Forum Thread

How do you recover a partition or drive that has almost all files at 0KB?

saveitman 2,223 100 November 21, 2015 at 04:09 AM
I am looking for software that can recover 0KB files I have tried many that couldn't and don't recall them all to list so I would just say yes I did try recuva.

I was a fool and did not backup and lost costly files after some virus or malware must of been able to achive in making almost all my files in the system partition into 0kb files. It happened after my Kaspersky AV subscription had ended a couple weeks back Frown. I had to do a fast reinstall on another HD to keep running. My last recourse that I know of is to seek the service of these data recovery businesses that charge an insane amount and I need more options before I go down that wallet hungry route.

The best thing from all of this is that I was smart enough to create a partition for the system drive so the damage didn't leak to any other partition or drive. As far as I know I have never experienced an infection that went beyond the system drive or partition.

28 Comments

1 2

Sign up for a Slickdeals account to remove this ad.

#2
Quote from saveitman View Post :
I am looking for software that can recover 0KB files I have tried many that couldn't and don't recall them all to list so I would just say yes I did try recuva.

I was a fool and did not backup and lost costly files after some virus or malware must of been able to achive in making almost all my files in the system partition into 0kb files. It happened after my Kaspersky AV subscription had ended a couple weeks back Frown. I had to do a fast reinstall on another HD to keep running. My last recourse that I know of is to seek the service of these data recovery businesses that charge an insane amount and I need more options before I go down that wallet hungry route.

The best thing from all of this is that I was smart enough to create a partition for the system drive so the damage didn't leak to any other partition or drive. As far as I know I have never experienced an infection that went beyond the system drive or partition.
To clarify, are these data recovery programs showing a list of files they can recover but all the files show up as 0kb?
Do the file show up in windows as 0kb?
Does the computer still boot windows and function on a general level?
Did anything display on the computer demanding payment to unlock your files or any other kind of message?
Did an anti virus program identify anything?

It's hard to be sure if a virus is the cause or not. It it were a virus it could be some flavor of cryptolocker type virus that encrypts/ransoms your files or something that simply formats the drive or wipes out your MBR. Any time there's any kind of data loss, it's best not to write anything to the effected drive. It's probably best to avoid your current potentially compromised windows installation when you attempt data recovery.

There are some programs you have to purchase that could be worth a try, they have a free demo of sorts that lets you analyze if files are recoverable. I've used Runtime's GetDataBack and Kroll's Ontrack EasyRecovery in the past.
Reply Helpful Comment? 0 0
Joined Jun 2008
I Trade Your Bing Credit$
737 Posts
82 Reputation
#3
recuva sucks at deep inspection. try PhotoRec, if same result, either they are encrypted or lost, i don't think you can get much back even you pay, maybe really depends on what file types
Reply Helpful Comment? 0 0
#4
If I were you I would go to Steve Gibson's GRC [grc.com] and buy his Spinrite utility [$89.00 with lifetime support] Steve offers a no questions asked refund for the purchase price if you are not happy with Spinrite's ability to cure non-physical hard drive errors.Smilie

I've been an MCSE for 24 years and whenever I needed to use Spinrite it never failed to fix the problem. Most people here have not had to provide support for 250+ computers (I'm not bragging, I'm just saying) I have needed to use Spinrite much more extensively than the average user and because of the extended experience that I gained I am confident that Spinrite can help you.

Some SD'rs think that Spinrite takes too long to repair a hard drive but consider this, sending your hard drive to a recovery company costs over $1000.00 and you need to wait for them to return the drive to you. Also if the HD circuit board or motor is not defective, guess what they use to recover the dataLMAO

Disclaimer: I am a Spinrite fanboy but I am not employed by nor have I ever met Steve Gibson. This post is simply my attempt to help the OP in be best way I can.
Reply Helpful Comment? 0 0
Earth 1st! We'll mine the other planets later. Biker

Did you know?

If it can't be grown its gotta be mined
EEK!

