Recovering a document from a FAT disk in a HEX editor. Best free hexadecimal editors (hex) Recover archives in WinRAR

Starting to write a review of the hex editor with the short name HxD, we did not expect that this seemingly unremarkable utility has such an impressive set of functions. Of course, first of all, this is editing files in hexadecimal code with the accompanying options for replacing and inserting bytes. And now let's just list the rest of the HxD functions: editing disks, RAM, gluing and splitting, comparing and safely deleting files, calculating file checksums by various algorithms and statistics on the use of characters in the text.

After starting HxD, open the file and see its contents in two panels: the hexadecimal code is displayed on the left, and the normal text content of the file is shown on the right.

To edit the contents of the file, simply place the cursor in the text panel and enter the text. Changed data is displayed in red for easy retrieval. You can change the information in hexadecimal mode, here you will already need to enter a character code consisting of two positions: these can be numbers from 0 to 9 or letters from A to F. Another useful function provided by HxD is the allocation of several bytes for subsequent operations ...

The selected block can be deleted, while the rest of the data is shifted to the left and the file size is changed. In most cases, deleting a part of the code in a file can lead to a violation of its integrity and inability to open it in the application. Right click on the selected block and select an item in the menu Fill selection will allow you to configure the byte replacement parameters. In the window, you can manually enter a code that will be replaced in bytes. It is also possible to fill bytes with random numbers in the specified range (option Random bytes). Button [Null bytes] allows you to select padding with zeros. In the list Steps you can add multiple passes and specify the characters to replace for each. As a result, HxD will rewrite the allocated bytes several times, and upon completion they will contain the data specified for the last step.

There is another way to allocate a block, which is especially effective for large amounts of data. Right-click in the text, select the item mnu Select block and adjust the selection parameters. We indicate the offset from the beginning of the file and the choice of the offset of the end or the length of the block. Offset values can be entered as hexadecimal ( hex), and more familiar to us decimal ( dec). As a result, we get a selected block of the specified dimension.

Through the menu Edit - Insert Bytes a window for setting the parameters for adding data to a file opens. Here, first of all, we indicate the number of bytes to be added. You can and enter a padding pattern, this sequence of hexadecimal data HxD will be inserted into the added bytes.

Button [Open disc] calls a list of drives connected in the system, which can also be opened in the editor. In this mode, a new toolbar appears for navigating the sectors of the disk, and to the right of the two main panels, another one appears, indicating the sector. By default, the disk opens read-only, but if you disable the option of the same name when selecting a disk, we will be able to edit the contents of the disk and save the changes made. Of course, editing a disk in hexadecimal code must be done carefully, knowing exactly what needs to be fixed. Reckless changes to disk data can lead to loss of files or violation of their integrity.

Equally useful is the function [Open RAM], which allows you to select an application in the list of processes and change the contents of RAM. Partly similar functionality is offered by numerous utilities for hacking games, allowing you to add "life", money, etc.

Further actions and possibilities are no different from editing files in hexadecimal code.

Finally, let's note some more features of the HxD hex editor. The program can display data in several encodings: Ansi, DOS, EBCDIC and Macintosh. Configurable offset basis and byte grouping (one by default), the number of bytes per line. If there is a need to reliably delete a file, without the possibility of deleting it, you can select from the menu Advanced - File Tools - Safe Removal (Shredder).

A couple more HxD functions are useful when working with files. Through the menu Advanced - File Tools - Combine a window for file splicing settings opens. You can select as many files as you like in the list, after which the program will combine them into one and save them under the specified name. The opposite function allows you to split one file into several parts. In this case, open the shared file, enter the base name for the parts of the file, and select or enter the size of the parts.

HxD's capabilities can often come in handy for comparing files ( Analysis - Compare files - Compare). Everything is simple here: select two files and see their hexadecimal code in two panels. By pressing the key F6 , you can navigate to the next difference, and the keyboard shortcut Shift + F6 returns us to the previous difference. In this way, you can quickly view all the differing data in the files.

HxD also offers us such a function as calculating the checksums of a file (menu Analysis - Checksums). Moreover, we have several calculation algorithms to choose from: Checksum (8, 16, 32, 64), CRCs (16 and 32), Custom CRC, SHA (1, 256, 384, 512), MD5 (as well as 2 and 4). Programmers may be interested in the export capabilities of the program. HxD supports export to Pascal, C, Java, C #, VB.NET source code, formatted output as plain text, HTML, Richtext and TeX, as well as Intel HEX and Motorola S-record hex files.

You can use bookmarks to move quickly. To set a bookmark, press the keys Ctrl + Shift + number , and to go to a bookmark just Ctrl + number .

And finally, another interesting feature of the hex editor. This is the statistics of the symbols in the file ( Analysis - Statistics), especially useful for text data. On the diagram, each column corresponds to one symbol, and there are 256 of them, as is known. And the higher the column, the more often the corresponding symbol appears in the text. When you click on a column, the status bar displays the symbol and its hexadecimal code, percentage in the text and quantity.

Specifications:
Interface language: Russian, English, etc.
OS: Windows 95, 98, Me, 2000, XP, 2003, Vista
File size: 874 Kb
License: free

Data recovery at 100% Tashkov Petr Andreevich

Recovering files in a HEX editor

Try to parse the file by opening it in a HEX editor. One of these programs, Hexplorer, was discussed at the beginning of the chapter. Other editors are widely known, for example WinHex ( http://www.winhex.com), HEdit or Free Hex Editor Neo ( http://www.hhdsoftware.com). In terms of basic capabilities, all these programs are equal, and the differences can be appreciated mainly by programmers who often use additional search and editing functions.

You may be able to recover the data on the first try. If the file contains uncompressed text, it will be enough to copy these fragments and put them together in a text editor. Since the required result has already been achieved, the thought may arise that there is no need to restore anything else.

For most formats, you still need to restore the file structure so that you can later open the document in the intended application. The more detailed description of the format is available to the user, the more chances to notice any inaccuracies in the file. In this case, an intact file of the same size and properties can serve as an example for comparison: open a second editor window next to it and try to find the differences. Of course, this does not apply to the content part, but you can almost always notice the difference in the structure of the headings.

Further actions are a creative process. When calculating the size or offset of individual file components, you can try to substitute these values in the header fields. The description of the structure or comparison with other similar files will help to find the position of the fields and their admissible values. The already named editor Hexplorer allows you to save intermediate results of editing, and then discard the changes made. The saved file can be checked immediately by opening it in the appropriate application. If unsuccessful, you need to go back a few steps and try to apply different values, etc.

In exceptional cases, any methods work: for example, it is possible to copy the header of one JPEG file and paste it in place of the lost or damaged one into another file. Sometimes such files open well with one of the viewers. The same can be said for some media files.

From the book PC Crashes and Errors. We treat the computer ourselves. Let's start! author Tashkov Petr

Archiving and restoring files Using this mechanism, you can configure the automatic archiving of operating system files so that later, if necessary, you can restore them. Let's see how this mechanism works.

From the book Windows Vista Without Straining the author Zhvalevsky Andrey Valentinovich

Archiving and restoring files But the system is a system, and most of all you should be concerned about the safety not of programs, but of the documents you have created. A program, even the most complex one, can, as a last resort, be re-installed, but the documents can - pah-pah-pah, so as not to

From the Nero 8 book author Kashevarov A

8.3. Restoring archive files We have considered possible cases of saving data as backups. In this section, you will get acquainted with the procedure for recovering data from previously created copies and archives. To restore data using a backup,

From the book Windows Vista the author Vavilov Sergey

Recovering Previous Versions of Files It is not uncommon for a user to mistakenly replace files with the same name. In previous versions of Windows, it was impossible to revert to the previous contents of the replaced file, in Windows Vista this problem

From the book PC Crashes and Errors. We treat the computer ourselves the author Dontsov Dmitry

Archiving and restoring files. Backing Up a Complete PC Computer In the previous subsection, we talked about saving system settings as restore points so that you can revert to them in case of a failure. In this subsection, we will talk about how to protect yourself from

From the book Video tutorial for creating an essay, term paper, diploma on a computer the author Balovsyak Nadezhda Vasilievna

Saving and Restoring Registry Files Never forget that the health of the operating system depends on the state of the registry. Very often, the performance of the registry is compromised by a variety of programs written without observing

From the book Firebird DATABASE DESIGNER'S GUIDE by Borri Helen

Chapter 4 Working with formulas in the Word editor Mathematical formulas Formulas created in previous versions of Word ChemPen3D1 editor It's hard to imagine a thesis or term paper without formulas. In works on the exact sciences (mathematics, physics, chemistry) without them

From the book Computer Sound Processing the author Zagumennov Alexander Petrovich

About Technical Editor Geoff Worboys has been designing and developing database applications for about 15 years. He has been using Firebird for the last 10 years, and before that he used his predecessor InterBase as a management system.

From the book Data Recovery 100% the author Tashkov Petr Andreevich

About the scientific editor of translation into Russian Dmitry Kuzmenko has been designing and developing database applications for 16 years. He started working with InterBase in 1994. In 2002 Dmitry founded the company iBase (www.ibase.ru), which provides technical support for InterBase and

From the book Home Doctor for Your PC the author Vinogradov Alexey Stepanovich

Editing arrangements and scores in the multichannel editor When performing arrangements in the multichannel MIDI editor, you must first of all be able to work with tracks: select, copy, move and reorganize parts of the project. To facilitate this

From the book Install, configure and restore Windows 7 100% the author Vatamanyuk Alexander Ivanovich

Chapter 1 Recovering Damaged Files File Structure in Hexplorer Understanding the File Format Recovering Files Using Your Own Software Tools File Recovery Software Useful Links Summary This chapter focuses on

From the book How to Train Your Computer in a Few Hours author Remneva Irina

Recovering files using your own tools of application programs In some application programs, the ability to test and restore damaged documents is initially provided. These possibilities are quite limited, but sometimes they are enough. C

From the author's book

Introduction Like any technique, a personal computer needs maintenance, adjustment and adjustment. Careless attitude to your machine leads to the fact that the computer becomes unstable and inefficient. And then it crashes and the computer

From the author's book

21.1. Recovering files Recovering your data, once you've taken care of backing it up, is a very simple process. It consists of just two steps. 1. Specifying the archive from which you want to take data. 2. Specifies the location where you want to recover data.

From the author's book

Chapter 22 Recovering Deleted Files 22.1. Working with the GetDataBack program 22.2. Using R-STUDIO Files during routine deletion most often end up in the Windows Recycle Bin - a folder specially designed for this. If you accidentally deleted a file or even a folder, open

From the author's book

Recovering Deleted Files If you accidentally deleted a file, you can recover it by removing it from the Recycle Bin. To do this, open the Recycle Bin window by double-clicking the icon of the same name on the desktop, or by right-clicking on it and selecting in

Hello.

Many experienced users, I think, have quite a few CD / DVD discs in their collection: with programs, music, films, etc. But CDs have one drawback - they are easily scratched, sometimes even from careless loading into the drive tray ( I will keep silent about their small capacity today :)).

If we also take into account the fact that discs quite often (who works with them) have to be inserted and removed from the tray, then many of them quickly become covered with small scratches. And then the moment comes - when such a disc cannot be read ... Well, if the information on the disc is distributed on the network and can be downloaded, but if not? This is where the programs that I want to give in this article will be useful. And so, let's get started ...

What to do if the CD / DVD is unreadable - tips and tricks

First, I want to make a small digression and give some advice. Below in the article are the programs that I recommend using for reading "bad" CD-disks.

