How do I recover the data from a text file showing up as empty in Windows?

October 29, 2005 8:02 AM

I just lost a month's worth of journal entries in a locally saved plaintext file. Is there any way to get them back?

Went out last night, and left my computer on as usual, with Firefox, Gaim, and a TED Notepad window open with a file containing what I'd written in my journal for October. This morning, I find Firefox has gone black and frozen (the Reminder extension has been acting funny lately), and Gaim's System Tray icon is looking weird. I close Firefox, and everything else seems to be fine. So I write a little more in the TED Notepad file about last night and press Ctrl-S to save it. I get an error dialog that says "Cannot save to 200510.txt!" which is, obviously, unexpected and unusual. So I try it again, and get the same error.

Not wanting to lose what I just wrote, I opened another Notepad window, copied and pasted the new entry, and saved that without any problem. Then I tried closing the original window, got the usual Save/Don't Save/Cancel dialog, and picked Save again. Same error as before. So I tried closing the window and not saving, which worked. But then when I went into Recent Documents to re-open that file, I got an empty file! The details for the file now say it contains "0 bytes". The file with the new entry is fine. I have an idea of what may have happened, but that idea doesn't make me feel optimistic about the prospects for recovering this data. Is the data still in my D: drive somewhere? Is there any way to get it back? Even just being able to read it would be constructive; if all else fails, I could write it all down on paper and then retype it. I just don't want to lose a month of personal reflection because of this.

This computer runs Windows ME. The data in question, along with most of my data, is on a physically separate internal hard drive from the system disk (both FAT32, IIRC), so I'm pretty sure web browsing won't overwrite the data formerly known as 200510.txt. Unfortunately, I don't think an undelete utility would work, because the problem isn't that the filesystem has marked the file as deleted -- it's that it has marked the file as empty. Any ideas would be most appreciated.

On preview: I have no money to spend on software. Seriously, it's going to be hard paying utilities next month. So please keep that in mind. Oh, and I do have another computer with Knoppix installed, if there's a solution that involves Linux; but I don't know jack about Linux, so that solution would have to be laid out in painstaking newbie detail. Thanks.

posted by skoosh to Computers & Internet (11 answers total)

You need an old style undelete utility that can directly read and modify the FAT table. IF you've not used the disk, the data may be in sectors marked deleted but not yet overwritten.

Google for file undelete utilities, there will be a bunch of free ones, of varying quality.
posted by orthogonality at 8:20 AM on October 29, 2005

Have you restarted the computer yet? The text might still be in the clipboard.
posted by sbutler at 8:23 AM on October 29, 2005

Best answer: The only thing I can think of is using a low-level disk utility that examines the contents of the harddrive regardless of what the filesystem says is there. I vaguely remember of having heard of such a program, but I must admit I'm really not sure such a thing exists.

Undelete seems out of the question for the reasons OP stated (i.e. the original file didn't really get deleted).
posted by CKZ at 8:27 AM on October 29, 2005

If you haven't rebooted the computer (I assume you haven't, since you say you can still write it all down on paper) the easiest thing to do would be to just paste the entries into an email addressed to yourself.
posted by Ryvar at 8:31 AM on October 29, 2005

One other thing - make sure you've either got Outlook/Thunderbird setup so they leave a copy of the email on your mail server, or mail it to a Yahoo/Gmail/whatever account.
posted by Ryvar at 8:34 AM on October 29, 2005

Best answer: Disk Investigator is what I was thinking about:

Disk Investigator helps you to discover all that is hidden on your computer hard disk. It can also help you to recover lost data. Display the true drive contents by bypassing the operating system and directly reading the raw drive sectors. View and search raw directories, files, clusters, and system sectors. Verify the effectiveness of file and disk wiping programs. Undelete previously deleted files.
posted by CKZ at 8:35 AM on October 29, 2005

Response by poster: I've restarted three times now, once after dragging the file into the Recycle Bin and then restoring it back, then again in safe mode to run ScanDisk (there was a boot sector that I repaired). Plus, I only copied and pasted the new entry, not all the old entries. I'm not sure if orthogonality and CKZ aren't recommending the same thing, but I'll look for one of these old-school disk utilities anyway. Is there any way to tell which ones do or don't directly read the allocation table in advance? Any names of disk utilities that fit the bill?
posted by skoosh at 8:42 AM on October 29, 2005

http://www.snapfiles.com/download/dlrestoration.html
posted by orthogonality at 10:10 AM on October 29, 2005

Best answer: So just to clarify, you did manage to save the second copy of the file in notepad? Which one has zero bytes, 200510.txt, or the second copy?

As far as I know, if it has been replaced with a zero byte file, an undelete utility will not help, as there isnt anything to unerase. In DOS (and I assume it's the same in WinME, as it uses the same filesystem), when a file is deleted, the file information is still in the directory listing, but the first letter is overwritten with a non-ascii symbol to indicate that it is deleted. This can be used to find the sectors on the disk which correspond to the file. If the file still exists, but has no content, this doesnt apply, and can't be undeleted by the usual undelete utilities.

If it is a text file, and it hasnt been overwritten, I think the only way to get it back is to use a raw disk editor, and search the hard disk for text that is unique to the file that you want to recover. I've done this before successfully with Norton Disk Editor. You will probably find parts of the file, and possibly junk as well, but as it is only text, it should be editable back into something resembling the original. Searching around for 'Disk Editor', I found a few free/free trial equivalents, listed below. Note I havent tried these, and can't vouch for these. Could wipe your hard disk, etc etc...

(On preview, you could try GetDataBack from runtime.org first. There's a free trial, you might have to pay to restore it, but will a least allow you to preview (and possibly cut/paste) any files that can be undeleted.)

http://www.runtime.org/diskexpl.htm
http://sourceforge.net/projects/diskeditor
posted by Boobus Tuber at 2:23 PM on October 29, 2005

Also, it might go without saying, but don't write anything to the drive that the file is on..
posted by Boobus Tuber at 2:26 PM on October 29, 2005

Response by poster: Thank you everyone for your answers. I tried Disk Investigator, and it worked perfectly! Apparently, some glitch inserted a bunch of binary characters at the end of the text file, and TED Notepad choked on them on trying to save it. Disk Investigator also gave me an "Invalid start cluster number" error when I tried to read the empty file. Fortunately(!), when I saved this morning's entry in a new file, it ended up very close to the data I was looking for. So once I got that starting point, it was just a matter of homing in on the beginning of the data. The GUI made almost too easy. There was a little bit of overwritten data, but I have copies of that bit elsewhere, so that was no problem.

AskMe rocks!
posted by skoosh at 4:43 PM on October 29, 2005