Fragmented files are probably one of the biggest headaches in data recovery

Why are files fragmented?

All hard disks have a finite capacity. This means that when a large file is to be written to a disk, there may not be a contiguous space for it. Consequently, the file will have to be written to two or more locations and hence is fragmented. Details of how the file is fragmented will be stored as part of the directory structure, or file details, and so when reading the file, the fragmentation is invisible to the user, or application program. Computers tend to read sequential files faster than fragmented files, so there are many utilities to defragment a disk and so keep performance to an optimum level.

Different operating systems work in different ways to try and reduce fragmentation but as often a size of the file is not known when a new file is created, it is difficult to know where to put a new file in the biggest possible space, or in a reasonable space early in the disk. On high capacity disks with low usage, and short files, fragmentation will be low.  With a very full disk, and large files, fragmentation may be extensive, and the longer the file, the more likely it is to be fragmented.

If the disk is intact, then CnW Software will process fragmented files without any problems.  If the disk is corrupted, or sections such as FAT, or MFT entries are missing, then the raw recovery may be required, and fragmentation becomes an issue. The log will indicate how many fragments a file has, so it is possible to find fragmented files, from an intact operating system.

How to recover fragmented files with CnW Recovery software

The first stage is to find the start of any possible file, and the easiest way is to use the Image scan of the disk to read files using data carving.  This function will recognise the start of files from their unique signature, or pattern of data.  The log will then show the starting location of the file. From now on, it all rather more complex, and sometimes it is debatable if it is worth the effort. For a very long file with many fragments, somehow each fragment has to be found, and then file stitched together.  For a short file, with only a few fragments, the problem comes in finding the start of each fragment.  Detailed knowledge of the file structure is required, and the ability to join these sections together.  Tools to assist in this, tools are being developed by CnW Recovery that will allow separate fragments to be saved, with an indication of what type of file each fragment belongs to. 

Fragmented JPEGs

This routine is in the queue for a development update.  Recent camera files sizes etc has made the recovery not very reliable, and a rather low success rate

For memory chips, CnW has had good success with JPEGs and AVIs and is developing yet more robust routines. By making use of both a possible thumbnail, and contrast matching, high success rates can be achieved.

Word files

 Partial success with Word Documents (Word 95,97, 2003, not 2007 docx files) has also been achieved. Word documents tend to be hard to automate as often they are very fragmented due to many edits.  There is also a big issue with many similar documents being edited in the same area of the disk, and so false matches are possible.  For best results, manual data carving should be considered.

Fragmented Zip File - Use DOCX wizard

Many Zip files are are actually archives if multiple Zip files, such as 30 files zipped into a single file.  CnW Recovery will evaluate the integrity of every zip file it restores in raw mode, and if not valid, will attempt to create a new zip file from valid zips embedded within the whole zip. This may mean that files are actually lost, but the reconstructed file will be a valid zip file that will open, and valid files may be extracted.

 

MP4/3GP/MOV  - Use MP4 Wizard

MP4 and 3GP are just a few of many Quick Time type files.  Often used as video recording on mobile phone type devices.  As the file system is often FAT32, a deleted file may be fragmented and reconstruction necessary. Click here for details on file structure and defragmenting routines.  It is not helped in that many video files are not stored in sequential sectors, ie they start off as a fragmented file, but the FAT data makes then sequential. Once deleted, the FAT data is lost, and so recovery will be required.

• For a white paper on fragmented videos, click here

Fragmented AVCHD files - use AVCHD Wizard

These video files are often stored on FAT32 devices, and if accidentally deleted, the fragments can be lost.  To make issues worse, some video cameras store the files fragmented.  This is when closing the file, other associated control files, eg .cpi are written possibly before the main .MTS file is closed.  The result is a fragmented .MTS file.  MTS file also tend to be long, and so the fragmentation is significant.  CnW has routines to process these fragmented files and reconstruct a single complete .MTS file. The function as part of the welcome wizard scans the whole chip in order to reconstruct the AVCHD .MTS files.

Fragmented AVI files - Use AVI Wizard

Many cameras record AVI files for their video.  As these are normally on FAT32, a deleted file will not have any fragmentation details.  The CnW function will try and recover the whole file, but if not possible will recover the first part and add an index to the end.  This way, even the partial file will be viewable.

Demo program and defragmentation

Unfortunately it is not possible to work on file defragmentation with the demo program, but it will indicate which files are possibly fragmented.

Defrag programs

Nobody ever plans to have to recover fragmented files from a damaged, or corrupted disk. As seen above, there are significant problems and one line of action is to limit the number of fragmented files on a disk drive.  Thus running a defrag program on a regular basis will leave a hard drive in a better position to be recovered if the worst ever happens.  A defraged disk drive can also help improve PC performance, but the difference is rarely noticeable without very careful timings.