Recovered files "NON-READABLE"

[chrrrymx]

Hi all! I accidentally deleted (or maybe overwritten) files on ext hard-drive via command prompt, i.e. with purge switch

robocopy D:\X-folder G:\Y-folder\ /s /purge

I've attempted recovery solutions with Recuva, Lazesoft, etc. All kits can find the lost files, as in Recuva, indicates some positives (done both normal / deep scans),

• Green dots
• Folder structures on list look fine
• State: Excellent
• Comment: No overwritten clusters detected
• info incl: 394 cluster(s) allocated at offset 121775296
• BUT Header: all "00"

Take recovered photos (*.jpg|*.dng|*.CR2) as example, the recovered files can't be opened / unreadable, even appears in a "good" sizes, i.e. 6mb. On IrfanView, returns "Can't read file header!" error, Windows built-in Photo can't open the files either.

I very much appreciate any ideas / suggestion please!!

[Augeas]

You copied from your D drive to your G drive, yet you appear to be trying to recover from the D drive, which presumably is your internael drive?

Whatever is happening, files with zeroes in the header are never going to open, or be fixed.

[chrrrymx]

Thanks @Augeas.

> You copied from your D drive to your G drive, yet you appear to be trying to recover from the D drive, which presumably is your internael drive?

Yes, I was trying to do some incremental backup via commandline, D-drive is internal (laptop) -> G-drive is external

> Whatever is happening, files with zeroes in the header are never going to open, or be fixed.

Btw what does "zeros" in Header mean? Interestingly Recuva and others seem be able to locate lost file cluster info. That's painful, going to try some local Data Recovery shops for any luck.

[Augeas]

Btw what does "zeros" in Header mean? = BUT Header: all "00"

File names, directory names, cluster addresses etc are all held in the MFT. What's actually on the disk could be anything. I'm still not sure what you did or were trying to do. Perhaps someone with experience with Robocopy can chime in.

 

[chrrrymx]

26 minutes ago, Augeas said:

I'm still not sure what you did or were trying to do

Basically I tried to do a manual backup from D-drive to external G-drive via Windows command prompt. Unfortunately destination path (G-drive) was messed up, robocopy (/purge switch) has  overwritten / deleted the destination files / folder(s).

I am trying to recover all lost files, for instance, via Recuva and Lazesoft, both have found the lost file(s) and folder(s) on G-drive, but after recovery, none of the recovered files are readable. Hence went into a bit more details found Recuva's header tab showing "00".

[Augeas]

I think I'm getting there. You ran a backup tio an already existing folder on the G drive (Y-Folder), and purge, which:

'Deletes destination files and directories that no longer exist in the source',

wiped out everything already in that folder. You then ran a recover of the contents of Y-Folder back to the D drive, but none of the files recovered open.

But that doesn't get provide a solution. The headers aren't Recuva's, but the files', and no file with zeroes in the header will open (except text files) as the file structure is unidentifiable. It's highly likley that the rest of the file is zeroes also.

I wouldn't have thought that Robocopy would overwrite deleted destination files with zeroes, but something has.

[chrrrymx]

20 minutes ago, Augeas said:

It's highly likley that the rest of the file is zeroes also.

Thanks @Augeas I haven't checked all but most of them quick scanned are with "00" header. This outcome is similar to old post you responded,

```<https://forum.piriform.com/topic/53803-pictures-found-recovered-files-unusable/?tab=comments#comment-305444>```

 

20 minutes ago, Augeas said:

I wouldn't have thought that Robocopy would overwrite deleted destination files with zeroes, but something has.

I wouldn't expect that either!! And I think the devil was prob an extra "\" at the end of destination path.

20 minutes ago, Augeas said:

But that doesn't get provide a solution.

I somehow managed to use Testdisk (given I have attempted with, Recuva Profession, Lazesoft, Search and Recover, etc. in the past 24hrs without much luck, though they all found my lost files on the drive) to recover some files and are readable, yet to confirm as only testing atm. I think the Q is leading to recovery of overwritten files than recovering formatted / deleted files.