R-Studio recovered the file, but its empty

A forum on data recovery using the professional data recovery software R-STUDIO.
xcom

R-Studio recovered the file, but its empty

Post by xcom » Wed Jul 13, 2011 7:37 pm

Hi, I just had an accident and deleted a VM from VMWare Workstation 7, with the "Delete from disk" option.
And when I try to recover the VM and disk file, its 0 bytes.

The VM it self was on a seperate partition for VM's (no other system folders), about 100 GB in size. The partition it self is 900 GB and after deletion there was 550 GB available.

Is there any way to recover it? R-Studio sucessfully recovered several others VM's that I deleted in the past, including some which where over 200 GB.
But not this one, so I think its strange that the last deleted VM is not recoverable, but 3 others VM's with disk files over 200 GB where recovered.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: R-Studio recovered the file, but its empty

Post by Alt » Fri Jul 15, 2011 12:33 pm

It's hard to say much without seeing the actual data.
I'd open the metafiles/$MFT file in the Hex editor built into R-Studio, find the file name (in unicode), look at it with the MFT file record template, and look at the start cluster and run lists. Maybe, its run lists are deleted, which sometimes happen when a very large file is deleted.

Post Reply