Case Study: Recover deleted .docx file.

Summary: A deleted Office Open Document XML (.DOCX) file was recovered from a USB drive.

Methods: The drive was imaged using GNU ddrescue and the file was found and recovered two different ways. Photorec was used to data carve the file and Sleuthkit was used to recover the file from the filesystem.

Details:

$ mkdir recovery
$ cd recovery

The drive was imaged:
$ sudo ddrescue /dev/sdc1 loopfile log

Photorec was run on the image and the file was recovered as a zip file.

$ photorec loopfile

Alternatively, the deleted files were listed using fls:

$ fls loopfile -r -f fat -i raw
r/r 3: test (Volume Label Entry)
r/r * 5: sample.docx
r/r * 7: sample.pptx
r/r * 9: sample.xlsx

The .docx file was recovered using icat:
$ icat -r -f fat -i raw loopfile 5 > sample.docx

Discussion:

DOCX (.docx, Office Open XML) documents are zip file types and can be recovered using methods used to recover .zip files.

Not recover deleted, I want

Not recover deleted, I want to know how to fix on .docx, just like some wins-app officefix, the file is not deleted, but the data is damaged, any ideas?

There is no software that

There is no software that can do than in the Ubuntu repositories.

You can try to open them and look through the xml. Perhaps some of the tools which can convert xml to html or csv would be a little helpful?

This is so awesome. I have

This is so awesome. I have used ddrescue and photorec quite a bit, but this example was a great introduction to the sluthkit tools, I'm am bookmarking this and using it the next time I need to pull a file out of a mirrored drive, which will be soon because I have become the data rescue guy in my IT department. I welcome any new howto's!

can anybody tell me how we

can anybody tell me how we recover deleted metadata after applying Document Inspector in MS Word 2007 ?

Automated recovery fls gives

Automated recovery
fls gives a list of files that can be recovered with icat. But what if there are plenty of files to recover? Does anyone know about automated methods to recover directory structures and files?

I entered the output from fls into Excel and created a scriptfile with icat-commands, but it was a lot of hand work and not a perfect result.

If you have already faced an

If you have already faced an error, when opening Microsoft Word, you may try to open your document with Recovery Toolbox for Word. This program can open corrupted files, created in any version of Microsoft Word.

Post new comment

The content of this field is kept private and will not be shown publicly.
CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Copy the characters (respecting upper/lower case) from the image.