The end of archive looks OK.
But first 32-bytes are not 7z header.
So It it's impossible to unpack start.
But it's possiblwe to get list of files and maybe unpack something from the end of archive.
Try to recover start header. You can read description of start header in source code (DOC folder).
Split file into two parts to get end header:
17 06 F0 F0 97 DB CD 01 09 87 15 00 07 0B 01 00 01 23 03 01 01 05 5D 00 20 00 00 0C 98 68 0A 01 86 18 B0 C9 00 00
Then calculate CRC for that header in 7-Zip file manager and write the CRC value to start header.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
First of all thanks for responding to this. Also I barely have a proper understanding on this subject so please bear with me.
I can't seem to locate the DOC folder you mentioned. Do you have a link to this file?
Split the last 38 bytes off the original bad file. And got the hex value of what you stated. Which CRC do I use? 32, 64, SHA256, or SHA1?
Thanks again for your help on this. And not sure if this information helps, but I my external hdd got corrupted and I recovered this 7zip file via Testdisk. I noticed this error happens to my 7zip files but not on other zip format.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
DOC folder in source code.
CRC32
Create some 7z archive with two .txt files inside, open archive in hex editor and look fields in first 32 bytes. Read about these fields in DOC.
Then create 32 bytes file with good fields:
offset, length, CRC32 of end header, CRC32 of start header.
Put crc32 values as little endian.
Then you can split your archive file to "32 4G" parts, replace 32 bytes .001 file with new good "header" file and then combine parts back.
Or write new fields values dirrectly in hex editor in big archive.
Don't change the size of archive (we suppose that archive size is correct).
If archive size is not correct, it's more difficult - you must find correct size of archive.
Last edit: Igor Pavlov 2014-10-13
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
So for me to create the good header, do I just edit the hex of the 2 blank text files that I zipped together? then once I have done all the changes, I split the archive to "32 4G" parts and use it as the start header for the bad zip file?
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
So I read through the guide and tried to understand it as much as I could. I calculated the CRC 32 of the end header as you instructed and got a 5C7D05B4 value. You mentioned to apply little endian so that makes it B4 05 7D 5C (hopefully I got that right)
Now the start header is composed of the following:
00: 6 bytes: 37 7A BC AF 27 1C - Signature (ok)
06: 2 bytes: 00 04 - Format version (ok)
08: 4 bytes: 5B 38 BE F9 - CRC of the following 12 bytes (?)
0C: 8 bytes: 59 0E 00 00 00 00 00 00 - relative offset of End Header (?)
14: 8 bytes: 23 00 00 00 00 00 00 00 - the length of End Header (?)
1C: 4 bytes: B4 05 7D 5C - CRC of the End Header (ok)
Can you please help me understand how to get the bytes with (?)
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Case: If start of archive is corrupted, then there is no link to End Header. But if the End Header is OK, and the size of archive is also correct, you can replace data in Start Header in hex editor to the following values:
I tried replacing the starting header with the hex you indicated above, it asked for the password and I typed it in, it extracted the files but they are all 0 kb. Any idea how to address this?
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
So you have two solid blocks.
block 0 is corrupted.
Try to extract files from solid block 1.
You can see block number in "block" column in 7-zip file manager.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Is there any possibility for the password to be modified when retrieving a file? I did try to extract from solid block 1, it says wrong password but I'm almost 99% sure of the password I used.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
When 7-Zip says:
"Data Error in encrypted file. Wrong password?"
it can mean 2 situations:
1) 99.9% cases: if archive is not corrupted, it's wrong password
2) 0.1% cases: archive is corrupted.
In your case, we know that archive is corrupted.
So probably you have both blocks corrupted.
Check it again so:
Call the command
7z l orig.7z > list.txt
find exact file of start of block 1. It must have non empty value in "compressed size" column.
And then try to extract that file.
If all solid blocks are corrupted, it's pretty difficult to recover data.
Maybe only some sectors at the end of archive are correct?
Last edit: Igor Pavlov 2014-10-25
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hello.
