Data Recovery from corrupt 7-Zip (7z) archive, a lucky break ..

By | May 18, 2021

I was looking through a 7-Zip file in an attempt to repair it using HxD. The archive was created by ZArchiver, an Android backup app. Once the backup was created the phone was reset.

Repairing a corrupt 7z file.

The maker of 7-Zip has some hints on repairing a corrupt .7z file. Header of the file looked okay, but it did not have an ‘end header’ so file may have never been properly finalized or was truncated for whatever reason. As this wasn’t a paid job I didn’t want to spend too much time on it, and I was just about to give up when I noticed a familiar structure!

A non compressed JPEG header! I did one more search for FF D8 FF, and yes, another one! It couldn’t be the files were uncompressed?

Forget repair, let’s see if we can recover JPEGs!

Worth a try! I decided to scan the file using JpegDigger. As you can see the ‘signature’ is not sector aligned, as it is normally on drives. So in advanced options I ticked the ‘non sector aligned’ option. A few minutes later JpegDigger had recovered 200+ JPEG files from the archive, some of which I must add, were slightly corrupt.

Confused..

I have no idea what happened here. I had already downloaded 7-Zip to try on the corrupt 7z file so I decided to create an archive myself using 30 JPEGs. This time the file consisted of a continuous stream of compressed data. No chance to recover any individual JPEGs at all! It appears I was just lucky being able to recover the JPEGs from the 7z file created by the Android backup app. Or maybe the backup app simply stores it’s output file as an uncompressed archive.

 

Leave a Reply

Your email address will not be published. Required fields are marked *