cgsecurity.org

I'm trying to recover data from a 3TB NTFS drive and saving the recovered data to another, newly formatted 3TB NTFS drive. At first I tried doing this by booting win7 normally, but PhotoRec (32-bit) gave the following error:

"PhotoRec has been unable to create new file."

Ok, it suggest that I try to disable my antivirus. But this does not help. I tried to run the same process in Windows Safe Mode and executing the exe as administrator, but I get the same error. Pressing continue does not help.

What are my options?

I found this screenshot in another thread
(http://forum.cgsecurity.org/phpBB3/phot ... t2189.html):

Sorry for lame suggestion, I'm no expert, in fact haven't used photorec ever but did you try running it with administrative rights?

Good point, but as I said in my post, I already tried this

I'll try to reproduce your problem.
Can you try to recover some files within your user profile like downloads or documents?
It's only intended as a test.

I'm also having this problem (7.0-WIP, no AV at all, all explorer windows closed, indexing disabled on those folders and only happens with some settings and at the same point plus resuming doesn't help). Could it be that photorec tries to save a file with a name that isn't allowed on windows? Could you please consider having photorec print the starting sector of the data and the name of the file being saved in the error message?

If you run "photorec_win.exe /log", a log file name photorec.log will be created. It will record the name of the file that failed to be created.

cgrenier wrote:If you run "photorec_win.exe /log", a log file name photorec.log will be created. It will record the name of the file that failed to be created.

Oh my! I had already looked at the log-file (I ran photorec with /debug /log) but I was looking at the end of it thinking it was a true log-file while instead it's a report-like file. This is the error but apparently it doesn't have anything to do with file names (though it's not the only disk image I had issues with): I used Nirsoft "OpenedFilesView" to view which files were left open but there were all kinds of them (zip, doc, xls, exe, etc.). There are at least a couple open files in most of the recup_dir folders. Could it be that those are files left open waiting to be completed by the brute-force option?

I have published a new 7.0-WIP that should fix this file descriptor leak/too many open files problem when brute-force mode is enabled. Can you try it ?

Thanks for the fix. I've tried re-processing a couple of disk images and no errors so far. I'll let you know if it ever happens again.