Recovered a 32GB .doc file ?!

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
webby1973
Posts: 5
Joined: 03 Apr 2016, 20:56

Recovered a 32GB .doc file ?!

#1 Post by webby1973 »

Hi,

I'm using PhotoRec 7.1 on a Mac, recovering an external NTFS HD from a Win7 machine.
I tried to recover doc/xls/ppt files but almost all of them (a few hundreds) where not recognized by Word/Excel/PPT.

There's a really odd thing: 1 .doc file of almost 32GB (gigabytes!) named f182134232.doc
I don't think it's a Word document, how can I see what it contains? Using TextWrangler I got a memory error.

Thank you for your suggestions :-)

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Recovered a 32GB .doc file ?!

#2 Post by cgrenier »

Do you have more success if you try to open the recovered doc/xls/ppt files using libreoffice ?
You can ignore the 32GB .doc file, it's a false positive.

webby1973
Posts: 5
Joined: 03 Apr 2016, 20:56

Re: Recovered a 32GB .doc file ?!

#3 Post by webby1973 »

cgrenier wrote:Do you have more success if you try to open the recovered doc/xls/ppt files using libreoffice ?
You can ignore the 32GB .doc file, it's a false positive.
I don't have libreoffice, I should install it. I tried also with the OS X Finder Preview.

The big file has this head:
"??ࡱ?>??
????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????hbin??????{00020424-0000-0000-C000-000000000046}????nk ?ގ??
=???????????h???NTypeLib???????P??????vkN???????{C66D66AF-F1B9-4388-9262-F676C736F109}????vp??Version????1.0????nk ?ގ??
=???????????h??

NumMethods???????????vk?4????REG_SZ????nk ?ގ??
=????????p??h???N
ProxyStubClsid32?=????????X??h???NProxyStubClsid????`??????vkNx??????{00020424-0000-0000-C000-000=????????8??h???NProxyStubClsid32????@??????vkNX??????{00020424-0000-0000-C000-0=??????????h???NTypeLib???? ?????????vkN8??????{565783C6-CB41-11D1-8B02-00600806D9B6}????v???Version????1.2????????nk ?ގ??=????????(??h???NProxyStubClsid????0??????vkNH??????{00020424-0000-0000-C000-000000000046}????????nk ?ގ??=?????????h???NProxyStubClsid32??????????vkN(??????{00020424-0000-0000-C000-000000000046}????????nk ?ގ??=???????????h???NTypeLib???????`??????vk??????{565783C6-CB41-11D1-8B02-00600806D9B6}????v???Version????1.2????????nk ?ގ??=???????????hp??NProxyStubClsid32??????????vkN??????{fd7f2b29-24d0-4b5c-b177-592c39f9ca10}????????nk ?ގ?p=?????????????
NumMethods???????????vk???????14????????nk ?ގ?p=????????p??h???NProxyStubClsid32????x??????vkN???????{7888E5FE-6C66-4A34-B217-FA2292073F4A}????????nk ?ގ?h=????????P??h???
NumMethods????X??????vkp??????15????????nk ?ގ?h=???????????h`??NProxyStubClsid???????????vk??????{00020424-0000-0000-C000-000000000046}????????nk ?ގ?h=???????????h@??NProxyStubClsid32???????????vkN???????{00020424-0000-0000-C000-000000000046}????????nk ?ގ?h=???????????hP??NTypeLib??????? ??????vkN???????{149E2513-F9F3-464D-88F2-A0715157F3D7}????v@??Version????1.0????????nk ?ގ?P=???????????h0??NProxyStubClsid???????????vkN???????{00020424-0000-0000-C000-000000000046}????????nk ?ގ?P=???????????h???NProxyStubClsid32???????????vkN ????????????(?????vkN??????1.0????hbin?????{00020424-0000-0000-C000-000000000046}????nk ?ގ?P=???????????h???NTypeLib????{82784F20-F673-4295-BB3B-2ACF7D239597}????v???Version????nk ?ގ?0=??????????h??
NumMethods??????????vk??????11????????nk ?ގ?0=????????@?h??NProxyStubClsid????H?????vkN`?????{00020424-0000-0000-C000-000000000046}????????nk ?ގ?0=???????? ?h??NProxyStubClsid32????(?????vkN@?????{27354130-7F64-5B0F-8F00-5D77AFBE261E}????????nk ?ގ?0=??????????h??NTypeLib????x?????vkN ?????{2735412F-7F64-5B0F-8F00-5D77AFBE261E}????v??Version????1.0????????nk ?ގ?=?????????h0?
NumMethods?????????vk?9????????nk ?ގ?=??????????h?NProxyStubClsid??????????vkN??????{00020424-0000-0000-C000-000000000046}????????nk ?ގ?=????????x?h??NProxyStubClsid32??????????vkN??????{27354130-7F64-5B0F-8F00-5D77AFBE261E}????????nk ?ގ?=????????P??NTypeLib????`???????vkNx?????{2735412F-7F64-5B0F-8F00-5D77AFBE261E}????v??Version????1.0????????nk ke??=?????????h?
NumMethods?????????vk?????21????????nk ke??=???????? ?hx ?NProxyStubClsid32???? ?????vkN ?????{27354130-7F64-5B0F-8F00-5D77AFBE261E}????????nk ke???=????????? ?h
?
NumMethods????? ?????vk
?????27????????nk ke???=????????x"


Using the "file" command via Terminal I got this error "CDF V2 Document, corrupt: Can't read SSAT"

What does it mean?

Locked