Win10 crashed and mangled a .rtf that I REALLY need back

[Dimitri001]

We already know that the file referenced by the MFT if filled with garbage. So, you need to find all RAW RTF files in hopes that one of them contains the data you are looking for. Alternatively, you could use use a hex editor, manually search the drive for the file's contents, then carve it out to a new file. But, that is not as easy as it sounds.

If I were to do this, would I be able to use a find function to find strings of text that I know were in the original file? Because if that's possible then that would probably be the easiest way.

[lcoughey]

Yes, you would need to look for strings of text, taking into consideration that you would be looking at it in HEX.

You can explore the functions of WinHex to determine if you can do this with the free version.

[Dimitri001]

Yes, you would need to look for strings of text, taking into consideration that you would be looking at it in HEX.

You can explore the functions of WinHex to determine if you can do this with the free version.

I've installed HxD and opened the partition and I've found some strings that there's a good chance would appear only in that file, but it's all scrambled, which is what I assume you mean when you say that I would be looking at it in HEX. What do I do with this stuff, how would I decode it into normal text?

[lcoughey]

That is for you to figure out or to hire a professional to do it for you.

[Dimitri001]

But is it something simple htat I could learn to do quickly on the internet or is it something really complicated?

[lcoughey]

But is it something simple htat I could learn to do quickly on the internet or is it something really complicated?

I don't know what you are capable of or what is available online. I've been doing this stuff since the 90's.

[Dimitri001]

Here's the situation right now:

I created a test .rtf file (not on the HDD I'm trying to recover from) and copy pasted a bunch of text into it and saved it and then I opened the file in HxD, just to see what it would look like. I could see the whole text no problem in HxD, preceeded by some technical stuff about font type, size etc.

Well, I did a search in my HDD for a string of text and found a string of text that beyond any doubt belongs to the file I lost, but it doesn't show up like it does in the test file. In the test file it's just normal text, on my HDD, the text is constantly interrupted with gibberish and it's scattered around. I can see large sections of the file, a lot of it is there, but it's spotted with gibberish and the whole text isn't there. There's a lot of it, but not the whole thing, whereas in the test file the whole text runs continuously with no interruption, as it would if you opened it in Wordpad.

Any idea why that might be and what I might do about it?

[lcoughey]

Here's the situation right now:

I created a test .rtf file (not on the HDD I'm trying to recover from) and copy pasted a bunch of text into it and saved it and then I opened the file in HxD, just to see what it would look like. I could see the whole text no problem in HxD, preceeded by some technical stuff about font type, size etc.

Well, I did a search in my HDD for a string of text and found a string of text that beyond any doubt belongs to the file I lost, but it doesn't show up like it does in the test file. In the test file it's just normal text, on my HDD, the text is constantly interrupted with gibberish and it's scattered around. I can see large sections of the file, a lot of it is there, but it's spotted with gibberish and the whole text isn't there. There's a lot of it, but not the whole thing, whereas in the test file the whole text runs continuously with no interruption, as it would if you opened it in Wordpad.

Any idea why that might be and what I might do about it?

Nope. You just need to carve out and create a new file. Sometimes the same text will show in multiple spots on the drive, too.

[Dimitri001]

But if the text is jumbled on the drive, wouldn't any file I create yield gibberish too? Because when I looked at a test .rtf file, it wasn't jumbled, the text was normal, gibberish free, as it would appear in Wordpad.

[lcoughey]

But if the text is jumbled on the drive, wouldn't any file I create yield gibberish too? Because when I looked at a test .rtf file, it wasn't jumbled, the text was normal, gibberish free, as it would appear in Wordpad.

That is where the carving comes in. You copy the text out to a new file, removing the garbage.