Software Crashed and File Disappeared

VTE_TECH
VTE_TECH used Ask the Experts™
on
Hello.  I have a piece of propriety software that crashed earlier today.  The file that was being worked on was gone when we got back into the software--after restart.  Any suggestions on recovering this file?  The software is a report writing software with an integrated database. We are running XP on a custom box.

Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Sounds like a long-term file that you've been building for quite some time was just "deleted" by your software when it crashed?

The only way I can imagine that happening is if the software loads the entire file into memory, then erases and rewrites the file to save it. Perhaps the file got too big and crashed the software before the file could be re-written.

If this was a brand new file that got erased, there is no hope of getting it back, the time spent trying would never be worth it.

If it was, in fact, an old file that you need back:

Shut down the computer immediately.

Find a data specialist and have them attempt to recover the file from disc.

Since it is proprietary,  existing file recoveries will not work, you will need to use custom signatures based on other files generated by this program. A data recovery specialist will know how to do this.

Good luck!

(If I am wrong, someone will correct me, but I don't think you'll be that lucky this time :( )

If you are lucky, Google'ing for the software name along with "deleted OR missing file" might yield some results.

-Ciao

-Robert

Author

Commented:
I suspect the file was too large.  I just found a hdmp (and mdmp) file in the windows\temp directory that was created at the time of the crash.  This file is about 2x the normal working file size.  If there are any suggestions working off of the hdmp or mdmp files please let me know.  I appreciate your comments Robert...and any additional help anyone could give.  I have had success with recovery in the past, but can't remember what utilities I used.  Thanks again!
I would recommend using a hex-editor like UltraEdit to edit the dump files. UE shows hex and asc side-by-side so it's easy to find out the format of the file, at the very least you could likely extract the file data this way from dumps (presuming that my original assertion is correct, and it seems likely: the program loaded the file, crashed without replacing it, and the dump data likely contains the file that was loaded into ram).

I can't think of any pre-fab tool off hand that would allow to search based on a custom file signature.

This article describes the basic principle: http://searchwindowsserver.techtarget.com/tip/Signature-based-data-recovery-A-last-ditch-technique

Author

Commented:
Thank you for the replys!  Due to the time and resources required to recover, we have chosen to re-enter the data.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial