Where is data?

[shahij]

Well, I have a Seagate 2TB HDD, the HDD is working fine, No UNC/Bad Sectors. According to customer information, the HDD was being used as Portable by using a regular SATA-USB converter. I checked and there is no Encryption issue. Later, Customer claimed, the HDD had 1 partition and it would be used under winxp/win7. Suddenly there was a power failure during the usage of the HDD. then he found no data/partition. While I checked the HDD then found no Partition and even didn't find any partition on it by scanning the HDD. Later I checked the Sector "0". It had no data except the signature "55AA". And no data on sector 63. The first data sector started from sector 64 and almost the full HDD has hex data. Used file recovery software, but found few small amount of invalid data. Where is the problem? Anyone have any idea?

[fzabkar]

Can you show us sector 64?

As for sector 0, it appears that the customer may have accepted Windows' benign sounding offer to "initialise" the drive.

[dick]

Maybe the drive has a Bitlocker volume?
Try a search in your hex editor as shown in the document Forensic Implications of Windows Vista Chapter 4.10.3–Identification Using a Hex Editor

[shahij]

After several communication & discussion, client confirmed he had the HDD inside a PORTABLE CHASIS and gave the chasis, then I found there is USB-SATA Bridge IC with encryption. But the card is damage, will try to fix it and will update you the result.

CLIENT NEVER WANT TO GIVE REAL INFORMATION!