All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 42 posts ]  Go to page 1, 2, 3  Next
Author Message
 Post subject: Toshiba MQ01ABF050, no bad sectors but "uncorrectable error"
PostPosted: March 17th, 2018, 13:46 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Hi,
Someone asked me to recover data from a laptop computer HDD (Toshiba MQ01ABF050, 500GB) which, supposedly, has only been reformated by mistake. But it was reformated by the owner's father because the computer was acting up for an unknown reason : failed to boot, got stuck with an error message or a blue screen or whatever, I don't know the details.
To be on the safe side, before attempting any "in place" fix, I removed the HDD and I'm currently imaging it with ddrescue : all goes well, about 3 hours to go.
GSmartControl indicates no reallocated or pending sectors, but there are several "Uncorrectable error in data" messages in the Error Log, at the same LBA.
Is the drive safe to use again ? What could be the cause of those errors ? I made a quick search : it may be related to an inadequate power supply, or a bad cable/connector. The computer is a Sony Vaio running on Windows 8, with no sign of damage, the battery and power cord are both original and appear to be in good physical condition.
Also, I see quite high numbers in the "G-Sense Error Rate" and "Free Fall Protection" fields : does that mean that the computer was seriously mishandled, or is that typical for a laptop computer with that kind of HDD ? (Most I've seen before for "G-Sense" was 5, on a 2.5" 500GB Seagate drive I bought used, which also reached a maximum temperature above 70°C, and which I don't trust for sensitive data for that reason, even though it has no bad sectors.)
Thanks.


Attachments:
Lubuntu 201803171757 2.png
Lubuntu 201803171757 2.png [ 717.06 KiB | Viewed 1130 times ]
Lubuntu 201803171757 1.png
Lubuntu 201803171757 1.png [ 564.25 KiB | Viewed 1130 times ]
Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 14:42 
Offline

Joined: September 30th, 2005, 7:33
Posts: 565
The drive is perfect. The Error Log is for factory use only. You shouldn't open it.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 16:39 
Offline

Joined: January 29th, 2012, 1:43
Posts: 348
Location: United States
The error log indicates that there could very well be a bad sector on the drive. You will know for sure when the ddrescue imaging completes. If it completes without errors, then the drive is okay.

At first I thought the sector reported bad in the log was at about 2.85GB, but then realized that the high order registers are not present, so it is most likely a higher LBA. You will know when the imaging is complete.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 16:52 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 8817
Location: Portugal
You can check this link as well :

http://www.hddoracle.com/viewtopic.php?f=117&t=1393

:D

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 17:20 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Thanks for those replies.

Quote:
The drive is perfect. The Error Log is for factory use only. You shouldn't open it.

Well, then why is it there at all in GSmartControl ? (Which seems to be aimed at regular users.)

Quote:
The error log indicates that there could very well be a bad sector on the drive. You will know for sure when the ddrescue imaging completes. If it completes without errors, then the drive is okay.
At first I thought the sector reported bad in the log was at about 2.85GB, but then realized that the high order registers are not present, so it is most likely a higher LBA. You will know when the imaging is complete.

It completed with no error indeed. What are “high order registers” ?
And so, what could be the cause of those errors ? Could it be consistent with a software / system related issue ?
Apparently this drive (and the whole computer I assume) has been used very moderately (232 hours, 319 start/stop counts), so how can it have such high values in shock/vibration related fields ?
I've been testing the computer's RAM for a few hours with Memtest86+ : no error whatsoever.
Below is a copy of the detailed report for each logged error.

Quote:

I've seen this thread a few months ago (soon after I registered on this forum actually), and marked it for further in-depth reading and testing, which I haven't done yet (so many things to do, so little time). Some of it seems to involve quite advanced procedures, with tools I haven't or couldn't even dream of having at the moment. But it sure is an instructive read.



Code:
Error 2678 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 d0 e0 21 55 40  Error: UNC at LBA = 0x005521e0 = 5579232

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 08 d0 e0 21 55 40 00      00:34:22.681  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:22.673  READ LOG EXT
  60 08 c8 e0 21 55 40 00      00:34:18.884  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:18.873  READ LOG EXT
  60 08 c0 e0 21 55 40 00      00:34:15.087  READ FPDMA QUEUED

Error 2677 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 c8 e0 21 55 40  Error: UNC at LBA = 0x005521e0 = 5579232

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 08 c8 e0 21 55 40 00      00:34:18.884  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:18.873  READ LOG EXT
  60 08 c0 e0 21 55 40 00      00:34:15.087  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:15.073  READ LOG EXT
  60 08 b8 e0 21 55 40 00      00:34:11.290  READ FPDMA QUEUED

Error 2676 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 c0 e0 21 55 40  Error: UNC at LBA = 0x005521e0 = 5579232

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 08 c0 e0 21 55 40 00      00:34:15.087  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:15.073  READ LOG EXT
  60 08 b8 e0 21 55 40 00      00:34:11.290  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:11.284  READ LOG EXT
  60 78 b0 e0 21 55 40 00      00:34:07.493  READ FPDMA QUEUED

Error 2675 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 b8 e0 21 55 40  Error: UNC at LBA = 0x005521e0 = 5579232

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 08 b8 e0 21 55 40 00      00:34:11.290  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:11.284  READ LOG EXT
  60 78 b0 e0 21 55 40 00      00:34:07.493  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:07.484  READ LOG EXT
  60 08 a8 e0 21 55 40 00      00:34:03.695  READ FPDMA QUEUED

Error 2674 occurred at disk power-on lifetime: 228 hours (9 days + 12 hours)
  When the command that caused the error occurred, the device was active or idle.

  After command completion occurred, registers were:
  ER ST SC SN CL CH DH
  -- -- -- -- -- -- --
  40 41 b0 e0 21 55 40  Error: UNC at LBA = 0x005521e0 = 5579232

  Commands leading to the command that caused the error were:
  CR FR SC SN CL CH DH DC   Powered_Up_Time  Command/Feature_Name
  -- -- -- -- -- -- -- --  ----------------  --------------------
  60 78 b0 e0 21 55 40 00      00:34:07.493  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:07.484  READ LOG EXT
  60 08 a8 e0 21 55 40 00      00:34:03.695  READ FPDMA QUEUED
  2f 00 01 10 00 00 28 00      00:34:03.683  READ LOG EXT
  60 08 a0 e0 21 55 40 00      00:33:59.898  READ FPDMA QUEUED


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 17:52 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 10263
Location: Australia
The SMART error log is a user log, not a factory log. The factory log is something else.

Did the Reallocated Sector Count or Current Pending Sector Count change after the cloning?

The Head Retract Cycle Count of 3342394 is best expressed in hex:

    3342394 = 0x0033003A -> 0x0033 0x003A -> 51, 58

It may be a coincidence, but these values appear to be related to the Free Fall Protection count (51).

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 17:58 
Offline

Joined: January 29th, 2012, 1:43
Posts: 348
Location: United States
Quote:
It completed with no error indeed. What are “high order registers” ?
And so, what could be the cause of those errors ? Could it be consistent with a software / system related issue ?

High order registers are another way of referring to 48 bit LBA access. It appears that GSmartControl used the read log command, the read log extended command would have the extended high order registers. You could use smartctl to read the extended log.
Code:
smartctl --log=xerror /dev/sdc

The fact that there were no errors when imaging, and no pending or reallocated sectors in smart, would indicate the possibility that there was a bad sector, it was rewritten (perhaps during the reformatting), and there were no issues so it is good again. So with the information provided, it would seem that the drive is healthy.
Quote:
Apparently this drive (and the whole computer I assume) has been used very moderately (232 hours, 319 start/stop counts), so how can it have such high values in shock/vibration related fields ?

When looking up how the drive may produce the G-Sense Error Rate provided a possible answer that could be very simple. It could be a count of how many times the drive experience a level of g force that caused it to abort a write. This is a safety feature and could only take a very small bump to trigger it. Values are vendor specific (and also likely drive specific), so unless you can find the exact meaning of the value for that drive, I would not read too much into it.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 18:08 
Offline

Joined: September 30th, 2005, 7:33
Posts: 565
maximus wrote:
The error log indicates that there could very well be a bad sector on the drive.

The error log indicates that there WAS an unreadable sector and the drive tried several times to read it. During the format this sector was rewritten and came out to be a GOOD sector, so there is nothing to worry about.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 17th, 2018, 21:43 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
@fzabkar
Quote:
The SMART error log is a user log, not a factory log. The factory log is something else.
Did the Reallocated Sector Count or Current Pending Sector Count change after the cloning?
The Head Retract Cycle Count of 3342394 is best expressed in hex:
3342394 = 0x0033003A -> 0x0033 0x003A -> 51, 58
It may be a coincidence, but these values appear to be related to the Free Fall Protection count (51).

No, reallocated and pending stayed at 0. Interesting observation.

@maximus
Quote:
High order registers are another way of referring to 48 bit LBA access. It appears that GSmartControl used the read log command, the read log extended command would have the extended high order registers. You could use smartctl to read the extended log.

I'll have to search more information on that matter to get this clearly, right now it's not the priority...

Quote:
The fact that there were no errors when imaging, and no pending or reallocated sectors in smart, would indicate the possibility that there was a bad sector, it was rewritten (perhaps during the reformatting), and there were no issues so it is good again. So with the information provided, it would seem that the drive is healthy.
When looking up how the drive may produce the G-Sense Error Rate provided a possible answer that could be very simple. It could be a count of how many times the drive experience a level of g force that caused it to abort a write. This is a safety feature and could only take a very small bump to trigger it. Values are vendor specific (and also likely drive specific), so unless you can find the exact meaning of the value for that drive, I would not read too much into it.

Alright, so I'll stop worrying about the hardware part.

Now, the main issue is that I can't find anything that looks like personal files/folders on that thing. There's a 438GB partition starting at 2.07GB, the only one that could contain relevant data (before that there are two EFI system partitions, one 1.44GB partition called “Windows RE tools”, a 128MB “Microsoft reserved partition”, probably related to GPT partitioning, and after that, at 440GB, there's a 25GB “Recovery” partition) ; it does contain a Windows install, program folders, the usual. It was supposedly reformatted, so I scanned the whole image with R-Studio, expecting to find many files from the former install : it finds a total of 206GB of files, but this includes a 150GB R-Drive image and a 10GB “QEMU virtual disk” which are very probably false positives. “Users” is almost empty, and there's not much interesting in “Extra found files” either. The owner said that she had pictures for instance, but only 8 files are detected in “JPEG Digital Camera”, all linked to the Windows folder or the programs' folders. There are just 2 MP3 files. I'm currently running Photorec, but I doubt that it will find much more, R-Studio is becoming very efficient at raw file carving, and JPEG files in particular have a very definite pattern, they are unlikely to be missed.
And yet the drive is full of “something” : if I open the partition with WinHex I can see non-zero data up until the very end, the “free space” is anything but free. Even if the Windows reinstall overwrote a great amount of former files there should still be some remnants, either as raw files or as MFT records, right ? Perhaps the partition was formerly encrypted, which would explain why nothing from it can be identified ; is there a way to determine this ? Could there be another explanation ? (I'm wondering if the HDD is indeed the original one, or if the owner's father replaced it without telling her when he “fixed” the computer... that would be another possibility... Some people “fix” a computer like veterinary doctors “fix” a dog ! :) )
I'll ask the owner tomorrow some more details, but she seemed kinda clueless, so it probably won't help much, and anyway, I'm afraid I won't be able to do anything useful at that point...


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 18th, 2018, 11:14 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Again, is there a way to determine if the volume was formerly encrypted, and what type of encryption was used ?
In that case, is there any way to access the data that used to be there, or is it a lost cause ?

I scanned the whole drive with Photorec, with almost all file types activated : it only found 25,1GB worth of files, with only 103MB of JPG images (all seem to come from Windows / programs folders).
And yet, as I said earlier, there's data all over, see attached WinHex screenshot.


Attachments:
Toshiba 500Go -- WinHex, free space.png
Toshiba 500Go -- WinHex, free space.png [ 158.48 KiB | Viewed 972 times ]
Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 18th, 2018, 20:39 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Damn, that picture has been seen 50 times, but noone has any clue or opinion on that matter ? :?
Are there particular sectors to look at for particular patterns that would hint toward particular kinds of encryption ?

The owner (well, actually her boyfriend) said that the drive is indeed the original one, and that it most likely was not encrypted, at least intentionally. But then, what are those 400GB of junk bytes, and how could a quick format and Windows re-install remove every single trace of the former files and folders ?


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 18th, 2018, 20:41 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3177
Location: Massachusetts, USA
Could just look visually in hex space and see if data looks encrypted. Or search for simple/common keywords in RAW space with Winhex. If you get hits, then it is not encrypted.

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 18th, 2018, 21:45 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Quote:
Could just look visually in hex space and see if data looks encrypted.

Well, you saw the picture... How should encrypted data look like ?
As far as I can see, this seems like totally random data with no distinguishable patterns, or similar to what can been found in the middle of a compressed video file for instance.
If it's not encryption, then what could have overwritten a whole partition with totally random data ? (Well, a write test with HD Sentinel set to “random data” could do that, but something like this would be very unlikely here.) Is there a stupid option or “feature”, when re-installing Windows 8, or when activating the “factory recovery” on a Sony Vaio laptop computer, which could lead to this ? Like, “you want to format your computer, we assume that you have something to hide, so we will make sure that neither God nor the NSA can ever figure out what you were up to, now click OK if you agree, or Cancel if you're angry, or Whatever if you're hungry”.

Quote:
Or search for simple/common keywords in RAW space with Winhex. If you get hits, then it is not encrypted.

I scanned the whole drive with both R-Studio (most common file types activated in “extra search for known file types”) and Photorec (almost all file types activated), both found nothing more than the current data, despite the fact that the whole drive – or more specifically the whole main 438GB partition – has data all over, I can't see any spot with empty sectors in the free space. So both of those reputed softwares recognized no pattern of common file types beyond the current files and folders, which form a basic Windows 8 install with the default programs supplied with that Sony Vaio computer.
(As a side note, what could be “simple/common keywords” for a search like this, without knowing even vaguely what kind of data was supposed to be there before ?)


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 18th, 2018, 21:52 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3177
Location: Massachusetts, USA
Ex: documents, desktop, a name of a file that the customer can confirm of
Text words, basically.

But based on what you are saying as far as file signatures goes, not finding any, then it is possible that some sort of encryption may have been on there.

If it is a "home computer", then most common is Bitlocker. Maybe TrueCrypt. Can search for those in hex, too.

If it is a corporate/company computer, then encryption options could increase to other.

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 18th, 2018, 22:43 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
This is almost certainly a “home computer”. So how could I identify a Bitlocker or TrueCrypt encryption ? And at which level is the encryption dealt with, with either of those systems ? I might be losing my time here, at least I'd be glad to learn something in the process ! :)


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 19th, 2018, 9:09 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3177
Location: Massachusetts, USA
abolibibelot wrote:
This is almost certainly a “home computer”. So how could I identify a Bitlocker or TrueCrypt encryption?

abolibibelot wrote:
Someone asked me to recover data from a laptop computer HDD (Toshiba MQ01ABF050, 500GB) which, supposedly, has only been reformated by mistake. But it was reformated by the owner's father because the computer was acting up for an unknown reason : failed to boot, got stuck with an error message or a blue screen or whatever, I don't know the details.

- Ask the customer or computer owner/actual user.
- Think how they may have encrypted it without them realizing they actually did and ask if they recall anything like that happening.
- Did they save any encryption keys? What about their Microsoft account?
- Look for Bitlocker or Truecrypt signatures.
- Try to replicate the problem with a test drive.
abolibibelot wrote:
And at which level is the encryption dealt with, with either of those systems ?

Not sure I understand your question.
Needlees to say, not sure what else I can suggest without more concrete information.

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 19th, 2018, 10:18 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Well, am I to understand that most pros here deal mostly with hardware / firmware failures, and that this particular issue is beyond the scope of this forum ? Nobody ever encountered something similar ? In that case, would there be another forum where I could get accurate insight on that specific topic ?
Or is there something inherently wrong with the kind of advice I'm requesting ?
If it needs to be said out loud : it's perfectly transparent, I sent the owner a link to this very page, I was thanked for my efforts, even if they proved unfruitful so far ; it's just frustrating to not be able to provide at least a conclusive answer as to why the usual procedure does not give the intended result.

[EDIT]
@labtech :
Sorry, I hadn't seen your follow-up reply. Reading it right now.


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 19th, 2018, 11:35 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3177
Location: Massachusetts, USA
abolibibelot wrote:
Well, am I to understand that most pros here deal mostly with hardware / firmware failures, and that this particular issue is beyond the scope of this forum ? Nobody ever encountered something similar ?

We encounter strange recovery cases all the time. All kinds, hardware, software and logical related (e.g. formatting, which is a very common screw up)
All technicians are tired of wasting time on scenarios where the end customer isn't cooperative and, on a brief analysis, the files seem likely unrecoverable. Hence, why the lack of replies likely.

abolibibelot wrote:
Or is there something inherently wrong with the kind of advice I'm requesting?"

No, not necessarily. The problem lies in the fact that we are expecting to come up with a solution before understanding the problem fully. We are just speculating so far based on limited information. To come up with a solution, we first need to fully understand all the details relevant [aka the problem].

abolibibelot wrote:
@labtech: Sorry, I hadn't seen your follow-up reply. Reading it right now.

No problem

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 19th, 2018, 11:50 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Quote:
- Ask the customer or computer owner/actual user.

The informations I got so far are rather sketchy... The actual user seems to have very little technical knowledge (no offense if she's reading this ! :) ), hence why she asked her father to fix the computer. I don't know what he did, I don't know if what appears as possibly encrypted data was there from the begining, or if this is the result of something he did while attempting to fix it. In order to have more accurate input, I would have to talk directly to the guy, and it would become very complicated, for possibly zero reward if it turns out that it's completely unrecoverable...

Quote:
- Think how they may have encrypted it without them realizing they actually did and ask if they recall anything like that happening.

That's the problem : how would they remember anything like this without realizing it at the moment ? By eating a madeleine ? :)
I also asked if it was possible for a laptop computer to be sold with a whole volume encryption already activated, without the owner's knowledge or explicit consent (that would be stupid for sure, but there are many stupid things happening in this world... at every single second, there is someone, somewhere, doing something utterly stupid, and sometimes that someone can be a large corporation with a worldwide customer base ! :shock: ).

Quote:
- Did they save any encryption keys? What about their Microsoft account?

They don't remember anything about an encryption process, and didn't consciously deal with any encryption key.
What about the Microsoft account ? How could it be related with a (possible) encryption ? I personally stayed away from Windows 8/10, and don't know much about that thing, which seems to be way more annoying than it is worth. (About a year ago I banged my head on the wall while trying to remotely configure my mother's computer running on Windows 8 so that it would have two separate user accounts, one for her and one for her companion, with a selection screen during startup and a password for each – just like it used to work perfectly with her former computer running on Windows Vista ; but I couldn't do that, even after applying some obscure registry trick, it came back at the next reboot, and I was asked to set up a Microsoft account, which is apparently necessary now to get that simple feature ; it was already difficult to explain to her the difference between the Windows account password and the e-mail account password, and it seemed way too convoluted even for me, so I gave up, and they still use the same account because it's too complicated and unintuitive to manually change the user account it after being logged in... That's about all that the words “Microsoft account” evoke to me ! :) )

Quote:
- Look for Bitlocker or Truecrypt signatures.

Yes, that's what I was requesting above, repeatedly : what would be Bitlocker or Truecrypt signatures, and where should I look for them ? (The difficulty must be compounded by the fact that a large chunk of the partition was overwritten when Windows was reinstalled – with no encryption obviously.)

Quote:
- Try to replicate the problem with a test drive.

I don't know enough about what happened in the first place to be able to replicate it.

Quote:
Not sure I understand your question.

I mean... I don't know much about cryptography, I never used any of those encryption systems myself, so, generally speaking, how does the system, and the user, interact with a volume encrypted with either Bitlocker or Truecrypt ? Is there a password to type each time, or can it be an automated process, linked with the user account password for instance, or with the computer's firmware, or something else ? Where is the encryption software located ? I'm just looking for any hint that would allow me to, at least, say if it is or is not encryption, or what else it could possibly be.

Quote:
Needlees to say, not sure what else I can suggest without more concrete information.

Well, I provided all the information I have myself. Imagine that you get exactly the same request, with exactly the same amount of information, and that you already went through the hassle of doing a volume image and a thorough analysis with two reliable tools and found absolutely nothing, what would you do ? (I initially asked 25€ for that job, which seemed pretty straightforward, and well within my current abilities.)


Top
 Profile  
 
 Post subject: Re: Toshiba MQ01ABF050, no bad sectors but "uncorrectable er
PostPosted: March 19th, 2018, 12:01 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3177
Location: Massachusetts, USA
abolibibelot wrote:
what would you do ?

Few options:
- Ask for another fee paying for your time to research (would recommend actually having the laptop with you, perhaps you can try booting with a clone drive and see what actually happens when booting in comparison to the original drive)
- Ask for another fee for outsourcing the job to a specialist
- Say you can no longer help and give the drive back

As far as other info - can search online - for example:
https://www.forensicswiki.org/wiki/BitL ... Encryption

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 42 posts ]  Go to page 1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Abdul Rauf, Google [Bot] and 53 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group