ST2000LM007 cloned but no file works

[Pandemicc]

hello everyone, Im trying to learn data recovery whenever I can. Now I have a ST2000LM007 that was quick formated to exfat. I cloned the drive with gddrescue then took the image to my RTT T80. It showed 4tb of photos and videos with their signatures are intact but every single file that is recovered is trash, sizes and names are okay but none of the files work. does it have anything to do with Firmware lock or something? am I doing anything wrong here?

[fzabkar]

https://mh-nexus.de/en/hxd/

[Zero Alpha]

Are the files trash on the source drive? Because a clone will just be an exact copy of whatever is wrong with the source drive.

If you are trying to recover data that was lost from a quick format then maybe you should try a software tool instead.

[fzabkar]

Although the FS is exFAT, I'm wondering if the data were TRIM-ed.

[Pandemicc]

https://mh-nexus.de/en/hxd/

are you suggesting that I must check the files' hex?

[Pandemicc]

Are the files trash on the source drive? Because a clone will just be an exact copy of whatever is wrong with the source drive.

If you are trying to recover data that was lost from a quick format then maybe you should try a software tool instead.

Source drive is empty. I already used R studio on it, I mentioned that?

[Pandemicc]

Although the FS is exFAT, I'm wondering if the data were TRIM-ed.

I am supposed to see zeroes on files if they are TRIM-ed yes? The file sizes are okay by the way

[fzabkar]

Do you see zeros? If yes, then the files have been TRIM-ed.

[Pandemicc]

Do you see zeros? If yes, then the files have been TRIM-ed.

sorry for my super late reply. I checked the files through HxD and no, there are no zeroes. what could be the issue?

[fzabkar]

What was the original file system?

Can you upload a sample file to a file sharing service, or at least the first few sectors of a problematic file?

Are there any problems with the SMART attributes, eg reallocated sectors?

[Pandemicc]

What was the original file system?

Can you upload a sample file to a file sharing service, or at least the first few sectors of a problematic file?

Are there any problems with the SMART attributes, eg reallocated sectors?

Sure, Im after .mp4 .jpg files. Every single file is broken, all 4TB of them https://we.tl/t-vZGuHFnkIt

It was an ExFAT, disk was working fine, only quick formated

[fzabkar]

It was an ExFAT, disk was working fine, only quick formated

That means that you destroyed the FATs. That's where the cluster chains are stored. Any recovered file that was originally fragmented will be corrupt because only the first fragment will be intact.

[Pandemicc]

It was an ExFAT, disk was working fine, only quick formated

That means that you destroyed the FATs. That's where the cluster chains are stored. Any recovered file that was originally fragmented will be corrupt because only the first fragment will be intact.

is there any workaround for that? either DIY or pro solutions?

[fzabkar]

Actually, I examined both JPEG samples and found no 0xFFD8 signature. However, both files had a 0xFFD9 signature at around 64 sectors from the end. This leads me to suspect that your data have been shifted by 64 sectors.

R-Photo is freeware. Give that a try.

[Pandemicc]

Actually, I examined both JPEG samples and found no 0xFFD8 signature. However, both files had a 0xFFD9 signature at around 64 sectors from the end. This leads me to suspect that your data have been shifted by 64 sectors.

R-Photo is freeware. Give that a try.

Run R-photo on the image? I already use T80 isn't that supposed to be more powerful?

[fzabkar]

Actually, I examined both JPEG samples and found no 0xFFD8 signature. However, both files had a 0xFFD9 signature at around 64 sectors from the end. This leads me to suspect that your data have been shifted by 64 sectors.

R-Photo is freeware. Give that a try.

Run R-photo on the image? I already use T80 isn't that supposed to be more powerful?

Sorry, I wasn't paying attention. I don't know what else to suggest except raw recovery (file carving).

[Pandemicc]

Actually, I examined both JPEG samples and found no 0xFFD8 signature. However, both files had a 0xFFD9 signature at around 64 sectors from the end. This leads me to suspect that your data have been shifted by 64 sectors.

R-Photo is freeware. Give that a try.

Run R-photo on the image? I already use T80 isn't that supposed to be more powerful?

Sorry, I wasn't paying attention. I don't know what else to suggest except raw recovery (file carving).

Raw recovery results are the exact same issue, at this point I just want to know the reason why actually ahah

[fzabkar]

Raw recovery identifies files based on their signatures. None of your sample files have any signatures, or at least none that I recognise. :-?

[Pandemicc]

Raw recovery identifies files based on their signatures. None of your sample files have any signatures, or at least none that I recognise.

I can send you the RAW recovered ones as well if you like

[fzabkar]

OK, just upload a couple of JPEGs.