Fragmented files are probably one of the biggest headaches in data recovery

Why are files fragmented?

All hard disks have a finite capacity. This means that when a large file is to be written to a disk, there may not be a contiguous space for it. Consequently, the file will have to be written to two or more locations and hence is fragmented. Details of how the file is fragmented will be stored as part of the directory structure, or file details, and so when reading the file, the fragmentation is invisible to the user, or application program. Computers tend to read sequential files faster than fragmented files, so there are many utilities to defragment a disk and so keep performance to an optimum level.

Different operating systems work in different ways to try and reduce fragmentation but as often a size of the file is not known when a new file is created, it is difficult to know where to put a new file in the biggest possible space, or in a reasonable space early in the disk. On high capacity disks with low usage, and short files, fragmentation will be low. With a very full disk, and large files, fragmentation may be extensive, and the longer the file, the more likely it is to be fragmented.

If the disk is intact, then CnW Software will process fragmented files without any problems. If the disk is corrupted, or sections such as FAT, or MFT entries are missing, then the raw recovery may be required, and fragmentation becomes an issue. The log will indicate how many fragments a file has, so it is possible to find fragmented files, from an intact operating system.

How to recover fragmented files with CnW Recovery software

The first stage is to find the start of any possible file, and the easiest way is to use the Image scan of the disk to read files in raw format. This function will recognise the start of files from their unique signature, or pattern of data. The log will then show the starting location of the file. From now on, it all rather more complex, and sometimes it is debatable if it is worth the effort. For a very long file with many fragments, somehow each fragment has to be found, and then file stitched together. For a short file, with only a few fragments, the problem comes in finding the start of each fragment. Detailed knowledge of the file structure is required, and the ability to join these sections together. Tools to assist in this, tools are being developed by CnW Recovery that will allow separate fragments to be saved, with an indication of what type of file each fragment belongs to. 

Fragmented JPEGs

For memory chips, CnW has had good success with JPEGs and AVIs and is developing yet more robust routines. By making use of both a possible thumbnail, and contrast matching, high success rates can be achieved.

Word files

 Partial success with Word Documents (Word 95,97, 2003, not 2007 docx files) has also been achieved. Word documents tend to be hard to automate as often they are very fragmented due to many edits. There is also a big issue with many similar documents being edited in the same area of the disk, and so false matches are possible. For best results, manual data carving should be considered.

Fragmented Zip Files

Many Zip files are are actually archives if multiple Zip files, such as 30 files zipped into a single file. CnW Recovery will evaluate the integrity of every zip file it restores in raw mode, and if not valid, will attempt to create a new zip file from valid zips embedded within the whole zip. This may mean that files are actually lost, but the reconstructed file will be a valid zip file that will open, and valid files may be extracted.

Demo program and defragmentation

Unfortunately it is not possible to work on file defragmentation with the demo program, but it will indicate which files are possibly fragmented.

Defrag programs

Nobody ever plans to have to recover fragmented files from a damaged, or corrupted disk. As seen above, there are significant problems and one line of action is to limit the number of fragmented files on a disk drive. Thus running a defrag program on a regular basis will leave a hard drive in a better position to be recovered if the worst ever happens. A defraged disk drive can also help improve PC performance.