Guide to Partially Recovering Files From Damaged Images

Started by sabl

I've fallen victim to the corrupted image problem and have read the several threads on it here, I thought I would make a quick guide to help users try to recover at least some of their files.

This was an NTFS-formatted image, should work for FAT-formatted images too, not sure.

As is always suggested, download OSFMount and install it. Go to mount new, then choose your corrupted image file. I recommend ticking the option "Image file in RAM", that way all changes happen in ram and not to the corrupted image. You could also make a copy of the image file just in case.

Set an image file offset of 4096 bytes. Untick read-only drive and tick mount as removable media.

Image will be mounted but Windows will show it as an unformatted RAW partition.


You have a couple choices here:

Assuming drive letter is R:
Open a command prompt, type chkdsk R: /R

After check disk runs, you should see the drive change under My Computer back to a formatted volume. Open it and try to salvage what you can.
You can also use chkdsk R: /F which seemed to yield more files but they were damaged anyway.


Another option is instead of using chkdsk you can try using a file recovery program, although the results will probably be the same, at least it was in my case.

When you mount the corrupted image and it shows up as raw, download Recuva.
Choose your drive from the drop down list. Go to options->actions tab. Tick Deep Scan and Scan for non-deleted files.
Under Recovering, tick Restore folder structure. Hit the Scan, and wait until it's done. It will show you a list of non-deleted files and deleted files.
Organize files by state, highlight all non-deleted files and right-click->recover highlighted. Choose a location, it will copy all the files, maintaining original folder structure.


Both methods yielded the same results for me. As far as recovering, about 99% of files were unrecoverable for me, mostly it was small text files that I was able to recover. Other text files showed gibberish, archives were corrupted or gave "unexpected end of archive" errors. Executables and other files flat out didn't work.
There's 2 possible reasons for this:
I had NTFS compression turn on for the RAM drive and file fragmentation. Usually recovering files from RAW partition depends heavily on file contiguity, and I suspect NTFS compression just added to it. It's possible the small files were recovered because I believe small files get saved in the MFT if I'm not mistaken.

If someone has a corrupted image file, if they can try this and let us know if they've had better success, and if they have NTFS compression turned on. That being said, I suggest everyone do backups to avoid problems like this. In my case I had version 3.4.5 installed with a boot disk loaded from image file. The image file was updated every 5 minutes. I also had CCleaner installed, but never had any problems. However I recently installed a new SSD on my laptop, and reinstalled Windows on it. I had the ram image on the mechanical drive so I installed the newest version 3.4.6. I had to rename the file from .svi to .img. I mounted the image, but then shutdown the computer without unmounting it. I did have CCleaner installed this time as well. When I restarted the computer, I went to manually mount the image again and it was corrupted. It was a 900MB image, it had increased in size to 927MB. I know it's supposed to be some issue with CCleaner but I wish it would finally get fixed. I didn't have any issue with it before with periodic writes, but this time forgetting to unmount it before shutting down, I was unlucky. I'm not sure what CCleaner has to do with corrupting the image, the only thing that does the writing and modifications to the file is the Ram Disk software, the fault would seem to lie with it.

I've been looking at other RAM Disk software but they don't quite have the same features and ease of use as SoftPerfect, and also sometimes suffer from image corruption.
This guide was the only thing saving me from losing my files forever. THANK YOU.

Reply to this topic

Sometimes you can find a solution faster if you try the forum search, have a look at the knowledge base, or check the software user manual to see if your question has already been answered.

Our forum rules are simple:

  • Be polite.
  • Do not spam.
  • Write in English. If possible, check your spelling and grammar.

Author:

Email:

Subject

A brief and informative title for your message, approximately 4–8 words:

     

Spam prevention: please enter the following code in the input field below.

  *******   **    **  **    **  ********    *******  
 **     **  **   **   ***   **  **     **  **     ** 
        **  **  **    ****  **  **     **         ** 
  *******   *****     ** ** **  **     **   *******  
        **  **  **    **  ****  **     **         ** 
 **     **  **   **   **   ***  **     **  **     ** 
  *******   **    **  **    **  ********    *******  

Message: