Data Recovery Service, Information Security and Information Forensic Articles.

Archive for the ‘File Data Recovery’ Category

How to repair file demage by Virus (Kspoold)

Monday, February 22nd, 2010

Anyone heard about Kspoold virus?. The virus is changing files *. doc and *. xls to be *. exe file. In addition, this virus also damaged dbf database files namely MDF and LDF. This virus became a celebrity in the world in 2007, rivaling the popularity of the famous eagle virus last year. Because of this virus I lost a lot of files and makes my head dizzy. :)

To recovery Microsoft Word and Excel file with exe extension can be done with some of these applications are:

1. Doc / xls recover obtainable from http://adilmakmur.wordpress.com/2007/05/25/doc-xls-recover/

2. Exe 2 Doc that can be obtained from http://www.ahlul.web.id/download/kespo

3. PCMAV RC19 Cleaner which can be obtained from the DVD / CD Media Magazine PC or can be downloaded from the routine www.maseko.com uploading this anivirus each month.

4. Gucup Antivirus can be obtained from http://www.softpedia.com/get/Antivirus/GAV.shtml

5. Ansav which can be downloaded at www.ansav.com

6. Yayat Antivirus which can be obtained from www.chanal.biz or from www. vaksin.com / removal.htm

7. The bundled applications in Power Remover can be downloaded at www.donixsoftware.web.id

8. Recover my files which can be found at www.ebsoft.web.id

9. DocRecover from DarkXerion at www.geocities.com / darkxerion / docrestore.zip

and many other applications.

Compared to how to recover doc or xls, recover dbf file is much more complex. The result take long time since the emergence of Kspoold, there has been no application to restore damaged dbf yag. Fortunately, there is an interesting article in the http://vaksin.com/2007/0707/kespo-dbf.htm the contents is a way to restore the dbf from Kspoold. The snippet of the article is as follows:


Steps to recover a damaged DBF files by virus Kspoold (Contributions Bp. Ismuddin, a veteran dbf Indonesia). Damage to data caused by viruses Kspoold is changing the header from DBF extension files (If you reply dbf data files had been changed the extensions are not being attacked). Because the header of each dbf file is not the same size, it depends on the number of fields, so for a number of files fieldnya slightly, the virus can attack the record. I noticed this because the author is deliberate in order not to change the file size. “

To fix header damaged dbf file can be done with the help utility UltraEdit which can be downloaded trial version at: http://www.tucows.com/preview/194610

Step by step to repair dbf corrupt file;

1. Open the damaged dbf file with UltraEdit.

2. Open the file that was still good with the same structure with the damaged file, or create a new file with the same structure of damaged files.

3. Block header clean data from the header line with the record until the beginning of the file, right click select copy.

4. Header block corrupted data from the boundary between the header with a record until the beginning of the file, right click select paste.

5. Save the damaged data at this go to Menu, Select File and then Save. The first phase of the data repair is complete, the results can still be read by VFP, because the number of records recorded on the damaged data is not the same as that in the Copy.

6. The next improvement I use a tool that serves to improve dbf file header is not reply severe damage with Table Repair Utility (Program Attached).

7. Click Select File, locate the file saved by UltraEdit.

8. Click the Change button in the line of Record

9. Click the button Change the file size in line

10. If your reply File Recover has a Memo field while his memo file is not available, change the flag to be Has Table CDX File, then click Change.

11. Click Open File … to open a file that is in the recover, at the bottom there are records of garbage, throw it .. ! Corrupted data can be saved. Here is my program also included for repairs after running the second phase UltraEdit-Fix dbf.zip (REPAIR.EXE and MODULS.EXE) which can be downloaded at www.vaksin.com / files / fix-dbf.zip.

Tags: ,

Deleted Photo Recovery from Digital Camera

Saturday, December 5th, 2009

 Here is the scenario:  Last year you bought a Canon 350D for your wife, she so happy with her new camera and take so many pictures during holiday with your family. Because you are so busy, you forget to transfer the pictures to laptop. A week later your brother borrows the camera and deletes all previous pictures. Your wife is so upset, so that you begin googling to figure out how to get back your old pictures.

 

There is many softwares claim can solve the problem, on that is CardRecovery. Cardrecovery can recover your photo with very easy steps. All you need to have is card reader for CF memory card and software it self.

 

First, plug in your memory card to your laptop and then follow the step.

