How do I recover a corrupted .txt file?

Question

Recently I often edited a txt file with Notepad++ on Windows XP and gedit on Linux (Mint). During shutdown on windows, it seems, that file was corrupted. This is the second time that this happens and both corrupted files now start with INDX(.

Unfortunately I made a backup (with rsync) this morning, which also copied the corrupted file.

Perhaps this also could have anything to do with problems on the hard disk, but its more unlikely, because I checked it already with different tools on both hard disks.. (chkdsk, smart)

This is the start of the file-content: (if you need everything, please ask me)

INDX(                    (       è      U Ì                   ©c     h T     òã     ¼µ

you are not using hibernation on windows, right? – Michał Šrajer Aug 07 '11 at 14:10 — Michał Šrajer, Aug 07 '11 at 14:10
@Michał Šrajer No, but it can be, that I tried it once. – Joschua Aug 07 '11 at 14:15 — Joschua, Aug 07 '11 at 14:15

score 1 · Accepted Answer · edited Mar 20 '17 at 10:16

1

Stop writing data to the hard drive or you'll decrease the chance to recover anything...

First try How do I recover lost/inaccessible data from my storage device?

If that doesn't help, WinHEX (paid) has a pretty good forensics mode.

edited Mar 20 '17 at 10:16

Community

1

answered Aug 07 '11 at 15:09

Tamara Wijsman

57,083
27
185
256

I think this won't help me, because this only covers lost files or problems with the filesystem or hard disk, but neither of these seems to be the case, as I already checked if there are any problems and my file isn't lost - just corrupted. Thanks anyway! – Joschua Aug 07 '11 at 16:11
@Joschua: That's just ignorant behavior, as you can recover it if it hasn't been overwritten by further usage. If you do not do this now, you will never manage to recover it. I also suggest you to use [sync](http://technet.microsoft.com/en-us/sysinternals/bb897438) on shutdown to prevent faults like these, and use a tool like [HD Tune](http://www.hdtune.com/) as your HDD might be malfunctioning. – Tamara Wijsman Aug 07 '11 at 17:20
Ok, I will try PhotoRec in the hope that it also handles file corruption. Just as you said, I already stopped writing data to the hard drive. – Joschua Aug 07 '11 at 18:04
@Joschua: Good luck. It's just a matter whether it wrote in-place or at a new place, it depends on whether the file changed size. If luck is with you then you can still recover it, other options include back-ups or the offline files feature of Windows but I guess those didn't help... – Tamara Wijsman Aug 07 '11 at 20:52
1

Hmm, didn't work :| I got a lot of files, but I couldn't find anything with grep. It seems I have to write everything again, Yay! :( One question: Do you know what this `INDX(` means? – Joschua Aug 07 '11 at 22:20
1

@Joschua: In the standard index header the four byte structure element, magicNumber contains the actual ASCII string "INDX" as a marker to denote the actual beginning of the index standard header. - **Source:** [NTFS Forensics](http://grayscale-research.org/new/pdfs/NTFS%20forensics.pdf) - It seems to me the original file record is pointing at a random location... – Tamara Wijsman Aug 08 '11 at 12:16

How do I recover a corrupted .txt file?

1 Answers1