cgsecurity.org

ANSWER : Files were there, in found.000, only Windows hides the folder by default and you have to uncheck 'Hide protected operating system files (Recommended)' in file explorer viewing options.

-----

Hi,

Windows CHKDISK deleted all my files whose name included a double dot ':' in their filename.
Given the quickness of the CHKDISK disk check 'n fix operation, i doubt it did any file moving, did it ? The files should still be there in memory ?
I tried to do a Free scan using Photorec but the files aren't there.
Do you think a complete scan could find something more ?
Is Photorec so low level that it can be claimed to be fail proof, or should an alternative be tried ?

J.

PhotoRec should have been able to find them if your files were using a file format known by PhotoRec.
Check if the files haven't been renamed to .chk files.

Thanks for the prompt support !

These were videos with time frames indicated in their name in the format xx:xx, most in .mp4 file format.
I searched .chk filenames on the disk, nothing to be found, no new public or hidden folder at the root,
i checked the recovered files with Photorec in free mode but there's nothing.

Do you have an idea of an alternative ? I'm not even sure if the related space has been freed or not, and some of the folders that contained the video also contained other files created at the same time : any way to use that if data is written in a contiguous way on a new hard disk ?

Perhaps i could try to use Win 7's CHKDISK that was more friendly to ':' characters ? Any chance it would damage the files further ? Perhaps the files are still lurking around ?

Using the character ":" in a Windows world is a bad idea as it is prohibited for use in file names.
That symbol indicates streams as far as I know.
I wonder how you created those names.

"explosion_08:12.mp4"

should not be treated as a mp4 file but as a file labeled

explosion_08

and an alternative data stream labeled

"12.mp4" therein.

recuperation wrote: ↑20 May 2020, 13:56 Using the character ":" in a Windows world is a bad idea as it is prohibited for use in file names.
That symbol indicates streams as far as I know.
I wonder how you created those names.

"explosion_08:12.mp4"

should not be treated as a mp4 file but as a file labeled

explosion_08

and an alternative data stream labeled

"12.mp4" therein.

Thanks for the precision, i see why it all exploded. I renamed the files on Linux, and then tried to use my hdd on windows.
Any idea on the consequences of these file names during CHKDISK ? Do you think they're entirely gone, null byted or overwritten, or perhaps still laying there in some kind of limbo ?

Thanks for the support guys, you made me look a bit further, and actually the files were there in found.000, only it's hidden by default on Win10's file explorer, you have to uncheck 'Hide protected operating system files (Recommended)' in the explorer's viewing option ! You were right cgrenier, merci de la part d'un voisin Nogentais !

Thankfully i found them now because i was about to run Hex searches that were gonna take 3-6 hours each...