Database recovery tool

[void]

db2efu is an Everything database recovery tool.

Download db2efu-1.0.0.2.zip

db2efu converts your Everything.db file to an Everything file list.
This is a CSV file and can be opened with Excel, Notepad or Everything.

Please make a backup of your Everything.db before running Everything.

The current supported database versions are:

• 1.6.6 (Everything-1.2.1.371)
• 1.6.7 (Everything 1.2.1.451a)
• 1.7.5
• 1.7.8 (Everything 1.3.4.686)
• 1.7.17 (Everything 1.4.0.704b)
• 1.7.20 (current)

Please request your database version here (or support@voidtools.com) if it is not supported yet.
Run db2efu.exe to determine the database version.

Usage:
Run db2efu.exe without parameters and it will request an Everything.db and an output Everything File List.

-or-

Run with parameters:

Code: Select all

db2efu.exe <Everything.db> <out.efu>

[MM_MM]

Would there be a reverse function where a database file could be created from an efu file. I ask because I could not find a method to automatically load extended information to the database via command line.

I use it on a network drive with over a million files which results in an .efu file well over 200mb, I would think that once converted to a .db it would much smaller.

Is there a better way in accomplishing a db file with extended information already loaded via cmd line?

[void]

Would there be a reverse function where a database file could be created from an efu file

To convert an efu to a db:

• In Everything, Include the efu file list in the index from Tools -> Options -> File Lists.
• Make sure there are no other NTFS or folder indexes or any excludes.
• Exit Everything
• Copy %APPDATA%\Everything\everything.db
• Open the db from the command line:

  Code: Select all

  Everything.exe -db <c:\pathto\Everything.db> -read-only

[sugoro]

I tried converting a DB and got this error:

Code: Select all

PS Z:\db2efu> .\db2efu.exe Z:\Everything.db .\out.efu
Z:\Everything.db opened for reading...
.\out.efu created for writing...
Magic ESDb
Version 1.7.8
Unknown DB version 01070008

The db's first eight bytes are

Code: Select all

45 53 44 62 08 00 07 01

I'm on Everything version 1.3.4.686 (x64).

Is something wrong on my side or the tool just doesn't support this DB version yet?
What's the latest Everything version I could use that would allow me to convert databases?

Thanks!

[ix101]

+1 on this .. is it possible to get an updated db2esu for version 1.7.8?

Thanks!

[void]

Updated to support Everything db 1.7.8

http://www.voidtools.com/db2efu.zip

Sorry sugoro, I must have missed your post.

[ix101]

Thanks!

[sugoro]

Updated to support Everything db 1.7.8

http://www.voidtools.com/db2efu.zip

Sorry sugoro, I must have missed your post.

I missed your post too, so we're good!


Thanks for the help, it is working now.

[myNameIsJonny!]

is it at all possible to merge db's?

[void]

Updated to support 1.7.20 (Everything 1.4.0.713b)

http://www.voidtools.com/db2efu.zip

[a1ph0r]

Requesting support for the following version please, thanks.

Code: Select all

db2efu <everything.db> <out.efu>
Everything_2009.db opened for reading...
Everything_2009.efu created for writing...
Magic BZh9
Unknown DB type 39685a42

[void]

Your database is compressed.

Please rename your Everything_2009.db to Everything_2009.db.bz2

Extract Everything_2009.db.bz2 to Everything_2009.db with your favourite unzip software (eg: 7zip).

Try the db2efu tool on the extracted Everything_2009.db.

[a1ph0r]

Renamed, extracted, getting this output now:

Code: Select all

Everything_2009.db opened for reading...
Everything_2009.efu created for writing...
Magic EZDB
Unknown DB type 42445a45

[therube]

Confirmed.
I happened to have a .db from 2009 too, BZh9, & I get the same results.

Code: Select all

C:\>db2efu Everything_home.db out_home.efu

Everything_home.db opened for reading...
out_home.efu created for writing...
Magic BZh9
Unknown DB type 39685a42

Code: Select all

C:\TMP\SEA\everythingDB>777 x *.bz

7-Zip [32] 16.00 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-10

Scanning the drive for archives:
1 file, 3731428 bytes (3644 KiB)

Extracting archive: Everything_home.db.bz
--
Path = Everything_home.db.bz
Type = bzip2

Everything is Ok

Size:       11084225
Compressed: 3731428

Code: Select all

C:\>db2efu Everything_home.db out_home.efu

Everything_home.db opened for reading...
out_home.efu created for writing...
Magic EZDB
Unknown DB type 42445a45

Code: Select all

b66368691c45fd18cfd29e2b7e5019df *db2efu.exe   06/16/2016

I can successfully extract an "ESDb" from 2014.

[void]

Added support for EZDb 1.6.6 (Everything-1.2.1.371)

http://www.voidtools.com/db2efu.zip

The Everything.db used in Everything-1.2.1.371 is always compressed.
Please rename your Everything.db to Everything.db.bz2 and extract the Everything.db with your favorite unzip program.

[a1ph0r]

Many thanks, able to recover those older versions now .

[disco]

I've also had a hard drive die and am attempting to recover the file list with this method.

Unfortunately I seem to have a version 1.6.7 database (from Everything-1.2.1.451a.exe) which isn't supported.

I'd be hugely grateful if you could add support for this, or point me in the direction of upgrading the DB.

Code: Select all

R:\RApps\Everything>db2efu.exe 7pro.db 7pro.efu
7pro.db opened for reading...
7pro.efu created for writing...
Magic EZDB
Version 1.6.7
Unknown DB version 01060007

Thanks!

[void]

Added support for the 1.6.7 database (Everything 1.2.1.451a)
Added support for bz2 compressed databases.

[disco]

Awesome, thank you very much! That works like a charm.

Donation is in the post

[void]

Thanks for your support.

[void]

Added support for the 1.7.17 database (Everything 1.4.0.704b)

[The Coolest]

This tool is a great addition to Everything, thank you.
I just lost my main SSD with 2 partitions 10 days ago. Only had a full backup of C:, now I can see what files I'm missing from the other partition on the dead drive.

[zeus04]

I get the error

Code: Select all

Invalid folder code offset 129 > 53.

Any ideas?

[therube]

And some information on your circumstances?

[zeus04]

What kind of information do you need?
Version 1.4.1.978 (x64)
OS: Windows 10

[NotNull]

The version of the database is important (take a look at the first message to understand why).

You can also try to open your database in read-only mode with a (CMD) command like this:

Code: Select all

"C:\path to\Everything.exe" -instance READONLY -readonly -db "c:\some path\Everything.db" -config nul\dummy.ini

That will start a separate Everything - can run next to your regular Everything - that opens "c:\some path\Everything.db" in read-only mode.
No extra files will be created on the system and the database will not be changed.

When the database opens, you can export the results with Menu:File > Export.

[zeus04]

Version of the db is 1.7.20

here is the full output:

Code: Select all

$ .\db2efu.exe .\Everything.db .\Everything.efu
db2csv <everything.db> <out.efu>
H:\Everything.db opened for reading...
H:\Everything.efu created for writing...
Magic ESDb
Version 1.7.20
flags 00007f3f
hidden files and folders exluded
system files and folders exluded
number of folders: 753629
number of files: 4004895
filesystem count: 17
filesystem 0: type 0
filesystem 0: out of date 0
filesystem 0: NTFS: guid: \\?\Volume{abca642c-b362-45ae-aacc-a3d103961f96}
filesystem 0: NTFS: path: C:
filesystem 0: NTFS: root:
filesystem 0: NTFS: include only:
filesystem 0: NTFS: USN Journal ID: 01d53d4d63cf8a71
filesystem 0: NTFS: Next USN: 000000035764a9e0
filesystem 1: type 0
filesystem 1: out of date 0
filesystem 1: NTFS: guid: \\?\Volume{626cb1dd-f9d9-11e7-b461-5cf37002ebf4}
filesystem 1: NTFS: path: D:
filesystem 1: NTFS: root:
filesystem 1: NTFS: include only:
filesystem 1: NTFS: USN Journal ID: 01d5343493f439f9
filesystem 1: NTFS: Next USN: 00000000000d92f8
filesystem 2: type 0
filesystem 2: out of date 0
filesystem 2: NTFS: guid: \\?\Volume{f6096492-e00f-11e7-b452-7824af326cc5}
filesystem 2: NTFS: path: E:
filesystem 2: NTFS: root:
filesystem 2: NTFS: include only:
filesystem 2: NTFS: USN Journal ID: 01d5325e8ff5f7e3
filesystem 2: NTFS: Next USN: 00000000028cbab0
filesystem 3: type 0
filesystem 3: out of date 0
filesystem 3: NTFS: guid: \\?\Volume{666b134c-e1f4-11e7-b453-7824af326cc5}
filesystem 3: NTFS: path: F:
filesystem 3: NTFS: root:
filesystem 3: NTFS: include only:
filesystem 3: NTFS: USN Journal ID: 01d5321ea9bccdfa
filesystem 3: NTFS: Next USN: 00000000015dfd98
filesystem 4: type 0
filesystem 4: out of date 0
filesystem 4: NTFS: guid: \\?\Volume{46a4f1b7-ffc9-11e7-b462-5cf37002ebf4}
filesystem 4: NTFS: path: G:
filesystem 4: NTFS: root:
filesystem 4: NTFS: include only:
filesystem 4: NTFS: USN Journal ID: 01d5343494afa7e0
filesystem 4: NTFS: Next USN: 00000000000c8688
filesystem 5: type 0
filesystem 5: out of date 0
filesystem 5: NTFS: guid: \\?\Volume{b648d739-0000-0000-0000-100000000000}
filesystem 5: NTFS: path: H:
filesystem 5: NTFS: root:
filesystem 5: NTFS: include only:
filesystem 5: NTFS: USN Journal ID: 01d5325e908a791b
filesystem 5: NTFS: Next USN: 00000000058eb848
filesystem 6: type 0
filesystem 6: out of date 0
filesystem 6: NTFS: guid: \\?\Volume{f60964c0-e00f-11e7-b452-7824af326cc5}
filesystem 6: NTFS: path: I:
filesystem 6: NTFS: root:
filesystem 6: NTFS: include only:
filesystem 6: NTFS: USN Journal ID: 01d532212ef98945
filesystem 6: NTFS: Next USN: 00000000009a3950
filesystem 7: type 0
filesystem 7: out of date 0
filesystem 7: NTFS: guid: \\?\Volume{626ca661-f9d9-11e7-b461-5cf37002ebf4}
filesystem 7: NTFS: path: J:
filesystem 7: NTFS: root:
filesystem 7: NTFS: include only:
filesystem 7: NTFS: USN Journal ID: 01d5325e90b33749
filesystem 7: NTFS: Next USN: 0000000002bd0fb8
filesystem 8: type 0
filesystem 8: out of date 0
filesystem 8: NTFS: guid: \\?\Volume{2f9a54b2-e04f-11e7-b452-7824af326cc5}
filesystem 8: NTFS: path: K:
filesystem 8: NTFS: root:
filesystem 8: NTFS: include only:
filesystem 8: NTFS: USN Journal ID: 01d534348d453024
filesystem 8: NTFS: Next USN: 0000000000044f00
filesystem 9: type 0
filesystem 9: out of date 0
filesystem 9: NTFS: guid: \\?\Volume{626ca598-f9d9-11e7-b461-5cf37002ebf4}
filesystem 9: NTFS: path: L:
filesystem 9: NTFS: root:
filesystem 9: NTFS: include only:
filesystem 9: NTFS: USN Journal ID: 01d53434844ce187
filesystem 9: NTFS: Next USN: 000000000003d420
filesystem 10: type 0
filesystem 10: out of date 0
filesystem 10: NTFS: guid: \\?\Volume{b40e883a-e01d-11e7-b452-7824af326cc5}
filesystem 10: NTFS: path: M:
filesystem 10: NTFS: root:
filesystem 10: NTFS: include only:
filesystem 10: NTFS: USN Journal ID: 01d5343489a5907b
filesystem 10: NTFS: Next USN: 00000000000407c0
filesystem 11: type 0
filesystem 11: out of date 0
filesystem 11: NTFS: guid: \\?\Volume{701507fa-a5dc-11e9-b45c-7824af326cc5}
filesystem 11: NTFS: path: N:
filesystem 11: NTFS: root:
filesystem 11: NTFS: include only:
filesystem 11: NTFS: USN Journal ID: 01d53c0421867e66
filesystem 11: NTFS: Next USN: 0000000012032ef0
filesystem 12: type 0
filesystem 12: out of date 0
filesystem 12: NTFS: guid: \\?\Volume{626ca53a-f9d9-11e7-b461-5cf37002ebf4}
filesystem 12: NTFS: path: O:
filesystem 12: NTFS: root:
filesystem 12: NTFS: include only:
filesystem 12: NTFS: USN Journal ID: 01d53265fc94e398
filesystem 12: NTFS: Next USN: 00000000000c5e28
filesystem 13: type 0
filesystem 13: out of date 0
filesystem 13: NTFS: guid: \\?\Volume{626ca723-f9d9-11e7-b461-5cf37002ebf4}
filesystem 13: NTFS: path: U:
filesystem 13: NTFS: root:
filesystem 13: NTFS: include only:
filesystem 13: NTFS: USN Journal ID: 01d5ca63f71ef436
filesystem 13: NTFS: Next USN: 00000000000155b0
filesystem 14: type 0
filesystem 14: out of date 0
filesystem 14: NTFS: guid: \\?\Volume{46a50faa-ffc9-11e7-b462-5cf37002ebf4}
filesystem 14: NTFS: path: Y:
filesystem 14: NTFS: root:
filesystem 14: NTFS: include only:
filesystem 14: NTFS: USN Journal ID: 01d53434889afa3d
filesystem 14: NTFS: Next USN: 0000000000096630
filesystem 15: type 0
filesystem 15: out of date 0
filesystem 15: NTFS: guid: \\?\Volume{6bc859d2-a98b-11e9-9ae3-7824af326cc5}
filesystem 15: NTFS: path: Z:
filesystem 15: NTFS: root:
filesystem 15: NTFS: include only:
filesystem 15: NTFS: USN Journal ID: 01d5321e5b95c26e
filesystem 15: NTFS: Next USN: 0000000055b778d0
filesystem 16: type 1
filesystem 16: out of date 0
Exclude flags 00
Loading Hierarchy...
Loading folders...
Invalid folder code offset 129 > 53.

