R-Studio recovered the file, but its empty

Post a reply


This question is a means of preventing automated form submissions by spambots.
Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:
BBCode is ON
[img] is ON
[url] is ON
Smilies are ON
Topic review
   

Expand view Topic review: R-Studio recovered the file, but its empty

Re: R-Studio recovered the file, but its empty

by Alt » Fri Jul 15, 2011 12:33 pm

It's hard to say much without seeing the actual data.
I'd open the metafiles/$MFT file in the Hex editor built into R-Studio, find the file name (in unicode), look at it with the MFT file record template, and look at the start cluster and run lists. Maybe, its run lists are deleted, which sometimes happen when a very large file is deleted.

R-Studio recovered the file, but its empty

by xcom » Wed Jul 13, 2011 7:37 pm

Hi, I just had an accident and deleted a VM from VMWare Workstation 7, with the "Delete from disk" option.
And when I try to recover the VM and disk file, its 0 bytes.

The VM it self was on a seperate partition for VM's (no other system folders), about 100 GB in size. The partition it self is 900 GB and after deletion there was 550 GB available.

Is there any way to recover it? R-Studio sucessfully recovered several others VM's that I deleted in the past, including some which where over 200 GB.
But not this one, so I think its strange that the last deleted VM is not recoverable, but 3 others VM's with disk files over 200 GB where recovered.

Top