I have a problem with 7zip file. I know that the password is correct, another file created with the same command is OK. When I open the file with 7zFM I see list of files with size and CRC. When I try to extract any of them the error occurs
"Data Error in encrypted file. Wrong password?"
I've discovered some similar topics on this forum, so this is my service data.
Is there a way to know if it is really a password issue or a result of the file being corrupted?
If you have replaced start of archive, then we know that block 0 is corrupted.
block 1 - it's more difficult to detect.
And how come it extracts the files with 0kb regardless of varying password?
The files with size = 0 don't need data from solid blocks.
I hope there's some way I can recover some files.
In your case it can be too difficult.
You can try to search 7z signature in your archive in hex viewer:
37 7A BC AF 27 1C
If successful search, you can try to copy data that starts with that signature to begin of archive and try to extract first file of Block 0.
if unsuccessful search, you can copy full image of your corrupted HDD to one big image file.
Then you search "37 7A BC AF 27 1C" signature in that image file, copy that data to start of archive and try to extract first file of Block 0.
It's big work. Maybe you have 100 files with that signature in HDD image. If the data are very important (more than $10000 in value), you can hire some software developer (not me) that will write required software for you. But the probability of success is not big.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
If first files can be extracted without problems, then there is some corruption in middle of archive.
To recover such archive, you must have good copy of first corrupted file (or copies of first corrupted files). Also you must write (develop) special version of 7-Zip that will uses AES IV from "bad.7z" archive in new "good.7z".
So it looks so:
We suppose that bad.7z consists of: "good data 1" "bad data" "good data 2"
you create new good.7z:
that contains same files in same order with same AES IV:
first files, first corrupted files.
then you replace "good data 1" and "bad data" with data from "good.7z".
Last edit: Igor Pavlov 2014-11-03
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi! I'm in dire need to recover some files that became (I believe they are) corrupted. I saved them in an Ultra LZMA2 7z format. The entire archived file is registered as 11 GB. I highly doubt it's that big. When I tried Zip Repair Pro, while it wasn't able to repair the file fully, it did show me the size (I think) and it happened to be around 2.8 GB. That size if I remember correctly is the correct one.
Is there a way to tell from the start header the correct RAW size of bad.7z given that the bad.7z is incorrect? I tried followign the instructions that you gave before while followign the tutorial of How to recover corrupted data but to no avail. I'm not sure if I should set the first 2 parts as:
Part 1: 32 bytes
Part 2: 11567104K (corrupted file size as is shown on computer)
First 48 bytes
37 7A BC AF 27 1C 00 03 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 1B 9E 93 8A F1 38 25 44 84 EB FA A9 CA D5 CC
Last 96 bytes
57 67 31 21 8E B0 39 62 E9 EA 12 4B 2F 51 A0 FF
D0 A4 BA 43 38 7F ED 91 5D C5 6D 1A F4 8F AE D1
CF B2 60 7D EC B5 AE 81 DF 0B B0 D0 FC D2 20 06
FA 3F 95 2E B2 40 AC 95 96 B0 9A 9F 35 87 BC 89
D3 F3 C5 6A A3 2B 91 F8 C2 ED 8C 36 8F 15 68 CF
CD 6C 72 1E D1 06 FD 6F 87 7D B5 E9 94 E6 8C BD
91 89 2F 55 44 9A DC 00 14 F9 E3 83 94 2E 48 18
or use the recovered 7z file from zip repair as
Part 1: 32 bytes
Part 2: 2743980K (the attempted recovery file size as shown on computer)
Hey there, I have a biiiig Problem, I backupped my PC, because I changed Operating systems. 7z is great for that, but now I have TWO Archives, that are corrupt. But since your website (https://www.7-zip.org/recover.html) is 1. Way to complicated for me and 2. I can't find anything about splitted archives with lost parts, I'll have to ask you here...
