All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 12 posts ] 
Author Message
 Post subject: HTS543232A7A384
PostPosted: September 15th, 2021, 10:03 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1527
Hello
Very strange case
Drive in topic came for data recovery.
All sectors shows LBA number.
See the attached example sector :


Attachments:
40000000-40000000.rar [145 Bytes]
Downloaded 67 times
Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 10:48 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 3724
Location: Hungary
apparently overwritten. Not much to recover from here...
What's the story according to the client?
pepe

_________________
Adatmentés - Data recovery
No bitcoin donations :)


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 11:28 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1527
pepe wrote:
apparently overwritten. Not much to recover from here...
What's the story according to the client?
pepe

The client said that he didn't give it to any company before, after diagnosing ( head 0 dead )
Full resources backed up.
Creating head map.
Start to image with the good head ( H 1 )
Noticed that there's something wrong with sectors.
Randomly checked and I found that weird.

Any ideas?


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 11:40 
Offline

Joined: November 7th, 2020, 5:31
Posts: 425
Location: The_UK
Assume the timestamp is from before you were given the drive, at least you can give the client a date and time for when things went wrong.

Is there anything in the early LBA's to give an indication of what software may have been used.

_________________
Properly, Quickly, Cheaply - Pick any two.


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 11:49 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1527
Lardman wrote:
Assume the timestamp is from before you were given the drive, at least you can give the client a date and time for when things went wrong.

Is there anything in the early LBA's to give an indication of what software may have been used.

I already called the client.

The problem that H 0 is dead.
I wonder which software did that.

Is it worth to give a try to replace heads and see which content side 0 have ?


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 12:09 
Offline

Joined: November 7th, 2020, 5:31
Posts: 425
Location: The_UK
Id finish cloning H1 and check in a lot more places throughout the drive. If it's consistent you've got to think it was intentionally wiped, especially if the timestamp is before you were given the drive. But you may just be checking in a wiped file location.

2 heads on a 320gb drive if H1 is all wiped then there's very little chance of getting anything of any size off the drive, depends what the customer is asking for - jpegs and documents you might get some but movies and music etc not likely to get anything useable. Having said that I'd be replacing it just to find out :lol:

_________________
Properly, Quickly, Cheaply - Pick any two.


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 12:12 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1527
Lardman wrote:
Id finish cloning H1 and check in a lot more places throughout the drive. If it's consistent you've got to think it was intentionally wiped, especially if the timestamp is before you were given the drive. But you may just be checking in a wiped file location.

2 heads on a 320gb drive if H1 is all wiped then there's very little chance of getting anything of any size off the drive, depends what the customer is asking for - jpegs and documents you might get some but movies and music etc not likely to get anything useable. Having said that I'd be replacing it just to find out :lol:

Yeah me too, I am curious :lol: :lol:


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 12:12 
Offline

Joined: November 7th, 2020, 5:31
Posts: 425
Location: The_UK
As an after thought - try a pcb swap just in case, it can't hurt.

_________________
Properly, Quickly, Cheaply - Pick any two.


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 12:16 
Offline

Joined: October 3rd, 2005, 0:40
Posts: 3724
Location: Hungary
can't hurt but won't help :P

_________________
Adatmentés - Data recovery
No bitcoin donations :)


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 13:58 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1527
Also H0 Except 0 and 2048 :lol: :lol: :lol:


Attachments:
Sectors.rar [1.15 KiB]
Downloaded 54 times
Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 14:03 
Offline

Joined: October 21st, 2007, 8:48
Posts: 1527
Some one used HDAT


Top
 Profile  
 
 Post subject: Re: HTS543232A7A384
PostPosted: September 15th, 2021, 15:10 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 13572
Location: Australia
Code:
LBA:0                  block: 0
Disk identifier (Windows):
DE2BBC42h
Boot  System ID   :   First    :    Last    : Relative : Number of:
Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
80h 07h NTFS/exFAT:   0  32 33 :   6 127 57 :      2048:    102400:  52.4 MB
00h 07h NTFS/exFAT:   6 127 58 :1023 254 63 :    104448: 243537920:   125 GB
00h 0Fh EXTx      :1023 254 63 :1023 254 63 : 243642368: 348626944:   178 GB
00h 17h NTFS/exFAT:1023 254 63 :1023 254 63 : 592269312:  32872448:  16.8 GB
MBR signature (0xAA55):
AA55h

I would examine the boot sectors of the other partitions, eg 104448, 592269312.

FWIW, I calculated the data transfer rate at 8.7 MBps.

https://ipv4.google.com/search?q=(40000000+-+2051)+x+512+bytes+%2F(12+hours+%2B+55+minutes+%2B+28+seconds+-+12+hours+-16+minutes+-+8+seconds)+in+megabytes+per+second

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google Adsense [Bot] and 104 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group