When a file has been recovered, in particular from unallocated space it is unfortunately true that for a fragmented disk, or a very long file, the data may be corrupted. CnW Software is aware if this type of problem, and so there are a growing number of file types that are validated, and where possible fixed in a way that they may be opened. One most common type of file for recovery is a JPEG file, used on most digital cameras. With such a file, it is possible that the end is missing, or an area of data in the middle has been overwritten.
When file verification is used on a file, the filename extension is modified to indicated that the file is corrupt, or has been fixed. Thus for a jpeg file, the normal recovered name is recover125.jpg. For a file that is considered corrupted, this will be called recover125.fail.jpg. When a fix has been attempted, it will be named recover125.fix.jpg Both the failed, and the fixed file will be stored.
File recovery is always a difficult process, and no promises can be made as to the quality of the fix. However, there is nothing to lose, as the original file optionally remains, and also most other low cost data recovery programs do not have this feature. For forensic investigation, a partial file may be extremely valuable, even if only to indicate that further investigation is required. With JPEG files, after a simple recovery feature has been added, about 50% more open after the recovery process, even though the image may be truncated.
Currently supported file recovery functions
- JPEG - limited but will truncate with a end code
- Zip files - will create a file name based on first zipped file, and ensure all contained files are complete.
- Video disks, a special tool to verify and merge MPEG files into a video disk
Recovery routines being developed