[void]

Invalid folder code offset 129 > 53.

The DB looks corrupt.

Please try db2efu-1.0.0.2.zip.

This version will recover as much data as possible.
Unfortunately, in your case, this might only be a few folders.

I can attempt to recover more data for you if you send me your zipped Everything.db

[sugoro]

Is there a version that works with the alpha's dbs?
I have a db that was created with 1.5.0.1256 and one from the latest alpha (1.5.0.1275) that I wanted to convert.
I currently used the actual Everything.exe to convert, but that means I have to keep several versions around. Having just a single db2efu.exe instead would be a lot simpler.

This is from 1.5.0.1256
Magic ESDb
Version 1.7.38
Unknown DB version 01070026

And this one from the latest 1.5.0.127
Magic ESDb
Version 1.7.39
Unknown DB version 01070027


First eight bytes of the dbs
1.5.0.1256: 45 53 44 62 26 00 07 01
1.5.0.1275: 45 53 44 62 27 00 07 01


Thanks!




Edit: just found the thread about this: viewtopic.php?f=5&t=10216
I'll keep this post up so the world can know I did not search properly before asking the question.

[void]

The database format will change too much during alpha.

I will add support for the Everything 1.5 database once it is in beta.

[zaadstra]

I've got an Everything.db database from a crashed system en tried to convert it to a .efu file.
The DB is from Version 1.4.1.1024 (x64) and the system was shut down properly (most likely).

Part of the log:
Everything>db2efu.exe Everything.db OUT.EFU
Everything.db opened for reading...
OUT.EFU created for writing...
Magic ESDb
Version 1.7.20
flags 00002525
system files and folders exluded
number of folders: 2792979
number of files: 7231624
....
Exclude flags 00
Loading Hierarchy...
Loading folders...
Invalid folder code offset 82 > 0.
Conversion complete!
Error: database corrupt

Is the db2efu.exe tool still uptodate for current database, or is it outdated?

[NotNull]

db2efu is still up to date for Everything 1.4.1.1024: it supports your database version 1.7.20.

It seems like your Everything database is corrupt ("Error: database corrupt").

Is OUT.efu stll readable in a text editor like Notepad?
Alternatively, do you have a recent backup of Everything.db?

[zaadstra]

OUT.EFU only gives a header line:

Filename,Size,Date Created,Date Modified,Date Accessed,Attributes

No backup, DB is rebuilt in a flash so no need (so I thought). The system is new now and I thought of looking up how some files and folders were organized.
Not super important but as the everything.ini has the same timestamp (I just copied settings from it) I really think of a clean shutdown. So a bit surprised of the corruption. I copied files from the userprofile after the crash with a WinPE rescue system.

[NotNull]

Typically, Everything will first write the database to an Everything.db.tmp file (in the same folder), before saving the .db file.
If Everything.db.tmp is still around, you could see if renaming this to - for example - crash.db and opening it in db2efu gives you more information.

Another alternative: copy Everything.exe and the corrupted Everything.db to a separate fodler and run this command in that folder:

Code: Select all

Everything.exe -instance CRASH -readonly -db Everything.db

(close with menu:File > Exit)

Succes ermee!

[zaadstra]

This works!

Interesting, it gives me a .EFU that is approx. 4.5 times the size of the .db file.
And, there are entries that came from a loaded .efu file (I load two or three automatically) - entries from NAS shares.
The date stamps stop at 27/7 (crash day) so this seems correct.
Well, this is sufficient for some analysis

Enne, hartelijk dank!

P.S. this Everything.db.tmp file was not present