CHK Files

[pclab]

Hi

I'm working on a Toshiba 2,5" that needed to swap heads.
Heads were swapped, could read all from heads 0,1 and 3 and head 2 struggled a lot to read.
But my problem is that a folder called FOUND.000 have many CHK files inside as you can see in the picture.
From this 2 things troubles me:
1º why do I have these CHK files with this date (09-12-2016), if I started imaging some days before the date of the files?
2º I made a disk to disk image. This shouldn't let the drive write files on patient, right? So why are they there??

[LarrySabo]

Hi Nuno,

Were they created Sept. 12th or December 9th? What date format displays for files not in the Found folder?

[lcoughey]

You are correct @LarrySabo, it is Day-Month-Year, making it Sept 12, rather than Dec 9th.

[pclab]

Hi Guys

I don't think so, that is 9th December, but I will check the other folders.

[pclab]

Here are another 2 PS...
On these you can see the date is day-month-year. So the other folder also should be the same, right?

[Garry_TS]

Hi, pclab

Folder called FOUND.000 are created after running CHKDSK. Each *.chk file contains recovered lost cluster chains which might get lost when file operations are interrupted abnormally.
For example, in the case of an USB flash drive, that might happen when you physically unplug the device before "Safely Removing Hardware" (actually, before the OS has finished writing cached data to the medium).

A single .CHK file may contain

• a single entire file (or multiple entire files),
• a part (or multiple parts) of a file (or multiple files) or
• a really messy mix of the above.

So if customer didn't say that something important is missed you can forgot about *.chk files.
If some files are missed you can try to build a map of all *.chk files and run RAW recovery or GREP at this map.

As for dates, PC-3000 Data Extractor uses Day-Month-Year format. So 09-12-2016 is December 9th.
By default Data Extractor is definetely not writing any information on the destination drive and of course not running CHKDSK itself

[pclab]

Actually, there are some missing photos.
I might try a RAW on that folder (is it possible??)

As the data, it's not possible to be on th 9th. The drive was imaging during that day. So, how can it make "changes" to the date?
Thanks

[LarrySabo]

Perhaps the customer's clock was set incorrectly, and used that date when it created the files.

[Amarbir[CDR-Labs]]

Source of the post Actually, there are some missing photos.
I might try a RAW on that folder (is it possible??)

As the data, it's not possible to be on th 9th. The drive was imaging during that day. So, how can it make "changes" to the date?
Thanks

Hello ,
Rename All .chk File As JPG and see if you find something

[Garry_TS]

Source of the post Perhaps the customer's clock was set incorrectly, and used that date when it created the files.

Larry is right, there could be simply wrong date at customer's clock

Source of the post
Rename All .chk File As JPG and see if you find something

What is the sense of renaming files to JPG, dear Amarbir ?

Source of the post
I might try a RAW on that folder (is it possible??)

Sure.

[pclab]

Thanks Guys!

[300ddr]

This may be helpful also: https://www.raymond.cc/blog/how-to-reco ... -scandisk/

[pclab]

Thanks 300ddr.
I have done what Pavel suggested and went great.
Got about 4.000 Jpegs extra.

[Amarbir[CDR-Labs]]

Hello Pavel ,
In This Case He Got His JPG's with RAW Scanning ,You Read Your Own Statement -> viewtopic.php?p=32158#p32158 .Sometimes Chkdsk can mark a entire file as a .chk file ,Hence as he was after JPG's renaming them to .JPG might reveal some actual jpg's converted to .chk by chkdisk .Its always wise to examine .chk files in hex to see headers something .chk file actually has what the client is after