Both are Split, one into 5gb big files, one into 1gb big files. So First the one that's split into 4gb files (This archive is VERY important!). The problem is, I lost TWO parts of the 7z. The lost parts are <filename>.7z.003 and <filename>.7z.004. There are 12 parts. The remaining files are this big:
.7z.001 - .7z.002 and .7z.005 - .7z.011:
Size: 3,99 GB (4.294.967.295 Bytes)
Size on disk: 4,00 GB (4.294.967.296 Bytes)</filename></filename>
Tell me what hex areas you need, I'll give them to you.
And please axplain me really easy how to repair it, I'm only fourteen, and just want my school files back. I know I won't get everything back, but the majority would be nice.
Btw, sorry for my crappy english...
Last edit: William Reed 2019-06-22
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Ok, I opened the .7z.001 file and there was a normal 7z file showing up in there (<filename>.7z) I extracted it, but it said cannot open <filename>.7z as an archive. </filename></filename>
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
What is the root cause of this? Is it being fixed?
hey Igor,
Hope you can reply to this. Kind of desperate to recover the files :(
--
file size
3,453,722,624
first bytes
DF 34 BB FC 37 9F CB 37 41 DE 1F A7 7F 51 13 FF
4E 36 9F 83 B5 91 B2 F8 16 4E 83 28 06 1A 28 E0
C1 7B 27 D1 0E A9 93 28 40 2B 1F 19 A4 CA 60 DE
8C BD 60 AE 3E CD 95 C6 36 0D EE D1 2C 44 DA 2D
last bytes
D7 63 BA E7 C1 3E 75 C6 2E F0 01 B0 5D 96 11 55
BB 22 F7 9C 68 8C BF F9 1F 75 9C 51 02 57 E1 44
93 01 36 20 00 17 06 F0 F0 97 DB CD 01 09 87 15
00 07 0B 01 00 01 23 03 01 01 05 5D 00 20 00 00
0C 98 68 0A 01 86 18 B0 C9 00 00
other info
password protected file
--
Btw, I tried your instructions here: http://sourceforge.net/p/sevenzip/discussion/45798/thread/e34b4a1d/#0c18. I did a "32 4G" split and also created a RAW out of a single file that is bigger than my corrupt 7z file. But in the end it is still broken.
Thanks in advance for helping!
Last edit: albert smith 2014-10-10
The end of archive looks OK.
But first 32-bytes are not 7z header.
So It it's impossible to unpack start.
But it's possiblwe to get list of files and maybe unpack something from the end of archive.
Try to recover start header. You can read description of start header in source code (DOC folder).
Split file into two parts to get end header:
17 06 F0 F0 97 DB CD 01 09 87 15 00 07 0B 01 00 01 23 03 01 01 05 5D 00 20 00 00 0C 98 68 0A 01 86 18 B0 C9 00 00
Then calculate CRC for that header in 7-Zip file manager and write the CRC value to start header.
First of all thanks for responding to this. Also I barely have a proper understanding on this subject so please bear with me.
I can't seem to locate the DOC folder you mentioned. Do you have a link to this file?
Split the last 38 bytes off the original bad file. And got the hex value of what you stated. Which CRC do I use? 32, 64, SHA256, or SHA1?
Thanks again for your help on this. And not sure if this information helps, but I my external hdd got corrupted and I recovered this 7zip file via Testdisk. I noticed this error happens to my 7zip files but not on other zip format.
DOC folder in source code.
CRC32
Create some 7z archive with two .txt files inside, open archive in hex editor and look fields in first 32 bytes. Read about these fields in DOC.
Then create 32 bytes file with good fields:
offset, length, CRC32 of end header, CRC32 of start header.
Put crc32 values as little endian.
Then you can split your archive file to "32 4G" parts, replace 32 bytes .001 file with new good "header" file and then combine parts back.
Or write new fields values dirrectly in hex editor in big archive.
Don't change the size of archive (we suppose that archive size is correct).
If archive size is not correct, it's more difficult - you must find correct size of archive.
Last edit: Igor Pavlov 2014-10-13
sorry for my delayed response on this.
Where do I locate the source code? Sorry if this is a stupid question but I can't really find the folder you mentioned.
