Recovering excellent json file doesn't work

[Joe123857]

So, I uninstalled chrome a few hours ago but I forgot to export my bookmarks first, and there were A LOT of them. And the C:\Users\User\Appdata\Local\Google\Chrome\User Data\Default folder was deleted with the uninstall, so I decided to check if Recuva can do it. Luckily for me, the C:\Users\User\Appdata\Local\Google\Chrome\User Data\Default\Bookmarks file which contains chrome's bookmarks, was unscathed, recuva says "Excellent" state and "No overwritten cluster detected." However, when I recover the file to another drive, and open it with notepad++, it's just NULL NULL  NULL etc. The file is 12kb in size. It doesn't have a file extension, it's just "Bookmarks", but the content is json, you can see it if you use chrome and open your bookmarks file with notepad++, it's in json format despite not having an extension. But for some reason, recuva says the file is completely untouched, yet recovers it in a broken state, how am I supposed to recover the text from it? If recuva can't recover a simple file that contains only text, god forbid if I have to rely on recuva for recovering something harder (I know it's my fault I forgot to export bookmarks)

[Augeas]

Recovery software does not guarantee that any file can be recovered in its entirety. Recovery is a copying operation, and Recuva will copy exactly what is in the deleted file's clusters to another location. Recuva in advanced mode will show the cluster number, so if you use a hex editor you can go to the start sector on the disk and see that what you have recovered is exactly the same as the deleted file: or you can take my word for it. A state of excellent means that no clusters from a live file are overwriting your deleted clusters at the time Recuva was run.

We've no idea how the file was deleted nor what has happened on your pc since, nor what the file system is, so it's not possible to say why you are not seeing what you want to see. I don't even know what should be seen in a Chrome bookmarks file.

A brief few minutes on Google shows that json files have no file signature, so how did you know you were looking at a json file if there were no contents?

[Andavari]

If the file was in good shape with no corruption it should be viewable, i.e.; you can read the contents in a text editor such as Notepad, etc., the contents shouldn't be stored encrypted or anything - at least that's what I'm seeing in SRWare Iron's bookmarks file and it's based upon Chrome/Chromium.

You should actually have two bookmark files, the one you mention without any file extension "bookmarks", and the backup copy "bookmarks.bak".

Perhaps in the future get into the habit of regularly creating your own backup copy of the bookmarks by exporting them to an HTML file in your Documents folder. That way not all is lost in case of a mishap, or if you decide to switch to a different browser altogether it's a simple process of importing that backup copy bookmarks HTML file which any browser can import.

[Joe123857]

16 hours ago, Augeas said:

Recovery software does not guarantee that any file can be recovered in its entirety. Recovery is a copying operation, and Recuva will copy exactly what is in the deleted file's clusters to another location. Recuva in advanced mode will show the cluster number, so if you use a hex editor you can go to the start sector on the disk and see that what you have recovered is exactly the same as the deleted file: or you can take my word for it. A state of excellent means that no clusters from a live file are overwriting your deleted clusters at the time Recuva was run.

We've no idea how the file was deleted nor what has happened on your pc since, nor what the file system is, so it's not possible to say why you are not seeing what you want to see. I don't even know what should be seen in a Chrome bookmarks file.

A brief few minutes on Google shows that json files have no file signature, so how did you know you were looking at a json file if there were no contents?

So, after my bookmarks were deleted and I reinstalled chrome, the bookmarks file was empty, I opened it with notepad++ and then saw that it's in json format, that's how I know the file is json despite being named just "Bookmarks" without any file extension. Idk what you mean by "file signatures", never heard this term before

 

And yes obviously I can't complain recuva didn't recover my file, it is what it is, but the fact it couldn't recover a simple text file containing only text, after the file was deleted with a normal program uninstall, and the file was deemed to be in excellent state, makes me doubt recuva's effectiveness, I'm certainly not gonna rely on it for the future. I haven't used file recovery programs till now, cuz I usually never forget to backup, but this time I forgot... And I thought, at least a text file will be recoverable, right? I guess not, but it is what it is, we learn from our mistakes and move forward. I tried using a hex editor (winhex) and searching for "type": "url" which is part of the Bookmarks json file, and I found a few of my old bookmarks with the links and everything (cuz the strings are right after each other, after type: url follows the url of the bookmark), but the majority I didn't find, I suppose they're gone for good now

 

7 hours ago, Andavari said:

If the file was in good shape with no corruption it should be viewable, i.e.; you can read the contents in a text editor such as Notepad, etc., the contents shouldn't be stored encrypted or anything - at least that's what I'm seeing in SRWare Iron's bookmarks file and it's based upon Chrome/Chromium.

You should actually have two bookmark files, the one you mention without any file extension "bookmarks", and the backup copy "bookmarks.bak".

Perhaps in the future get into the habit of regularly creating your own backup copy of the bookmarks by exporting them to an HTML file in your Documents folder. That way not all is lost in case of a mishap, or if you decide to switch to a different browser altogether it's a simple process of importing that backup copy bookmarks HTML file which any browser can import.

It should be readable, but it's all NULL NULL NULL in notepad++, I tried recovering it a few times, same thing every time, I also tried encoding it in different formats, in some of them it appeared as a bunch of spaces. In normal notepad, the file appears empty, though there is a long horizontal scrollbar, not as if you just created a new txt file

Like I said, the folder with these bookmarks files was deleted, and in recuva there was no bookmarks.bak file, only the bookmarks file, ¯\_(ツ)_/¯

 

 

[Augeas]

Recovering a 'simple text file' is no easier, or more difficult, than recovering the most securely triple-encrypted file. A text file is merely one where the bit sequence can be translated into a pattern recognisable by a human being. It means nothing special to Recuva, or the disk, or the operating system. To them it's just a string of bits.

As stated above, Recuva will copy faithfully whatever is in the deleted file's clusters. What's recovered is what is on the disk. So Recuva did what it should have done. That the end result is not what was expected is unfortunate, but Recuva can't conjure up what isn't there.

I's still puzzled by the file being empty yet being in json format. Either it is empty, or it contains some Javascript coding.

Now you say that you reinstalled Chrome. I'm not even sure if you're looking at the new bookmarks file, presumably empty or nearly so, or what.

[Andavari]

2 hours ago, Augeas said:

Either it is empty, or it contains some Javascript coding.

When not empty a bookmark would look like this, completely readable:
 

}, {
            "date_added": "12812753827000000",
            "id": "825",
            "name": "Piriform Forums",
            "type": "url",
            "url": "https://forum.piriform.com/"
         }, {

 

[recuvauser20]

@Augeas Hi, I am sorry to reopen this thread. I had a txt which was kept opened in npp. suddenly the system got restarted, when the notepad++ was opened up, I saw [nul] repeated in the text file. I opened up in notepad it showed blank file. I used recuva to recover. I got a file with 0000 written when i opened up in sublime text editor

I re-ran recuva with all options on, deep scan. I got a different file this time with all json key/value pair. I have splunk running on my machine. The recovered file has links with splunk all over. I couldn't understand why it shows these entries. My text file has nothing to do with splunk. this is an important i use. How do I recover this? why it has splunk entry all over? any ideas? i am trying to see if it gives me a location with some pointers so I can go to that location and view the file.

Any help is appreciated.

a few lines in the recovered file,

"log_level":"INFO","component":"IOStats","data":{"device":"\\Device\\HarddiskVolume4","fs_type":"ntfs","mount_point":"C:","interval":"60","reads_ps":"0.317","writes_ps":"7.083","reads_kb_ps":"9352.348","writes_kb_ps":"216401.044","avg_total_ms":"15.604","cpu_pct":"10.52"}}
 

"process":"splunkd","args":"service","process_type":"splunkd_server"

"process":"mongod","args":"--dbpath=C:\\Splunk\\var\\lib\\splunk\\kvstore\\mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=200 --keyFile=C:\\Splunk\\var\\lib\\splunk\\kvstore\\mongo\\splunk.key

Thanks