If your disc cannot be read in your drive, try inserting it into another (preferably one that can burn DVD-R, DVD-RW ( earlier, there were floppy drives that could only read CDs, for example. More details about this here: https://ru.wikipedia.org/)). I myself have one disc that completely refused to play in an old PC with a regular CD-Rom, but easily opened on another computer with a DVD-RW DL drive ( by the way, in this case, I recommend making a copy from such a disk).
It is possible that your information on the disk is of no value - for example, it could have been posted on a torrent tracker a long time ago. In this case, it will be much easier to find this information there and download it than trying to recover a CD / DVD disc.
If there is dust on the disc, gently blow it off. Fine dust particles can be gently wiped off with napkins ( in computer stores there are special ones for this case). After wiping, it is advisable to try again to read the information from the disk.
I must point out one detail: it is much easier to recover a music file or movie from a CD-ROM than any archive or program. The fact is that in a music file, if it is restored, if some piece of information is not read, there will simply be silence in this moment. If some section is not read in the program or archive, then you will not be able to open or run such a file ...
Some authors recommend freezing discs and then trying to read them. (arguing that during operation the disk heats up, but after cooling it down - there is a chance that in a few minutes (until it warms up) the information will be able to be pulled out). I do not recommend doing this, at least until you try all the other methods.
And the last... If there was at least one case that the disk was unavailable ( could not be read, got out an error) - I recommend copying it completely and rewriting it to another disk. The first bell is always the main one 🙂

Programs for copying files from damaged CD / DVD discs

1. BadCopy Pro

BadCopy Pro is one of the leading programs in its niche that can be used to recover information from a wide variety of media: CD / DVD disks, flash cards, floppy disks (probably no one uses these already), USB disks and other devices.

The program is quite good at extracting data from damaged or formatted media. Works in all popular Windows versions: XP, 7, 8, 10.

Some features of the program:

the whole process takes place fully automatically (especially important for novice users);
support for a bunch of formats and files for recovery: documents, archives, pictures, videos, etc .;
the ability to recover damaged (scratched) CD / DVD discs;
support for different types of media: flash cards, CD / DVD, USB disks;
the ability to recover lost data after formatting and deleting, etc.

2. CDCheck

CDCheck- This utility is designed to prevent, detect and recover files from bad (scratched, damaged) CDs. With this utility, you can scan and check your disks and determine which files have been corrupted on them.

With regular use of the utility, you can be calm about your disks, the program will inform you in time that data from the disk needs to be transferred to another medium.

Despite the unpretentious design (see Fig. 2) - the utility does its job very, very well. I recommend to use.

Rice. 2. The main window of the CDCheck v.3.1.5 program

3. DeadDiscDoctor

This program allows you to copy information from unreadable and damaged CD / DVD disks, floppy disks, hard drives and other media. Lost pieces of data will be replaced with random data.

After starting the program, you are offered three options to choose from:

Copy files from damaged media;

Make a complete copy of a damaged CD or DVD;

Copy all files from media and then burn them to CD or DVD.

Despite the fact that the program has not been updated for a long time, I still recommend trying it in case of problems with CD / DVD discs.

4. File Salvage

To give a short description, then File Salvage is a program for copying broken and damaged discs. The program is very simple and not large in size (only about 200 KB). Doesn't need installation.

Officially works in Windows 98, ME, 2000, XP (unofficially tested on my PC - worked in Windows 7, 8, 10). Regarding recovery - the indicators are very average, with "hopeless" disks - it is unlikely to help.

5. Non-Stop Copy

Despite its small size, the utility very effectively recovers files from damaged and hard-to-read CD / DVD disks. Some distinctive features of the program:

can continue files not fully copied by other programs;
the copying process can be stopped and resumed anew, after some time;
support for large files (including more than 4 GB);
the ability to automatically exit the program and turn off the PC after the copying process is completed;
Russian language support.

6. Roadkil's Unstoppable Copier

In general, it is not a bad utility for copying data from damaged and scratched disks, disks that refuse to be read by standard Windows tools, and disks that cause errors when reading them.

Rice. 7. Super Copy 2.0 - the main window of the program.

Another small program for reading files from damaged disks. Those bytes that will not be read will be replaced ("packed") with zeros. Useful when reading scratched CDs. If the disc is not badly damaged - then on the video file (for example) - after recovery, flaws may be absent altogether!

That's all for me. I hope that at least one program will turn out to be the one that will save your data from the CD ...

Happy recovery 🙂

Read in the article, step by step a guide to find and recover a document deleted from a FAT disk using a HEX editor... In previous articles, we looked at the structure of a FAT disk. In this work, using a specific example, we will consider searching for the contents of a deleted document using a HEX editor. Data recovery lab engineers perform this operation many times a day, but I still hope that this information will be useful to our readers.

Let's take a flash drive and format it.

Fig. 1 Formatting the flash drive.

Then we write on it a text document of 20 KB in size, which contains a repeating text string "Test file".

Content:

Boot sector

After that, delete the test object and run Hetman Partition Recovery. Let's open a USB flash drive formatted in FAT32 using a HEX editor and start the analysis from the reserved area.

Fig. 2

In the figure above, the fields that interest us are highlighted:

The first highlighted field indicates that the disk sector size is 512 bytes;
The following snippet shows that the cluster size is 8192 bytes;
Next, we see that the size of the reserved area is 1,160,192 bytes;
The next field shows that there are two copies of the FAT on the disk;
It is further stated that the size of each FAT copy is 7808512;
The following snippet indicates that the root directory is in cluster 2 relative to the data area (16793600 bytes).

With this information in mind, we can imagine the location of the basic structures of a FAT disk.

Root directory

Let's take a look at the root directory. We see a number of records, one of which is our test Test.txt... The first byte of the record is 0xE5 since it has been deleted. During uninstallation, the driver creates an additional entry in the root directory of the disk, preceding the main one. This entry is also created with the first byte equal to 0xE5... It is designed to store the name of the deleted object. Let's try to get our deleted content back.

