ST2000LM007 cloned but no file works

[Pandemicc]

OK, just upload a couple of JPEGs.

Here it is: https://we.tl/t-CZgLaCA7VE

[fzabkar]

I tried a few JPEGs. None have a JPEG signature. They all look like the first few sectors have been stripped from the file. The Sony JPEG contains a small 160x120 thumbnail image.

The MP4 files also appeared to be affected in the same way.

I don't understand how any software, especially R-Studio, could make such a mess out of file carving. :-?

Last edited by fzabkar on December 5th, 2024, 17:44, edited 1 time in total.

[Pandemicc]

I tried a few JPEGs. None have a JPEG signature. They all look like the first few sectors have been stripped from the file. The Sony JPEG contains a small 160x120 thumbnail image.

I don't understand how any software, especially R-Studio, could make such a mess out of file carving.

what are your thoughts? I would really love to learn more about this case of mine

[fzabkar]

I have no explanation for your results.

Try different software, eg DMDE. Also, try R-Photo.

To see the problem for yourself, examine the headers of good JPEG and MP4 files, and compare them against your bad ones.

HxD is a freeware hex editor:

https://mh-nexus.de/en/hxd/

[Pandemicc]

I have no explanation for your results.

Try different software, eg DMDE. Also, try R-Photo.

To see the problem for yourself, examine the headers of good JPEG and MP4 files, and compare them against your bad ones.

HxD is a freeware hex editor:

https://mh-nexus.de/en/hxd/

R-photo couldn't find anything, not a single thing. I will try DMDE

[Pandemicc]

I don't understand how any software, especially R-Studio, could make such a mess out of file carving.

DMDE actually worked, found many files and folder names intact. how and why r-studio failed in a case like this? I feel like I won't be buying rtt software anymore

[pepe]

try an older version, it might be a bug or something... or misuse?

[Pandemicc]

try an older version, it might be a bug or something... or misuse?

I've been using it for more than a year, I had many successful recoveries

[fzabkar]

I can't explain why R-Photo found no signatures, but R-Studio seems to be offsetting the first cluster of the file by 64 sectors. It seems to be finding the directory records of each file. These records contain the file name, file size and starting cluster. Since the file system metadata have been destroyed, R-Studio would need to calculate the LBA of the first cluster in the file system and then offset the starting cluster of each file relative to this. Maybe that's where it is going wrong? Is it time to submit a bug report?

[Pandemicc]

I can't explain why R-Photo found no signatures, but R-Studio seems to be offsetting the first cluster of the file by 64 sectors. It seems to be finding the directory records of each file. These records contain the file name, file size and starting cluster. Since the file system metadata have been destroyed, R-Studio would need to calculate the LBA of the first cluster in the file system and then offset the starting cluster of each file relative to this. Maybe that's where it is going wrong? Is it time to submit a bug report?

I e-mailed them about this yesterday, they keep insisting that I am doing something wrong. Still an ongoing discussion

[Arch Stanton]

Yeah, the JPEGs are full of JPEG data, but as Franc says, no "header".

Does JpegDigger detect JPEGs? Let the tool detect cluster size. If it takes > half hour then there's probably no file signatures.

[Pandemicc]

Yeah, the JPEGs are full of JPEG data, but as Franc says, no "header".

Does JpegDigger detect JPEGs? Let the tool detect cluster size. If it takes > half hour then there's probably no file signatures.

I do not know about JpegDigger, DMDE already did the job. But I can test it if you like, Dr. Tuna

[Arch Stanton]

Yeah, the JPEGs are full of JPEG data, but as Franc says, no "header".

Does JpegDigger detect JPEGs? Let the tool detect cluster size. If it takes > half hour then there's probably no file signatures.

I do not know about JpegDigger, DMDE already did the job. But I can test it if you like, Dr. Tuna

Oh sorry, missed that. I responded to a post @ Reddit, https://www.reddit.com/r/datarecovery/c ... _recovery/

[fzabkar]

@Pandemicc, can you show us the Partitions tab in DMDE?

[Pandemicc]

@Pandemicc, can you show us the Partitions tab in DMDE?

sure, here https://imgur.com/a/iMFRfMt

[fzabkar]

I was wondering if DMDE would find the old exFAT volume at a different location. Apparently not.

[fzabkar]

It's curious that your exFAT volume begins at sector 64. Is that just a coincidence?

[Pandemicc]

It's curious that your exFAT volume begins at sector 64. Is that just a coincidence?

I have no idea, I would love to provide more information if needed

[fzabkar]

I'm wondering whether the original configuration was a "super floppy" with a boot sector at LBA 0. A subsequent repartition and reformat would destroy the boot sector, and perhaps R-Studio then assumes that LBA 64 is the original boot sector location. This 64-sector offset would account for the loss of the first 64 sectors of every recovered file.

You could examine LBA 0 to LBA 63 and look for non-zero sectors. If you find something, you could carve out that area and upload it. DMDE has a Tools -> Copy Sectors function for this purpose.

[Pandemicc]

I'm wondering whether the original configuration was a "super floppy" with a boot sector at LBA 0. A subsequent repartition and reformat would destroy the boot sector, and perhaps R-Studio then assumes that LBA 64 is the original boot sector location. This 64-sector offset would account for the loss of the first 64 sectors of every recovered file.

You could examine LBA 0 to LBA 63 and look for non-zero sectors. If you find something, you could carve out that area and upload it. DMDE has a Tools -> Copy Sectors function for this purpose.

That is something that I am very much not familiar of, Im going to need more guidance