Hitachi HTS5... 500G Strange Files after Recovery

[hddnoob]

I have been trying to recover a 500g Hitachi drive that seems to be formated, there was about 50G of data on the disk orginally, and was mixed file data, word, apps, photos etc.

When I perform a recovery using a number of tools, testdisk, getdata back etc. Each of the scans I do are deep scans 8+ hours.

When the the scans complete the only files that are available are a bunch eula files, and there is no trace of the orginal data. Has any one encountered this before?

[Vulcan]

I have been trying to recover a 500g Hitachi drive that seems to be formated

You seem to be unsure of the history of what's been done to the drive. I suggest that (if possible) you ask the customer / original owner exactly what they did which may have erased the data, which OS they used to do it, and what else they did afterwards, before you got the drive.

A full format by Windows Vista or Win 7 will erase data - but that doesn't explain any files being found at all, hence my suggestion as to what questions you ask the customer / original owner. I suspect there is more to this story, then just one action having been done.

[hddnoob]

Thanks for your reply. The data was from xp environment, then user upgraded to Win7, tried to remount disk and then did a quick format. Blind clicking apparently.

I thought although you have performed a quick format you should with a descent recovery tool, still be able to recover some of the orginal files minus obviously the structure and depending on the sw files names etc etc.

I have done a various amount of scans but no luck. I hope that sheds some more light on the situation. Also no new data has been written to the drive.

[Vulcan]

Thanks for your reply.

The data was from xp environment, then user upgraded to Win7

Do you mean that they installed Win7 on this disk? If so, how is the disk partitioned now - 1 big partition or multiple? How was it partitioned under WinXP - 1 big partition or multiple? Or did they upgrade Windows on a different disk, and (so they say) leave this one intact at that point?

tried to remount disk

What exactly do you mean by that? I know what I would mean by that description in a *nix context, but I don't know how someone "remounts" a disk on Windows - unlike *nix, there is no explicit "mount" command in standard Windows...

and then did a quick format. Blind clicking apparently.

I suspect you're being misled, and it was a full format which they did - as you said, under Win7.

I thought although you have performed a quick format you should with a descent recovery tool, still be able to recover some of the orginal files minus obviously the structure and depending on the sw files names etc etc.

Basically correct - hence why I don't believe that it was a quick format which they did under Win7.

I hope that sheds some more light on the situation.

Yes thanks.

Also no new data has been written to the drive.

Please explain more about the "eula" files you said were found during a scan by recovery s/w. What do they contain? I'm not familiar with "eula" except as a type of license. My point is that after a Win7 full format, there should be nothing recoverable, so recovery s/w finding anything at all, is unexpected.

My main suggestion is that you have a good browse of the disk with a hex editor (in read-only mode, just to be safe). Do you find it full (or almost full - depending on what we can understand about these "eula" files) of hex 00 bytes in every sector? If so, it's almost certainly had a Win7 full format and is unrecoverable - the only mystery would then be these "eula" files. Hope that helps.

[hddnoob]

The OS is on a seperate disk, SSD. The Hitachi is/was used as seperate storage device and was a single partition. And I am recoverying to another External HDD. Had a look through HxD Hex tool and the disk is definatley not zero'd. But I think its all these eula file and junk...

I have been looking into these files and some of the txt files are in multiple languages. Exctracts bellow..... completly random junk....

08-956D-1752CD7F7E5A};{E2019D64-E819-3B4F-9C85-95BE2688ABF9};{F750C986-5310-3A5A-95F8-4EC71C8AC01C};{3ABC7CFA-A6F5-3870-A59C-B856DA1DA4F4};{95B012AD-3A4A-31D7-9167-5D07D2A71F47};{780262B9-4578-3727-97D3-62DE7B9F5F82};{0F5B4A82-9DAF-3D13-8CB8-AEB25E4A614E};{8FC35EC2-F690-3417-8175-ED16EC771126};{FD031145-2925-3FEF-9A4E-64047AAD8951};{32714140-CBC5-3FAF-BFC2-3A7376C3EECF};{B26FE5DE-6EC1-39B3-8FD2-4C1C8AB5ADD6};{2617FA1F-0C04-3ABB-AF64-7D5B6620C341};{A3499A41-41EA-3567-977C-29E9E226A360};{321320E1-0E5A-36CB-9E52-F3B201B8C4D4};{20A15757-4AE4-3C82-9711-863C84AFE6AA};{F855451C-21E2-3034-B042-E1E66923548A};{5208FDB2-D561-3FB4-9763-6B10B06745B7};{C60AAF4C-A72C-36E0-8CA4-41FF753D74F6};{B1EEC87C-E30F-3BAD-9D3C-F225873EC0CF}


