Fragments Directory?

[dr_glenn]

I just used ZAR 9.1 to recover contents of SDHC 8 Gig card that is used in Android phone. The card had about 4 Gig used. During analysis it marked MANY sectors as data fragments. When recovery was complete, I attempted to copy all files to a new card. Unfortunately I filled up the card! Why? Because ZAR created a directory named "Fragments" that was about 40 Gig in size!

I suppose the Fragments directory is bigger than the actual drive (hey, I've got a TARDIS drive!) because of minimum file size allocation on my hard drive, but still I don't really understand what happened here.

I then copied everything except Fragments to a new SD card and my phone seems just fine.

Can someone please explain what happens with these Fragments files?

[Alexey V. Gubin]

Think of it as "noise". Sometimes, there are objects on the disk of which we are not quite sure whether these are garbage or corrupt filesystem structures. As long as these objects can be repaired to represent a reasonably valid filesystem object, they are repaired and used in analysis. Quite often it results in "phantom" files. Also, if there are older versions of files, partly overwritten with new files, these will be recovered as well. If there were multiple versions, it is not unusual to end up with ten times more recovered data than there was originally.