atuovu wrote:
Unfortunately I've no idea how much data was in the drive.
Used the latest version of getdataback (simple?) on 4-star mode. found 2TB NTFS but it was useless as stated.
I'll try the programs you mentioned.
Being a CAD geek myself, I can tell you your most valuable tool here will be information from the customer. Namely, the specific use case for the machine.
For instance, If you can narrow its use down to professional CAD work, as performed in an office, as opposed to a mix of professional CAD as well as personal CAD and the myriad of other personal uses, then I would say the customer is probably mostly interested in recovering work in the form of CAD files (almost always stored on a network drive or in the user's own folders) and possibly daily work reports or other critical documents that play a central role in much of the industry in which CAD work is performed.
The file-types differ quite greatly depending on which Autodesk software is primarily being used.
For AutoCAD, these would include (but are not limited to) DWG and DXF for the main form of the work being done, and to supplement the recovery of these, there are a number of automatically saved back-up copies of these that are typically stored in the user's temp folder or in a specifically configured folder.
There will be no end to the set of possible file types that you'd need to recover going only on a general presence of Autodesk files. It is likely that your customer is not a CAD person themselves, but getting them to obtain as much information from the person who used the machine would be your only real hope for success. This is due to the enormous number of files that are included with any Autodesk software that have the same file types as those created by the software itself.
The customer may just want a small folder that contains 5 dwg files from the user's desktop, but without the master file table, your software will be endlessly trying to carve out thousands of DWG files. But if the user could confirm whether they used, for example, the option to save DWGs in contiguous form, or that they routinely performed full de-fragmentation of their CAD files or the whole disk, then carving will have much better success.
If they were doing professional work without a network drive for completed work, back-up, collaboration, etc.. then you may also be looking for PDFs, PNGs, cached outlook emails, etc.
Regardless of whether the CAD files represent professional or personal work, if the user is a developer, they could also have any number of scripts, or possibly custom plugins developed on the machine that would be just as valuable to them as the related drawings.
Lastly, to re-iterate Arch's point, if the 2 TB drive happened to have more than a million files in its MFT, then Windows will have allocated an extension to the MFT residing well past the 4GB zone. ZAR is a good choice for creating a list of many possible locations for the MFT. If you find any that show a large portion saved in the upper areas of the disk, try recovering a few complex files using the most promising MFT instances, and see if any of them result in significantly more complete or working files.