Windows 10: Using a hex editor to find remnants of an oferwritten file?

I had windows crash recently and a .rtf file that I was working on and which was saved on my HDD got mangled. All the contents of it were replaced with empty spaces (like what you get when you press tab). I'm desperate to recover the file and someone suggested I might use a hex editor to look for the contents of the file on the drive.

I've never used a hex editor and don't even really know what one is exactly, so I'm wondering:
1) is this something that could work
2) how do I do this?

 

Hex editor recommendation?


Has anyone here, using any hex editor, successfully made a text replacement longer than the original and not had it rejected as 'corrupt or invalid by the original application please?

I've made several attempts with various editors over many hours today and failed. So I'm hoping to find a mutually accessible app to step through the procedure (inserting extra bytes, etc, etc).

As per my opening post, the app I'm focusing on is called MX Pro and an example binary MEX file is viewable and downloadable here:
https://dl.dropboxusercontent.com/u/...20%28ph%29.mex

For my test, I'm simply trying to change the string PHOTOS to PHOTOS2.

--
Terry, East Grinstead, UK

 

Hex editor recommendation?

Oh - the joys of binaary/assembler coding .

It would be a very clever hex editor that can make a text string longer than original, as it would mean all subsequent binary code has moved out n bytes (n being additional length of text editor).

It would depend if the binary code was using relative or absolute addresses.

Think of it like having a formula in Excel where cell B1 point to A1 e.g. B1: =A1.
If you moved cell B1 to C1, it would now read C1:=B1

On other hand if B1 read B1:=$A$1
then if you move B1 to C1, C1 would read C1:=$A$1

How many time have you moved stuff in excel and it fell over because you used a relative reference rather than absolute (or an absolutee reference rather than a relative one).

So a binary program would almost certainly fall over if it had absolute addresses built into the binary code, and all code after the text portion was moved out n bytes.

So the hex editor would have to have the additional ability to reconcile all absolute addresses if the code position moved which would be a major undertaking i.e. the editor would be a binary re-compiler as well.

This will not happen if the text is shortened, as the editor will simply fill the excess space with blanks, keeping the position of the rest of the code unaltered.

 

Hex editor recommendation?


I emailed the developers of MX Pro and had a prompt and thorough reply. As I expected, they are unable to provide detailed table structure documentation for their MEX files. And there are other complications (packing) which would make it impossible in practice. It seems that similar issues arise in mots proprietary binary files.

So I'll drop my pursuit of a no-brainer global hex edit. Thanks for hex editor recommendations, most of which are now installed.

--
Terry, East Grinstead, UK