Looking for suggestions on recovering an encrypted drive

[stozin]

sorry for the long delay in replying - I had some traveling to do lately and didn't get a chance to really hit this forum
So after attempting some restores of files using a variety of programs, I managed to put a few in the attached zip file. I was unable to attach, say, the .jpgs individually as the forum was unable to determine the dimensions of the images (and they are not viewable in Windows)
I also attached some .mp3s that the restore program said were recovered but were not playable at all. I'm also going to try some of the apps fzabakar mentioned earlier now that I'm back home

Attachments

uno9.zip

(313.5 KiB) Downloaded 343 times

[fzabkar]

Your files do not appear to be encrypted, but they do appear to be corrupt, or incorrectly recovered.

For example, here is a section from akeah.jpg:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00002A90  B4 04 B5 04 B6 04 B7 04 B8 04 B9 04 BA 04 BB 04  ´.µ.¶.·.¸.¹.º.».
00002AA0  BC 04 BD 04 BE 04 BF 04 C0 04 C1 04 C2 04 C3 04  ¼.½.¾.¿.À.Á.Â.Ã.
00002AB0  C4 04 C5 04 C6 04 C7 04 6E 74 6F 73 6B 72 6E 6C  Ä.Å.Æ.Ç.ntoskrnl
00002AC0  2E 65 78 65 00 45 78 41 63 71 75 69 72 65 46 61  .exe.ExAcquireFa
00002AD0  73 74 4D 75 74 65 78 55 6E 73 61 66 65 00 45 78  stMutexUnsafe.Ex
00002AE0  49 6E 74 65 72 6C 6F 63 6B 65 64 41 65 64 45 78  InterlockedAedEx
00002AF0  63 68 61 6E 74 61 74 69 73 74 69 63 00 45 78 49  chantatistic.ExI

Moreover, the sizes of the files and their compression ratios suggests that, even if some were encrypted, they are not MP3s or JPEGs.

[kyriakosxn]

if you can see the partitions and files on your drive but files has no valid content, then you may got infected by cryptlocker virus. I have seen similar cases.
CryptLocker is a file-based encryprion virus which encrypt all the data on your HDD.
Please give a look here: http://en.wikipedia.org/wiki/CryptoLocker

[dick]

if you can see the partitions and files on your drive but files has no valid content, then you may got infected by cryptlocker virus. I have seen similar cases.
CryptLocker is a file-based encryprion virus which encrypt all the data on your HDD.
Please give a look here: http://en.wikipedia.org/wiki/CryptoLocker

Hi that would have been a good call, and even I was thinking that was a maybe, except in his first post it was stated the drive failed in 2006 and was in storage until it was sent for imaging last year. I don't think Cryptolocker or anything like it was around at that time.

[labtech]

Since the MBR looks correct, then any decent software should be able to build the file tree for each of the partitions. Can you post a picture of the file tree structure for each of the partitions?

Also, since you said that wherever the drive was sent to determined the drive had an electronics issue, then that should have not had any impact on the logical structure.

You mentioned a cheap enclosure of some sort was used to connect this drive. Can you describe this adapter in more detail? What is the model, brand, etc?

Let's assume the drive is not encrypted. You can use software to run a keyword search in the RAW data for some common words that any set of data would contain. If you get no hits in the search for several words, the drive is likely encrypted.