Recovering word files from a USB drive

[tallmantim]

Hello all

I have tried undelete tools (various) to recover files from a USB drive - to no avail.

I would like to use a Hex Editor (HxD or FlexHex) to scan the entire drive contents - I know some of the key phrases from within the word (docx) documents, however the internals of those files are not in plain text. I am unsure what format they are in - does anyone know how I could do a search for a text string in ANSI/ASCII for whatever format Word writes its docx format in for the constituent text?

Many thanks.

Tim

 

[tallmantim]

Just in case anyone comes across this looking for the same sort of answer:

Microsoft's docx format stores the content in a bunch of xml files encapsulated within a zip file. You can rename a docx file to .zip and open it with an archive tool. You can use zip repair tools to recover information too if a docx file won't open in Word.

There is also a tool for doing this automatically to recover text:

http://sourceforge.net/projects/damageddocx2txt/

this gives you the text component of a docx file. You could also copy out a segment of a disk page from using a hex editor etc and copying the file out to use with the tool.

In this case, it looks like it was a virus/worm/etc that deleted and scrubbed the data on the USB drive. I found 11 docx files that were completely zeroed out which is the approximate number that were under the folder that was lost.

Unfortunately, the virus hit just her PhD folder - a couple of months work that she did not have backed up anywhere else! Told her the sad news that it is completely unrecoverable.

 

[Dark Lord of Tech]

http://www.piriform.com/recuva

Recuva