Windows woes

[God-damnit-all]

I stumbled upon this project looking for something that could possibly recover overwritten files on Windows. I thought this was it, since it was written in a cross-platform language, but no such luck.

Is there any tool out there that can do what RecoverPy does, but for Windows? There are plenty of tools that can recover deleted files, but I've yet to encounter one that can recover overwritten ones. Is it just a limitation of the NTFS file system?

[PabloLec]

Hi, it's not related to NTFS, you totally can use RecoverPy to search a NTFS partition.
It has more to do with what's used by RecoverPy which are UNIX only tools. Especially grep that allow powerful searching directly inside partition blocks. That would be a gigantic pain to reimplement in Python.

To use RecoverPy on a Windows system you might try WSL, or maybe natively using cygwyn. No idea how it would behave, especially regarding unmounted partitions, but it's worth giving it a try running as admin.

If you really need to use it, you should probably create a Ubuntu (or just any distro) live USB. Quick and easy, plus all partitions would be unmounted.

[God-damnit-all]

Hi, it's not related to NTFS, you totally can use RecoverPy to search a NTFS partition. It has more to do with what's used by RecoverPy which are UNIX only tools. Especially grep that allow powerful searching directly inside partition blocks. That would be a gigantic pain to reimplement in Python.

ripgrep is able to do that too, isn't it? That's available on Windows.

To use RecoverPy on a Windows system you might try WSL, or maybe natively using cygwyn. No idea how it would behave, especially regarding unmounted partitions, but it's worth giving it a try running as admin.

The last time I tried to use file recovery tools for a NTFS disk on Linux, it ended up corrupting my Windows partition, and I have no idea how or why. It definitely spooked me concerning using such low-level disk tools that weren't meant for Windows systems.

[PabloLec]

From what I understand ripgrep can only search mounted partition, and use the file system hierarchy.
With grep you can read a partition as a "file", disregard its file system hierarchy, read its blocks content directly whether binary or not and finally get a byte offset of a result which is critical to recover neighboring blocks.

So I don't think it might be a viable option.
But I'll definitely give another look to Windows solutions for the future v2. It might be possible to use cygwin and possibly WSL with some tweaks.

RecoverPy won't do any write operation, so leaving your partition unmounted there shouldn't be any risk of data corruption... In theory

[God-damnit-all]

From what I understand ripgrep can only search mounted partition, and use the file system hierarchy. With grep you can read a partition as a "file", disregard its file system hierarchy, read its blocks content directly whether binary or not and finally get a byte offset of a result which is critical to recover neighboring blocks.

So I don't think it might be a viable option. But I'll definitely give another look to Windows solutions for the future v2. It might be possible to use cygwin and possibly WSL with some tweaks.

RecoverPy won't do any write operation, so leaving your partition unmounted there shouldn't be any risk of data corruption... In theory

Honestly, I thought ripgrep had a feature that allowed it to read partitions in the same way, but it seems you're right - I must've misunderstood something I read at one point.

It might be possible with some serious PowerShell 7 wizardry, but that would require a pretty major rework, probably comparable to what you'd have to do to implement the same functionality in Python.