The best meal I ever ate was Spotted Owl fried in Exxon Oil! Yumshake head

Expand your horizons. Explore something new. Get a RasberryPi and learn something.
Joined Aug 2005
L10: Grand Master
12,661 Posts
4,824 Reputation
Pro
#5
Quote from dale_101798 View Post :
If I were you I would go to Steve Gibson's GRC [grc.com] and buy his Spinrite utility [$89.00 with lifetime support] Steve offers a no questions asked refund for the purchase price if you are not happy with Spinrite's ability to cure non-physical hard drive errors.Smilie

I've been an MCSE for 24 years and whenever I needed to use Spinrite it never failed to fix the problem. Most people here have not had to provide support for 250+ computers (I'm not bragging, I'm just saying) I have needed to use Spinrite much more extensively than the average user and because of the extended experience that I gained I am confident that Spinrite can help you.

Some SD'rs think that Spinrite takes too long to repair a hard drive but consider this, sending your hard drive to a recovery company costs over $1000.00 and you need to wait for them to return the drive to you. Also if the HD circuit board or motor is not defective, guess what they use to recover the dataLMAO

Disclaimer: I am a Spinrite fanboy but I am not employed by nor have I ever met Steve Gibson. This post is simply my attempt to help the OP in be best way I can.

While I am a Spinrite fan it sounds like OP got cryptolocker or something like that and Spinrite won't help with that. Please reread the OP.
Reply Helpful Comment? 0 0
Vague questions receive vague answers . . . . . .
#6
Quote from LiquidRetro View Post :
While I am a Spinrite fan it sounds like OP got cryptolocker or something like that and Spinrite won't help with that. Please reread the OP.
I do respect your opinion. However in every case Ransom-ware provides a way for the victim to pay the fees required to unlock the files on the hard drive. I have personally attempted to help the owners or users of PC's that was subjected to cryptolocker or ransom-ware. What I saw is not what our OP describes.

The Op's description does not meet the expectations I've come to look for from ransom-ware. Rather I believe the boot sector of this HD was corrupted somehow. Spinrite can and will repair those corruptions if they exist. Also if Spinrite does not do the job the OP can easily get his/her money back. In my book that is a win-win.

OP If you have a SSD and you want to use Spinrite you should run it at level 2. Any other scan level would add wear to your SSD which would shorten it's life expectancy by some small factor.
Reply Helpful Comment? 0 0
#7
Quote from dale_101798 View Post :

I've been an MCSE for 24 years and whenever I needed to use Spinrite it never failed to fix the problem. Most people here have not had to provide support for 250+ computers (I'm not bragging, I'm just saying) I have needed to use Spinrite much more extensively than the average user

[/SIZE]
Is it 12 years or 24 years? You need to make up your mind and stick to your story. If you are going to pad your resume keep good notes.
http://slickdeals.net/forums/showpost.php?p=74626281&postcount=6
Half your posts are condecending to the others providing support.
Reply Helpful Comment? 0 0
Last edited by fenderman November 21, 2015 at 11:06 AM
#8
Quote from fenderman View Post :
Is it 12 years or 24 years? You need to make up your mind and stick to your story.
http://slickdeals.net/forums/showpost.php?p=74626281&postcount=6
Half your posts are condescending to the others providing support.
Ah, yes; well you see I started in IT 14 years ago [Oops, 24 was a typo, excuse me] but I got all of my certifications about 12 years ago. Today I am comfortably retired. I have no need to work anymore, so I suppose you could say I am not 100% up to date with everything that is relevant these days in the IT field because I have devoted my life to my family, not work. This does not in any way make my advise any less accurate.

As for being condescending you were my only target for that behavior at the time because I felt that you deserved my belittling attitude because you belittled me 1st. I am trying to be better at that, are you?hug
Reply Helpful Comment? 0 0

Sign up for a Slickdeals account to remove this ad.

#9
We simply don't have enough info to determine if the op got a cryptolocker virus or if something else happened, possibly something unrelated to viruses/malware. Cryptolocker doesn't immediately display a ransom demand, it waits until it has encrypted a sufficient number of files. I haven't had to deal with cryptolocker myself, so I'm not 100% certain what to expect from it symptom wise. What I've read doesn't quite track with the op's description which is a bit ambiguous. There are plenty of other viruses that destroy or delete data, but it could have been something else entirely.

