HTS543232A7A384

[unknown]

Hello
Very strange case
Drive in topic came for data recovery.
All sectors shows LBA number.
See the attached example sector :

Attachments

40000000-40000000.rar

(145 Bytes) Downloaded 293 times

[pepe]

apparently overwritten. Not much to recover from here...
What's the story according to the client?
pepe

[unknown]

apparently overwritten. Not much to recover from here...
What's the story according to the client?
pepe

The client said that he didn't give it to any company before, after diagnosing ( head 0 dead )
Full resources backed up.
Creating head map.
Start to image with the good head ( H 1 )
Noticed that there's something wrong with sectors.
Randomly checked and I found that weird.

Any ideas?

[Lardman]

Assume the timestamp is from before you were given the drive, at least you can give the client a date and time for when things went wrong.

Is there anything in the early LBA's to give an indication of what software may have been used.

[unknown]

Assume the timestamp is from before you were given the drive, at least you can give the client a date and time for when things went wrong.

Is there anything in the early LBA's to give an indication of what software may have been used.

I already called the client.

The problem that H 0 is dead.
I wonder which software did that.

Is it worth to give a try to replace heads and see which content side 0 have ?

[Lardman]

Id finish cloning H1 and check in a lot more places throughout the drive. If it's consistent you've got to think it was intentionally wiped, especially if the timestamp is before you were given the drive. But you may just be checking in a wiped file location.

2 heads on a 320gb drive if H1 is all wiped then there's very little chance of getting anything of any size off the drive, depends what the customer is asking for - jpegs and documents you might get some but movies and music etc not likely to get anything useable. Having said that I'd be replacing it just to find out

[unknown]

Id finish cloning H1 and check in a lot more places throughout the drive. If it's consistent you've got to think it was intentionally wiped, especially if the timestamp is before you were given the drive. But you may just be checking in a wiped file location.

2 heads on a 320gb drive if H1 is all wiped then there's very little chance of getting anything of any size off the drive, depends what the customer is asking for - jpegs and documents you might get some but movies and music etc not likely to get anything useable. Having said that I'd be replacing it just to find out

Yeah me too, I am curious

[Lardman]

As an after thought - try a pcb swap just in case, it can't hurt.

[pepe]

can't hurt but won't help

[unknown]

Also H0 Except 0 and 2048

Attachments

Sectors.rar

(1.15 KiB) Downloaded 281 times

[unknown]

Some one used HDAT

[fzabkar]

Code:

LBA:0                  block: 0
Disk identifier (Windows):
DE2BBC42h
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
80h 07h NTFS/exFAT:   0  32 33 :   6 127 57 :      2048:    102400:  52.4 MB
00h 07h NTFS/exFAT:   6 127 58 :1023 254 63 :    104448: 243537920:   125 GB
00h 0Fh EXTx      :1023 254 63 :1023 254 63 : 243642368: 348626944:   178 GB
00h 17h NTFS/exFAT:1023 254 63 :1023 254 63 : 592269312:  32872448:  16.8 GB
MBR signature (0xAA55):
AA55h

I would examine the boot sectors of the other partitions, eg 104448, 592269312.

FWIW, I calculated the data transfer rate at 8.7 MBps.

https://ipv4.google.com/search?q=(40000000+-+2051)+x+512+bytes+%2F(12+hours+%2B+55+minutes+%2B+28+seconds+-+12+hours+-16+minutes+-+8+seconds)+in+megabytes+per+second