All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 13 posts ] 
Author Message
 Post subject: Formatted SDD drive recovery - possible?
PostPosted: December 8th, 2017, 10:26 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
hello all - to the point :) So drives in question are a 128gb M2 ssd, and a 2.5" SSD, 240gb. Not sure if TRIM is enabled. Computer stolen. New OS installed on M2. Other ssd doesn't show up at all under My PC. Recovered computer via GPS, and seems like it wasn't used at all. No new programs or files installed, only used to watch youtube and such when I browsed the history.

I have encrypted .dat files, text on desktop 'sticky note' program, and encrypted notepad file that I need to recover.

The 2.5" drive does not show up in windows explorer, but found it in disk management. Says its empty.

https://gyazo.com/9fd29927cbc37114aeef4ceddcd80489
Just purchased basic SATA to USB converters, and my next plan was to clone the drives and run a slew of data recovery programs to see if anything can be located. Then its time for the professionals. Any suggestions on where to start?

Will home recovery programs be able to find data I'm looking for on either drive from a clone? I have no problem at all sending anyone who helps me successfully retrieving the data a bit of BTC. After days of searching forums and reading articles, this seems like the place to be. Thank you so much for your time and any expertise is appreciated.


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 9th, 2017, 15:15 
Offline

Joined: October 16th, 2013, 13:21
Posts: 618
Location: Brazil
First clone both disks, then try running the recovery software in the clones.

There is a *possibility* that the filesystem in the second disk is just corrupt, and some
software could still find files in it.

Post your results after cloning and running the recovery software, so people can advise you in the next ( if necessary ) steps.


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 10th, 2017, 11:54 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
valeu, after searching around quite a bit for which cloning software to use, I was continually directed right back here to hddguru's raw copy tool. Nice :)

The one thing I am unsure about is if the cloning process itself will write any data to the drives, as I didn't notice any type of write blocker or read only feature. This is terrifying to me, as I realize that any data overwritten could potentially be lost forever. I made one clone of the 2.5" drive and hopefully that will be sufficient.

So the first recovery software I ran was Recuva. Normal scan took like 30 seconds and did not retrieve anything.

Deep scan took 1.5 hours and didn't retrieve anything - just completely blank, found zero files. This is for the 2.5" drive which may be slightly less likely to have the files I am looking for. I kept OS and SQL database stuff on the M2 ssd on that machine. Desktop Sticky note program should be on the same drive as the OS, desktop notepad file should be same drive as OS, and .dat file was from a downloaded application - this may or may not be on the drive I just cloned/scanned - as I tried to keep most programs there.

Trying easeus next, and then R-studio, but not expecting much if recuva found absolutely nothing during a deep scan.

Will ask some local companies tomorrow about their process and services before just flying back to USA and getting trusted professionals to work on things. Any advice moving forward?

This data is fairly important and I am willing to go anywhere in the world to have it recovered.


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 10th, 2017, 13:56 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
https://gyazo.com/4f9dbed94b3e807dd77b17b648c94f56

ok, easeus looks to have recovered a bunch of stuff. Note that I made the clone right onto a folder of my current desktop. Looking through dates some of these files don't seem possible. Getting late now and I'd like a fresh mind to start digging through this, but will pay for the program tomorrow and see what pops out. Browsing files for 15 minutes and nothing much is coming through - a couple pictures, and a pdf file that I created NOT on the drive, but on this current computer like 2 weeks ago. So it seems like easeus might be mixing some things up and combining the 2 drives somehow, even though I pointed at a folder with ONE file in it - the clone copy of my HD.

its almost 80k files - how should I be trying to locate what I need? Nothing came up in searches for .dat, microsoft, stickynotes, .txt. The name of the application which holds the .dat file also had nothing come back when searching for it.

Anyways, possibly some progress


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 10th, 2017, 14:20 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
one good thing is - my current new computer has only one hard drive in it, and it only 90gb. So at least some of the data must have been from the ssd drive in question. I'm finding random pictures from websites I visited today only though, so going to have a lot of stuff to dig through. My first hypothesis is that the files I'm looking for are all actually located on the ssd M2 drive which I have not yet cloned. I suppose my next step is to buy that cable and clone the other drive. In the meantime will purchase easeus and start searching


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 11th, 2017, 2:02 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
Seems like my previous post didn't go through. But ran recuva/deep scan and zero results. Ran easeus and found 80k files or so.

https://gyazo.com/bd9f321850bc077cbd58ded6d55c5d99


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 11th, 2017, 6:01 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
My previous posts aren't being shown, possibly because I was uploading links wrong.

ran recuva deep scan - nothing. ran easus deep scan and it found 160gb of files, but all in jumbled format, many in zip files, nothing I was looking for found by search terms

https://gyazo.com/3b01eebc147af9d4e2bb9dad602a1e12


I'm getting almost zero support from data recovery 'professionals' in both bangkok and singapore. I've been told everything from they just can't help me with a drive that has been formatted, to they won't give me a single detail into their 'proprietary' systems of data recovery when I ask what types of software and hardware they use, if they do binary code extraction, and if they use non-invasive techniques in order to attempt data recovery. I hate to be the ugly american with high expectations, but I'm going to be paying thousands of dollars for a service, and anyone is asia isn't even letting me know what that service pays for or if they are going to destroy my drives in the process. Firms in North America on the other hand have spent plenty of time answering my questions and giving me advice. It's my last resort, but a couple 30 hour plane journeys may be in order soon. Hoping to make a bit of progress myself with recovery software before it comes to that.


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: December 25th, 2017, 12:17 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 9172
Location: Portugal
Plug the "formated" drive and image it to a raw uncompressed binary image file using something like R-Studio, DMDE, WinHex, whatever or if you want to you can as well clone the drive to another one using ddrescue or hddsuperclone. Do a sector by sector copy without any sort of compressing and if you chose to image instead make sure you are not saving the image in any properiatary format. Now run your logic recovery software on the clone/image.

You should try R-Studio, GetDataBack, UFS - Recovery Explorer Professional, etc .... Save the data that you can to another drive.

This of course assuming that the data is still there, that TRIM was not enabled, that space was not over-written, etc ....

On the SSD the chances for logic recovery (or any recovery at all) are very low ...

Good luck.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
paypal.me/Spildit - (PayPal Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: March 27th, 2018, 2:42 
Offline

Joined: December 8th, 2017, 7:42
Posts: 7
Location: Thailand
Sorry for the late bump. I had finally sent the drive in, and was told:

Our engineers report that this volume has suffered from logical corruption which has resulted in loss of access to the data files.
We are expecting a File Type recovery with loss of file and folder names. The files will be sorted by types of files and chronologically.

Not sure how to interpret this news, or if it means that they expect the same exact results for $2,000 that I got for free, which is the image listed above - 80k raw files that are not decipherable at all. I calc'd it would take 55 days straight to go through each and every file, assuming it takes 1 minute to decompress/unzip/and look thru each one.

https://gyazo.com/3b01eebc147af9d4e2bb9dad602a1e12
https://gyazo.com/4f9dbed94b3e807dd77b17b648c94f56

Any suggestions on how to proceed? Paying thousands of dollars for information I already have - 80k files with loss of file and folder name, does me close to zero good


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: March 28th, 2018, 9:34 
Offline

Joined: November 9th, 2006, 15:15
Posts: 2961
You have to take into account data overwriting, wear leveling, write amplification, TRIM.... Image should have been made as soon as you determined that a recovery was needed.

Quote:
We are expecting a File Type recovery with loss of file and folder names. The files will be sorted by types of files and chronologically.


realistically, this is probably as good as your going to get.....


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: March 29th, 2018, 20:56 
Offline

Joined: November 22nd, 2017, 21:47
Posts: 101
Location: France
Quote:
Plug the "formated" drive and image it to a raw uncompressed binary image file using something like R-Studio, DMDE, WinHex, whatever or if you want to you can as well clone the drive to another one using ddrescue or hddsuperclone.

In a case like this, plugging a storage device on a Linux system to perform the image/clone would be preferable, as Windows will automatically mount partitions and may write data on them. I'm not sure if or how it affects the “trim” function though.

Quote:
We are expecting a File Type recovery with loss of file and folder names. The files will be sorted by types of files and chronologically.

If the medatada is lost (no file and folder names, meaning that the MFT has been completely wiped), then the files obtained by “raw” recovery can not be sorted “chronologically”, as the timestamps are also stored as metadata (or it's just the chronological order in which they were recovered, but that's completely irrelevant).

Quote:
Trying easeus next, and then R-studio, but not expecting much if recuva found absolutely nothing during a deep scan.

Recuva is quite good (especially considering that it's a free software) at analyzing NTFS structures and displaying anything that can be recovered using the metadata (found in the MFT). It's quite limited on the other hand for “raw” file recovery ; it recognizes few file types compared with R-Studio or the Easus software (which I haven't tried, it looks quite powerful in that regard, but the way the result is displayed is a mess compared with R-Studio, which classifies the file types in a convenient hierarchy of its own).

But if you still have that image you could also try Photorec : it's free and does “raw” file recovery, you can select the file types you want and uncheck the others (which might improve the result, in some cases it reduces the risks of false positives and truncated files). For some file types it performs better than R-Studio. To run Photorec on a drive image (as opposed to a physical device), either run the command : photorec.exe [path and name of the image], or right click on the image, “open with”, then select the photorec executable to open it.

You could also open your image with WinHex, and perform a thorough search with one or more keywords you remember from the files you're after (it has an option to search for several keywords at once and list the results). Or search through the files you already extracted with something like TotalCommander (it's just the software I use for that purpose, it does many things and does them well, there are specialized tools which may be more convenient – any of them will be more convenient than Windows built-in search function !). But if those files you're looking for are encrypted, or are natively in a compressed / proprietary format which doesn't let the text appear plainly in the data stream, obviously this won't work.

You could open a few files encrypted in the same way as those you're after and look for particular patterns (in the header and/or footer, i.e. the first and last sectors), then either create a custom file signature in R-Studio, or manually search the image using WinHex with keywords based on those patterns.

As for the time it would take to look through each and every one of those files : you only need to look at the ones from the relevant types, obviously you won't find anything useful in TTF files as on your screenshot ! :)


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: April 1st, 2018, 22:06 
Offline
User avatar

Joined: September 29th, 2005, 12:02
Posts: 3184
Location: Chicago
Format usually trims all the data, the only option for recovery is to work with raw data from the chips(through vendor commands) which almost nobody can or want to do.
Also garbage collector on an SSD will eventually erase even that "unavailable" data.

My bet is no data would be realistically possible to recover

_________________
https://www.linkedin.com/in/artemrubtsov/


Top
 Profile  
 
 Post subject: Re: Formatted SDD drive recovery - possible?
PostPosted: May 24th, 2018, 18:31 
Offline

Joined: December 5th, 2011, 5:38
Posts: 1132
Location: Italy
Doomer, can a software as CnW Recovery help to recover RAW data on flash drives?
I know it can recover fragmented raw files through metadata searching, but i don't know if it might help for flash drives.
What's your opinion?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 13 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group