Recover an excel file damaged by chkdsk

Repairing damaged Microsoft Office documents: R-Word, R-Excel, R-Mail.
recoverxls

Recover an excel file damaged by chkdsk

Post by recoverxls » Sun Oct 24, 2010 9:03 pm

Hi,

My hard drive has performed recently a chkdsk at boot. Since then, I cannot find an excel file named mdp.xlsx.
I have the following lines appearing in the bootex.log created after completion of chkdsk:

The file reference 0x3000000003d66 of index entry mdp.xlsx of index $I30
with parent 0x39e8 is not the same as 0x1000000003d66.
Deleting index entry mdp.xlsx in index $I30 of file 14824.
The file reference 0x3000000003d66 of index entry MDP~1.XLS of index $I30
with parent 0x39e8 is not the same as 0x1000000003d66.
Deleting index entry MDP~1.XLS in index $I30 of file 14824.

I was wondering whether this would help me. Thanks for letting me know what is the best path to follow to recover this file.


Thanks again :)

Alt
Site Moderator
Posts: 3126
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover an excel file damaged by chkdsk

Post by Alt » Mon Oct 25, 2010 8:56 am

Try our program R-Excel to recover the file.

recoverxls

Re: Recover an excel file damaged by chkdsk

Post by recoverxls » Mon Oct 25, 2010 9:22 am

Hi,

R-excel does not help since the file is not visible in the explorer. I thought I should use Rstudio. My question is: Does the log of chkdsk give me some hint about how to search for this lost file? Which search options should I select accordingly in R studio?

Thanks for your help.

Alt
Site Moderator
Posts: 3126
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover an excel file damaged by chkdsk

Post by Alt » Tue Oct 26, 2010 10:20 am

1. I don't think the log shouldn't help you, as a very deep knowledge of the file system is required.
2. I think, as chkdsk has moved some data around the disk, only scan for known file types might help. See R-Studio online help for details.

recoverxls

Re: Recover an excel file damaged by chkdsk

Post by recoverxls » Tue Oct 26, 2010 12:39 pm

Hi,

I have scanned the drive with R-studio demo by setting the "Known file type" option to .xlsx.
The file system has been set to NTFS.
Although the program has recovered another ecel file which had been lost after the chkdsk run, it did not find the file I am looking for.

Is there something else I can do, or should I consider that this file is definitively lost? (even if "only" its entry in the index has been deleted)

From the chkdsk log is there a way to know on which sectors this file is writen?

Thanks for your help

Alt
Site Moderator
Posts: 3126
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover an excel file damaged by chkdsk

Post by Alt » Wed Oct 27, 2010 8:39 am

Maybe, a data recovery professional could do that, not an ordinary user.

recoverxls

Re: Recover an excel file damaged by chkdsk [SOLVED]

Post by recoverxls » Wed Oct 27, 2010 11:15 am

Thanks for your comments.

However, I retrieved my file manually from my drive F:

1) I used R-studio demo to list any .xlsx file on my drive F.
2) I have noticed that the .xlsx files that are stored on another drive contain
two occurences of the ASCII string: xl/worksheets/sheet1.xml. I used this pattern as a signature for any .xlsx file .
3) I thus scanned the drive F with the hex editor provided by R-studio demo, and looked for any occurence of this string.
4) I also scanned with the hex editor every xlsx file found in 1).
5) Comparing the adresses obtained in 3) and 4), I could determine which occurences of the string did not belong to an identified file.
6) Then looking closely at the remaining occurences, and comparing the records around them with the structure of a typical .xlsx file edited with the hex viewer, I could find the beginning and the end of each file record.
7) I finally saved these bytes in a new file which opened nicely with Excel.


All this took me 6 hrs.

I guess that all this worked fine because there were not too many xlsx files on my drive and because the file I was looking for was small (10 KB) and not fragmented.

Thanks again for your help

Alt
Site Moderator
Posts: 3126
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover an excel file damaged by chkdsk [SOLVED]

Post by Alt » Thu Oct 28, 2010 10:11 am

recoverxls wrote: because the file I was looking for was small (10 KB) and not fragmented.
These are the points.

And that was a good job! Congratulations, sorry for misunderstanding your qualification.

abolibibelot
Posts: 40
Joined: Sun Jan 31, 2016 5:45 pm
Location: France

Re: Recover an excel file damaged by chkdsk

Post by abolibibelot » Fri Oct 06, 2017 5:10 pm

I know it's an old thread, but still...
– Normally, when CHKDSK deletes an invalid MFT entry for a given file, it moves the content of the file to a hidden “found.000” directory (or “found.001”, etc. when there are several) with a .chk extension. That is the first place to look for it.
– If nothing can be found there, and if R-Studio fails to find a specific file in raw mode, Photorec can do the trick ; although it is a freeware, it's generally excellent as a file carver, better than many commercial softwares, and on par with very expensive, professional forensic tools. If looking only for files of a specific type, you can uncheck the other types in the options, so as to reduce the unwanted clutter, and it can also reduce the chances of false positives and file truncation in some cases.
– Otherwise, indeed, you're left with the option of scanning the whole volume manually with a specific enough string, which is tedious but can save hours of work, as it probably did for the author of this thread. It's particularly tricky in a case like this because XLSX/DOCX files are compressed (standard XLS or DOC are not), so the actual contents are not readily apparent when examining data directly with an hexadecimal editor, and it's not possible to use a particular expression that you remember from the original content of the file you're looking for (it won't appear as such within the raw data stream). So indeed that was a smart workaround.
What I wonder is why that specific XLSX file was not detected by R-Studio like the others : even if that was 7 years ago and the program has been vastly improved in the meantime, if it was indeed able to find XLSX files in raw mode it should have been able to find all of them. Unless there are several possible variations for a XLSX header, and the lost file had an odd one – I had a such an issue when attempting to recover MKV files from a HDD which was originally full of them, but the MFT had been completely wiped, and R-Studio could only find a few of them (Photorec performed much better in that case).

Alt
Site Moderator
Posts: 3126
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Recover an excel file damaged by chkdsk

Post by Alt » Tue Oct 10, 2017 4:49 pm

Well, if you have an excel file that R-Studio cannot recognize, please let us know about that.

Post Reply