Page 1 of 1

R-Studio recovered the file, but its empty

Posted: Wed Jul 13, 2011 7:37 pm
by xcom
Hi, I just had an accident and deleted a VM from VMWare Workstation 7, with the "Delete from disk" option.
And when I try to recover the VM and disk file, its 0 bytes.

The VM it self was on a seperate partition for VM's (no other system folders), about 100 GB in size. The partition it self is 900 GB and after deletion there was 550 GB available.

Is there any way to recover it? R-Studio sucessfully recovered several others VM's that I deleted in the past, including some which where over 200 GB.
But not this one, so I think its strange that the last deleted VM is not recoverable, but 3 others VM's with disk files over 200 GB where recovered.

Re: R-Studio recovered the file, but its empty

Posted: Fri Jul 15, 2011 12:33 pm
by Alt
It's hard to say much without seeing the actual data.
I'd open the metafiles/$MFT file in the Hex editor built into R-Studio, find the file name (in unicode), look at it with the MFT file record template, and look at the start cluster and run lists. Maybe, its run lists are deleted, which sometimes happen when a very large file is deleted.