Fig. 3

In the picture above, the first is an additional entry:

0xE5;
The next checked box contains the name - Test.txt.

The first highlighted field contains the signature 0xE5, which indicates that the document has been deleted;
Further contains the address of the cluster (relative to the data area) with the content (16818176 bytes);
The size below is 19584 bytes.

Having determined the initial cluster and size, we must refer to the FAT area to chain the clusters it occupies on disk. But the problem is that the chain has not survived. When deleted, all clusters that were occupied by the chain were marked as free. This is why all we have is an initial cluster and size.

The document occupied all clusters in a row, starting with the first one. This method cannot be applied to a fragmented disk.
The document occupied all currently free disk clusters, starting from the first. This approach can be used if the object was deleted recently and new objects that were written after did not overwrite it.

In this case, option 1 suits us. We will create a text file on the desktop and copy the contents of the analysis into it.

Fig. 4

Important: It is necessary to save the work result to a disk different from the analyzed one. In our example, we examined the disk F:, and the results were saved to C:.

Chapter 1
Recovering damaged files File structure in Hexplorer
File format concept

useful links
Summary

This chapter will focus on recovering so-called broken files. A file can be damaged if it is not saved correctly, especially if you tried to open and then save a file that someone else created in a newer version of an application. Such files can be retrieved from damaged media. Although you can copy them, you will see an error message when you try to open the "saved" file. After recovering data from a randomly formatted disk, there will probably be a lot of broken files among the files found. Finally, such files will be found as a result of analyzing the data saved by the operating system when checking and automatically correcting hard disk errors - such files have the CHK extension.
A file is considered to be a named finite and contiguous sequence of bytes that carries some information. For our purposes (data recovery) this is enough. In those files that have to be restored in practice, such a sequence usually encodes quite meaningful and complete information, for example, the text of a document or a raster (many dots) of an image.
Recall that 1 byte = 8 bits, that is, each byte can take values from 0 to 2 8 = 256 in decimal (dec) or 2 8 = FF in hexadecimal (hex) notation. There are programs that allow you to view and modify the contents of any file as a simple sequence of bytes. It is logical to call them byte or binary (binary) editors. Since such programs usually display byte values in hexadecimal form, they are called "HEX editors".
If we open the file in any HEX editor, we will see such a representation of its contents. The use of HEX editors to restore the contents of a file will be discussed at the end of the chapter, they will help you understand the structure of the file and what is the essence of its damage.

File structure in Hexplorer

ICY Hexplorer program is a simple, but quite functional free binary data editor. Its distribution kit is available on the developers website.
The working area of the window is divided vertically. After opening the file in the left part of the work area, the contents of the file are displayed by bytes in the form of their hexadecimal values (Fig. 1.1). On the right side of the window, the same bytes are interpreted as ASCII text character values.

Rice. 1.1. Hexplorer window - text file open

In this case, the selected fragment is simultaneously highlighted in both halves of the window. It is easy to see what each byte of the file means if we assume that it encodes a text character. When considering text files, this interpretation is perfectly valid. The View and Structures menu commands let you interpret the contents of a file in a different way, such as a bitmap, and view it in a child window.

File format concept

There are many types and formats of files. In general terms, a format is information about how a program should interpret the contents of a file when it is opened. Sometimes the format is confused with the file name extension, but these are completely different concepts. The operating system can use the filename extension to quickly determine which program should open a given file. Typically, the extension must match the format, but this is not required. The format information is in the file itself — it is placed at the beginning of the byte sequence.
A text file is the simplest format. Each byte of a text file is a code for a specific ASCII character (letters, numbers, or punctuation mark), as well as the characters for the space, the beginning and the end of the line. Apart from the values of the text characters, there really is nothing else in the text file! The structure of any other file type is much more complex.
As an example, let's open a picture file in BMP format in a HEX editor (Fig. 1.2). At the very beginning of the file, the sequence 42 4D is given - in the textual interpretation these are the letters BM. This is followed by a rather long sequence of bytes, in which zero values prevail, and then an array of very different values begins, which continues until the very end of the file.

Rice. 1.2. Hexplorer window - a picture file in BMP format is open

It can be assumed that the beginning of the file is some kind of service information, and its very first bytes indicate the file format. Only then follows the content that a program working with such files should interpret as a drawing.

Note
There is a resource on the Internet that will be repeatedly mentioned - "Wikipedia", or "Free Encyclopedia". It contains a large amount of information about file formats, and about many other concepts, all information about which in one book is simply impossible to collect.