So I did create two blank text files and zipped them together and got the first 32 bytes out of the zip files:
37 7A BC AF 27 1C 00 04 C5 4B 35 8F 5D 00 00 00
00 00 00 00 21 00 00 00 00 00 00 00 87 DE 70 37
But I'm assuming to create 32 bytes with good fields is in the document you were referring to?
What do you mean by "Don't change the size of archive"?
Thanks for your patience on this problem.
Try google "7-zip source code".
Read also:
http://www.7-zip.org/recover.html
Last edit: Igor Pavlov 2014-10-19
thanks for the link.
So for me to create the good header, do I just edit the hex of the 2 blank text files that I zipped together? then once I have done all the changes, I split the archive to "32 4G" parts and use it as the start header for the bad zip file?
sorry about that, i replied without fully reading your link. I'll try to follow the instructions there first.
Will update you if something turns out.
Thanks again :)
Hi again,
So I read through the guide and tried to understand it as much as I could. I calculated the CRC 32 of the end header as you instructed and got a 5C7D05B4 value. You mentioned to apply little endian so that makes it B4 05 7D 5C (hopefully I got that right)
Now the start header is composed of the following:
00: 6 bytes: 37 7A BC AF 27 1C - Signature (ok)
06: 2 bytes: 00 04 - Format version (ok)
08: 4 bytes: 5B 38 BE F9 - CRC of the following 12 bytes (?)
0C: 8 bytes: 59 0E 00 00 00 00 00 00 - relative offset of End Header (?)
14: 8 bytes: 23 00 00 00 00 00 00 00 - the length of End Header (?)
1C: 4 bytes: B4 05 7D 5C - CRC of the End Header (ok)
Can you please help me understand how to get the bytes with (?)
http://7-zip.org/recover.html
Case: If start of archive is corrupted, then there is no link to End Header. But if the End Header is OK, and the size of archive is also correct, you can replace data in Start Header in hex editor to the following values:
0000000000: 37 7A BC AF 27 1C 00 04 00 00 00 00 00 00 00 00
0000000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Hi Igor,
I tried replacing the starting header with the hex you indicated above, it asked for the password and I typed it in, it extracted the files but they are all 0 kb. Any idea how to address this?
Show the properties of archive:
Open archive
Press "Info"
Ctrl+C
And insert information from clipboard here.
Last edit: Igor Pavlov 2014-10-24
Properties
Size: 3 543 261 493
Packed Size: 3 453 720 560
Folders: 0
Files: 136
CRC: DBCE86C4
Path: C:\Users\Desktop\o\New folder\New folder\orig.7z
Type: 7z
Warnings: Headers Error
Physical Size: 3 453 722 443
Headers Size: 1 883
Method: LZMA:24 7zAES
Solid: +
Blocks: 2
OK
So you have two solid blocks.
block 0 is corrupted.
Try to extract files from solid block 1.
You can see block number in "block" column in 7-zip file manager.
Is there any possibility for the password to be modified when retrieving a file? I did try to extract from solid block 1, it says wrong password but I'm almost 99% sure of the password I used.
When 7-Zip says:
"Data Error in encrypted file. Wrong password?"
it can mean 2 situations:
1) 99.9% cases: if archive is not corrupted, it's wrong password
2) 0.1% cases: archive is corrupted.
In your case, we know that archive is corrupted.
So probably you have both blocks corrupted.
Check it again so:
Call the command
7z l orig.7z > list.txt
find exact file of start of block 1. It must have non empty value in "compressed size" column.
And then try to extract that file.
If all solid blocks are corrupted, it's pretty difficult to recover data.
Maybe only some sectors at the end of archive are correct?
Last edit: Igor Pavlov 2014-10-25
Hello.
I have a problem with 7zip file. I know that the password is correct, another file created with the same command is OK. When I open the file with 7zFM I see list of files with size and CRC. When I try to extract any of them the error occurs
"Data Error in encrypted file. Wrong password?"
I've discovered some similar topics on this forum, so this is my service data.
First bytes:
00000000 37 7A BC AF 27 1C 00 03 24 2C 43 2B DB C9 49 69 7zјЇ'...$,C+ЫЙIi
00000010 00 00 00 00 28 00 00 00 00 00 00 00 A2 70 3B 9F ....(.......ўp;џ
00000020 46 7B 93 2D 0D 1B 5F 76 26 27 25 23 E5 8A 72 DB F{“-.._v&'%#еЉrЫ
last bytes:
6949C9E0 98 E2 A9 53 49 C3 25 D7 52 A8 6E 6E 8D 89 72 6C .в©SIГ%ЧRЁnnЌ‰rl
6949C9F0 A0 82 4D DD 05 C6 B1 74 94 00 00 17 06 F0 70 9F ‚MЭ.Ж±t”....рpџ
6949CA00 48 69 01 09 C1 6B 2A 00 07 0B 01 00 01 23 03 01 Hi..Бk*......#..
6949CA10 01 05 5D 00 00 0C 00 0C CA F0 3F 0A 01 88 DC BA ..].....Кр?..€Ьє
6949CA20 CD 00 00 Н..
the initial command is:
7za a -t7z -m0=lzma -mx=9 -mfb=64 -md=32m -xr@exclude -ms=on -p${SZ_PSW}
SZ_PSW variable is correct, another 7zip archive extracted OK.
7zip version is
7-Zip (A) [64] 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18
p7zip Version 9.20 (locale=ru_RU.UTF-8,Utf16=on,HugeFiles=on,2 CPUs)
This is the header and first rows of output of 7za l a.7z:
7-Zip (A) [64] 9.20 Copyright (c) 1999-2010 Igor Pavlov 2010-11-18
p7zip Version 9.20 (locale=ru_RU.UTF-8,Utf16=on,HugeFiles=on,2 CPUs)
Listing archive: share.7z
--
Path = share.7z
Type = 7z
Method = LZMA 7zAES
Solid = +
Blocks = 1
Physical Size = 1766443555
Headers Size = 76467
Date Time Attr Size Compressed Name
2013-12-03 14:29:21 ....A 180735 1766367088 share/
7za t -pPassword_here share.7z output gives me at the end:
Sub items Errors: 4445
and hell of "Data Error in encrypted file. Wrong password?" errors during execution.
Any help will be greatly appreciated.
P.S.: Is it possible to communicate in russian?
Last edit: Igor Pavlov 2014-11-03
albert smith:
If you have replaced start of archive, then we know that block 0 is corrupted.
block 1 - it's more difficult to detect.
The files with size = 0 don't need data from solid blocks.
In your case it can be too difficult.
You can try to search 7z signature in your archive in hex viewer:
37 7A BC AF 27 1C
If successful search, you can try to copy data that starts with that signature to begin of archive and try to extract first file of Block 0.
if unsuccessful search, you can copy full image of your corrupted HDD to one big image file.
Then you search "37 7A BC AF 27 1C" signature in that image file, copy that data to start of archive and try to extract first file of Block 0.
It's big work. Maybe you have 100 files with that signature in HDD image. If the data are very important (more than $10000 in value), you can hire some software developer (not me) that will write required software for you. But the probability of success is not big.
1nno:
If first files can be extracted without problems, then there is some corruption in middle of archive.
To recover such archive, you must have good copy of first corrupted file (or copies of first corrupted files). Also you must write (develop) special version of 7-Zip that will uses AES IV from "bad.7z" archive in new "good.7z".
So it looks so:
We suppose that bad.7z consists of: "good data 1" "bad data" "good data 2"
you create new good.7z:
that contains same files in same order with same AES IV:
first files, first corrupted files.
then you replace "good data 1" and "bad data" with data from "good.7z".
Last edit: Igor Pavlov 2014-11-03
Hi! I'm in dire need to recover some files that became (I believe they are) corrupted. I saved them in an Ultra LZMA2 7z format. The entire archived file is registered as 11 GB. I highly doubt it's that big. When I tried Zip Repair Pro, while it wasn't able to repair the file fully, it did show me the size (I think) and it happened to be around 2.8 GB. That size if I remember correctly is the correct one.
