Recovered Photos

[Glen Tas]

I managed to delete all our photos from one of our partitions after Partition Magic stalled half way through a process.

I've run a Complete Format Recover and the folder/file structure seems to have found most of them. If I try to view them after saving them to disc, they can't be opened.

To confuse the issue, I can preview some files in the File Type View that aren't able to be previewed in the Folder Type View. If these files are saved to another partition, they come up fine.

Does File Type View recover data more successfully, but less conveiently (in terms of file/folder information) than File Type View?

Cheers,

Glen

[GDH]

Hi Glen,

Files in "File View" and "Folder View" are found using different search techniques.

Files in "Folder view" are found using the old partition records (MFT records). Each file on a PC has an MFT record which tells the computer the name of the file and the location of the file on the hard disk. Because you have had a problem with partition magic, the partition records are screwed around and the records are no longer pointing to the correct location.

The files in "File View" are found by looking for the header and footer of the file. Because the file name is only stored in the MFT record, these files do not have their original name and will be called "Recovered_JPEG_X".

There is no easy solution to your problem - the best rule to apply is that if you can preview the file it can be recovered - if not, it cannot. You will need to run both a "Complete Format Recover" and a "Complete File Search" to find and save what you can.

I hope this helps.

[Glen Tas]

Thanks for the response.

From reading a couple of other posts, I'd (sort of) come to grips with the MFT records.

What I'm curious about though is why the search method that results in the "File View" actually brings up more recoverable files. We've got files that are not recoverable from the Folder View (ie copy them to HD - can't open) that recover perfectly in the File View.

[GDH]

For files found in "File View": Recover My Files runs over the disk cluster by cluster. It is looking for the file types that you selected in the list. When, for example, it finds a sector on the disk that looks like a JPEG header, it runs some tests to verify that it is a jpeg header and then continues down the disk looking for the footer. If it finds a valid footer then it runs some more tests to determine if it is a valid file and displays the result. There is not much that can go wrong with this method of finding files which is why files diplayed in "File View" are usually good.

The one thing that the header / footer search is not good at finding is fragmented files - i.e. where files are broken up into c***** and stored in different locations on the disk.

For files found in "Folder View": Each file has on a computer has an MFT record. Recover My Files searches the disk looking for these MFT records. An MFT record for a file contains the name of the file and a "run list". A run list tells Winodws what storage clusters the file data occupies on the disk. For example, a file callled shopping list can have a runlist of 10, 11, 12, 40, 77, 2039 - meaning the file is fragmented (if you were to defragment your hard disk the run list would look like 10,11,12,13,14,15).

When you use programs like partition magic you start to screw with MFT table - so if you have a problem it can have serious results. For example, it is possible that the files that were in one location have been moved, new data now resides in this location, but the MFT records did not get updated to tell the computer where the new data is. Thus, RMF can find the MFT record, but the data that is returned in not valid.

[Glen Tas]

Ahhh - THAT makes a heap of sense.

Thanks very much for the help - we've been able to get back about 75% of our photos & vids documenting the first 7 months of our daughter (needless to say my wife was a LITTLE upset when I told her what had happened!).