The article says that a BMP file does indeed have four parts:
file header (BITMAPFILEHEADER). The first field of the header (the first two bytes) is the signature - an indication of the file type;
image header (BITMAPINFOHEADER) - an optional component, it can be absent;
palette, which may also be missing;
the image itself - each byte describes one point in the image.
An important conclusion must be drawn here. It is obvious that the distortion or loss of data related to the first three parts can lead to the fact that the file will no longer be opened by the intended program, although all the significant information in it remains intact. In this case, the message "The file is not in the correct format or is damaged" appears. On the contrary, the loss or distortion of the image data itself will not affect the opening of the file in any way, but individual fragments will drop out or be distorted in the opened image.
As an experiment, you can make several copies of the file, deliberately spoil each of them in different places using a HEX editor, and then save. Opening these files with a standard Windows viewer or Paint program, the user will be convinced of the validity of the earlier conclusion.
Any file works in a similar way, although the specification of the parts of the file depends on its type. Descriptions of almost all formats have been published and can be found on the Internet. Some of the detailed descriptions span more than a dozen pages. Moreover, a clear description of Microsoft Office file formats is the most difficult to find, but there are still general provisions.
At the beginning of a file, there is always its header. The title itself also has an internal structure.
- The title begins with a signature, or "magic number". This is a piece of code that unambiguously makes it clear what kind of file it is or what program it was created by. For example, an EXE file always starts with MZ characters, a RAR archive contains a RAR signature in its code.
- Other header fields can contain information about the file size, indicate which byte the headers end on and the actual data start on, and so on.
The file may contain headers specific to this format, for example, for image files, they indicate the compression algorithm, color depth, image size in pixels, etc. For audio files, such parameters will be the frequency and bit depth of the digitization, the number of channels, the compression algorithm, etc.
Some files may contain auxiliary components: palette, code table, embedded font data, macros, and so on. In some formats, like Microsoft Office or CorelDRAW documents, this data can take up more space than anything else. Just look at the size of a "blank" Microsoft Word 2003 document!
The unique data of the document itself. Sometimes in complex documents, this data is organized in chains, or chunks. In this case, somewhere in the headings, a link is given to the beginning and size of each portion.
The end-of-file indicator or check sum verifies the integrity of the file. They are not present in all formats.
Obviously, any damaged file can be restored or at least extract useful information by opening and editing such a file with a HEX editor. If the information about the format is corrupted, it (theoretically) can be recreated, and then the file can be opened by a "regular" application. If the data area itself is damaged, only what is left of the file can be retrieved.
Recovering or extracting useful information from damaged files manually is a laborious task. In essence, it is similar to programming. The problem is not even to understand the structure of the format, but to find and create a new record of the "necessary" bytes will require a lot of routine and tedious recalculations, trials and checks. Therefore, in practice, if such a possibility exists, it is advisable first to resort to two other methods.

File recovery using your own software tools

In some applications, the ability to test and recover damaged documents is built from the outset. These possibilities are quite limited, but sometimes they are enough. On the other hand, who, if not software developers, know all the subtleties of the formats used, as well as the algorithms for their creation and restoration.

Attention!
Before any attempts to restore a damaged file, you must make several copies of it. Don't experiment with a single original instance!

Document recovery using Microsoft Word

Microsoft Word provides the function of opening documents with recovery. In addition, the complete Microsoft Office suite includes text recovery converter. It is not installed by default.
Note that there is also a third function related to the use of autosave Word documents while the application is running. Rather, it relates to the area of backup: copies of the document are periodically saved in the same folder as the open document, or in the \ Application Data \ Microsoft \ Word folder in the user profile. If Microsoft Word crashed before the user saved the document correctly, the next time you open it, you will see the Document Recovery panel, which shows the existing file backups. Most likely, this function will not work when recovering really broken files.
To install the Text Recovery Converter, you must rerun Microsoft Office Setup.
1. In the initial installation window, select Add or Remove Components. Press "Next.
2. In the Custom Installation window, select the Advanced Application Configuration check box and click Next. The Advanced Setup window appears.
3. Is the Text Recovery Converter component located in the General Office Tools group? Converters and Filters? Text file converters. Click the arrow next to this component and select Run from my computer.
4. Following the instructions of the wizard, complete the installation of the selected components.
5. Then start Word. Go to the settings window (menu Tools? Options) and on the General tab, select the Confirm conversion on opening check box. Save the settings.
There are now two ways. First, use the built-in document recovery function.
1. From the File menu, select the Open command. The Open Document window appears.
2. Select the file to restore in it.
3. Click the arrow next to the Open button and select the Open and Restore command (Fig. 1.3).

Rice. 1.3. Opening a document with recovery

The document may open successfully. After opening the document, save it under a different name. Better yet, copy the entire content and paste it into a new document. However, experiments show that only the smallest defects can be corrected in this way. The text recovery converter has slightly more capabilities.
1. In the Open Document window, in the Save as type drop-down list, select the Recover text from any file option.
2. Open the required file. During the opening process, an additional File Convert window may appear (Fig. 1.4).

Rice. 1.4. File Convert Window

3. In this window, select the Recover text from any file option and click OK.
With such a restoration, the original formatting of the document will be lost - instead, you will get plain text. Nevertheless, this function does not always work. In this case, you should restore the document with special programs from third-party developers.

Recovering archives in WinRAR

The popular WinRAR archiver includes the function of recovering damaged archives. This program can recover RAR and ZIP archives. WinRAR tries to determine the archive type automatically by the file signature and its extension, but the user can specify the archive type on his own.
The RAR format provides for the introduction of redundant information into the archive - the so-called recovery information immediately upon creation. To do this, when adding files to the archive in the Archive name and parameters window, select the Add recovery information check box (Fig. 1.5). By default, this check box is cleared. On the Advanced tab, you can set the relative size of the recovery information as a percentage of the total archive size.

Rice. 1.5. Create an archive and add recovery information

Adding such information inevitably increases the size of the archive, but this precaution is not always used. As a rule, when compressing files, the minimum size of the resulting archive comes out on top. The creators of the program recommend adding information for recovery to archives that are supposed to be written to floppy disks or when compressing especially valuable data.
Archive recovery takes place in two stages. First, the archive contains a block of information for recovery. If such a block is present in the archive, the damaged part of the data is small in size and continuous, then the chances of successful recovery are high. As a result, the archiver creates a new file named fixed.arcname.rar, where arcname- the name of the original damaged archive.
If the damaged archive contains no information for recovery or the damage is very serious, then an attempt is made to recover using a different algorithm. Only the structure of the archive is being reconstructed. A new archive named rebuilt is created. arcname.rar, where arcname is the name of the original archive. Uncorrupted files can be extracted from this repaired archive. All surviving data are successfully extracted from simple archives. It is usually possible to recover from a solid archive only the files that were located at the beginning of the archive to the point of damage.
When WinRAR detects errors in the archive during normal opening, a window with diagnostic messages is displayed (Fig. 1.6). By the content of these messages, one can already judge the nature and extent of the file damage.