Is there a way to tell from the start header the correct RAW size of bad.7z given that the bad.7z is incorrect? I tried followign the instructions that you gave before while followign the tutorial of How to recover corrupted data but to no avail. I'm not sure if I should set the first 2 parts as:
Part 1: 32 bytes
Part 2: 11567104K (corrupted file size as is shown on computer)
First 48 bytes
37 7A BC AF 27 1C 00 03 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 1B 9E 93 8A F1 38 25 44 84 EB FA A9 CA D5 CC
Last 96 bytes
57 67 31 21 8E B0 39 62 E9 EA 12 4B 2F 51 A0 FF
D0 A4 BA 43 38 7F ED 91 5D C5 6D 1A F4 8F AE D1
CF B2 60 7D EC B5 AE 81 DF 0B B0 D0 FC D2 20 06
FA 3F 95 2E B2 40 AC 95 96 B0 9A 9F 35 87 BC 89
D3 F3 C5 6A A3 2B 91 F8 C2 ED 8C 36 8F 15 68 CF
CD 6C 72 1E D1 06 FD 6F 87 7D B5 E9 94 E6 8C BD
91 89 2F 55 44 9A DC 00 14 F9 E3 83 94 2E 48 18
or use the recovered 7z file from zip repair as
Part 1: 32 bytes
Part 2: 2743980K (the attempted recovery file size as shown on computer)
First 48 bytes
50 4B 03 04 34 13 63 0B 11 99 BD 5C 29 CF 15 B6
AC 00 4A E3 77 A7 0C 95 52 33 38 94 18 D0 F4 37
EE CD 36 7C 99 60 A1 95 F6 AF 52 D0 1A D1 92 48
Last 96 bytes
00 00 34 13 34 13 00 00 00 00 00 00 00 00 01 00
00 00 00 00 00 00 01 00 00 00 00 00 00 00 7E 64
01 00 00 00 00 00 B8 47 79 A7 00 00 00 00 50 4B
06 07 00 00 00 00 36 AC 7A A7 00 00 00 00 01 00
00 00 50 4B 05 06 00 00 00 00 01 00 01 00 7E 64
01 00 FF FF FF FF 00 00
Thank you in advance!
Last edit: Ezekiel Yorke 2016-03-14
http://7-zip.org/recover.html
Hey there, I have a biiiig Problem, I backupped my PC, because I changed Operating systems. 7z is great for that, but now I have TWO Archives, that are corrupt. But since your website (https://www.7-zip.org/recover.html) is 1. Way to complicated for me and 2. I can't find anything about splitted archives with lost parts, I'll have to ask you here...
Both are Split, one into 5gb big files, one into 1gb big files. So First the one that's split into 4gb files (This archive is VERY important!). The problem is, I lost TWO parts of the 7z. The lost parts are <filename>.7z.003 and <filename>.7z.004. There are 12 parts. The remaining files are this big:
.7z.001 - .7z.002 and .7z.005 - .7z.011:
Size: 3,99 GB (4.294.967.295 Bytes)
Size on disk: 4,00 GB (4.294.967.296 Bytes)</filename></filename>
.7z.012:
Size: 2,22 GB (2.384.910.907 Bytes)
Size on disk: 2,22 GB (2.384.920.576 Bytes)
Tell me what hex areas you need, I'll give them to you.
And please axplain me really easy how to repair it, I'm only fourteen, and just want my school files back. I know I won't get everything back, but the majority would be nice.
Btw, sorry for my crappy english...
Last edit: William Reed 2019-06-22
Just copy files:
002 to 003
002 to 004
So 7-Zip will open all volumes and it must extract files that are in good parts.
Ok, I opened the .7z.001 file and there was a normal 7z file showing up in there (<filename>.7z) I extracted it, but it said cannot open <filename>.7z as an archive. </filename></filename>