[SOLVED] RAR Damaged after Recovery

[Leyte82]

I recovered a RAR file from a USB stick using Recuva recovery software. The file is recovered with its original name and the .rar extension,
but it's not recognized when I try to open it. I get the errors: "The archive is either in unknown format or damaged" and "No archives found"

The file is the original size. I did not use the USB after deleting the file. So nothing was written to the USB. Recuva (the recovery software)
says the file is in excellent condition and no overwritten clusters are detected. It looks like the file is the original but nothing will open it.

The file is encrypted with a password, so I don't know if that has any issue with the recovery.

Everything looks normal with the file.. but I can't open it with WinRAR or 7 Zip. Also, the rar repair tools don't recognize it.

Any help would be appreciated.

 

[fzabkar]

Examine the file with a hex editor (eg HxD freeware). Does it have a "Rar!" header?

Compare your recovered file against a working, password protected RAR file.

 

[Leyte82]

Ok. There is no Rar! at the beginning of the file.

I created a encrypted rar file with a password to compare. The file I created has a Rar! at the beginning.. my recovered file does not.

Is it possible to add a header to the recovered file? Not sure what needs to be added..

 

[fzabkar]

Your file appears to have been overwritten.

Your best approach would be to clone the drive to preserve its current state, then run other data recovery tools against the clone. You can clone the drive to an image file rather than another physical drive.

The free version of DMDE, or R-Undelete, are two other free options.

 

[Leyte82]

Ok. I'll do that.. and try some other programs. Thanks for the help in showing me that the header was missing.

 

[fzabkar]

DMDE has a raw search option. You can limit the search to RAR files. It's a very powerful tool, but its GUI is not the most user friendly.

 

[Leyte82]

Ok.. I will give it a try.

 

[doolittle]

it sounds like the file is corrupted from the usb errors and cannot be recovered, if the other utilities do not work the only way to recover them would be to have created parity files like Parchive (par / par2), and save the parity files along with the compressed archive - if enough parity files are available you can recover the original file as it was created if it gets corrupted

info:
https://www.newsgroupreviews.com/par-files.html

utility for windows:

QuickPar for Windows

QuickPar is a PAR 2.0 recovery volume creation tool. Use it to protect and repair any data file.

www.quickpar.org.uk