Hi Folks,

I got a 2TB seagate drive with a logical problem.
Customer says that it was in a windows PC as internal drive and someone formatted it and now there is nothing there.
I looked into it and the drive is physically good and currently has a NTFS empty partition.
Opening the drive in WINHEX i see data all over the drive but when i do i deep scan with R-STUDIO, Stellar etc. it can't find any files shows blank even in RAW Recovery.
That's quite weird and i suspect Encryption but user is not aware of any.
Is there a way to identify an encryption type by some signature?

Hi,

It could be encryption or someone messed with it before you.
Did you scan the whole drive to find raw data and nothing found?
What was the file system before?

Probably Windows 7 encryption (Bitlocker)

Was the PC set up for him by someone else? Maybe they enabled Bitlocker?

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

it was win 7 but he doesn't know if they sey bitlocker on, is there a way around that?

take screenshot by winhex of ur hdd (beginning) n [aste here

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

the drive was quick formatted and has new NTFS partition on it which is empty.
Which LBA's should i capture in the screenshots?

One that is not part of the new partition.

sorry did not pay attention to the format issue

if r-studio did not find anything , try to see if you can get any RAW data (working files)

and let us know


forgot to mention, if drive was Encrypted by BitLocker, and been quick formatted, then no need for all of this
its all gone (based on my tests here)

good luck

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

If it's using 128-bit AES encryption, then there will be a repeating pattern of 16 bytes wherever there are blocks of encrypted zeros. If the volume was full formatted as an encrypted volume, then I would expect to see these repeating patterns near the end of the drive, before the backup NTFS boot sector.

_________________
A backup a day keeps DR away.

i did a deep scan it with r-studio and few more software suite and all found nothing.
Same result with raw recovery attempt.
So i guess its all gone.

Here is a screenshot.

Word !

This sector is in the data area. Instead I would go to the very last sector and work backwards. Look for sectors containing a repeating pattern of 16 bytes.

_________________
A backup a day keeps DR away.