ATCHNEWPACKAGECODEPATCHNEWSUMMARYSUBJECTSecurity Update for Microsoft .NET Framework 4.0 - KB2518870PATCHNEWSUMMARYCOMMENTSKB2518870

الرجاء ملاحظة ما يلي: ترخص لك شركة Microsoft Corporation (أو إحدى الشركات التابعة لها حسب محل إقامتك) هذا البرنامج الملحق. ويجوز لك استخدامه مع كل نسخة سارية الترخيص من برامج نظام تشغيل Microsoft Windows (حسبما ينطبق عليه هذا البرنامج الملحق) (والمُشار إليها لاحقًا باسم "البرنامج"). ولا يجوز استخدام البرنامج الملحق إذا لم يكن لديك ترخيص للبرنامج. تنطبق شروط ترخيص البرنامج على استخدامك لهذا البرنامج الملحق. توفر Microsoft خدمات الدعم للبرنامج الملحق كما هو موضح على www.support.microsoft.com/common/international.aspx.

請注意：Microsoft 公司 (或其關係企業，視　貴用戶所居住的地點而定) 授權　貴用戶使用本增補程式。　貴用戶擁有之每份有效授權的 Microsoft 軟體(適用本增補程式之軟體) （「軟體」），均得使用一份 Microsoft Visual Studio 2010 or Microsoft Windows operating system 增補程式。若　貴用戶未取得軟體授權，即不得使用本增補程式。使用本增補程式時，亦須遵守軟體之授權條款。Microsoft 為「增補程式」提供支援服務之相關說明，請參閱 www.support.microsoft.com/common/international.aspx。

There are hundreds of these random files. CAB, txt, rtf, jpegs.... all file types and random sizes up to 3GB. But I have no idea what this data relates to. Nothing has been installed on this drive and was only to copy data to as a backup to prepare for windows re-image.

I am at a loss.

[Nick_CT]

Please explain more about the "eula" files you said were found during a scan by recovery s/w. What do they contain? I'm not familiar with "eula" except as a type of license.

I would imagine they're just end user license agreement text files. I got a drive in last week which had about 20 of these on the root.

[pcimage]

I had a similar thing about a year or so ago, client claimed they were running XP then upgraded to Win7.

After that the PC ceased to work.

We got the HDD and it cloned 100% with no problems, but ZERO actual data on the drive although we could see tons of apparent "data" on it with Winhex.

It looked very much like an encrypted drive (e.g. Bitlocker, Truecrypt) but no such signatures anywhere, and client swears they didn't encrypt it.

Maybe W7 tried to Bitlocker the drive and failed?

Probably wasn't getting the full story from the client as usual. Like the other day we had a drive that clearly had bitlocker encryption. Client denied it vehemently and refused to admit it and would not give us the unlock key, claiming they never got one. After asking them 5 times at least and getting a different lie each time, we told the them they weren't getting their data back but still being charged for the physical part of the recovery, the unlock key magically appeared from them by email!! They got their data.

[Alt(R-TT)]

Thanks for your reply. The data was from xp environment, then user upgraded to Win7, tried to remount disk and then did a quick format. Blind clicking apparently.

Maybe, Specifics of File Recovery After a Quick Format can give a clue?

[hddnoob]

Hey All, Thanks for your replies. Looks like I will need a lab, no software tools work and cant seem to find answer.

[Vulcan]

@hddnoob:

Thanks for the xtra info, but your latest comments now seem to be contradicting some comments from your first post, so the end result is that I'm now unsure which of your comments are true and which are not (or which are unclear/musunderstood) - end result is that I can't help on a situation I don't understand. A few brief comments below...

But I think its all these eula file and junk...

Without seeing the disk, IMHO it's really difficult to know what you mean I strongly suspect you are not being given the whole story - and therefore can't give the whole story to us. If the customer is, as you say, capable of "blind clicking" resulting in (what they claim was) a quick format, then you (and we) can't know what else was done by "blind clicking", can we?!

Exctracts bellow..... completly random junk....

It's not completely random, and I bet that the hex looked rather different (i.e. I expect you've just shown the text, but that there were other unprintable characters in the files).

What those examples do show, is that the filesystem / disk is not encrypted - if it was encrypted, there would be no readable text.

There are hundreds of these random files. CAB, txt, rtf, jpegs.... all file types and random sizes up to 3GB.

At the beginning, you said that the "deep scans" were showing only "eula" files - now you're saying that there are other file types too (though you don't explain if these are only "recovered" by a deep scan or using another method). So how do you know that these files you mentioned weren't the original files?

Anyway, I see you mention that you're stopping working on this and will outsource it, so good luck