It reminds me of this weirdness I had (starting from post #9) :
viewtopic.php?f=1&t=36574Same scenario : Windows supposedly reinstalled over old data, then absolutely nothing could be extracted (using R-Studio and Photorec) beyond the new Windows files, despite the fact that the whole unallocated space was full of “something”. Yet the owner did not set any kind of encryption scheme (at least actively / purposely). I still have no explanation for this.
In R-Studio (and for “raw file carving” in general) it's a good practice to uncheck the file types that are unlikely to be found in a particular drive (Settings => Known file types), since the default list is unnecessary cluttered, so as to avoid getting too many false positives, i.e. “garbage” files which are erroneously detected based on fake “signatures” randomly found in the stream of data, which can be 1) part of valid files (for instance there can be a random JPG signature in the middle of a valid MP4 file – obviously that JPG file won't be readable, and in some cases the valid file may be truncated as a result, even though it was not fragmented and could have been recovered fully – although R-Studio is constantly improving and is pretty good at avoiding this, it still happens {*}), 2) remnants of older files which can no longer be fully recovered, 3) encrypted data. Better stick to the most common and most important file types (JPG, DOC/DOCX, XLS/XLSX, ODT/ODS, PDF...), then only if a client needs a particular uncommon type of files, and if the filesystem is too damaged to recover them based on metadata / file records with their original attributes and directory structure and full cluster list (very important in case of fragmentation), should you check them in the list (and warn the client that files recovered that way have a low probability of being 100% valid, especially large files, if the drive was nearly full and its contents were constantly changing). Or, conversely, if a client doesn't know what PBM / PGM / PPM files are, you probably shouldn't bother about those...
{*} With Photorec it's more frequent in my experience (even though it's still excellent for a freeware, and has even been compared favorably to very expensive file carving softwares); for instance I've seen perfectly valid and non fragmented video files be either truncated when a fake JPG signature was found inside, or missing small chunks of a few KB corresponding to fake MP3 files, and only after unchecking JPG and MP3 in the list of detected file types were those files flawlessly recovered...
FAQ
Search
Login
Register
HDDGURU FILES
