Case Study: Recover deleted .docx file.
Summary: A deleted Office Open Document XML (.DOCX) file was recovered from a USB drive.
Methods: The drive was imaged using GNU ddrescue and the file was found and recovered two different ways. Photorec was used to data carve the file and Sleuthkit was used to recover the file from the filesystem.
Details:
$ mkdir recovery
$ cd recovery
The drive was imaged:
$ sudo ddrescue /dev/sdc1 loopfile log
Photorec was run on the image and the file was recovered as a zip file.
$ photorec loopfile
Alternatively, the deleted files were listed using fls:
$ fls loopfile -r -f fat -i raw
r/r 3: test (Volume Label Entry)
r/r * 5: sample.docx
r/r * 7: sample.pptx
r/r * 9: sample.xlsx
The .docx file was recovered using icat:
$ icat -r -f fat -i raw loopfile 5 > sample.docx
Discussion:
DOCX (.docx, Office Open XML) documents are zip file types and can be recovered using methods used to recover .zip files.

Not recover deleted, I want
Not recover deleted, I want to know how to fix on .docx, just like some wins-app officefix, the file is not deleted, but the data is damaged, any ideas?
There is no software that
There is no software that can do than in the Ubuntu repositories.
You can try to open them and look through the xml. Perhaps some of the tools which can convert xml to html or csv would be a little helpful?
This is so awesome. I have
This is so awesome. I have used ddrescue and photorec quite a bit, but this example was a great introduction to the sluthkit tools, I'm am bookmarking this and using it the next time I need to pull a file out of a mirrored drive, which will be soon because I have become the data rescue guy in my IT department. I welcome any new howto's!
can anybody tell me how we
can anybody tell me how we recover deleted metadata after applying Document Inspector in MS Word 2007 ?
Automated recovery fls gives
Automated recovery
fls gives a list of files that can be recovered with icat. But what if there are plenty of files to recover? Does anyone know about automated methods to recover directory structures and files?
I entered the output from fls into Excel and created a scriptfile with icat-commands, but it was a lot of hand work and not a perfect result.
If you have already faced an
If you have already faced an error, when opening Microsoft Word, you may try to open your document with Recovery Toolbox for Word. This program can open corrupted files, created in any version of Microsoft Word.
Post new comment