All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 4 posts ] 
Author Message
 Post subject: WD2002FAEX-007BA0
PostPosted: March 22nd, 2018, 10:21 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1258
Hello!
Customer says there's two HDD's connected to the PC one of them for OS and the other (drive in topic) is one partition 2 T.B has all data on it. He tried to install a new OS but he surprised that the 2 T.B drive is formatted.
I tried logical scan until first 10000000 sectors with R-Studio and DMDE but no luck. In similar cases scanning the first 10 million sectors will show at least folders structure.

Any thoughts?
Thanks in advance


Attachments:
0&2048.rar [1.01 KiB]
Downloaded 36 times
Top
 Profile  
 
 Post subject: Re: WD2002FAEX-007BA0
PostPosted: March 22nd, 2018, 17:49 
Offline

Joined: October 16th, 2013, 13:21
Posts: 717
Location: Brazil
Customer formatted ( and choose option to fully clean ) the wrong drive during setup ?


Top
 Profile  
 
 Post subject: Re: WD2002FAEX-007BA0
PostPosted: March 23rd, 2018, 9:49 
Offline
User avatar

Joined: December 8th, 2013, 4:48
Posts: 690
Location: Pakistan
normally if drive is over written with new OS means old MFT is gone which is located normally at 3GB position all you can have is Raw recovery if possible at all.

sector 2048 shows a partition of size : 262143 sectors so the next data partition would be starting from sector 264192.

I am afraid there wont be much option to retrieve the old folder structure.

_________________
Data Recovery Pakistan


Top
 Profile  
 
 Post subject: Re: WD2002FAEX-007BA0
PostPosted: March 24th, 2018, 8:42 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1258
rogfanther wrote:
Customer formatted ( and choose option to fully clean ) the wrong drive during setup ?

I don't think so. After full scan with r-studio all I get is 317GB in extra found files contains garbage data. Also in hex all sectors until 3906000000 contains data (not 00's).

MindMergepk wrote:
normally if drive is over written with new OS means old MFT is gone which is located normally at 3GB position all you can have is Raw recovery if possible at all.

sector 2048 shows a partition of size : 262143 sectors so the next data partition would be starting from sector 264192.

I am afraid there wont be much option to retrieve the old folder structure.

If drive overwritten with new OS at least it would show new folders related to new OS (users, program files, windows...etc) none of them appears even with full scan.
My guess is someone encrypt the drive with bit locker or whatever and then reformatted.

Anyway the customer has take the drive yesterday while I was in my vacation. :)


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 4 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot], Google [Bot], Google Adsense [Bot] and 27 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group