Corrupted files after hard disk data recovery

[Manish Kaushal]

Hi Members

I had an accidental deletion of one folder which had a lot of sub folders containing the data consisting of excel, word and ppt files.

The moment i had this deletion, i stopped using the system, shut the system down and the very next day an attempt was made for the recovery by a third party.

Data was recovered to the full with each and every folder, but the files are mostly duplicated with .Id_XXXXX and seems corrupted as well. The file size is intact.

For example
Status_08 May 2019.Id_710419 as compared to Status_08 May 2019.

No third party software is able to repair the files. Inquired a professional and he told that files may have been overwritten. I am not sure of the overwriting as i stopped using the system after the deletion.

Please help on what exactly the issue is and if the files could be repaired anyhow.

 

[lcoughey]

Can you confirm that the recovered files were returned on the drive from which they were recovered? My guess is that the third party scanned the drive with a recovery program, found the files and recovered them back to the drive from which he was recovering, overwriting them as he went. If so, there is absolutely nothing more that can be done.

If the original drive is still in the original condition without anything being written back to it since you made the mistake, the recovery will need to be done again correctly.

 

[Manish Kaushal]

Thanks Luke for the prompt reply.

Third party handed over the recovered folder/files in a pen drive. I had the pen drive copied to my drive later on.

But even when i open up the pen drive, the issue is still there. Many files are intact and opening up with complete data, but a lot have the above issue.

 

[pclab]

That is file corruption..
If you already save them to your original HDD, the case got worst, because if you want to do another attempt the results will not be good.

 

[Joep]

Can you use for example HxD, open one of the corrupt files and post a screenshot? And also, is this hard drive from which the files were deleted a conventional disk or SSD?

 

[Cassie W]

When you used 3rd party tool to scan the drive, did you preview the detected files in advance? If you can view them normally, you have great chance to recover them successfully.

 

[Manish Kaushal]

@Joep - Attached

@PcLab_ Anything which could be done now.

@Cassie W : I did preview the files through teamviewer and files were very well there. I tried opening them up and there was the same error. I didn't have any idea about the files not opening up. Thirt party said once pulled out, they will open anyhow on my system.

 

[Joep]

That's the header of a JPEG. I can't see the filename /extension, so I have to ask: Did you expect it to be a JPEG or something else?

- If a JPEG then can you send the whole file so I can see if it's complete?
- If you expected it to be another file type then your recovery software did something wrong / or deleted file was written over already

 

[Jared]

Just FYI, I'm moving this out of the tutorial's section and into the logical data recovery section. This is not a tutorial.

 

[RolandJS]

A question for Jared:
"...files are mostly duplicated with .Id_XXXXX..." Jared, is it possible that the recovery picked up all previous deleted versions along with the most recent version of the documents?
For example, I edited my advice.htm three times this week, both deleted copies and the currently saved advice.htm would be picked up by my internal data recovery software -- if I accidentally deleted the folder that housed advice.htm.
I have no knowledge as to why some of the nice person's files were corrupted, except to ask:
maybe a slowly-encroaching HD failure?