Rice. 1.6. WinRAR diagnostic messages

To restore, select the archive in the WinRAR program window and click the Repair button or select the Operations? Menu command. Restore archive (s). Subsequent dialogs depend on the nature of the damage and the integrity of the individual file components.
In particular, if the header is damaged, you will need to specify whether the original archive format is RAR or ZIP, and whether the archive is continuous. During the restore operation, the program may ask the user whether the item found in the archive should be considered a file: Suspicious item possible file name>. Add to archive: Yes / No / All. Answer Yes to add this element to fixed.arcname.rar.
For troubleshooting RAR archives, WinRAR seems to be the optimal and basic tool. It also gives good results for ZIP archives, but there are numerous specialized programs competing here.

Restoring 1C: Enterprise databases

The databases used by the programs of the 1C: Enterprise family consist of many separate files. Some of them carry configuration information, while others (files with the DBF extension) are mutable database files. If the error affected only the configuration files, the easiest way is not to restore the database, but simply overwrite these files from the configuration distribution kit or any backup copy.
Damage to the database most often occurs as a result of system failures, sudden power outages of computers, or problems with the local network. The main and direct way of restoring the database is testing and fixing it by means of the 1C program launched in the Configurator mode. The main feature of such recovery is that the Configurator uses the logic of building a database and some data can be recovered from the associated records in other undamaged files.
Of course, you should back up your database before attempting any recovery. It is best to do this by simply copying the base folder to another directory.
1. Open the 1C program in the configurator mode.
2. Run the scan of the open database (Administration menu? Test and repair).
3. If you have a fresh backup, you can start repairing right away: select the Test and repair option. During testing, detected database errors are shown. Pay attention to the filenames. When correcting, in case of discrepancies, the program may ask you to indicate on the basis of what data a specific record should be restored or it should be deleted altogether.
4. After restoring, open the database in exclusive mode and check the correctness of the entries and totals. It is possible that some records will have to be corrected or added manually.
Recovery of damaged databases is almost always possible. It's just a matter of the number of lost records. Restoring individual files with special programs is practically not required - the 1C Configurator tools effectively restore the structure of database files. The program includes archiving tools, and other backup methods are always available. Recovering from the last backup can be faster than testing and recovering, even if you re-enter data since the last backup.

File recovery software

Specialized programs are designed to recover files of almost any known format. In terms of the number of programs, Microsoft Office documents are undoubtedly in first place. A simple search on the Internet gives about three dozen names of utilities for recovering Word documents or Excel spreadsheets.
The operation of such programs is based on the fact that the file is searched for structures inherent in this format (headers, tables, etc.). If the structure is found, it is analyzed to see if the records it contains are valid. The validation rules are known, they follow directly from the format description. If the entry clearly does not match the valid or expected value, then it is corrected. Likewise, missing or incomplete structures can be generated. All programs have their own specific algorithms, so the results of their work in real situations are different.
The same rule applies to recovery software as to antivirus software: the more applications are used in a given case, the higher the chances of success. However, if one of the programs once helped where others were powerless, this does not mean that it will recover any other broken file better than the others. Fortunately, almost all of these programs are available in trial or shareware and demos. The limitation usually concerns the preservation of recovered data or the maximum allowable amount of recoverable information.
Create multiple copies of the damaged file - a different copy for each attempt. If the recovery was successful the first time, good. If not, you should apply one remedy after another. Perhaps some other program will be able to recover text or table data. In this case, it remains only to purchase it or register otherwise.
A small economic digression is appropriate here. When working with a computer in a single family or company, the recovery program is likely to be needed only once. After the loss and the complications it causes, users will become more prudent and will make regular backups. It turns out that the price of a license is equal to the price of recovering from one to ten files. The license price ranges from ten to several hundred dollars. Apparently, it is better to first try to apply all demos that can be found and then look at prices.
For those who are professionally engaged in information recovery, another approach is justified. For example, Office recovery is almost universal and effective. The license will pay off pretty quickly, because data recovery is always a popular and well-paid service.
Several programs will be discussed below. Their choice is almost random, since one of the main tasks of the book is to show programs of different classes and approaches to working with such programs. If the first program is an “automatic” for a novice user, the second is a “semi-automatic” with the ability to manually fine-tune the result, then the third is an amateur development that requires certain skills from the one who uses it.

Office recovery package

Recoveronix Ltd. offers over 30 utilities for automatic recovery of most common file formats. From the official website of the company, you can download both individual applications and their package under the general name Office recovery. To give an idea of the capabilities of the package, some of the programs included in it are listed below.
Recovery for Word, Recovery for Excel, Recovery for Outlook Express, Recovery for Outlook, Recovery for PowerPoint, Recovery for Publisher, Recovery for Access - recover Microsoft Office documents.
PDFRecovery, PhotoshopRecovery - Adobe document recovery.
PixRecovery - recovery of BMP, GIF, TIFF, JPEG graphic files.
ZipRecovery - recovery of ZIP archives.
The package includes tools for recovering documents Microsoft Works, WordPerfect, many database formats.
In addition to the listed tools for recovering broken files, the Office recovery package includes programs for operations of a different kind. The following chapters are devoted to recovering and retrieving information from damaged media. Such package components are simply named here.
MediaHeal for CD and DVD, MediaHeal for Diskettes, MediaHeal for Flash, MediaHeal for Hard Drives, MediaHeal for Removable Disks - data recovery tools from various media.
FreeUndelete is a utility for recovering accidentally deleted data.
When installing the package, you are prompted to select the required applications. Each of them is installed in a separate folder and is completely independent. All application windows follow the same pattern. Integration consists in the presence of a Toolbox menu item in the window of each application, under which a large list of other applications opens.
The most popular application is Recovery for Word. All other components of the package are built on exactly the same principle and are designed for the user with minimal training. As a prototype, you can consider a file from which code fragments are cut out by a HEX editor and / or "garbage" - random values is written in their place. This is very similar to file corruption resulting from write or read failures from faulty media.
1. Start the program and click the Recover button in its main window. A standard file open window will appear.
2. Select the file to be repaired and click the Recover button in the window. The file recovery process will begin. Comments on the operations performed appear in the main window, and soon in the Save the Recovered File window, you will be prompted to specify a file name (Fig. 1.7). By default, the name of the original file with the Recovered prefix is offered to save the recovery result.

Rice. 1.7. Recovery for Word

The recovered file can be opened through Windows Explorer to see the results. The demo version of the program replaces a part of the recovered text with the words demo demo demo. The rest of the program is absolutely functional. It restores text in a document, including used formatting, styles, tables, pictures, and other embedded objects.
A set of programs from the company Recoveronix Ltd. in terms of document recovery, Microsoft Office is ahead of similar utilities from other developers both in the number of recoverable files and in the completeness of data recovery within each document. The main disadvantage of the package is its price. A license for one component of Recovery for Word 3.1 costs about $ 150, and the price of a package of 14 applications is about $ 350.

JPEG Recovery Pro

While the applications of the Recoveronix suite run almost automatically, JPEG Recovery Pro combines the automatic recovery of the JPEG file format with the ability to edit the recovered data. The distribution kit of the JPEG Recovery Pro program is available on the developer's website.
During operation, the program scans the specified directory, lists the image files found there and offers to select the files to be restored. The program then tries to extract and restore the selected files by saving them to disk. Even before saving, you can use the second component of the program to remove or retouch the damaged parts of the images in separate windows.
1. Run the program and open its settings window using the File? Menu command. Options (File? Settings). The first tab contains a list of file types that the program will search for (Fig. 1.8). On the second tab, Other options, you can set the maximum number of files (Max. No. Of physical files) and the number of files to skip at the start of the scan (Skip first n physical files). Both of these settings can be useful when recovering files directly from digital camera media. Memory cards can contain many fragments from previously deleted images, and restrictions will help you avoid viewing unnecessary material.

Rice. 1.8. Selecting file types

2. Save the settings.
3. Specify in the Folder field the path where the program will search for images, and in the Output Folder field the path where the recovered files should be saved.
4. Click the Scan button. Thumbnails of the found pictures will appear in the work area (Fig. 1.9).

Rice. 1.9. Image search result

5. Check the boxes next to the images you want to restore and save. Click the Recover button. The files will be saved.
6. If you can see in the main program window that the image is damaged, such as the middle picture in the described example, try to fix it differently. Double-click the distorted picture. A window will appear prompting you to try to correct the image automatically (Fig. 1.10).

7. Click Yes to try this. The image will be changed at the discretion of the program, and then it will open in the built-in JPEG Recovery Pro Editor window (Fig. 1.11). If you click the No button in the window, no corrections will be made and the image will open in the editor in its original form.

Rice. 1.11. JPEG Recovery Pro Editor

As you can see in the example (in the middle of the file, 256 bytes of information about the image were replaced with a pseudo-random set of numbers), before the automatic recovery, the picture was "cropped" from the place of damage. After automatic restoration, the image was fully developed, but in one place a faint strip became visible - this is the very "garbage" introduced into the drawing for the purpose of damage. Another common problem with the JPEG format is shifting or inverting the colors of a part of an image after a piece of data has been lost or changed. This problem is also successfully eliminated by automatic correction in the program in question.
JPEG Recovery Pro Editor has two main functions: deleting all pixels from one specified point to another, and inserting / deleting a specified number of pixels or rows, counting from a given point. Such operations are suitable for removing accidentally added "garbage" or, conversely, for eliminating pixel shift as a result of the loss of a piece of data. It is better to master these techniques purely practically. The editor supports undo / redo of the actions performed, so the best correction method can be selected many times. It should not be forgotten that after saving the recovered file, it can always be further processed in any graphics editor, for example, Adobe Photoshop, and finally return the picture to its normal appearance.

CDRfind program

CorelDRAW documents are one of the common file types. These documents are all the more valuable because they usually contain the results of many days of work by designers or illustrators. As a rule, both of them are extremely frivolous about backing up their works.
At the same time, very few utilities for recovering CDR files have been created. This program is a collection of useful tools for working with CorelDRAW files. Including this program can recover faulty CDR files. The author of the program, Mikhail Kondakov, offers to download it from his website. The main window of the program is extremely simple (Fig. 1.12).

Rice. 1.12. CDRfind program

To view the contents of a CDR file, click the File Info button and in the standard window that opens, select the file you want to open. Two Notepad windows will appear: the first (info. Log) shows information about the file, the fonts it contains (Fonts used), and all the text that can be extracted from this file (Document text). The second window (map.log) shows the file structure as a list of the fields it contains (Fig. 1.13).

Rice. 1.13. File content analysis

Another useful function of the program is to search for a CDR document on a disc according to a specified criterion. Such criteria can be the text contained in the file or the sizes of graphic objects within the file. This function is launched by clicking the Search File button. The function of recovering a broken file is interesting.
1. Click the Edit / Restore File button. The Edit file window will open.
2. Click the Open file button in this window and in the standard Windows window select the failed CDR file to open. The structure of the opened file will be displayed in the working area of the dialog (Fig. 1.14).

Rice. 1.14. Edit file window

You can then try saving the file again by clicking the Save file button and specifying a name for the new file. Bad fields will be removed from the original file, and it will be saved unpacked. Then try to open the resulting document in CorelDRAW. When opened, it will likely display numerous error messages. They should be ignored and eventually the file will open anyway. Then you can copy the content you want to a new file created in CorelDRAW.
If the problem area falls on a raster image embedded in a file, then you can try to extract only its vector part from the file. For this there is the Extract vector mode. By clicking this button and selecting the source and target files, you can get a file containing only the vector part of the source. CorelDRAW will also display error messages when opening such a file. Again, you need to ignore them and, opening, save the file (Save as) again or copy objects from it into a new document.

