1

I'm trying to recover files that my in-law deleted(and emptied from recycle bin) few days ago. I can get some .odt files back but can't check if they are those that we need because no matter what encoding I choose it looks gibberish like this, keep in mind its a test file I deleted on my computer to see if I get same results, body of the file should be "1212121212".

Test document

Thats how document looks after recovery. I'm looking for a way to make it readable again.

Thanks in advance.

Adam Henry
  • 13

2 Answers2

0

Well the first thing to note is that file recovery can be a little bit of a hit or miss. You say it was a few days ago that it happened if you didn't notice it until now theres a good chance that data has already been overwritten sadly. The text might just be in a different format though, for that I suggest downloading something like notepad++ and seeing if that is opening it. From your screenshot it does display your name so it's not like it's encrypted or anything.

I would now:

  1. Try a program like notepad++
  2. Try throwing it at a file corruption reverser you can find many of those online
  3. Try maybe using a different 3rd party file recovery tool instead and see if you have any luck with that.

I do wish you the best of luck!

Lite
  • 1
  • Thanks for reply. In Notepad++ i see same gibberish sadly, file corruption sites don't detect anything wrong with the file. I used recuva and one other (googled best free file recovery) and they all recover those files just like winfr but they are in gibberish. Regarding that overwritten status i'm aware it might be problematic for that data on my in-law computer but I have same results on test files I delete on my computer. I get files back but they are just like the one above. – Adam Henry Sep 02 '22 at 18:32
  • Well one other thing I thought of if it is a company computer or if you like safety, you might have setup bitlocker or some other encryption/privacy software it might automatically be overwriting it so that it can deliberately not be found again since this can be a risk in a lot of fields. Just a hunch though, mby try doing the test with a txt file and see if the same thing happens, if it works fine with a txt file it could 100% be the odf format thats being messy. Again good luck! – Lite Sep 02 '22 at 18:37
  • oh sorry for confusing things, odt file is the one on my in law computer (its a home computer btw no bitlocker), my test file is docx, recovered as DOC – Adam Henry Sep 02 '22 at 19:18
0

Deleted file recovery from a live volume is like Russian roulette. Clusters that were allocated to the file may be overwritten at any time.

If we then add SDD and SMR drives to the equation those clusters may be 'trimmed' virtually immediately. It depends on the SSD if it then returns zeros when we try to access those clusters using file recovery / undelete software or gibberish. And again if those clusters are used for new newly written data you may get gibberish too. If some compressed data for example is written to the clusters and you try reading that as Word document or text, it will appear to be gibberish. So in case of SSD we have two mechanisms at work that work against you.

Reason undelete software can detect these files is that the file system data itself is not trimmed. For example in NTFS it's mostly a matter of flipping a flag in MFT entry for the file (used: y/n). Apart from that logs may be updated as well as the $Bitmap file which tracks used/unused clusters.

Info on TRIM: https://en.wikipedia.org/wiki/Trim_(computing)

Video with some examples: https://youtu.be/hzClnwGeJUM

Joep van Steen
  • 6,119