Customer called us and said they were backing up their Windows 10-files (it's unclear how they backed up) and somehow the drive was wiped clean afterwards, without any of them allowing it to be formatted or similiar.
Since there are no physical damages to the drive we made a dd-copy and investigated it in DMDE by full-scanning the whole drive (Raw, NTFS, exFat, etc) but other than some files that looks like they're belonging to a Windows 10-installation, the drive is completely wiped clean of their own files. We also ran photorec on the image, just for the sake of testing, and while there were some differences the general problem was still there: clean drive.
We've never seen this situation before. Is this the outcome of a TRIM-operation on the flash chips, or something else? If trim, would it be completely pointless to pull the chips and run them through VNR?
| Attachments: |
|
dmde_Untitled.jpg [ 101.77 KiB | Viewed 5096 times ] |