Hello. I added files to the archive and had to restart the computer. After this, the archive does not open, it says “Error in headers”. When I opened it with a HEX editor, I saw that the final header consisted of zeros. What to do?
It was an external hard drive that was connected via USB. If I'm not mistaken, I restarted the computer through the Start menu, possibly with a forced shutdown. I tried to restore according to the instructions you suggested, but I can’t understand which part of the file needs to be changed and why there are so many “zeros” in the file. I managed to extract two large files (see screenshot), but I can’t open it.
7-Zip copies data from new temp archive to final usb archive, when you update usb archive. Also there is Windows file cache for that operation. And that Windows file cache was not full flushed to your USB by some reason.
You could try to recover archive from temp file in Windows temp folder. You need some tool to recover deleted NTFS files.
1) Look big files in C:\Users\user_name\AppData\Local\Temp\
folder with 7-Zip.
2) Look same temp folder with some NTFS deleted files recovering tool.
If recoving of deleted NTFS files is not possible, you can try to recover as described here: https://www.7-zip.org/recover.html
It can be difficult.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Igor, thank you very much for your help, I was able to make raw.dat file and inside it you can see the signatures of the necessary jpeg files (I don't know how to identify others yet). But the code is very large, how can you get files from raw.dat? Having found the answer to this, you can close the question.
Last edit: Oleg Generalchenko 2024-12-12
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hello everyone, I want to report on the results. According to Igor's instructions, I extracted the RAW file from the damaged archive. After that, I tried using different programs to extract data from it, but so far I was only able to extract some of the photos using JpegSnoop. I haven’t been able to extract any other data yet; I’ll report on my successes later. Thank you so much for your support.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Was it internal drive or usb drive?
How did you restart the computer?
Find exact last posistion that is not zero.
Read instructions here:
https://www.7-zip.org/recover.html
It was an external hard drive that was connected via USB. If I'm not mistaken, I restarted the computer through the Start menu, possibly with a forced shutdown. I tried to restore according to the instructions you suggested, but I can’t understand which part of the file needs to be changed and why there are so many “zeros” in the file. I managed to extract two large files (see screenshot), but I can’t open it.
Sorry, I forgot to write: I found the positions that come before the “Zeros”, the rest further are “Zeros”.
7-Zip copies data from new temp archive to final usb archive, when you update usb archive. Also there is Windows file cache for that operation. And that Windows file cache was not full flushed to your USB by some reason.
You could try to recover archive from temp file in Windows temp folder. You need some tool to recover deleted NTFS files.
1) Look big files in
C:\Users\user_name\AppData\Local\Temp\folder with 7-Zip.
2) Look same temp folder with some NTFS deleted files recovering tool.
If recoving of deleted NTFS files is not possible, you can try to recover as described here:
https://www.7-zip.org/recover.html
It can be difficult.
Thanks a lot! Will try..
Can you suggest a parser to extract data from a RAW file?
I think I got raw.dat by your instructions, but I don't know what to do next.
1) look that file in hex editor.
2) try to open it with
7-Zip / Open Inside #command.Thanks, I will notice in any success.
Igor, thank you very much for your help, I was able to make raw.dat file and inside it you can see the signatures of the necessary jpeg files (I don't know how to identify others yet). But the code is very large, how can you get files from raw.dat? Having found the answer to this, you can close the question.
Last edit: Oleg Generalchenko 2024-12-12
CGSecurity's PhotoRec is exactly what you're looking for.
There is some tool in linux that can extract jpg and another files from single file.
Hello everyone, I want to report on the results. According to Igor's instructions, I extracted the RAW file from the damaged archive. After that, I tried using different programs to extract data from it, but so far I was only able to extract some of the photos using JpegSnoop. I haven’t been able to extract any other data yet; I’ll report on my successes later. Thank you so much for your support.