ST2000LM007 cloned but no file works

[pepe]

That is something that I am very much not familiar of, Im going to need more guidance

read File System documentations, check out some working file systems in hex editor to identify main concepts, etc. No guidance can save you the efforts you need to put in learning on your side. One question answered rises a few more questions.
... if you are really interested how things work... Yes, you will need a few days to get a grip of the concepts and it will get a bit easier as you proceed.
FAT file systems are pretty easy ones, good to start with. However, if you are not familiar with the very basics of information technology (bit, byte, word, endianness, logic operations(AND, OR, XOR, shifting), i would recommend looking into that first.
while writing this i realized that i have about 36 yrs of background, so things i think being trivial may not be so. But there's no other way...

[Pandemicc]

That is something that I am very much not familiar of, Im going to need more guidance

read File System documentations, check out some working file systems in hex editor to identify main concepts, etc. No guidance can save you the efforts you need to put in learning on your side. One question answered rises a few more questions.
... if you are really interested how things work... Yes, you will need a few days to get a grip of the concepts and it will get a bit easier as you proceed.
FAT file systems are pretty easy ones, good to start with. However, if you are not familiar with the very basics of information technology (bit, byte, word, endianness, logic operations(AND, OR, XOR, shifting), i would recommend looking into that first.
while writing this i realized that i have about 36 yrs of background, so things i think being trivial may not be so. But there's no other way...

I thought that there may be other methods, I kind of knew about hex comparison. Yes you make it sound easy sir, 36 years is too much ahah

[fzabkar]

@Pandemicc, your DMDE screenshot shows an .img file. You can use a hex editor to carve out the region from 0 to 0x7FFF.

https://mh-nexus.de/en/hxd/

My hypothesis is that your old and new exFAT volumes start at LBA 0 and LBA 64, respectively. R-Studio thinks they both start at LBA 64.

[pcimage]

I've had good results with ReClaime on formatted exFAT drives.

Had one recently where both R-Studio and even UFS Pro produced garbage results, but ReClaime got virtually all data back perfectly.

Probably ReClaime goes about it a different way? It was noticeably slower than the others as it gradually rebuilt the file structure on-the-fly

[fzabkar]

AIUI, the OP has already recovered the data with DMDE. If we could see the contents of sectors 0 to 63, I suspect that we will find old exFAT metadata. However, I'm not sure that the OP understands how to carve out this area.

[Arch Stanton]

I've had good results with ReClaime on formatted exFAT drives.

Had one recently where both R-Studio and even UFS Pro produced garbage results, but ReClaime got virtually all data back perfectly.

Probably ReClaime goes about it a different way? It was noticeably slower than the others as it gradually rebuilt the file structure on-the-fly

Vital in FS recovery is determining offset to filesystem + cluster factor. About every tool can scan for directories and get start clusters for files, but without correct offset to filesystem and blocksize these are useless. If a tool gets garbage results it got one of those two parameters or both of them wrong.

[fzabkar]

Here is an unusual case of a ROM based FAT file system with a sector size of 1024 bytes and no 0x55AA signature in the boot sector:

https://www.eevblog.com/forum/repair/what-more-i-can-do/msg5749037/#msg5749037

https://www.eevblog.com/forum/repair/what-more-i-can-do/?action=dlattach;attach=2462675

This freeware tool (ImDisk Toolkit) was able to mount it under Windows:

https://sourceforge.net/projects/imdisk-toolkit/

The full package supports the following image file formats (non exhaustive list):

- vhd, vdi and vmdk (static, dynamic and vmdk multipart)
- raw formats (img, ima, raw, vfd...)
- iso, nrg, bin (read-only, and some bin files only)
- dmg, sdi (some versions only)

Some other formats may work but require tests, and the non Windows file systems may need additionnal drivers.

[Pandemicc]

I've had good results with ReClaime on formatted exFAT drives.

Had one recently where both R-Studio and even UFS Pro produced garbage results, but ReClaime got virtually all data back perfectly.

Probably ReClaime goes about it a different way? It was noticeably slower than the others as it gradually rebuilt the file structure on-the-fly

even UFS? wow! I always thought that the UFS is the mother of all.

[Pandemicc]

AIUI, the OP has already recovered the data with DMDE. If we could see the contents of sectors 0 to 63, I suspect that we will find old exFAT metadata. However, I'm not sure that the OP understands how to carve out this area.

yes DMDE already did the job but I would love to carve out sectors and provide more information, I just do not know how

[Arch Stanton]

I've had good results with ReClaime on formatted exFAT drives.

Had one recently where both R-Studio and even UFS Pro produced garbage results, but ReClaime got virtually all data back perfectly.

Probably ReClaime goes about it a different way? It was noticeably slower than the others as it gradually rebuilt the file structure on-the-fly

even UFS? wow! I always thought that the UFS is the mother of all.

At some point tools have to decide on cluster-factor and filesystem offset. Any tool can make a mistake, thinking one specific tool is above that is foolish. Now assume boot sector, backup boot sector, FAT and all that is gone/wiped/overwritten you lose everything that can give easy clues so you basically have to take directory structures that you find, say pointing to start clusters of JPEGs > make assumptions about data area offsets + cluster size and see if you can find FF D8 FF headers. Or variant, take startclusters and cross reference against file headers you find. But if all files found through file system are corrupt then chances are FS start and/or clustersize was wrong.

[fzabkar]

At some point tools have to decide on cluster-factor and filesystem offset. Any tool can make a mistake, ...

ISTM that an intelligent user could determine where the original boot sector was located and then insert a dummy at that location.

[fzabkar]

yes DMDE already did the job but I would love to carve out sectors and provide more information, I just do not know how

Open you image file in HxD.

https://mh-nexus.de/en/hxd/

Edit -> Select Block

start offset = 0
length = 8000
radio button = hex
OK

Edit -> Copy
File -> New
Edit -> Paste insert
File -> Save as

ZIP your file and upload it here.

[Arch Stanton]

At some point tools have to decide on cluster-factor and filesystem offset. Any tool can make a mistake, ...

ISTM that an intelligent user could determine where the original boot sector was located and then insert a dummy at that location.

Yes, or you can 'virtually' enter the values in DMDE > tools > reopen volume parameters.

fat32bs.png (5.65 KiB) Viewed 6223 times

[Pandemicc]

yes DMDE already did the job but I would love to carve out sectors and provide more information, I just do not know how

Open you image file in HxD.

https://mh-nexus.de/en/hxd/

Edit -> Select Block

start offset = 0
length = 8000
radio button = hex
OK

Edit -> Copy
File -> New
Edit -> Paste insert
File -> Save as

ZIP your file and upload it here.

I hope I did it right, only three lines contains data. https://we.tl/t-6abNFhG7VW

[fzabkar]

There is only a new partition table. There are no old metadata.

[Pandemicc]

There is only a new partition table. There are no old metadata.

Disk was formated, hence my recovery adventure. could it be because of that?

[fzabkar]

There is only a new partition table. There are no old metadata.

Disk was formated, hence my recovery adventure. could it be because of that?

It would have been the repartitioning rather than the reformatting that destroyed the old metadata.