Corrupted Files on USB drive...

[Joanne]

OK before I start, no bashing on how "SHE SHOULDN'T HAVE DONE THAT BLAH BLAH" everyone involved already knows, so I would appreciate helpful comments.

 

Scenario: USB flash drive gone awry. Folders with weird names appeared. Work gone.

 

I have done a virus scan and removed viruses. I have done a check disk, which removed all the strange folders. I have tried file recovery (recuva, get data back, test disk) and I have recovered a load of CHK files. I cannot find any files to recover that were modified recently... so I think these might be my only hope.

 

So I'm trying un-CHK and FileCHK, but I get an error of a missing DLL file when trying to run the programs.

 

Any ideas on what I can try next? Every search I do points to these 2 programs... if I got the "missing" dll file... where would I even put it?

[jamesb]

There's an article here that suggests a few other tools that could be used: https://www.raymond.cc/blog/how-to-recover-chk-files-created-by-chkdsk-and-scandisk/

 

Alternatively you could always try, if there aren't too many files, examining the file headers in a hex editor to manually identify them then rename them to the correct extension.

[Joanne]

I've tried opening them in notepad and it is just a mash of gobbledy gook! I had a quick scan through the file, but couldn't see much in there.

[unixman_again]

I've often been more successful using Linux to recover files. Try mounting the usb and see if you can read it. If not, use dd to create a raw image and dump it.

[jamesb]

Notepad won't cut it, you'll need an actual hex editor. Notepad++ has a plugin available that provides one: Download Notepad++ Plugins from SourceForge.net

 

Once you have Notepad++ and the plugin, open the file and choose Hex Editor from the Plugins menu.

[Joanne]

chk-mate is scanning now. Thanks for that link. Most useful! Hopefully it will get something back. The teacher was pretty distraught.

[jamesb]

I'll keep my fingers crossed. Everyone slips now and then, let me know if at least some of the data comes back.

[Oaktech]

is it docx/pptx files? you might be able to open recovered docx files in 7zip to open the contained XML files to at least recover the text content.

[Joanne]

I managed to get some of the CHK files to open with CHK-Mate. I've handed the USB back to the teacher and asked that she save stuff to her Documents folder, then at least it is backed up on the server. Hopefully not too much is missing....

[SYNACK]

Hope it works out, unfortunately and belatedly the more tools you run the less chance you have of recovery, each tool does read/writes and alters the structure of the data. Best bet as above is to take a raw image of the drive then work on copies of that. Tools like chkdsk can just as easily mow over the data as recover it. Best to try and run undelete/recovery on the raw image first then wipe any viruses that remain (use Linux or well protected, isolated windows box).

 

System-tools - SystemRescueCd with ddrescue, photorec and testdisk are probably worth a shot in future cases.

[Joanne]

Thanks. I know that check disk totally wiped all the corrupt looking folders... didn't know about the other tools changing stuff though. Good to know for future use!! Unfortunately another lesson learned the hard way.