OP, try the online analysis of the S.M.A.R.T. data for your hard drive in speedfan http://www.almico.com/speedfan.php
Reply Helpful Comment? 0 0
Last edited by jkee November 21, 2015 at 01:12 PM
Joined Jun 2005
Let Sleeping Dogs Lie
5,847 Posts
2,388 Reputation
#10
try r-studio and see what it can find but DO NOT install any software or add any files to the drive. You can install a trial version of r-studio on a second PC then connect the drive either internal or via USB

http://www.r-studio.com/
Reply Helpful Comment? 0 0
#11
Can you log onto your computer?

If you can log on what happens when you attempt to open a file? Are you confronted with a demand to pay a ransom? If not proceed to GRC [grc.com]and get Spinrite. In my opinion your only other option is to just keep spinning your wheels and getting nowhere.

I should not need to say this but every time you attempt a recovery using alternative methods/software the bits and bytes on the hard drive may be changed and that would make it more difficult for Spinrite to do what it does.

Just sayin', I still believe that Spinrite is your best chance to recover your data. If you insist on putting your data at risk. Please image the hard drive to a completely different hard drive and try your alternate methods on the clone not on the original one. Seriously, if your data is important to you why would you want to risk it for a measly one time cost of $89.00?
Reply Helpful Comment? 0 0
Last edited by vec November 25, 2015 at 02:27 PM
Joined Jun 2005
Let Sleeping Dogs Lie
5,847 Posts
2,388 Reputation
#12
Well if he can log on the drive is probably not failing as windows has a lot of files and the chances of a bad drive not affecting any windows files is pretty small.

I own a copy of spinrite and it works ok but unless I had problems that pointed to a failing drive like slow boot or multiple read errors in the even log or no boot I would not run spinrite.

We need a little more data that is why the answers are all over the board,

Did you run chkdsk or any other tools to repair files, did you find out if a virus/malware did cause the issue?

Where are the files located, on a separate drive from your windows install or on the same disk?

I noticed the OP has not replied to any posts so we should just all wait until they do reply back!
Reply Helpful Comment? 0 0
Joined Jan 2006
L10: Grand Master
11,221 Posts
1,465 Reputation
#13
Quote from dale_101798 View Post :
Rather I believe the boot sector of this HD was corrupted somehow.
The boot sector is independent of the file-systems. If it is corrupt it's a separate issue to having all your files at 0kb
Reply Helpful Comment? 0 0
Heifer whines could be human cries
Closer comes the screaming knife
#14
Quote from vivahate View Post :
The boot sector is independent of the file-systems. If it is corrupt it's a separate issue to having all your files at 0kb
These days the most prevent File System used by windows computers is NTFS [New Technology File System] NTFS contains within it the Master Boot Record. NTFS is responsible for keeping a record of where every single file is contained on or in a Hard Drive. The Windows System uses the Registry to record & determine where on a hard drive any particular file or directory is located, access to files may become impossible for a number of reasons. But if the MBR fails to locate a file that is required for boot up, Windows will not boot up correctly.

I had hoped that I could avoid this lengthy explanation.

PCGuide [pcguide.com] has a lengthy tutorial about Hard Drives and how they work with multiple OS's.
Reply Helpful Comment? 0 0
#15
Quote from dale_101798 View Post :
These days the most prevent File System used by windows computers is NTFS [New Technology File System] NTFS contains within it the Master Boot Record. NTFS is responsible for keeping a record of where every single file is contained on or in a Hard Drive. The Windows System uses the Registry to record & determine where on a hard drive any particular file or directory is located, access to files may become impossible for a number of reasons. But if the MBR fails to locate a file that is required for boot up, Windows will not boot up correctly.

I had hoped that I could avoid this lengthy explanation.

PCGuide [pcguide.com] has a lengthy tutorial about Hard Drives and how they work with multiple OS's.
Wait, please help me understand, you used the wrong term and now its his fault and you "hoped that I could avoid this lengthy explanation. "..you could have avoided it by being correct. You are passive aggressive even when its your fault!
Reply Helpful Comment? 0 0
Page 1 of 2
1 2
Join the Conversation
Add a Comment
 
Copyright 1999 - 2016. Slickdeals, LLC. All Rights Reserved. Copyright / Infringement Policy  •  Privacy Policy  •  Terms of Service  •  Acceptable Use Policy (Rules)  •  Interest-Based Ads
Link Copied to Clipboard