Data recovery Western Digital

[cavemanhg]

Hi. I'm in the final stages of trying to recover some photos for a friend from their WD drive. I'm not after any ninja ripping apart of the drive, purely looking for a software solution.

I was given the drive with a "I stopped working, it might have been a virus..."

I tried with various partition recovery and unerasers (commercial and free) with no joy. I've been playing for a couple of weeks and this is a last ditch plea before I simply re-install and accept the data as lost. Below are a sequence of shots showing the hex view of the drive. As you can see there is the note about this not being a boot drive, lots of nothing, then the rest of the drive is filled with "FF". I have run the Full Western Digital scan in DOS and the drive is flawless... any idea what has happened (it appears that something has physically overwritten the drive with "ones" from about sector 2015 onwards to the end of the drive. Is there anyway to recover this 'at home' (not worth the lab costs - it's photos )


Front of the drive:



Zeros:


And for completeness - Ones?:



Am I doomed?

[itconcept]

Try with R-Studio software.

[petkus]

Try PhotoRec

[cavemanhg]

Thanks for the quick replies, I'm not sure PhotoRec will have any effect as it recovers files that are still present on the drive, having had their metadata removed (or if the FAT is corrupted for example...) - from their site:

For example, PhotoRec identifies a JPEG file when a block begins with:

* 0xff,0xd8,0xff,0xe0
* 0xff,0xd8,0xff,0xe1
* or 0xff,0xd8,0xff,0xfe

I'll give it a go - but as you can see in my screen-shots - there is nothing on the drive apart from "FF" and "00" - so unless that is a read error (I've tried several different raw drive readers in DOS and Windows and they all show the same pattern) I'm not sure PhotoRec will find anything

R-Studio looks excellent, and I will definitely be keeping for future use (thanks) but again I suspect it will have no effect - I used the HEX/Text viewer on the WD drive and it also shows most of the drive as having been written to binary "1" - it does indeed appear that a virus has overwritten the entire drive - haven't seen that since the early DOS viruses

I'm running a scan but not holding my breath.

I'm pretty sure the data is unrecoverable - I don't suppose there is a software solution to 'un-write' bits the way they can in a lab?

[pepe]

I pretty much convinced that this one is not recoverable. And if the data was overwritten, no lab will be able to recover it either.

pepe

[drc]

'un-write' bits the way they can in a lab?

This is not accurate... if the drive is full of FF then there is nothing on your drive anymore except FF

[quasimodo]

Unfortunately it's bye, bye data

[cavemanhg]

'un-write' bits the way they can in a lab?

This is not accurate... if the drive is full of FF then there is nothing on your drive anymore except FF

Forensic recovery allows them to analyse the drive and effectively 'unwrite' the recent change by examining the charge on the platter - minute variations in the alignment of the bits can indicate the previous state of that bit... but we're not looking to spend quite that much...

[hddguy]

'un-write' bits the way they can in a lab?

This is not accurate... if the drive is full of FF then there is nothing on your drive anymore except FF

Forensic recovery allows them to analyse the drive and effectively 'unwrite' the recent change by examining the charge on the platter - minute variations in the alignment of the bits can indicate the previous state of that bit... but we're not looking to spend quite that much...

Who is 'them'? Show me one company that is able to do this...

[drc]

Forensic recovery allows them to analyse the drive and effectively 'unwrite' the recent change by examining the charge on the platter

I understand the concept, but nobody actually does this.