Recovering large files from overwritten NTFS

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering large files from overwritten NTFS

#11 Post by recuperation »

ria4 wrote: ↑19 Oct 2019, 17:26 I did not dive deep into the code, but I guess it might have something to do with PhotoRec not anticipating that one same sector could belong to a JPG file and a CR2 file at the same time...?
Without looking into the code - this is not posible. NTFS supports hardlinks which are not commonly used. Two or more files can share the same content. Basically there is one file that is referenced to at different places of the file system.
A CR2 file though would have a different content than a JPG file. Therefore they would differ and occupy different locations on the disk.

Your particular result is probably due to another reasonable assumption in the code of Photorec:
Data that is assigned to a certain file won't be assigned to another file.
If Photorec's guesses fail, a failed file may contain content that belongs to another file that could have been recovered when searching for just that extension.
If Photorec acted differently, the recovery results could require a multiple of space of the failing drive/partition.


In any case, massive thanks for your work on the software.
As there is so much information around on cgsecurity.org, the following beautiful page can easily be overseen. 8-)

Click me!
Top
Locked

Return to “File recovery”