Corrupt Word Docuement

[PR Tech]

My nephew had been working on a script for over a year on a Windows PC. He recently bought a Mac. But instead of transferring the files directly to the new Mac, he put them on an a SanDisk encrypted flash drive as he thought they would be much safer. He opened the script in Word on the new Mac twice and successfully made edits to it. The 3rd time he went to open the file, it was blank. The file actually shows as 82 KB (should be 500+ KB) but what is there is garbage. I have tried the "Repair" function in Word as well as the "Repair Text" function. All of the other files on the encrypted disk are fine and open and save without issue. So, the thumb drive itself is fine. He has no backup.

I searched the temp folders Word uses on the Mac. Since he only had the Mac a week and only worked from the flash drive, there was nothing to recover. He had not yet turned on the Autosave function. I searched the temp folders on the PC - found a copy from 10/8/18. He has made a ton of edits since then, so he is still devastated. I am happy we at least got something back for him, but not all of it. He was not using OneDrive or any other type of cloud based service. Recova was unable to help.

I have a crushed 21-year old on my hands here. He NOW knows the importance of backing up his files and data backup redundancy.

Anything else I can try that I may have missed?

 

[Archon Prime]

3-2-1 backup? sorry to be Captain hindsight.. but should have had that stuff backed up daily/weekly. I don;t think there is much else he can do.

 

[Markverhyden]

I'd image the stick. Then I'd use r-studio to scan the image and look at raw files. On the PC. You said he transferred them from the PC to the stick. So they were deleted from the PC? You could scan the PC HD as well with r-studio. Did you check on the PC for the autorecover folder location? Many times it's in some obscure location.

 

[PR Tech]

I'd image the stick. Then I'd use r-studio to scan the image and look at raw files. On the PC. You said he transferred them from the PC to the stick. So they were deleted from the PC? You could scan the PC HD as well with r-studio. Did you check on the PC for the autorecover folder location? Many times it's in some obscure location.

I do have an image the stick. I will try R-Studio next on it. The files were transferred to the encrypted flash drive and then deleted from the PC (trash emptied too). But, I still have the PC at my shop and can try R-Studio on it as well. I did already try the Autorecover folder. Thank you for your feedback. It is much appreciated on my end. Trying to do everything I possibly can.

 

[PR Tech]

3-2-1 backup? sorry to be Captain hindsight.. but should have had that stuff backed up daily/weekly. I don;t think there is much else he can do.

Preaching to the choir my friend. It is a hard lesson for him to have to learn. I feel so bad for him.

 

[Porthos]

he files were transferred to the encrypted flash drive and then deleted from the PC (trash emptied too).

I see that with a lot of people. They think the external whatever is a BACKUP but it is the only place the file resides now and when it goes.......

 

[Markverhyden]

I see that with a lot of people. They think the external whatever is a BACKUP but it is the only place the file resides now and when it goes.......

Just had a phone call about that the other day.

him - My backup drive stopped working.
me - At least you can get another one and backup to that.
him - But my backup drive isn't working.
me - a backup implies you have an original. Do you?
him - no

If the PC hasn't been used since then there are fair chance that you might be able to recover the file @PR Tech. But if it's been on and off a lot, even just web browsing it's probably gone.

 

[nlinecomputers]

I see that with a lot of people. They think the external whatever is a BACKUP but it is the only place the file resides now and when it goes.......

Yep.

Had one the other day. "I thought my files were safer on the external drive. Computers crash ya know." Hands me an external hard drive with a cracked case. "And what happened here?" "Well, I uh knocked it off my desk." #facepalm Drive clicks so yeah toast.

 

[nerd2u]

You do know when you delete a file it doesn't just magically disappear.

Just go back to the original PC make an image of it and recover from the image.

Never work on the original drive.

If it is that important send it out to a professional recovery firm.

My guess is the flash drive wasn't being properly unmounted from the mac and was just being unplugged?

Sent from my SM-G870W using Tapatalk

 

[katz]

him - My backup drive stopped working.
me - At least you can get another one and backup to that.
him - But my backup drive isn't working.
me - a backup implies you have an original. Do you?
him - no

I find this conversation quite amusing.

 

[PR Tech]

You do know when you delete a file it doesn't just magically disappear.

Just go back to the original PC make an image of it and recover from the image.

Never work on the original drive.

If it is that important send it out to a professional recovery firm.

My guess is the flash drive wasn't being properly unmounted from the mac and was just being unplugged?

Sent from my SM-G870W using Tapatalk

He had let some updates run on the Window laptop before it made it to my shop. We ran R-Studio on it, but it was not able to find what we were after.

 

[Markverhyden]

He had let some updates run on the Window laptop before it made it to my shop. We ran R-Studio on it, but it was not able to find what we were after.

Given that I wouldn't expect being able to recover something that small and only one file. The size is less than one block.

 

[nerd2u]

Unless the drive was extremely full I doubt the file would have been over written by a few updates.

I'm trying to think back to my classes on file size and data writing to drives.

Have you checked the MFT for the file entry?

Purhaps Luke from recovery force will pop in this is right up his alley

Sent from my SM-G870W using Tapatalk