Page 1 of 2

Recover an excel file damaged by chkdsk

Posted: Sun Oct 24, 2010 9:03 pm
by recoverxls
Hi,

My hard drive has performed recently a chkdsk at boot. Since then, I cannot find an excel file named mdp.xlsx.
I have the following lines appearing in the bootex.log created after completion of chkdsk:

The file reference 0x3000000003d66 of index entry mdp.xlsx of index $I30
with parent 0x39e8 is not the same as 0x1000000003d66.
Deleting index entry mdp.xlsx in index $I30 of file 14824.
The file reference 0x3000000003d66 of index entry MDP~1.XLS of index $I30
with parent 0x39e8 is not the same as 0x1000000003d66.
Deleting index entry MDP~1.XLS in index $I30 of file 14824.

I was wondering whether this would help me. Thanks for letting me know what is the best path to follow to recover this file.


Thanks again :)

Re: Recover an excel file damaged by chkdsk

Posted: Mon Oct 25, 2010 8:56 am
by Alt
Try our program R-Excel to recover the file.

Re: Recover an excel file damaged by chkdsk

Posted: Mon Oct 25, 2010 9:22 am
by recoverxls
Hi,

R-excel does not help since the file is not visible in the explorer. I thought I should use Rstudio. My question is: Does the log of chkdsk give me some hint about how to search for this lost file? Which search options should I select accordingly in R studio?

Thanks for your help.

Re: Recover an excel file damaged by chkdsk

Posted: Tue Oct 26, 2010 10:20 am
by Alt
1. I don't think the log shouldn't help you, as a very deep knowledge of the file system is required.
2. I think, as chkdsk has moved some data around the disk, only scan for known file types might help. See R-Studio online help for details.

Re: Recover an excel file damaged by chkdsk

Posted: Tue Oct 26, 2010 12:39 pm
by recoverxls
Hi,

I have scanned the drive with R-studio demo by setting the "Known file type" option to .xlsx.
The file system has been set to NTFS.
Although the program has recovered another ecel file which had been lost after the chkdsk run, it did not find the file I am looking for.

Is there something else I can do, or should I consider that this file is definitively lost? (even if "only" its entry in the index has been deleted)

From the chkdsk log is there a way to know on which sectors this file is writen?

Thanks for your help

Re: Recover an excel file damaged by chkdsk

Posted: Wed Oct 27, 2010 8:39 am
by Alt
Maybe, a data recovery professional could do that, not an ordinary user.

Re: Recover an excel file damaged by chkdsk [SOLVED]

Posted: Wed Oct 27, 2010 11:15 am
by recoverxls
Thanks for your comments.

However, I retrieved my file manually from my drive F:

1) I used R-studio demo to list any .xlsx file on my drive F.
2) I have noticed that the .xlsx files that are stored on another drive contain
two occurences of the ASCII string: xl/worksheets/sheet1.xml. I used this pattern as a signature for any .xlsx file .
3) I thus scanned the drive F with the hex editor provided by R-studio demo, and looked for any occurence of this string.
4) I also scanned with the hex editor every xlsx file found in 1).
5) Comparing the adresses obtained in 3) and 4), I could determine which occurences of the string did not belong to an identified file.
6) Then looking closely at the remaining occurences, and comparing the records around them with the structure of a typical .xlsx file edited with the hex viewer, I could find the beginning and the end of each file record.
7) I finally saved these bytes in a new file which opened nicely with Excel.


All this took me 6 hrs.

I guess that all this worked fine because there were not too many xlsx files on my drive and because the file I was looking for was small (10 KB) and not fragmented.

Thanks again for your help

Re: Recover an excel file damaged by chkdsk [SOLVED]

Posted: Thu Oct 28, 2010 10:11 am
by Alt
recoverxls wrote: because the file I was looking for was small (10 KB) and not fragmented.
These are the points.

And that was a good job! Congratulations, sorry for misunderstanding your qualification.

Re: Recover an excel file damaged by chkdsk

Posted: Fri Oct 06, 2017 5:10 pm
by abolibibelot
I know it's an old thread, but still...
– Normally, when CHKDSK deletes an invalid MFT entry for a given file, it moves the content of the file to a hidden “found.000” directory (or “found.001”, etc. when there are several) with a .chk extension. That is the first place to look for it.
– If nothing can be found there, and if R-Studio fails to find a specific file in raw mode, Photorec can do the trick ; although it is a freeware, it's generally excellent as a file carver, better than many commercial softwares, and on par with very expensive, professional forensic tools. If looking only for files of a specific type, you can uncheck the other types in the options, so as to reduce the unwanted clutter, and it can also reduce the chances of false positives and file truncation in some cases.
– Otherwise, indeed, you're left with the option of scanning the whole volume manually with a specific enough string, which is tedious but can save hours of work, as it probably did for the author of this thread. It's particularly tricky in a case like this because XLSX/DOCX files are compressed (standard XLS or DOC are not), so the actual contents are not readily apparent when examining data directly with an hexadecimal editor, and it's not possible to use a particular expression that you remember from the original content of the file you're looking for (it won't appear as such within the raw data stream). So indeed that was a smart workaround.
What I wonder is why that specific XLSX file was not detected by R-Studio like the others : even if that was 7 years ago and the program has been vastly improved in the meantime, if it was indeed able to find XLSX files in raw mode it should have been able to find all of them. Unless there are several possible variations for a XLSX header, and the lost file had an odd one – I had a such an issue when attempting to recover MKV files from a HDD which was originally full of them, but the MFT had been completely wiped, and R-Studio could only find a few of them (Photorec performed much better in that case).

Re: Recover an excel file damaged by chkdsk

Posted: Tue Oct 10, 2017 4:49 pm
by Alt
Well, if you have an excel file that R-Studio cannot recognize, please let us know about that.