Why my rescued PDFs forms are empty?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Posts: 1
Joined: 01 May 2015, 16:39

Why my rescued PDFs forms are empty?

#1 Post by fromvega »

First I'd like to thank you for the awesome tools. I'm using ddrescue and photorec to try to rescue files from a USB stick. It's a 32GB stick that has no more partition information so I had no success using testdisk.

I'm using ddrescue to try to rescue data. It is insane slow (like a couble kb/s when I'm lucky) but after a few days it got some data. Here is the command I used:

Code: Select all

ddrescue -d -n /dev/sdd imagefile logfile
I used photorec to see what I could get from the generated image file. I'm mostly interested in some PDF forms that were in the stick. I managed to recover a bunch of them but to my surprise after my brief moment of happiness I noticed that ALL PDFs were empty!

Those are PDFs with form fields that had been filled up with text. The PDFs have all the pages, but all fields are empty! I tried opening them on a text editor to see if could spot data in there somewhere but I think the data is gone. All PDFs are the same size, that also is an evidence that the form data is gone.

So now I wonder, why is that? Where would that information be? Would that be because the recovery wasn't complete? Maybe photorec doesn't work well with forms?

Anyway, I'm running ddrescue again, but not sure what parameters to use to make it try to squeeze more data out.

Do you guys have any suggestion or idea that could help me? Thanks!