 

After you launch CardRecovery, click “Next” to start the recovery. 

 

 cf

Step 1

 

1. Drive Letter: Select the drive which contains your memory card. If your card or camera cannot appear as a drive letter in “My Computer”, an external memory card reader is necessary. 

 

2. Camera Type: Select the camera type you use, it will help CardRecovery determine photo file formats it needs to detect in the following scan. If you’re not sure about the camera type, select “Generic Digital Camera”. 

 

3. Destination Folder: Specify the destination folder to save the recovered photos and files. CardRecovery will give you a default location. 

 

 

 

After you complete the three options in Step 1, click “Next” and CardRecovery will detect the memory card size, if it’s incorrect due to some reasons, please modify it to its proper size and it will help CardRecovery detect all the recoverable files from the storage. 

 

When you reach Step 2, CardRecovery will start a full scan on the memory card.

 

 

 

Step 2 

 

During the scan, it will prompt the scan progress and estimated completion time. In our testing, it scans a 1GB SD card in less than 4 minutes using USB 2.0 card reader. Depending on different card speed, card size, computer CPU and card reader speed, it may take less or more time to complete a scan. It you believe it has found your desired files, you may click “Stop” and the previewly found files can be recovered and saved. 

After the scan completes, you may click “Next” to reach step 3. 

 Step 3 

 

cf3

Step 3 will allow you to preview and select the needed photos before saving them. CardRecovery will show 6 thumbnail pictures one time. CardRecovery is a data recovery software and the internal viewer isn’t very powerful. The internal viewer can only preview JPEG/JPG files with size less than 10MB. 

 

After previewing the recovered photos, you may click “Next” to complete the recovery (full/registered version user) 

 

 

 

Complete

 

CardRecovery will save all the selected photos to the destination folder you specified in step 1. After the saving is completed, you may click “Open Recovered Files Folder” button to view and access them. Just several clicks, the whole recovery process is finished.

Tags:

PDA Palm Data Recovery (pdb file)

Saturday, December 5th, 2009

PDA is has been used wide world for years, many people use it for  his personal assistant in business and daily life, they save important information in their PDA, but PDA some time also has problem. Kernel for Palm PDB recovers corrupted .PDB (Database file for the Palm handheld organizer) database files corrupted due to expected palm shutdown, palm organizers synchronization break, HotSysncT failure and displays error messages such as Error opening PalmPilot database, Sync Manager Error – Connection Was Lost. During repairing process a complete scan of the all the damaged palm databases is performed to locate and extract the recoverable information. After the complete scanning the databases which are repairable can be previewed and later saved or copied in the used defined location. Kernel for Palm PDB Database Repair Software uses quick algorithm for searching and repairing corrupted database files and hence is a fast, simple and easy to use Palm Database Repair Software, which helps you to recover and repair your corrupt database files in minutes. Kernel for Palm PDB – corrupted database recovery software supported versions includes Palm OS 5, Palm OS Garnet, Palm OS Cobalt 6.1 databases. Kernel for Palm PDB has full support for both install and uninstall.

 

Step 1:

 

Open the Nucleus Kernel PDB recovery software.

 pdb

 

 

Step 2:

 

Select the corrupted file(s) from “Add Files” button and add into list.

 pdb2

 

 

Step 3:

 Press Next Button or click the “Repair Files” Button on the toolbar.

 

Step 4:

 

The file repairing will proceed and it will show you the details of the corrupted file(s).

 pdb3

 

 

Step 5:

 

Then you can see the preview of the repaired files by double clicking the file(s) in the list.

 pdb4

 

 

Step 6:

 

Then you can save the file(s) by clicking “Save Files” button from toolbar.

Tags:

How to recover powerpoint files .ppt, .pot, .pps

Saturday, December 5th, 2009

In the business world Powerpoint (.ppt, .pot, .pps) is one of the most important files, it will be a disaster if you lost your file right before your meeting or presentation. And maybe you will lose your job also. Nucleus Kernel PowerPoint is the most powerful software to recovers corrupted PowerPoint presentation files corrupted due to unexpected system shutdown, software crash, virus attacks. After complete scanning the corrupted or damaged PowerPoint presentation which are recoverable are shown in the preview window. During repairing process a complete scan of the damaged powerpoint file is performed to locate and extract the recoverable information. After the complete scanning the contents which are recoverable are recovered and saved in the user defined location. Kernel for PowerPoint Repair Software uses quick algorithm for searching and repairing the corruptions in the corrupted powerpoint files and hence is a fast, simple and easy to use PowerPoint repair software, which helps you to recover and repair your corrupt PowerPoint files in minutes. Software recovers every enhancement made in the presentation file (.ppt, .pot, .pps) like animation, sound effects, tables, images and rotations. Kernel for PowerPoint – corrupted presentation recovery software supported versions includes PowerPoint 2003, PowerPoint 2000, PowerPoint 97 files.

