Win10 crashed and mangled a .rtf that I REALLY need back

[Dimitri001]

I had two .rtf files open in Wordpad in Windows 10. After the crash, one of them is fine and in the other one, all the contents have been replaced by empty space such as you would get if you just pressed down on the tab key.

Any idea on how I might get to the previous version of the file? What kind of software might I try running?

[lcoughey]

If you haven't got them back since you first posted about this issue in March (viewtopic.php?f=5&t=509&p=1301#p1301), I suspect that you are out of luck.

[Dimitri001]

This is a different file.

[lcoughey]

But the answer/solution is the same.

[Dimitri001]

The situation is different because in the previous situation there were no saved files. What was lost was lost from an open Wordpad window. This time, what happened is that a file that is saved on my desktop got mangled in a crash. The files is a few days old and I've been working on it daily. It's been saved the whole time. But all I got now is this mangled file on desktop.

I ran Recouva and it found a version of the file, I recovered it, but all that was in it was gibberish (which is different than what's in the mangled file that's still on my desktop - that's just full of blank spaces, the ones you get with the tab button).

[lcoughey]

Please confirm the very first thing you did when you discovered the file was missing off the desktop was to power the drive off and only access it in read-only mode. That is, every sector written to the drive following the file deletion would likely have overwritten the lost file. If it is on an SSD and TRIM is enabled, the odds of recovery are even lower.

Again, I still suggest R-Studio for a recovery program over Recuva.

[Dimitri001]

Yes, I'm accessing the drive through another computer.

Can recovery software help me in this situation? Given that this is not a deleted file, but that the file I want still exists and I need the earlier, pre-crash version, which isn't changed in this strange way.

Obviously, Recouva found something, but I don't know what the heck what version it found, given that the contents are gibberish.

[lcoughey]

Obviously the MFT records that exist now point to a file that is filled with garbage. So, you'll need to run a full scan of the drive and carve out all found RTF files and then open them one by one to see if any contain the data you are looking for. If not, you are probably out of luck.

[Dimitri001]

So I should not necessarily be looking exclusively at the folder that the file is in? (nor the folder where Wordpad stores temp files?)

I should be looking at all .rtf files, regardless of the filename, is that right?

Is it possible that the contents of the file will be stored in some kinda temp file that will have a different extension? Which extensions should I be looking at?


I did that shorter version of a scan with R-Studio and it found my file, although it said in parentheses "existing file", I recovered it and I got the same thing I got now. All the text that had been in the file has been replaced with " ".

[lcoughey]

We already know that the file referenced by the MFT if filled with garbage. So, you need to find all RAW RTF files in hopes that one of them contains the data you are looking for. Alternatively, you could use use a hex editor, manually search the drive for the file's contents, then carve it out to a new file. But, that is not as easy as it sounds.