Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Kemper Watson]

The LS9 was powered off by the road crew at the end of the night before the recording was stopped. A direct-to-disk editor shows that there is still a large amount of data there. Of course, the Windows OS doesn't see the file as it was not correctly written.

Is anyone aware of either a Windows-based direct editor or file recovery software that could recover the file? Or a service out there that you've used to recover a file like this? I haven't done anything to the USB stick at all since this occurred to try to preserve the data.

Thanks in advance,
Bob Charest

I've had good luck with this, if it's recoverable at all

http://www.pandorarecovery.com/

[Bob Charest]

I've had good luck with this, if it's recoverable at all

http://www.pandorarecovery.com/

Hi Kemper - I'll check it out. As the file was never finshed, software that undeletes files might not do what's needed. After I solve my initial problem, I'm going to create a series of tests to see what software/method yields a consistent result.
Thanks,
Bob

[Dan Richardson]

Hi Kemper - I'll check it out. As the file was never finshed, software that undeletes files might not do what's needed.

Last thing that happens when an OS writes a file is that it edits the header and such.
When a file is deleted, the OS generally just overwrites that header. Undelete reconstructs it.
Which is to say, undelete might be exactly what's needed.

After I solve my initial problem, I'm going to create a series of tests to see what software/method yields a consistent result.

There are a number of us who will be interested in your results.

[Chris Davis]

When a file is deleted, the OS generally just overwrites that header. Undelete reconstructs it.
Which is to say, undelete might be exactly what's needed.

Actually "deleted" files are basically just "hidden" by the operating system, then most likely overwritten sometime in the future when the disc space is reclaimed for something else. 

In one Undelete program I have used, the deleted files simply appear in the program with a question mark at the beginning.  So "hello.kty" deleted would look like "?hello.kty" from within that program.  This program basically just bypasses the usual disc interface provided with the OS and gives you an alternate look at the hard drive.  The (?) makes sense to me, as hidden files in Linux start with a period (.)  An example where you might find that is the ".htaccess" file that Apache server uses, that is a hidden file. (forgive me for going off topic here as I see correlations)

Anyhow, that is quite a bit more simple than a file that has not been fully created or finished and at some point is most likely actually missing part of the data or part of the structure.  Therefore, there may be additional steps to get the MP3 file to work, assuming the data can initially get recovered.   

So, to recap.  First make the data accessible to the Windows OS.  This may or may not give you a clean MP3 file.  Since it was abruptly powered down, I would wager not.  Then, parse the file with an audio editor or other program and produce a clean new file with a fresh file structure so that you have all your bases covered.
 

There are a number of us who will be interested in your results.

+1

[Bob Leonard]

The problem here is not the header, which is written first. The problem is the file is not recognized because it was never properly closed and the operating system, any operating system, will not recognize the file as valid.

what the OP has going for him right now is that no other files have been written to the thumb drive, and doing so increases the chance the data will be lost when the OS see's the improperly closed file as available space and writes over it. The EOF has not been written and the header will be the only data blocks recognized as not available.

The company I recommended will close the file properly and whatever data was written will become available. That being said it does not mean that all of the data was written to the file. What data becomes available will be whatever data was written before the plug was pulled.

[Bob Charest]

Last thing that happens when an OS writes a file is that it edits the header and such.
When a file is deleted, the OS generally just overwrites that header. Undelete reconstructs it.
Which is to say, undelete might be exactly what's needed.

There are a number of us who will be interested in your results.

Hi Dan,

Back when the first undelete utilities came out, I remember that the process for DOS at the time was to delete the first letter of the file name replacing it with a tilde, then removing the entry from the FAT. When the board powered down I'm doubtful that anything that organized went on. When I had someone pull the stick out before stopping the recording (the 2nd week we had the board) I tried to recover the file and it turned an evenings recording into a 4k mp3 file with a valid structure as far as the OS was concerned but without anything in it. That's why I'm being so circumspect this time around. After I get my basic problem resolved, or find that it can't be, I'm going to run a series of tests to see what will actually work in this case...

I'll be really interested in the result too! 

Thanks,
Bob

[Bob Charest]

The problem here is not the header, which is written first. The problem is the file is not recognized because it was never properly closed and the operating system, any operating system, will not recognize the file as valid.

what the OP has going for him right now is that no other files have been written to the thumb drive, and doing so increases the chance the data will be lost when the OS see's the improperly closed file as available space and writes over it. The EOF has not been written and the header will be the only data blocks recognized as not available.

The company I recommended will close the file properly and whatever data was written will become available. That being said it does not mean that all of the data was written to the file. What data becomes available will be whatever data was written before the plug was pulled.

Hi Bob - I called Xfiles Recovery today and they were going to call me back but didn't get to it - maybe they had a day like I did! In any case, I've sent a follow-up email as I really do want to get this done. I'm sure Chris will get back to me.

One good thing about this event is that I'm learning about the data format of mp3 files... reminds me a bit of VTAM and my SNA formats book   If the mp3 frames can be stitched back together I might be in good shape as the recording ran for at least 15 minutes after the end of the event. This wiki on the data format for mp3 files was instructive: http://en.wikipedia.org/wiki/MP3#File_structure

Thanks,
Bob

[Bob Charest]

mp3 file structure from Oreilly text:
http://oreilly.com/catalog/mp3/chapter/ch02.html#71109

[Bob Leonard]

Hi Dan,

Back when the first undelete utilities came out, I remember that the process for DOS at the time was to delete the first letter of the file name replacing it with a tilde, then removing the entry from the FAT. When the board powered down I'm doubtful that anything that organized went on. When I had someone pull the stick out before stopping the recording (the 2nd week we had the board) I tried to recover the file and it turned an evenings recording into a 4k mp3 file with a valid structure as far as the OS was concerned but without anything in it. That's why I'm being so circumspect this time around. After I get my basic problem resolved, or find that it can't be, I'm going to run a series of tests to see what will actually work in this case...

I'll be really interested in the result too! 

Thanks,
Bob

This is what I eluded to. The recovery see's the file header but nothing after it because there is no EOF data and considers the file empty. That leaves you with a file name and no data.

[Dan Richardson]

This is what I eluded to. The recovery see's the file header but nothing after it because there is no EOF data and considers the file empty. That leaves you with a file name and no data.

Undeletes have come rather a long way since the days of simply rewriting the FAT. R-Studio is an undelete I've used that looks for known data structures. I've used it to recover files off discs that have been formatted and had a different operating system installed. Which is not to say he shouldn't send it to the pros. He should.

[ProSoundWeb Community]