0 byte files (as hard links) in “Extra found files”
Posted: Tue Jun 02, 2020 6:35 pm
I made a recovery of a Windows 7 system partition on a 500GB HDD using R-Studio, and to my surprise, it identified a bunch of empty files, i.e. files with a “0 byte” size, inside “JPEG Digital Camera” (9 out of 8538) and “Text Document” (8 out of 229971). Those files are hard links of files identified through the analysis of the filesystem, under “Root”, but if they are present in those “EFF” sub-directories it means that they were also identified by their file signature matching those particular file types, which of course is not possible for files with a size of 0 byte. I thought that it could mean that the filesystem was somehow corrupted between the moment I made the scan and the moment I made the extraction (Windows crashed in between, I used the saved scan information later on to proceed with the extraction) ; to verify this, I re-made the scan from scratch -- and the result is the same, there are still “0 byte” files appearing in R-Studio's explorer in “JPEG Digital Camera” and “Text Document”, same number and same names. Those files seem to be all hard links to files in “Root\Users\[username]\AppData\Local\Temp”. There are many other “0 byte” files in “Temp” which do not appear as hard links in “Extra found files”. How can this be explained ?
Another issue with Extra found files :
That 500GB HDD contains three partitions, a 14.65GB “Recovery” partition, a 116.44GB “System” partition, and a 334.67GB “DATA” partition, but in R-Studio's file explorer, for each identified partition, the “Extra found files” virtual directory contains files which are actually located on the physical space corresponding to other partitions. For instance, there are large video files from “DATA” which appear in “Extra found files” on the tab corresponding to the “System” partition, without being linked to the corresponding files identified through the analysis of the filesystem. The same large video files appear in “Extra found files” on the tab corresponding to the “DATA” partition, and there they appear as hard links, with the names and timestamps of their counterparts in “Root”. So if I want to do a thorough extraction of the whole drive's contents, since there's no easy means of selecting only the files in “Extra found files” which are located within the physical boundaries of the currently examined partition, the only solution is to extract everything, which generates a lot of duplicates, and then use a duplicate remover to painstakingly sort out that mess. So there should be either one single “Extra found files” virtual directory for all partitions, or an option to limit the displayed “Extra found files” for each partition to the files actually physically present within the boundaries of that partition, excluding files physically belonging to other partitions. (I hope that this is clear enough.)
Yet another issue / suggestion :
There should be a clear distinction between the “Extra found folders” (orphaned folders identified through the analysis of the filesystem) and the actual “Extra found files” (identified by means of file signature search). Sometimes there are a gazillion of orphaned deleted folders overcrowding the “Extra found files” virtual directory, with names like “$$$Folder215405354”, and generally those folders contain nothing interesting, as the files they used to contain have generally been overwritten. While files in “Extra found files” are almost always valid files (unless they are false positives, or truncated in a way that makes them unreadable).
Another issue with Extra found files :
That 500GB HDD contains three partitions, a 14.65GB “Recovery” partition, a 116.44GB “System” partition, and a 334.67GB “DATA” partition, but in R-Studio's file explorer, for each identified partition, the “Extra found files” virtual directory contains files which are actually located on the physical space corresponding to other partitions. For instance, there are large video files from “DATA” which appear in “Extra found files” on the tab corresponding to the “System” partition, without being linked to the corresponding files identified through the analysis of the filesystem. The same large video files appear in “Extra found files” on the tab corresponding to the “DATA” partition, and there they appear as hard links, with the names and timestamps of their counterparts in “Root”. So if I want to do a thorough extraction of the whole drive's contents, since there's no easy means of selecting only the files in “Extra found files” which are located within the physical boundaries of the currently examined partition, the only solution is to extract everything, which generates a lot of duplicates, and then use a duplicate remover to painstakingly sort out that mess. So there should be either one single “Extra found files” virtual directory for all partitions, or an option to limit the displayed “Extra found files” for each partition to the files actually physically present within the boundaries of that partition, excluding files physically belonging to other partitions. (I hope that this is clear enough.)
Yet another issue / suggestion :
There should be a clear distinction between the “Extra found folders” (orphaned folders identified through the analysis of the filesystem) and the actual “Extra found files” (identified by means of file signature search). Sometimes there are a gazillion of orphaned deleted folders overcrowding the “Extra found files” virtual directory, with names like “$$$Folder215405354”, and generally those folders contain nothing interesting, as the files they used to contain have generally been overwritten. While files in “Extra found files” are almost always valid files (unless they are false positives, or truncated in a way that makes them unreadable).