Recover zero length files

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
jtech1
Posts: 10
Joined: 25 Jul 2014, 17:03

Recover zero length files

#1 Post by jtech1 »

Using testdisk, I have been able to find the file system on a 3TB drive. And have been able to copy almost 90% of teh files I needed to recover... some files, however, show the correct size in testdisk, but once copied to a new volume, the length is zero. The copy operation shows 0 error count, and all success for all files copied... but still the zero length at the destination for some. Is this because the length is listed in the file system entry, but the first cluster field in the file entry is blank... or something else? If the first cluster field were blank, wouldn't testdisk show it in the file listing as a deleted file? (how are deleted files indicated)?

I'd appreciate any advice on what causes this.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover zero length files

#2 Post by cgrenier »

Do you have the problem with latest 7.0-WIP ?
Avoid FAT filesystem for the destination.

jtech1
Posts: 10
Joined: 25 Jul 2014, 17:03

Re: Recover zero length files

#3 Post by jtech1 »

Yes. It is the latest 7.0 version. Destination is a GPT drive, NTFS file system.

jtech1
Posts: 10
Joined: 25 Jul 2014, 17:03

Re: Recover zero length files

#4 Post by jtech1 »

Any idea what condition cause testdisk to do this? And is there a way for me to look at the values in the file system entry? ie. starting cluster, size of file, mod dates, delete status, etc. then follow the cluster string? It appers that photorec only does a full disk scan to find files? or does it have a mode where I can give it a starting sector (ie from the file system entry from testdisk?) and let it look for something there?

I'd appreciate any advice to solve the zero length issue. Nothing was deleted from this drive... so it would surprise me if all these file system entries are marked deleted...

jtech1
Posts: 10
Joined: 25 Jul 2014, 17:03

Re: Recover zero length files

#5 Post by jtech1 »

I'd really appreciate anyone's feedback here. When testdisk copies a zero length file, even though the file list shows the file size, does that indicate that the data NTFS record is gone or is it there but the file clusters in the bitmap file have been reused? What condition will cause testdisk to do this? Can testdisk show me the NTFS file entry in it's entirety so I can see data run info? Can any tool help me with this? There are too many with zero lengths to have been overwritten... this drive was mainly read only. Testdisk is the only utility that can find the NTFS file system since the partition table is damaged... what can I do to get to the file record data and the actual file clusters from what I see in the testdisk file list?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover zero length files

#6 Post by cgrenier »

Can you tell me if the problem is still here with latest 7.0-WIP ?
If you are using Windows, please try both 32-bits and 64-bits version.

jtech1
Posts: 10
Joined: 25 Jul 2014, 17:03

Re: Recover zero length files

#7 Post by jtech1 »

Yes. I am using the latest 7.0 version. I will try the x64 7.0 version later today and post the results.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover zero length files

#8 Post by cgrenier »

WIP=Work In Progress This version is updated every week. It's why I asked if you used the latest 7.0-WIP...

jtech1
Posts: 10
Joined: 25 Jul 2014, 17:03

Re: Recover zero length files

#9 Post by jtech1 »

Sorry, I did not know what WIP meant. I just tries it with the latest WIP (8/20) build and it is still writing the new file with zero length. Is there any way for me to see more details about the NTFS file entry?

The log file stops showing entries after the Quick search for the file system... the quick search succeeds, and I can navigate to the files I want to copy (most of which copied OK..only about 50 copied as zero length). Once I select teh file and copy it, testdisk takes a few seconds, and then shows Copy done! 1 ok, 0 failed. The log file last entry was form when I did the Quick Search and ended as:

file_pread(8,1,buffer,1565567602(364801/108/30)) lseek err Invalid argument
file_pread(8,1,buffer,1565567603(364801/108/31)) lseek err Invalid argument
file_pread(8

no further entries were written for the copy operation.

I tried 6.14 also, and got the same result. There has to be some reason for the zero length copy... I would think it should be in the log file, but the log file is stopping in mid line back on the quick search operation. Is there a max log file size? Any way around it if there is?

What is the best utility to use to make a sector level copy of this drive so that I can use testdisk on a copy instead of the original going forward?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recover zero length files

#10 Post by cgrenier »

Use gnu ddrescue to do a sector by sector copy. It's shipped with all Linux distribution.

Locked