MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 25 posts ]  Go to page Previous  1, 2
Author Message
 Post subject: Re: Looking for suggestions on recovering an encrypted drive
PostPosted: March 23rd, 2014, 17:28 
Offline

Joined: March 5th, 2014, 16:42
Posts: 8
Location: New York
sorry for the long delay in replying - I had some traveling to do lately and didn't get a chance to really hit this forum
So after attempting some restores of files using a variety of programs, I managed to put a few in the attached zip file. I was unable to attach, say, the .jpgs individually as the forum was unable to determine the dimensions of the images (and they are not viewable in Windows)
I also attached some .mp3s that the restore program said were recovered but were not playable at all. I'm also going to try some of the apps fzabakar mentioned earlier now that I'm back home


Attachments:
uno9.zip [313.5 KiB]
Downloaded 333 times
Top
 Profile  
 
 Post subject: Re: Looking for suggestions on recovering an encrypted drive
PostPosted: March 23rd, 2014, 17:50 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16960
Location: Australia
Your files do not appear to be encrypted, but they do appear to be corrupt, or incorrectly recovered.

For example, here is a section from akeah.jpg:

Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002A90  B4 04 B5 04 B6 04 B7 04 B8 04 B9 04 BA 04 BB 04  ´.µ.¶.·.¸.¹.º.».
00002AA0  BC 04 BD 04 BE 04 BF 04 C0 04 C1 04 C2 04 C3 04  ¼.½.¾.¿.À.Á.Â.Ã.
00002AB0  C4 04 C5 04 C6 04 C7 04 6E 74 6F 73 6B 72 6E 6C  Ä.Å.Æ.Ç.ntoskrnl
00002AC0  2E 65 78 65 00 45 78 41 63 71 75 69 72 65 46 61  .exe.ExAcquireFa
00002AD0  73 74 4D 75 74 65 78 55 6E 73 61 66 65 00 45 78  stMutexUnsafe.Ex
00002AE0  49 6E 74 65 72 6C 6F 63 6B 65 64 41 65 64 45 78  InterlockedAedEx
00002AF0  63 68 61 6E 74 61 74 69 73 74 69 63 00 45 78 49  chantatistic.ExI


Moreover, the sizes of the files and their compression ratios suggests that, even if some were encrypted, they are not MP3s or JPEGs.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Looking for suggestions on recovering an encrypted drive
PostPosted: April 19th, 2014, 13:55 
Offline
User avatar

Joined: May 26th, 2009, 3:28
Posts: 38
Location: Cyprus
if you can see the partitions and files on your drive but files has no valid content, then you may got infected by cryptlocker virus. I have seen similar cases.
CryptLocker is a file-based encryprion virus which encrypt all the data on your HDD.
Please give a look here: http://en.wikipedia.org/wiki/CryptoLocker

_________________
D.R.L Data Revive Lab Services Ltd
Web: https://www.datarevive.net


Top
 Profile  
 
 Post subject: Re: Looking for suggestions on recovering an encrypted drive
PostPosted: April 19th, 2014, 14:05 
Offline

Joined: January 8th, 2008, 5:21
Posts: 927
Location: uk
kyriakosxn wrote:
if you can see the partitions and files on your drive but files has no valid content, then you may got infected by cryptlocker virus. I have seen similar cases.
CryptLocker is a file-based encryprion virus which encrypt all the data on your HDD.
Please give a look here: http://en.wikipedia.org/wiki/CryptoLocker

Hi that would have been a good call, and even I was thinking that was a maybe, except in his first post it was stated the drive failed in 2006 and was in storage until it was sent for imaging last year. I don't think Cryptolocker or anything like it was around at that time.


Top
 Profile  
 
 Post subject: Re: Looking for suggestions on recovering an encrypted drive
PostPosted: April 26th, 2014, 10:57 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3669
Location: Massachusetts, USA
Since the MBR looks correct, then any decent software should be able to build the file tree for each of the partitions. Can you post a picture of the file tree structure for each of the partitions?

Also, since you said that wherever the drive was sent to determined the drive had an electronics issue, then that should have not had any impact on the logical structure.

You mentioned a cheap enclosure of some sort was used to connect this drive. Can you describe this adapter in more detail? What is the model, brand, etc?

Let's assume the drive is not encrypted. You can use software to run a keyword search in the RAW data for some common words that any set of data would contain. If you get no hits in the search for several words, the drive is likely encrypted.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 25 posts ]  Go to page Previous  1, 2

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 96 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group