View topic - Oh well

Main » Forums home » Research and development

All times are UTC - 5 hours [ DST ]

Forum rules

Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...

Oh well

Page 1 of 1

[ 19 posts ]

Previous topic | Next topic

Author

Message

DRUG

Post subject: Oh well

Posted: February 21st, 2016, 0:40

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

So, here's the thing:

This week a drive came in and this was the customer story:

Computer rebooted and ran chkdsk, upon starting outlook, he realized his .pst file has gone from 8GB to 0KB.
Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.

After imaging the disk I ran a raw recovery, but no .pst files except the 0KB one was found.

Should I just give up or try something else ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

HaQue

Post subject: Re: Oh well

Posted: February 21st, 2016, 3:56

Joined: December 4th, 2012, 1:35
Posts: 3937
Location: Adelaide, Australia

In my experience, one that size will never be recovered. I guess you could look in the FOUND.000 folder at the .CHK files and see if there is an 8GB one, but I seriously doubt you will have luck with this one

Top

MindMergepk

Post subject: Re: Oh well

Posted: February 21st, 2016, 4:46

Joined: December 8th, 2013, 4:48
Posts: 842
Location: Pakistan

DRUG wrote:

Obviously CHKDSK made this happen, and the file wasn't deleted, but was overwritten IMO.

why you think it is overwritten, did customer use drive after this happen or create new data on the drive ?

atleast partial recovery should be possible. 8GB is alot sectors.
btw did you try more than 1 software for raw recovery ?

_________________
Data Recovery Pakistan

Top

HaQue

Post subject: Re: Oh well

Posted: February 21st, 2016, 8:13

Joined: December 4th, 2012, 1:35
Posts: 3937
Location: Adelaide, Australia

but a partial recovery on a .pst? is that going to be useful? I don't know the format, so maybe a tool can pull out individual .eml files or something, but it is probably going to be one of those jobs...

Top

DRUG

Post subject: Re: Oh well

Posted: February 23rd, 2016, 11:16

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

I've cloned the disk with MRT, then scanned the image with r-studio, gdb, etc. Only found one, the 0KB file, i believe chkdsk did this :s

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

data-medics

Post subject: Re: Oh well

Posted: February 23rd, 2016, 11:33

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI

Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?. :lol:

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company

Top

DRUG

Post subject: Re: Oh well

Posted: February 23rd, 2016, 11:41

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

data-medics wrote:

Good old chkdisk. Who needs those mission critical files anyway, just delete them so the the system has no issues booting Windows. That's all you really want anyway Right?. :lol:

What's making me mad is that the file wasn't even deleted but somehow overwritten to go from 8GB to 0KB :'(

This was such a important client for us. MEH.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

DRUG

Post subject: Re: Oh well

Posted: February 23rd, 2016, 20:52

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

Magical update.

After running all some other recovery software I was able to find at raw files some .pst's

They weird thing is that I have 2 pst folders, with 4x 3GB files and 4x 1GB files. (some of the files have recent e-mails, but that's no good enough, im not sure if its the software I'm using or something else, but I'll give it some more shots.)

Does anyone know a good pst viewer /scanner ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

arvika

Post subject: Re: Oh well

Posted: February 23rd, 2016, 21:10

Joined: October 24th, 2009, 15:22
Posts: 922
Location: Poland

Zmail...

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

Top

DRUG

Post subject: Re: Oh well

Posted: February 24th, 2016, 10:58

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

arvika wrote:

Zmail...

ZMail -- open source email software used to send fake emails ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

arvika

Post subject: Re: Oh well

Posted: February 24th, 2016, 13:04

Joined: October 24th, 2009, 15:22
Posts: 922
Location: Poland

http://www.z-a-recovery.com/extras/news.aspx
But they probably remove from download section - maybe close the project?

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

Top

jermy

Post subject: Re: Oh well

Posted: February 24th, 2016, 13:16

Joined: March 19th, 2015, 15:01
Posts: 1388
Location: isreal

@arvika according to link..., I don't think it supports .PST files

Top

arvika

Post subject: Re: Oh well

Posted: February 24th, 2016, 14:37

Joined: October 24th, 2009, 15:22
Posts: 922
Location: Poland

It support pst file.

Attachments:

zmeil21setup.zip [1.4 MiB]
Downloaded 1034 times

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

Top

DRUG

Post subject: Re: Oh well

Posted: February 24th, 2016, 21:57

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

Oh, that's from ZAR!

I've tried it anyways, and after loading the files pops up a error message saying outlook can't open the files.

CHKDSK criminal.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

MindMergepk

Post subject: Re: Oh well

Posted: February 25th, 2016, 6:34

Joined: December 8th, 2013, 4:48
Posts: 842
Location: Pakistan

http://www.techrepublic.com/blog/five-a ... air-tools/

btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.

_________________
Data Recovery Pakistan

Top

DRUG

Post subject: Re: Oh well

Posted: February 25th, 2016, 14:47

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

MindMergepk wrote:

http://www.techrepublic.com/blog/five-apps/five-reliable-outlook-pst-file-repair-tools/

btw i have an idea not sure it will work or not but worth to try, let me know if you are interested.

What is your idea ?

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

MindMergepk

Post subject: Re: Oh well

Posted: February 27th, 2016, 10:06

Joined: December 8th, 2013, 4:48
Posts: 842
Location: Pakistan

pm sent.

_________________
Data Recovery Pakistan

Top

DRUG

Post subject: Re: Oh well

Posted: March 2nd, 2016, 10:32

Joined: April 22nd, 2015, 20:32
Posts: 413
Location: Portugal

Problem still not solved, I mean, not fully, 10% of the info recovered.

I might outsource this if someone feels like it.

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/

Top

MindMergepk

Post subject: Re: Oh well

Posted: March 6th, 2016, 9:05

Joined: December 8th, 2013, 4:48
Posts: 842
Location: Pakistan

i can take a look remotely.
PM me if interested.

_________________
Data Recovery Pakistan

Top

Page 1 of 1

[ 19 posts ]

Main » Forums home » Research and development

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: Bing [Bot] and 4 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum