Switch to full style
Anything related to computer forensics (new section!)
Post a reply

Formatted SDD drive recovery - possible?

December 8th, 2017, 10:26

hello all - to the point :) So drives in question are a 128gb M2 ssd, and a 2.5" SSD, 240gb. Not sure if TRIM is enabled. Computer stolen. New OS installed on M2. Other ssd doesn't show up at all under My PC. Recovered computer via GPS, and seems like it wasn't used at all. No new programs or files installed, only used to watch youtube and such when I browsed the history.

I have encrypted .dat files, text on desktop 'sticky note' program, and encrypted notepad file that I need to recover.

The 2.5" drive does not show up in windows explorer, but found it in disk management. Says its empty.

Just purchased basic SATA to USB converters, and my next plan was to clone the drives and run a slew of data recovery programs to see if anything can be located. Then its time for the professionals. Any suggestions on where to start?

Will home recovery programs be able to find data I'm looking for on either drive from a clone? I have no problem at all sending anyone who helps me successfully retrieving the data a bit of BTC. After days of searching forums and reading articles, this seems like the place to be. Thank you so much for your time and any expertise is appreciated.

Re: Formatted SDD drive recovery - possible?

December 9th, 2017, 15:15

First clone both disks, then try running the recovery software in the clones.

There is a *possibility* that the filesystem in the second disk is just corrupt, and some
software could still find files in it.

Post your results after cloning and running the recovery software, so people can advise you in the next ( if necessary ) steps.

Re: Formatted SDD drive recovery - possible?

December 10th, 2017, 11:54

valeu, after searching around quite a bit for which cloning software to use, I was continually directed right back here to hddguru's raw copy tool. Nice :)

The one thing I am unsure about is if the cloning process itself will write any data to the drives, as I didn't notice any type of write blocker or read only feature. This is terrifying to me, as I realize that any data overwritten could potentially be lost forever. I made one clone of the 2.5" drive and hopefully that will be sufficient.

So the first recovery software I ran was Recuva. Normal scan took like 30 seconds and did not retrieve anything.

Deep scan took 1.5 hours and didn't retrieve anything - just completely blank, found zero files. This is for the 2.5" drive which may be slightly less likely to have the files I am looking for. I kept OS and SQL database stuff on the M2 ssd on that machine. Desktop Sticky note program should be on the same drive as the OS, desktop notepad file should be same drive as OS, and .dat file was from a downloaded application - this may or may not be on the drive I just cloned/scanned - as I tried to keep most programs there.

Trying easeus next, and then R-studio, but not expecting much if recuva found absolutely nothing during a deep scan.

Will ask some local companies tomorrow about their process and services before just flying back to USA and getting trusted professionals to work on things. Any advice moving forward?

This data is fairly important and I am willing to go anywhere in the world to have it recovered.

Re: Formatted SDD drive recovery - possible?

December 10th, 2017, 13:56


ok, easeus looks to have recovered a bunch of stuff. Note that I made the clone right onto a folder of my current desktop. Looking through dates some of these files don't seem possible. Getting late now and I'd like a fresh mind to start digging through this, but will pay for the program tomorrow and see what pops out. Browsing files for 15 minutes and nothing much is coming through - a couple pictures, and a pdf file that I created NOT on the drive, but on this current computer like 2 weeks ago. So it seems like easeus might be mixing some things up and combining the 2 drives somehow, even though I pointed at a folder with ONE file in it - the clone copy of my HD.

its almost 80k files - how should I be trying to locate what I need? Nothing came up in searches for .dat, microsoft, stickynotes, .txt. The name of the application which holds the .dat file also had nothing come back when searching for it.

Anyways, possibly some progress

Re: Formatted SDD drive recovery - possible?

December 10th, 2017, 14:20

one good thing is - my current new computer has only one hard drive in it, and it only 90gb. So at least some of the data must have been from the ssd drive in question. I'm finding random pictures from websites I visited today only though, so going to have a lot of stuff to dig through. My first hypothesis is that the files I'm looking for are all actually located on the ssd M2 drive which I have not yet cloned. I suppose my next step is to buy that cable and clone the other drive. In the meantime will purchase easeus and start searching

Re: Formatted SDD drive recovery - possible?

December 11th, 2017, 2:02

Seems like my previous post didn't go through. But ran recuva/deep scan and zero results. Ran easeus and found 80k files or so.


Re: Formatted SDD drive recovery - possible?

December 11th, 2017, 6:01

My previous posts aren't being shown, possibly because I was uploading links wrong.

ran recuva deep scan - nothing. ran easus deep scan and it found 160gb of files, but all in jumbled format, many in zip files, nothing I was looking for found by search terms


I'm getting almost zero support from data recovery 'professionals' in both bangkok and singapore. I've been told everything from they just can't help me with a drive that has been formatted, to they won't give me a single detail into their 'proprietary' systems of data recovery when I ask what types of software and hardware they use, if they do binary code extraction, and if they use non-invasive techniques in order to attempt data recovery. I hate to be the ugly american with high expectations, but I'm going to be paying thousands of dollars for a service, and anyone is asia isn't even letting me know what that service pays for or if they are going to destroy my drives in the process. Firms in North America on the other hand have spent plenty of time answering my questions and giving me advice. It's my last resort, but a couple 30 hour plane journeys may be in order soon. Hoping to make a bit of progress myself with recovery software before it comes to that.

Re: Formatted SDD drive recovery - possible?

December 25th, 2017, 12:17

Plug the "formated" drive and image it to a raw uncompressed binary image file using something like R-Studio, DMDE, WinHex, whatever or if you want to you can as well clone the drive to another one using ddrescue or hddsuperclone. Do a sector by sector copy without any sort of compressing and if you chose to image instead make sure you are not saving the image in any properiatary format. Now run your logic recovery software on the clone/image.

You should try R-Studio, GetDataBack, UFS - Recovery Explorer Professional, etc .... Save the data that you can to another drive.

This of course assuming that the data is still there, that TRIM was not enabled, that space was not over-written, etc ....

On the SSD the chances for logic recovery (or any recovery at all) are very low ...

Good luck.
Post a reply