This started more as a personal project after a HD crash on my brother's computer, so I'm not
sure if it would be useful to others. At the time, there was a bad sector in the new WinXP user
admin directory under /Documents and Settings/ and when the computer started up,
it dumped everything in /Documents and Settings/ and subsequent directories into
a well known folder known as /found.000. I am sure many people have seen these
folders on their root drives after a crash. These folders contain data stored in files such as
found0000.chk. The stupid thing is that as chkdsk goes around checking
the integrity of the drive, dumps whatever it is reading (often multiple files) at the time into these binary files.
In my brother's case, we ended up with a /found.000 directory that was a couple
gigabytes large! Even worse, many of his files had been stored in My Documents
and the Desktop which meant much of it was completely unreadable after the dump.
In a desperate attempt to recover as much data as possible, I created program to search
through all the files and sort out by the byte headers which files were which, renaming them
after recognizing it was a specific kind of file. Although we did not recover all the data
lost after the crash, we were able to restore a large portion of his commonly used files such
as music.
Currently supported extensions are:
- exe (Application)
- markup Language (simple HTML and VSPROJ)
- avi (Movies)
- bmp (Bitmapped Images)
- ico/cur (Icons and Cursors (not including dll libraries))
- zip (Zip compressed files)
- lnk (Windows Shortcuts)
- gif (GIF Image files)
- mp3 (MP3 Audio files)
- pdf (Adobe PDF Documents)
- doc (Winword Documents)
- rar (RAR Archive files)
Although the program does not work perfectly, it will give you an idea of which files are which, after which you can simply open them with a hex editor and make changes as needed. Below are the byte headers I checked for each type of file, if you have any suggestions, feel free to email me them.
Readme (PLEASE read this if you plan on testing the program!)
- download not yet up, still need to comment and fix up code.
- usage: java Restore <file> <range>
- for the sake of convenience, files need to have the same name (if you have changed them).
- this program does NOT alter the original files in any way, it simply creates a new file with the same name, but with a different extension.
- this program is for Windows users ONLY.
- this program does not guarantee results, but email me with samples if nothing happens.
Technical:
- exe - byte[0-1]: 0x(4D 5A) or "MZ"
- simplified markup Language - "vrproj or html"
- avi - byte[0-4]: valid fourCC
- bmp - byte[0-1}: 0x(42 4D) or "BM"
- ico - byte[0135]: 0x00, byte[2]: 0x01
- cur - byte[0135]: 0x00, byte[2]: 0x02
- zip - byte[0-1]: 0x(50 4B) or "PK"
- lnk - byte[0]: 0x(4C) or "L"
- gif - byte[0-5]: 0x(47 49 46 39 38) or "GIF89"
- mp3 - byte[0-3]: "ID3", byte[0-]: 0xffffffff
- pdf - byte[1-4]: 0x(70 64 66) or "pdf"
- doc - byte[0]: 0xffffffd0 and byte[1]: 0xffffffcf
- rar - byte[0-3]: 0x(72 61 72) or "rar"