File recovery woes...

June 1, 2008 7:14 PM

File recovery woes. OpenOffice Writer doc, no backup...

The XP user opened the file and found it blank. It was a lengthy doc once upon a time but now even the file size is teeny tiny. I'm guessing that the novice user somehow 'selected all' and deleted the contents. Then, upon closing the file, resaved at the prompt.

So, there is no actual file to recover. Given that we know phrases that were once in the file, is there a relatively easy way (with a freeware app) to search the unallocated HD space for the lost file contents?

posted by whatisish to computers & internet (4 comments total)

Given how often XP is hitting the disk, unless the user unmounted the drive immediately after losing the file/file content, I would bet that those blocks have been reallocated already. Though, if it were me, and I were desperate, I would reboot with a Linux "live" cd, and try some things from here:

https://help.ubuntu.com/community/DataRecovery

In particular, SleuthKit: http://www.sleuthkit.org
posted by Zach! at 8:59 PM on June 1

Open the document and check under Tools - Options - Load/Save - General to see if "Always create a backup copy" is checked. If so, read on.

From OpenOffice Writer Help:

Saving Documents Automatically

To create a backup file every time you save a document

1.Choose Tools - Options - Load/Save - General.
2.Mark Always create backup copy.

If the Always create backup copy option is selected, the old version of the file is saved to the backup directory whenever you save the current version of the file.

You can change the backup directory by choosing Tools - Options - OpenOffice.org - Paths, then change the Backups path in the dialog.

The backup copy has the same name as the document, but the extension is .BAK. If the backup folder already contains such a file, it will be overwritten without warning.
posted by exphysicist345 at 9:45 PM on June 1

Do exactly what Zach! suggests, without doing what exphysicist345 sugggests. Any disk activity in XP is going to reduce the chances of recovering this file rapidly.
posted by gum at 11:15 PM on June 1

Incidentally, scanning the disk for those phrases will likely be futile - OpenOffice files are (last I checked) zipped xml files, so those phrases will be compressed into binary static. This also means searching for zip files is useful.

I've used SleuthKit from the Helix Forensics CD. If memory serves, it will require much disk space & time. PhotoRec can do this, & though I haven't used it, it gets mentioned often on here. That might be much faster & less complex.

Do downloads / make any live cds from another computer, & shutdown the computer in question asap.)
posted by Pronoiac at 1:27 PM on June 2