 

The key features includes : Recovery of deleted slides, restore images, animations, slide effects, objects, OLE, Live Preview of the recovered contents in advance, powerful integrated mode for faster recovery.

 

You can easily recover your powerpoint file (.ppt, .pot, .pps) by performing the following steps:

 

Step 1:

Open the Nucleus Kernel PowerPoint recovery software.

 

 ppt

 

Step 2:

Click the Browse… button to locate the PowerPoint presentation file from your computer system. The following screen will be displayed:

 

 ppt2

 

Select the corrupted presentation file and click Open.

 

 ppt3

 

Step 3:

Click the Recover button to proceed with the process.

 

The Kernel PowerPoint recovery will ask you for the location to save the file to be recovered.

 

Step 4:

 

 ppt4

Select the desired location and click OK.

 

Step 5:

Kernel PowerPoint displays the screen to select the mode of recovery of the corrupted presentations.

 

 ppt5

 

The Standard Mode is best suited for recovery of major corruptions. In some of the complex cases, the images or objects may be recovered raw, these images then have to be organized in the file again.

 

The Integrated Mode is fast and best suited for the less corrupted presentation files. This option maintains the formatting. If the mode does not gives better results then you should select the Standard Mode, which is an advance option.

 

Click OK.

 

The software will now start the process of recovery.

 

If you have selected the “Standard Mode” then click the link to view the recovery procedure of the mode: Standard Mode

If you have selected the “Integrated Mode” then click the link to view the recovery procedure of the mode: Integrated Mode

The Kernel PowerPoint Recovery has successfully recovered the presentation files.

 

 

 

Difference between Standard and Integrated Mode: The major difference lies in the process of recovering presentation files. The software in the Standard mode recovers data in the form of text, images and objects and saves in three different folders whereas in Integrated mode, the pictures are saved in different folder and the text and objects are saved in a presentataion file.

 

 

Important: The Demo version of the Nucleus Kernel PowerPoint Recovery software enables you to view the recovered data but does not saves it whereas Full version of the software saves the recovered data.

Tags:

How to recover Microsoft Word and Excel Corrupt Files

Saturday, December 5th, 2009

If you have a corrupted or damage Microsoft Word and Excel Documents, Nucleus Kernel Word is a software you should looking for to make your file life again. Nucleus Kernel Word is a advance easy to use word document repair software for corrupt .doc files. Software uses QFSCI technology to repair corrupt or lost word document files. It is one of the most widely used word file repair in the world today.  The software repairs the damaged word document files which gets corrupted due to the bad sector in the disk, unexpected system shutdown, software crash, virus corruption, media corruption, error opening file. Software Key Feature includes – Recovers text from corrupt word documents created on Windows or Macintosh, Restores document formatting, Recover pictures. The software performs complete scan of corrupt .doc file and try to recognize corrupt or lost data. Software recovers data from .doc files on from all versions of MS Word including Word 97, Word 2000, Word Xp, Word 2003.

 

You can recover your corrupt files by very easy step by step as follow:

 

Step 1:

 

Open the Excel word recovery application

 

 nucleus word1

  

 Step 2:

 

Select the files (damaged files) from “Add Files” button and add into list

 

 nucleus word2

 

Step 3:

Select “Repair Mode”

 

Step 4:

Press Next Button

 

Step 5:

the file repairing will proceed and it will show the detail of repaired files.

 nucleus word3

 

 Step 6:

 Now you can see the preview of the repaired files by double click the files in list.

 Untitled-1

 

 Step 7:

 

Now you can see save files by clicking “Save Files” button

 

 nucleus word4

 

BTW, If you have problem recovering your file, you can send me the file for diagnotic. it free of charge.. just sign up for my feed.

 Good luck !!!

Tags: