Trying to Recover 40Gig Tib file

I've hit this problem before so I guess my real question is:
Are tib files that are >20gig simply too large to recover, even on an NTFS file system, and even when nothing has been overwritten.

It's probably a noob question but I don't recall learning about a size limitation for recovering deleted files.

I'm trying to recover a 40GB tib file that I accidentally deleted --and obviously a 40Gig file by-passes the recycle bin. But the partition in question hasn't been formatted or touched since that simple deletion--so the MFT should just have a few bytes changed.

Normally something like GetDataBack, Active@Undelete or R-Studio will do a sector scan, read the MFT and allow me to recover what hasn't been overwritten---but I don't think any of those apps have ever worked with a large .tib file.

I suppose if I were still on top of low level stuff I could use Partition Table Doctor and go in and manually tweak the hex but it's been too long since I've worked at that low a level to know what I'm doing anymore.

The best file recovery app I have is Media Tools Pro--and at 400 bucks per license it should be good--and it is. It does very low level scans to regurgitate boot records, MFT etc. But I'm not sure even that would work...I'm guessing after a file reaches more than a few GB in size that the number of pointers needed to find all the sectors gets prohibitively large and these big .tib files are simply not retrievable once deleted??

 

I'd just try it, at least to see what the recovery software can identify. Proceed with the actual recovery if you like what you see.

If it is important data, why not do a "sector to sector" backup image first? Then you have a good chance of keeping the deleted data file even if your recovery software fails to finish.

 

Well I've tired on a number of occasions with a wide array of apps without any success on these large single files. I'm hoping someone actually knows if there IS a size threshold beyond which it's not possible to recover a deleted file.

The data isn't critical...this time but one day it might be and I'd like to know what the bottom line is.

 

I am not aware of any upper size limit on tib files. I have restored files greater than 50 Gb so your problem with files around 40Gb should not be a problem.

I am using ATI 2009 build 9709.

Do the tib files pass Acronis validation?

 

well yes they generally do if I can find them. I just got off chat with a friend at Cambridge who knows this stuff inside and out. We think in this case since 40GB is nearly half the size of the partition that the MFT got tweaked with the delete --even though I created no new files and we lost the first pointer--which is essential.

But i'm glad to hear you've manged to recover files of that size. which app do you use to recover deleted files?

 

When you say the partition hasn't been touched, do you mean that no version of Windows has had any kind of direct access to it? Windows (especially Vista) is always writing files. If the drive was connected and Windows saw it, there's a good chance that the MFT entry got used. Also, because of the size of the file that was lost, there's a good chance that at least one byte of its space got overwritten (which would corrupt the TIB file).

I usually try to pull a drive like that as quickly as possible and access it outside of a standard Windows installation so there's less chance of anything being written to the drive.

Have you scanned the partition looking for the first few bytes of the TIB file? Some recovery programs do signature type scans. Perhaps the TIB file is still there. Of course, if you could find the first sector, the program would still need to piece it back together. This may not be too hard if it's only the first link that's broken. (I'm not an expert by any means when it comes to the MFT.)

 

Well my OS du jour was XP pro SP3 but I think the same issues are in play. I believe that even though I wrote nothing that the OS itself wrote something when it deleted the file or did some book-keeping and it trashed that first pointer.

I actually went immediately into a recover mode with GetDataBack and I did a full sector by sector scan--but it fcouldn't find the .tib file--not even a hint of it.

I have actually run several good recovery apps and none of them could find anything. The one app I mention above--Media Tools Pro does boot up into it's own environment and does the most complete scan but it takes forever.

I imagine this 40gig .tib file was fragmented all over the place and there were probably hundreds of pointers--any one of which being corrupted would probably render the tib useless.

In theory, I've learned, there is no actual size limit on a file to be recovered but in practice with windows--XP or Visa, the larger the file in relation to the total parition size, the more likely that the OS itself will do something funky with it's own disk management just in the deletion.

Normally these better file recovery apps can recover files even after more than one high level format or a complete reinstall of windows. Some will find as many partition tables as were ever created and reconstruct each, as you choose, and can sometimes recover files from WAY back.

 

Hello Paulb,

Thank you for using Acronis Products

You should use data recovery programs, unfortunately good data recovery tools are not free. As for me I used R-studio and ZAR which helped me to restore some data after formatting the drive. The main idea is that you should attach the drive (with data you want to recover) as second hard drive to working machine and recover data to it.

You may try to mount the image after restore and retrieve critical data.

Best regards,
--
Dmitry Nikolaev