Quote:
Plug the "formated" drive and image it to a raw uncompressed binary image file using something like R-Studio, DMDE, WinHex, whatever or if you want to you can as well clone the drive to another one using ddrescue or hddsuperclone.
In a case like this, plugging a storage device on a Linux system to perform the image/clone would be preferable, as Windows will automatically mount partitions and may write data on them. I'm not sure if or how it affects the “trim” function though.
Quote:
We are expecting a File Type recovery with loss of file and folder names. The files will be sorted by types of files and chronologically.
If the medatada is lost (no file and folder names, meaning that the MFT has been completely wiped), then the files obtained by “raw” recovery can
not be sorted “chronologically”, as the timestamps are also stored as metadata (or it's just the chronological order in which they were recovered, but that's completely irrelevant).
Quote:
Trying easeus next, and then R-studio, but not expecting much if recuva found absolutely nothing during a deep scan.
Recuva is quite good (especially considering that it's a free software) at analyzing NTFS structures and displaying anything that can be recovered using the metadata (found in the MFT). It's quite limited on the other hand for “raw” file recovery ; it recognizes few file types compared with R-Studio or the Easus software (which I haven't tried, it looks quite powerful in that regard, but the way the result is displayed is a mess compared with R-Studio, which classifies the file types in a convenient hierarchy of its own).
But if you still have that image you could also try Photorec : it's free and does “raw” file recovery, you can select the file types you want and uncheck the others (which might improve the result, in some cases it reduces the risks of false positives and truncated files). For some file types it performs better than R-Studio. To run Photorec on a drive image (as opposed to a physical device), either run the command : photorec.exe [path and name of the image], or right click on the image, “open with”, then select the photorec executable to open it.
You could also open your image with WinHex, and perform a thorough search with one or more keywords you remember from the files you're after (it has an option to search for several keywords at once and list the results). Or search through the files you already extracted with something like TotalCommander (it's just the software I use for that purpose, it does many things and does them well, there are specialized tools which may be more convenient – any of them will be more convenient than Windows built-in search function !). But if those files you're looking for are encrypted, or are natively in a compressed / proprietary format which doesn't let the text appear plainly in the data stream, obviously this won't work.
You could open a few files encrypted in the same way as those you're after and look for particular patterns (in the header and/or footer, i.e. the first and last sectors), then either create a custom file signature in R-Studio, or manually search the image using WinHex with keywords based on those patterns.
As for the time it would take to look through each and every one of those files : you only need to look at the ones from the relevant types, obviously you won't find anything useful in TTF files as on your screenshot !