search

Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

Recoverable partition but only restores a few files. #107

Closed s0lst1ce closed 2 years ago

s0lst1ce commented 2 years ago

Hello, I have the following partition found by RecuperaBit:

Partition #3 -> Partition (NTFS, ??? b, 75823 files, Recoverable, Offset: 0, Offset (b): 0, Sec/Clus: 8, MFT offset: 1967737288, MFT mirror offset: None) But doing: > restore 3 5

Only get me a few files: 

INFO:root:Restoring #5 Root
INFO:root:Restoring #65706 Root/bootTel.dat
INFO:root:Restoring #32742 Root/Recovery
INFO:root:Restoring #32743 Root/Recovery/Logs
INFO:root:Restoring #78408 Root/found.000

Why?

Lazza commented 2 years ago

Did you check the list of files, for example via the CSV export?

s0lst1ce commented 2 years ago

I did check the list of files. I haven't checked to see if there are exactly 75823 of them but there certainly are a lot more than 3.

Lazza commented 2 years ago

How many of them are under the root branch and not under the lost files?

I don't need an exact number, just an estimate. Thank you!

s0lst1ce commented 2 years ago

I think you found what I was missing. I hadn't considered that they could have been put under lost files. I'll try to recover those and see if there are still some missing. Considering this partition should have around 1.5TiB of data it's going to take a while if most of them remain. I'll keep you posted, and thanks for the very quick reaction time.

s0lst1ce commented 2 years ago

Well I've finished recovering them and the count is right, all the files appear to be here. Thanks for the help!