Recovering files in a HEX editor

As already mentioned, theoretically it is possible to recover at least some of the significant information from any damaged file. All it takes is a binary data editor, a document with detailed format information, a penchant for programming, and a lot of time. There are no ready-made solutions here, it remains to formulate general directions.
Try to parse the file by opening it in a HEX editor. One of these programs, Hexplorer, was discussed at the beginning of the chapter. Other editors are widely known, such as WinHex, HEdit or Free Hex Editor Neo. In terms of basic capabilities, all these programs are equal, and the differences can be appreciated mainly by programmers who often use additional search and editing functions.
You may be able to recover the data on the first try. If the file contains uncompressed text, it will be enough to copy these fragments and put them together in a text editor. Since the required result has already been achieved, the thought may arise that there is no need to restore anything else.
For most formats, you still need to restore the file structure so that you can later open the document in the intended application. The more detailed description of the format is available to the user, the more chances to notice any inaccuracies in the file. In this case, an intact file of the same size and properties can serve as an example for comparison: open a second editor window next to it and try to find the differences. Of course, this does not apply to the content part, but you can almost always notice the difference in the structure of the headings.
Further actions are a creative process. When calculating the size or offset of individual file components, you can try to substitute these values in the header fields. The description of the structure or comparison with other similar files will help to find the position of the fields and their admissible values. The already named editor Hexplorer allows you to save intermediate results of editing, and then discard the changes made. The saved file can be checked immediately by opening it in the appropriate application. If unsuccessful, you need to go back a few steps and try to apply different values, etc.
In exceptional cases, any methods work: for example, it is possible to copy the header of one JPEG file and paste it in place of the lost or damaged one into another file. Sometimes such files open well with one of the viewers. The same can be said for some media files.

useful links

At the end of the chapter, we will consider a far from complete list of tools that recover data from damaged files. This is just the direction of the search: both new versions of well-known programs and completely new utilities are released regularly. The best way to find and select a program that can solve a specific problem is to go to any search engine on the Internet, and then try to do something.
Recover Microsoft Office documents:
Quick Recovery for Microsoft Word, Quick Recovery for Microsoft Excel, Quick Recovery for Microsoft PowerPoint;
R-Word Recovery, R-Excel Recovery;
Nucleus Kernel Word Document;
Excel File Repair.
All these programs are quite similar in their capabilities and efficiency. If the formatting of the document or table cannot be restored due to damage to the file structure, only the text is retrieved. In addition to actually recovering broken files, they are able to find previously deleted documents on the disk, looking for them by signatures.

Restoring databases of mail programs:
DiskInternals Outlook Express Repair;
SoftAmbulance 4 Outlook Express;
R-Mail for Outlook Express;
Nucleus Kernel Outlook Express.
The programs are designed to recover accidentally deleted emails, as well as to recover damaged DBX files, in which the Microsoft Outlook Express mail client stores its database. Individual emails are recovered as files with EML extension, which can be easily imported into Microsoft Outlook Express.
Zmeil. The program can extract messages from mail databases of most common email clients, including Outlook Express, TheBat! Eudora, Thunderbird. Recovered messages are saved as EML files or in UNIX mailbox format. Then they can be imported into any email client.

Database recovery:
Quick Recovery for Database. This and the following programs work with damaged Microsoft Access 95-2003 files, as well as with all versions of DBF files (dBASE, FoxBase, FoxPro, Visual FoxPro). It is possible to recover accidentally deleted records inside the database file;
DBF Doctor;
Windbfview. One of the programs recommended for manual database recovery of the 1C family of programs. Automatic recovery of damaged DBF file header, selection of encoding for viewing. View and edit fields of type string, number, date and boolean fields. Saving all or only displayed data to another file in DBF format or in text format.

Restoration of archives:
Advanced Zip Repair, Advanced TAR Repair, Advanced CAB Repair, Advanced RAR Repair. The purpose of the utilities is clear from their names. The same company produces a full range of file recovery programs, as well as thematic packages, such as Advanced Archive Repair;
ZipCentral. A rather old, but very handy program - an archive manager. Among its functions is the recovery of ZIP archives.

Recovery of graphic files:
Zero Assumption Recovery. The program recovers accidentally deleted and damaged files of many graphic formats. Works both with files saved on the hard drive and directly with various digital media;
Photo Nose Image Recovery Software. A typical program of this kind: it both retrieves deleted files from various media and automatically recovers damaged image files.

Recovering media files:
iPod Recovery Utility;
Recover iPod Songs.
Two programs from the same developer that recover both accidentally deleted data on iPod players and files of common formats: 3GP, AAC, MPG, MPEG, MP3, M4A, M4B, M4P, M4V, MP4, WAV, AIF, JPEG, GIF. Obviously, the task of restoring such files is not so great - it is usually easier to find them on the Internet and download them again than to restore them.

Summary

Before restoring broken files, look carefully to see if there are any backups of them. This action will save you a lot of time and effort. Obviously, you only need to recover unique documents, since finding the original source from which the files were copied is almost always easier and even faster. You can always ask to send mail again.
If the damaged documents or other files are truly unique, make multiple copies at once. Each copy is needed for a new attempt - it is not worth checking the same file sequentially by several programs.
Data recovery by means of the same program that created the file is the easiest and fastest way out of the situation. With regard to RAR archives, this is perhaps the most efficient way.
If recovery by conventional means is not possible, you will have to resort to special programs. The basic principle here is to try different programs that work with this file type until you get the result. There are no universal recovery algorithms, so the key to success lies in a variety of approaches.
Manually editing a file is an almost trouble-free, but extremely time-consuming method. Apparently, it can be recommended only to those users who have a mathematical and analytical mindset, and only if the data being recovered is really extremely important.