filesystem?

So, here's what I would do next:
1. See if you can mount the filesystem with ubuntu and windows. If the filesystem mounts, we're un luck.
2. Try to fix an image of the filesystem instead of "recovering the files". If the jpegs are fragmented, then the filesystem will contain the information needed to recover them. right now this looks like the most promising solution.
3. Run different recovery software to at least narrow down the number of causes. you're recovery software might be using or ignoring the filesystem hints. I'm not sure if they do that, but it's a theory that I beleive may be accurate.

At the very least, it looks like all of the information is still be there, but it looks like it's a bit scattered.

Also, as a side point, this is one reason why defragging is a good idea.

[trucker1948]

Hi thank you, you have more or less confirmed my suspicions that files were pieced together in big way especially when I found many, many copies of the same file currupted in differant ways. Emails had only part of the message with parts of web pages inserted. That is why it had over 7 million files off of a 500gb drive. I am not an expert in computers like most of the people here but nearly always I can fix issues no matter whether hardware or software. I have been using, building and repairing computers starting with the Spectrum ZX81, Vic 20 with games on cartriges & the BBC B where a word processor came on a ZIF Chip and software on cassette so a long time now but I could never undertstand Hex Code. I will try your sugestions and I will let you know what happens. Once again many thanks for your help.