Jul 19, 2019
A hexadecimal editor is the way to go if you have a corrupt Microsoft Access file and need to check the severity of the damage and the chances of recovering the data.
In this article, I will explain how to identify some types of major damage in Microsoft Access files. The goal is to detect anomalies in the binary content of the file.
To illustrate the explanation, I will use some files from the "How I repaired 28 corrupt databases" project.
When I need to repair a corrupt Access file, the first thing I do is to check if it is internally complete. A file that looks normal as per its icon or size could be completely empty of data.
A good way to check if an Access file really contains data is to "look" at its binary content.
It sounds complicated but it's not. It's just a matter of visualizing the bytes of a file, from a bird's eye view, to try to detect empty spaces in data.
To view the "raw" content of a file you can use any hexadecimal editor. In this article we will use the free utility HxD. To follow this guide I recommend that you download and install it.
Hexadecimal is a numerical notation widely used in computing. While we are all used to decimal notation, which uses 10 digits from 0 to 9, hexadecimal uses 16 digits, adding 6 more after 9, represented by letters from A to F.
If we count in hexadecimal, we will have: 0 1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 (...) 18 19 1A 1B and so on.
It is just another way of expressing the same numbers.
Once the tool HxD is installed, open the accdb or mdb file from the menu File | Open.
We can see three different areas:
The bytes of the file, each one expressed as 2 hexadecimal digits. For example 00, 53, 6E or FF. For our purpose we only need to understand that each pair represents one byte.
The same bytes, which are now interpreted as letters (ASCII). As not all bytes have a corresponding letter, many bytes will appear as dots or "odd" characters.
The position, counted in number of bytes from the beginning of the file.
Now, let's view what a regular non-damaged Access file looks like, and aftwerwards, we will look at a few corrupt files:
Scrolling through the file, we see alternating small areas with data, and others that only contain zeros (00). This is the normal pattern.
If we progress at a uniform speed we will find data along the whole file:
Access database viewed with an hexadecimal editor
Any Microsoft Access file, whether mdb or accdb, from versions 2002 to 2019, must begin with the text Standard ACE DB and for 2000 and earlier versions Standard JET DB.
In this example, the first 4KB have been replaced by random data not belonging to the original file.
Compare these two images:
This other file has lost its original data that has been replaced with zeros. Despite its normal size, the file does not contain any information. This file is unrecoverable.
I don't know what causes this problem, but I have found similar cases in client files. Based on my experience, the missing area is usually located at the end of the file varying its extent from 10% to 100% of the total content.
Access file without any valid data
Similar to the previous example but with a partial data loss. The final 10% of the accdb file is missing.
Notice how at the end of the file there are only zeros:
Lack of data at the end of the file