-1

I'm having some difficulties in recovering the contents of a .txt file. While writing to a text file, on a Win7 x64 virtual machine, the host machine crashed. After rebooting, I noticed that the file's contents are no longer visible in notepad. Using notepad++, however, reveals that all content has been overwritten with NULL values and the file's size remained the same. Here is a snapshot of notepad++.

Corrupted file

Are there any means of recovery since it was stored on a virtual drive(I'm using vmware)?

Sebi
  • 229
  • 2
  • 4
  • 10
  • off-topic? the questions states nothing about the contents of the file. It actually contains log data that is now impossible to recover. – Sebi May 28 '14 at 19:46

1 Answers1

1

Short answer:
Nope.

Long answer:
Notepad does not operate from the disk. When you open a txt file, it loads the entire file into memory (this is why Notepad is so slow when opening large files, and why the file can change by another process and you won't see it).

When you save a file in notepad, it does not append the contents. Instead, it overwrites the entire contents of the file every single time. A save in Notepad is essentially deleting the old file and saving a new one with the same name and different contents.

When your machine crashed, it did so right at that (not so) perfect moment where the file was being erased and re-written. If you're lucky, you might be able to use a file recovery tool to get it back. But Notepad itself does not have any kind of redundancy or recovery mechanism.

Sorry :-(

Wes Sayeed
  • 1,902
  • 6
  • 28
  • 43
  • But the file size is still 130KB as it was originally. I wonder why all bytes are set to NULL. If it occurred during the rewriting process I should still be able to retrieve at least part of the contents – Sebi May 28 '14 at 18:23
  • What you are seeing is the *new* file that Notepad hadn't had a chance to write data into yet. Notepad deleted the *old* file, created a new one (with the same name) and began writing data into it. That's when the crash happened. The data never made it to the disk but the new file allocation did. The data from that old file is still sitting somewhere on your hard drive, but it would only show up to a recovery program as a deleted file. – Wes Sayeed May 28 '14 at 18:33