I'm trying to recover a large number of "Favorites" (internet shortcut .url files) from a hard disk drive where they were apparently accidentally deleted. But I did a test run on my own hard disk drive, which has about 20,000 Favorites on it, searching the whole partition (not just the free space), and PhotoRec seems to find only the largest of the .url files. (Note: my .url files are larger than typical, because I use xmarks, which stores extra information in the .url files.)
Most .url files are less than 200 bytes, but the only .url files that PhotoRec found range from 455 to 1026 bytes!
My first thought was that compression might be causing the problem, but I checked, and my Favorites folder is not compressed.
So my theory, now, is that NTFS stores very small files in the MFT, rather than in their own data blocks, and PhotoRec cannot find such files. Does that sound right?
If so, then my guess is that there's no hope of recovering the lost .url files. Is that true?
Please tell me that I'm wrong!
Dave
Subject: recover MS Internet Shortcut .url files ONLY
When I run photorec_win.exe (PhotoRec 6.14-WIP, Data Recovery Utility, March 2013), and look through the list of available file-types, .url files are not listed by themselves:
Instead, there is:Code: Select all
... [ ] txt Other text files: txt,html,asp,bat,C,jsp,perl,php,py/emlx... scripts [ ] tz Timezone info [ ] v2i v2i backup [ ] vault McAfee Anti-Theft/FileVault ...
Unfortunately, recovering all those file types finds a LOT of useless Internet temporary files, perhaps even too many to fit on the destination flash drive. How can I recover just the lost .url files using PhotoRec?Code: Select all
[ ] tx? Text files with header: rtf,xml,xhtml,mbox/imm,pm,ram,reg,sh,slk,stp,jad,url
Right now I'm looking at running a "cleanup" script in another window, but there must be a better way:DaveCode: Select all
:top sweep32 del /q *.h* @REM -- ping is used to insert a 1 second delay ping -n 2 127.0.0.1 >nul sweep32 del /q *.j* ping -n 2 127.0.0.1 >nul sweep32 del /q *.x* ping -n 2 127.0.0.1 >nul sweep32 del /q *.m* ping -n 2 127.0.0.1 >nul sweep32 del /q *.s* ping -n 2 127.0.0.1 >nul sweep32 del /q *.r* ping -n 2 127.0.0.1 >nul sweep32 del /q *.a* ping -n 2 127.0.0.1 >nul sweep32 del /q *.p* ping -n 2 127.0.0.1 >nul ping -n 2 127.0.0.1 >nul ping -n 2 127.0.0.1 >nul goto top