cgsecurity.org

First of all thanks for developing such a helpful recovery utility.

I am working to recover Shadow Protect .spf files from a Synology NAS (my Shadow Protect backup destination) and am using the instructions on these sites to mount the NAS as an LVM in Ubuntu and attempt recovery:

Mount NAS Disks:
https://www.synology.com/en-us/knowledg ... using_a_PC

Using PhotoRec to recover delete files:
https://www.synology.com/en-us/knowledg ... nology_NAS

I have been able to run PhotoRec and have recovered .spf files but none of them are large enough to be the base image backup files of my servers.
When I try to open the recovered .spf files using Shadow Protect SPX I get the error "Invalid Image File"

I am currently running Test Disk to see if I can recover the partition information for the folders originally containing the .spf files on the Synology.

Has anyone else experienced these issues or any advise on recovering .spf files or if there are any methods to combine what seem to be fragments/chunks of files?

nerdofreak wrote: 16 May 2019, 14:47 Has anyone else experienced these issues or any advise on recovering .spf files or if there are any methods to combine what seem to be fragments/chunks of files?

The recovery success of photorec varies as a function of the file system involved and as a function of file length.
Your issue is not a bug - it's unfortunately a feature that is based on lack of information when assembling files.
If you ever are to recover jpg-files you can visually see where photorec failed to assemble the picture correctly.

Thanks for the reply!
That makes sense but using your .jpg example, are there any tools that can reconstruct the original file from the fragments PhotoRec finds?
It is great we can get the fragments, but I am not sure what utility this provides if the results of the recovery are not readable or visible in the case of .jpg.

nerdofreak wrote: 22 May 2019, 17:23 but I am not sure what utility this provides if the results of the recovery are not readable or visible in the case of .jpg.

It is sad to read that you ignored my lengthy last post.
Recovery software can recover a part of your data. A part is nothing, a little, a lot or even everything.
If everything below 100% recovery does not meet your expectations, don't use testdisk and photorec and no other recovery software either.

If you are happy about maybe recovering a part using free and open source software then testdisk and photorec is yours.

Maybe you understand this one:
Based upon your reasoning you would doubt the usefulness of any medical treatment or operation without a 100% success rate.
Take a big painting, use a shotgun and then complain about a programm trying to guess the colours of the missing holes not getting it right.
Your statement is outright ignorant, unfortunately.
Try finding something better, please, and let us all know!
Ask a professional recovery company how to do the magic, please.

Fragments are there because they all show the same file header. Putting together various fragments that belong to different files is not a good idea.

Now here is what you can do:

Learn the spf file format specification, go through a recovered file in cluster steps, try to guess if the next cluster is a valid one.
Write your decision logic in code and let it run.
Have your code examine each cluster on the disk as possible successor of your current cluster.

In 2001 I assembled an excel file manually under FAT32 by examining the disk with a hex editor doing manual guesswork of the biff-streams.
That was a short file. I was able to put it together luckily because it contained the invitation list of a collegue's wedding.
The invitations had already been sent out.
I have no idea if I could have programmed that.

photorec is a change to recover data that is depending on the file sytem not yet overwritten (NTFS) or lays down on the disk in serial manner (FATxx).