Seagte 2TB with scrambled data

[odedshankar]

Hi Folks,

I got a 2TB seagate drive with a logical problem.
Customer says that it was in a windows PC as internal drive and someone formatted it and now there is nothing there.
I looked into it and the drive is physically good and currently has a NTFS empty partition.
Opening the drive in WINHEX i see data all over the drive but when i do i deep scan with R-STUDIO, Stellar etc. it can't find any files shows blank even in RAW Recovery.
That's quite weird and i suspect Encryption but user is not aware of any.
Is there a way to identify an encryption type by some signature?

[dmarques]

Hi,

It could be encryption or someone messed with it before you.
Did you scan the whole drive to find raw data and nothing found?
What was the file system before?

[pcimage]

Probably Windows 7 encryption (Bitlocker)

Was the PC set up for him by someone else? Maybe they enabled Bitlocker?

[odedshankar]

it was win 7 but he doesn't know if they sey bitlocker on, is there a way around that?

[einstein9]

Hi Folks,

I got a 2TB seagate drive with a logical problem.
Customer says that it was in a windows PC as internal drive and someone formatted it and now there is nothing there.
I looked into it and the drive is physically good and currently has a NTFS empty partition.
Opening the drive in WINHEX i see data all over the drive but when i do i deep scan with R-STUDIO, Stellar etc. it can't find any files shows blank even in RAW Recovery.
That's quite weird and i suspect Encryption but user is not aware of any.
Is there a way to identify an encryption type by some signature?

take screenshot by winhex of ur hdd (beginning) n [aste here

[odedshankar]

the drive was quick formatted and has new NTFS partition on it which is empty.
Which LBA's should i capture in the screenshots?

[dmarques]

One that is not part of the new partition.

[einstein9]

the drive was quick formatted and has new NTFS partition on it which is empty.
Which LBA's should i capture in the screenshots?

sorry did not pay attention to the format issue

if r-studio did not find anything , try to see if you can get any RAW data (working files)

and let us know


forgot to mention, if drive was Encrypted by BitLocker, and been quick formatted, then no need for all of this
its all gone (based on my tests here)

good luck

[fzabkar]

If it's using 128-bit AES encryption, then there will be a repeating pattern of 16 bytes wherever there are blocks of encrypted zeros. If the volume was full formatted as an encrypted volume, then I would expect to see these repeating patterns near the end of the drive, before the backup NTFS boot sector.

[odedshankar]

i did a deep scan it with r-studio and few more software suite and all found nothing.
Same result with raw recovery attempt.
So i guess its all gone.

[odedshankar]

Here is a screenshot.

Attachments

[BlackST]

the drive was quick formatted and has new NTFS partition on it which is empty.

forgot to mention, if drive was Encrypted by BitLocker, and been quick formatted, then no need for all of this
its all gone

Word !

[fzabkar]

Here is a screenshot.

This sector is in the data area. Instead I would go to the very last sector and work backwards. Look for sectors containing a repeating pattern of 16 bytes.