Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Jethryn Freyman

macrumors 68020
Original poster
Aug 9, 2007
2,329
3
Australia
Deleted a movie file, then used testdisk and Data Rescue 2 to recover it. The file was not overwritten at all, and the disk was not written to after the deletion of the file.

This is what testdisk recovers:



Can't play the movie file, and it has a different md5 hash compared to the file before it was deleted (which is to be expected), but the file size is exactly the same.

Data Rescue 2 and Photorec recover the single .mov file, and it will open in Quicktime, but only displays a black screen. In VLC, nothing will come up. Same results on FAT32 and HFS+ devices.
 
Deleted a movie file, then used testdisk and Data Rescue 2 to recover it. The file was not overwritten at all, and the disk was not written to after the deletion of the file.

Obviously, this is not true. Something has changed. You say yourself that the hash code has changed which means the file is different even if the length is the same. Do you have a backup?

Hopefully, some one smarter than I am will show up with better advice. I wish you well.
 
Obviously, this is not true. Something has changed. You say yourself that the hash code has changed which means the file is different even if the length is the same. Do you have a backup?

Hopefully, some one smarter than I am will show up with better advice. I wish you well.

Yes, I think a header or something must have been changed.

Fortunately I do have a backup, I just decided to see if I could recover the files, and it turns out they don't play after being recovered.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.