1

Is there an app that can save all of the free clusters on a disk to a file?

In some circumstances, when a file gets deleted, the only way to try to recover it is to scan the disk (or partition) for a unique string or something that is known to be in the file. If the disk is fairly full, then it is much easier to scan the free clusters for the content of the missing file than it is to scan the whole disk.

Is there an app that can save free clusters to a file? Alternately, is there a data recovery app or disk viewer that can narrow a search to free clusters?

Thanks.

Synetech
  • 69,547

6 Answers6

1

Probably the user who posted this question already there will be found another way to resolve your concern but a few hours ago I discovered a way to save all the "empty" sectors (what would come to be the free space on a hard drive) to a file, for which should do the following:

  1. Download and install WinHex.
  2. Open the program, go to the Tools menu and choose "Open Disk" where then have to choose the drive (logical or physical) of which you want to clone the free space.
  3. In this step is necessary wait until the program make a snapshot of the open volume (although I'm not sure that this is indispensable).
  4. At the end should show a window with two panels, the upper panel contains a file browser and the bottom shows the binary content of the drive. In the file browser have to look for a special file called "Free space" (usually is the last file in the list, or one of the last).
  5. Only remains open this and save to another hard disk/flash drive with "Save As" (to avoid overwriting the free space itself).
Swicher
  • 26
0

Yes, there are apps that will only search for deleted files. I think Recuva is one, but I'm not 100% certain on that. I've never heard of a specific app that will only dump unallocated sectors or clusters to an image.

What you can also do is image the entire drive, then mount that image (since the filesystem will be intact), then wipe existing files with zeroes using a secure delete program (like bcwipe), and then let your file carving/recovery utility loose on anything that's left.

Depending on your platform (Windows, Unix, etc.), there are several ways to do this.

Geoff Fritz
  • 969
0

Download and burn Hiren's 10.1 preferably using a different pc than the one with missing files.

Once you have a copy of the disc, from the recovery set of programs run getdataback ntfs or getdataback fat32, depending on the drive format type.

When recovering the files make sure they are recovered to a drive different from the one you are recovering from and all should be well.

Best of luck!

Kythos
  • 331
0

Imaging free disk space on a drive won't work because file deletion takes place at the disk catalogue level (and in some cases, the sectors are overwritten with 0's). When you image a disk, you image the data and catalogue, but not the -- effectively -- magnetic residue.

gabrielk
  • 101
0

I just downloaded about a dozen file-recovery apps and the very first one I tested did the trick.

I was quite surprised too because PhotoRec is billed as an app to recover photos from a camera card. However it was perfectly able to scan just the free disk space for text files (in my case a couple of dozen BAT files) and recover them in seconds.

Wow, way to go Christophe Grenier!

I have yet to find an app that can save unused clusters to a file, but this worked just fine as an alternative.

Synetech
  • 69,547
0

I am not sure of any free tool that does this (but would like one if anyone knows a good one!).

That aside, if you do not mind paying, I use R-Studio and it does exactly what you want, it allows you to make an offline image of an entire disk then scan that file for deleted files.

This program is brilliant... I personally use it on drives that are just out the freezer (the trick works!) so I can quickly make a full copy before it dies, then do the recovery in my own time.

William Hilsum
  • 117,648