Hi.
Recently, I lost an RTF file (pressed save button, it finished saving, then I got a BSOD). Turned my PC back on and used it normally. An hour later, I opened the file to go back to work and found the surprise 80% of its contents were deleted. (Opened it in Notepad, and the rest are either numbers from picture data, or blank spaces, hex editor gave no results.)
It happens that was the only file on my computer to contain the keyword: "detergent" (among others which also satisfy this paragraph). When I open the Start Menu and type "detergent", I get the file listed, even when the word isn't currently inside. That told me my file (or at least some of its words, which reading would help me reconstruct my document) was stored somewhere else.
Testing to see if the corrupted file still contains the word, I moved it to a different location and performed a search. The keyword wasn't found inside the file. With this I noticed that basically, Windows Search has the file contents stored and associated with the file directory, and it does not go inside the file and read it every time you perform a search.
So I went and extracted the Windows.edb file (Windows Search database) with a tool called "libesedb". The keyword was nowhere to be found inside.
So I concluded the contents are stored inside the CI files located in "ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles"
CI = Content Index/Index Contents.
The problem is that the files are unreadable, just like Windows.edb if you try to open it with Notepad. According to the maker of "libesedb", he created some kind of algorithm to "de-obfuscate" the data inside the "Search_AutoSummary" column of the Windows.edb file.
So my question/issue is, does anyone know a method or way to open or de-obfuscate the data inside the CI files? I barely know any programming.
The OS is Windows 7 x64.
Thanks for your time.
Recently, I lost an RTF file (pressed save button, it finished saving, then I got a BSOD). Turned my PC back on and used it normally. An hour later, I opened the file to go back to work and found the surprise 80% of its contents were deleted. (Opened it in Notepad, and the rest are either numbers from picture data, or blank spaces, hex editor gave no results.)
It happens that was the only file on my computer to contain the keyword: "detergent" (among others which also satisfy this paragraph). When I open the Start Menu and type "detergent", I get the file listed, even when the word isn't currently inside. That told me my file (or at least some of its words, which reading would help me reconstruct my document) was stored somewhere else.
Testing to see if the corrupted file still contains the word, I moved it to a different location and performed a search. The keyword wasn't found inside the file. With this I noticed that basically, Windows Search has the file contents stored and associated with the file directory, and it does not go inside the file and read it every time you perform a search.
So I went and extracted the Windows.edb file (Windows Search database) with a tool called "libesedb". The keyword was nowhere to be found inside.
So I concluded the contents are stored inside the CI files located in "ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles"
CI = Content Index/Index Contents.
The problem is that the files are unreadable, just like Windows.edb if you try to open it with Notepad. According to the maker of "libesedb", he created some kind of algorithm to "de-obfuscate" the data inside the "Search_AutoSummary" column of the Windows.edb file.
So my question/issue is, does anyone know a method or way to open or de-obfuscate the data inside the CI files? I barely know any programming.
The OS is Windows 7 x64.
Thanks for your time.