Scour for ASCII string

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pjbola
Posts: 7
Joined: 03 Jan 2013, 15:40

Scour for ASCII string

#1 Post by pjbola »

Can PhotoRec be used to simply search for an ASCII character string on a hard drive like"/return/" without the quote marks? If I know that this string, which is in an Excel file, does not exist on my hard drive, then I can give up my search for the deleted file that contained the string.

Is there another program that can be used to do such a search?

Thanks for your program and your assistance.
dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Scour for ASCII string

#2 Post by dragonfly41 »

A hexeditor might help in searching ..

you don't give any clues to your setup .. OS (Windows, Mac, Linux ??)

[Later edit]

Here is an example of a file recovery product which has a built in hex editor
and searches for "file signatures"

http://www.r-tt.com/Articles/Creating_C ... ndex.shtml

You might be able to use R-Studio in evaluation mode.

pjbola
Posts: 7
Joined: 03 Jan 2013, 15:40

Re: Scour for ASCII string

#3 Post by pjbola »

Some missing details of my unfortunate situation:

Media Type: Laptop
Manufacturer Brand: HP
Model: G70-468NR Notebook PC
Media Size Capacity: 157 GB of 285 GB used
Operating System: Windows Vista

CIRCUMSTANCES OF FAILURE:

A 10MB Excel 97 file Todo_h_2004+hp.xls which is open most of the time and added to/modified daily in Excel 7's compatibility mode, had about 1000 rows inadvertently deleted, presumably by me. That screw up was saved no more than 1 day prior to my noticing the mistake. The laptop has been used only to search for deleted copies or fragments of deleted copies of the unaltered file since then.
dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Scour for ASCII string

#4 Post by dragonfly41 »

Your problem is .. the more you use your laptop to find deleted files the greater the chance that any deleted excel file might be overwritten.

You can try this ...

http://www.easeus.com/data-recovery/off ... -excel.htm

Note: read the warning ..
Save then install it on a drive other than the one on which your files were lost

Or ..
Stop using the laptop.

Go to another working laptop and download a Live CD Linux (there are several to choose from).

Boot up your Live CD in your laptop.

Try using Linux forensic tools in your Live CD to look for deleted files in your laptop drive (which is than working under the Live CD).


[Afterthought]

This article .. http://support.microsoft.com/kb/103329/en-us
.. gives this advice ..
When you save a file that you changed in some way on a Windows-based computer, Microsoft Excel saves the file with a temporary file name and places this file in the same folder as the original file. This creates a new file. The original file is then deleted and the temporary file is renamed with the original file name.

If this process is somehow interrupted, your file may not be saved properly or you may find one or more temporary files in the folder where you tried to save your file. In addition, you may receive one of several alert or error messages.

When you use Microsoft Excel to save a file that you changed in some way on a Macintosh-based computer, and the program unexpectedly quits, Microsoft Excel saves the file with a temporary file name. Temporary files are placed in an invisible folder called Temporary Items in the root level of the hard disk. When Microsoft Excel unexpectedly quits, this folder becomes visible. When you restart the computer, this folder is moved to the Trash and placed in a folder called "Rescued Items from <hard disk name>." You can then drag the file back to the hard disk to recover it.
So your best hope would be to look at temporary files.

Have you looked at temp files in same folder as your changed file?
pjbola
Posts: 7
Joined: 03 Jan 2013, 15:40

Re: Scour for ASCII string

#5 Post by pjbola »

dragonfly41,

Thanks for all your advice and help. I'll work my way backwards from your lastest to your oldest suggestions:

"Have you looked at temp files in same folder as your changed file?" [Yes, within an hour of the discovery of my loss, I had a technician look for temp, auto save, and ~... files hidden or not. We didn't find any.]

"Try using Linux forensic tools in your Live CD to look for deleted files" [I haven't found the right Linux forensic tools. Ubuntu doesn't seem to have any tools that would help. Recommended tools like Ultimate Boot CD (UBCD) contains PhotoRec and TestDisk. I've gone full circle! I haven't tried TestDisk as it sounded to be specialized for more complex losses: boot sectors, and partitions for example. I have tried PhotoRec which looks promising but tends to have an issue thinking my USB Flash drive is full prematurely. Please see http://forum.cgsecurity.org/phpBB3/view ... 659&e=6659 as no one else seems to be seeing it.]

"A hexeditor might help" [Do you know of any that can search a drive for an ascii sting? I'll do some more searching myself.]

"You might be able to use R-Studio in evaluation mode." [ It can recover only un-fragmented files. I don't think it will work because PhotoRec finished its non-fragmented file search without finding anything useful. However there was a related utility called R-Excel which I've downloaded and tried, but it gives me nothing, perhaps because it doesn't support my OS or Excel version:
· Host OS: Windows 98/ME/NT/2000/XP. [Not Windows Vista or Windows 7]
· Supported *.xls file formats: Microsoft Excel 97/2000/XP/2003 "[Not Excel 2007]

Pete
dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Scour for ASCII string

#6 Post by dragonfly41 »

I have tried PhotoRec which looks promising but tends to have an issue thinking my USB Flash drive is full prematurely. Please see viewtopic.php?f=7&t=896&p=6659&e=6659 as no one else seems to be seeing it.]
One approach would be to copy your USB image in entirety into a larger USB drive which has enough space for PhotoRec recovered files. This is always suggested in any recovery process to ensure that you keep your original corrupted USB as your "master" and then you try to recover from the copy.

I haven't used PhotoRec for a while but I thought that you could define a target drive to receive your recovered files. If not then recovering a copied USB image seems to be your best bet. If you recover into your USB you are in fact reducing the chances of recovery since your recovered files may be overwriting the space where deleted files might be recoverable.

I didn't find Excel 2007 in PhotoRec file types but remember your slim hope is finding the temporary file containing your last Excel edit (although some time passed before you had realised your error in deleting 1000 rows).

I don't hold too much hope that you will find an Excel file which was overwritten rather than deleted.

Next time consider opening a Dropbox account to hold important data files you are working on. 2GB storage is free.
pjbola
Posts: 7
Joined: 03 Jan 2013, 15:40

Re: Scour for ASCII string

#7 Post by pjbola »

Dragonfly41,
Thanks again for responding.
"A hexeditor might help" [Do you know of any that can search a drive for an ascii sting? I'll do some more searching myself.]
I found and used HxD hex editor and it found unique strings from files of interest on my hard drive. Unfortunately, the files are broken on sector boundary and there seems to be no finding the other matching pieces. But it gave me hope that some file or file fragment might be recoverable. So back to PhotoRec.

BTW, I'm recovering from a HD to a USB device that was too small. My remedy: Get a USB adapter on a 3TB drive for the destination. That apparently was big enough. Haven't completed my search of those results for unique strings yet.
dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: Scour for ASCII string

#8 Post by dragonfly41 »

Locked