OK this is a true dialogue:

- I have deleted one video file off my hard drive and i need to recover it.
- OK. Can you tell me what type of video it is?
- Ermmm... It is from my son's birth.
- No, i mean what file type
- I don't know.
- OK. How did you shoot the video?
- With my camera.
- I mean what kind of camera.
- It's a digital camera.
- What brand?
- I don't know. A Sony?
- OK. How did you delete the video?
- I don't know.
- Where was it stored before it got deleted?
- I don't know.
- How large was the video then?
- 15 minutes I think. Wait, maybe 30.
- I mean in file size. Any idea?
- I don't know.
- I see your drive has two partitions. In which one was the file in question?
- Maybe in C. Otherwise in D.
- How much time ago was this file deleted?
- I don't know. Could be 2 months, could be three months or more. Last time I looked for it was 2 months ago.
- And you didn't find it.
- No. I looked everywhere.
- And what did you do since then?
- Nothing.
- Did you work with your computer all this time?
- Yes, of course.
- Why didn't you bring the hard drive at this time? Chances would be bigger. Now, after two months a lot of things have happened to your drive, therefore chances are slim
- Nothing happened to the drive since then.
- I mean...
- Listen, if you can't help, just tell me to seek some other pro's assistance...


(TRUE story).

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Man I need to start doing this that was funny in a strange way since I deal with this sort of thing everyday its amazing we are able to do our jobs with so little information from the (L)users. Did you ever find anything in the MFT that may lead to a filename ?

Nope.
I had another client with exactly the same situation (lost videos from child's birth) but they were a little more descriptive, at least they gave me date information of when the shooting took place. At least the date is something to work with...

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

I am in my biz / at my location now close to 25 years .... its nearly a daily experience ...

One only can devide it into:

a) foolish ignorance
or
b) aggressive ignorance
( ".... I dont care why this happened - solve the problem - you get paid for that ...")

Finally there are those customers "delivering the issue to you" and from that very
moment on - you are responsible for lost data or defect programes or installation.
"I gave it to you because I relied on you - but you are not as professional as you
made me believe ...."

My best experience only a week ago:

Customer with laptop problems (couldnt start Windows any more):

Took the hdd out of laptop - checked it and found immediately some pending
defect sectors. I explained the issue to the customer - but he didnt believe me.
He was very unhappy about "my unprofessional way of dealing with his system"
- and left the shop.

Thank God, its only a few customers - but they do take a lot of energy ...
Hope to deal better with such situations and keep my patience this new year

+++

+++