toshiba laptop hard drive problem advice please

[hddhelp]

why not let craig6928 speak for himself? Or are you lives so boring you simply try to do other peoples talking for your pwn pleasure?

Anyway, what is the 6928 for? Weight maybe??

[craig6928]

If you have the tools to clear glist, havent you got the tools to recover in a non-windows environment?

yes we do have standalone machine and allso the hie tool from russia

these are seen by the machine

when you do a recovery the drive fine around 30gb worth of data

but when you do a recovery all it recovers is winzip and cab files
which are zero data.

the g list is not at fault no errors and does not need recovering at all

the smart error is simply the drive is failing

what we are seeing is that the drive has failed with to many errors on the platter.
beyond the recovery.

mhdd does pick the drive up fine and it does fine the errors and scans away.
but there red blocks and the errors run into about 700 errors

it looks like that the customer had the drive somewhere and the company removed the pcb board
and the data has been destroyed forever

[hddguy]

but when you do a recovery all it recovers is winzip and cab files
which are zero data.

it looks like that the customer had the drive somewhere and the company removed the pcb board
and the data has been destroyed forever

Are you even sure the disk has a Windows OS on it?

Also cant you create a clone of the disk, then seek shift points using DE? If the PCB is not original then all adaptive data and defect information will not be native information causing shifts in data, but if disk works well enough to be accessible, surely a image and translator recovery within UDMA DE could be possible?

[HDD Spaz]

Is it possible the data has encryption? A raw data scan will find some data if data has shifted.

If no data can be found following full clone and raw data scan

1. Data is Encrypted.

or

2. Data has been wiped.

[hddguy]

He says in his post he has recovered winzip and cab files, though the files are empty the signitures would have been identified indicating the disk is not zeroed. Could be encrypted though. Ive lost count of the ammount of times a client of mine has 'forgotten' to mention they have encrypted their media!!

[pcimage]

Sounds a bit like some Sandisk memory sticks I've come across.

Sandisk Cruzers usually.

Remove the chip(s), read the data off, unscramble the block order and extract the data to an image, and it all looks garbage (No FAT anything)

Run raw recovery and all it finds is one ZIP file (that is all, absolutely nothing else) which is perfectly readable and contains the Sandisk "U3" software, and it extracts and runs perfectly.

It appear that this pre-installed software encrypts the users data, unbeknownst to him/her!

Nasty

[hddguy]

That is nasty

[craig6928]

tried to do a forensic copy but no look at all
just stays zero with errors on the drive .

look like it just bad media with to many errors

any other ideas guys