rogfanther wrote:
Customer formatted ( and choose option to fully clean ) the wrong drive during setup ?
I don't think so. After full scan with r-studio all I get is 317GB in extra found files contains garbage data. Also in hex all sectors until 3906000000 contains data (not 00's).
MindMergepk wrote:
normally if drive is over written with new OS means old MFT is gone which is located normally at 3GB position all you can have is Raw recovery if possible at all.
sector 2048 shows a partition of size : 262143 sectors so the next data partition would be starting from sector 264192.
I am afraid there wont be much option to retrieve the old folder structure.
If drive overwritten with new OS at least it would show new folders related to new OS (users, program files, windows...etc) none of them appears even with full scan.
My guess is someone encrypt the drive with bit locker or whatever and then reformatted.
Anyway the customer has take the drive yesterday while I was in my vacation.