Scrambled data?

[pcimage]

Hi all,

This ones got me stumped!

Seagate Momentus 40Gb Drive.

In good shape (1 or two bad sectors, but nothing serious)

Can see two partitions (one ~27Gb another ~15Gb).

But no data

Even a raw scan finds nothing except these files..

INDEX.BTR
INDEX.MAP
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP

Even a hex search for "FILE" produces nothing except the above "hits". On a good drive, I find thousands and thousands.

Sector edit with Winhex sees "data" across the whole drive, but nothing meaningful.

Any ideas?

It's apparently come out of a Packard Bell standard laptop, nothing unusual.

Any help would be gratefully received!

Cheers

Sean

[sempre]

Hi pcimage!!

It does not see given with the publisher hexa in all surface of hdd?
Case yes does not have what to recovery....
they had probably given one wipe in hdd...

I wait to have helped!

[pcimage]

Hi Sempre,

I can see "data" all over the HDD with hex editor (such as WinHex), but no file signatures

Trouble is, I'm not dealing with the end-user. Through a dealer, who has tried some software solutions himself.

End user is not PC literate, so unlikely he's wiped it.

Thanks for your reply.

Sean

[sempre]

Hi pcimage!

Please it can give more details of the case?

Which type of operational system was used?

Which type of partitions?

How it presented the problem? (story of the final user)

The more information on go to help to understand better!

But I want to help!

Thanks...

[pcimage]

Many thanks Sempre!

It was XP.

Two NTFS Partitions.

The first couple of hundred sectors are OK, look normal.

The there are a few thousand of a repeated string (cant remeber what, but something like: F6 64 05 7B F6 64 05 7B F6 64 05 7B etc etc)

Then random looking characters till the end of the drive.

Not sure of situation leading up to failure, I'll see if I can get more info out of the client tomorrow.

[pcimage]

I'm thinking this one is a non-starter.

Tried everything I can think of (inc. Photorec, thanks Sempre for that tip).

Used: DE, Winhex, GetDataBack, R-Studio, RecoverMyFiles, RecoverMyPhotos....Nothing

At the most 9 files of crap are found.

The rest of the drive has no valid file signatures.

The client swears the drive in not encrypted, but I can't see any other explanation. Surely a virus couldn't zap the whole drive?

Any input gratefully received.

This one is not a big money-earner but is annoying me!!

Sean

[sempre]

Hi my friend!

Virus?

the action of a type of virus can be possible!
Somebody of fórum already found some situation here similar?
We go to help to arrive at a conclusion of this case!

[rchadwick]

I've heard rumors of Viruii who could encrypt the drive, but have never seen it. Supposedly the files were encrypted one at a time over weeks or months so the user wouldn't notice. It's possible the files were simply overwritten and destroyed instead of encrypted, but possibly they were modified so as to be recoverable. There are ways that might give you a better answer..

1) If they are encrypted, there should be a piece of the live virus somewhere to decrypt it. A virus scan may find it, and research will tell you what that virus does.

2) With a piece of the live virus, you can expose it, or perhaps the entire drive, on a machine you don't care about (VirtualPC is good for this), and see if it trashes the drive the same way.

[hddbug]

Did you tried RAW recovery , by putting most of the file signatures? As these softwares try to get files from Mft's and If MFT's are badly damaged , these softwares may not give results. I know some of the tools which try to get files by searching headers ( you can define custom signatures ) . This is useful when viruses like "Blackworm" converts files into 1 Kb.
I will try to get solution from our software team.
Best Luck
Hddbug

[Odiferous]

Sean,


Have you checked that the firmware is 100%?

I had a Maxtor in recently with similar problems - garbled data that wasn't recognised - some bad modules appeared to be causing the corruption.

Duncan

[pcimage]

Duncan,

It looks OK to me, but I'm no expert on Seagate f/w.

Sean

[CK]

Sounds to me like the data is encrypted. Possibly something like Safeguard Easy.

[pcimage]

Any way to check this?

And/or recover data?

[CK]

It's a bit of a tough one Sean. Under what circumstances did the drive arrive with you? i.e. Customer deleted data, or was it a physical problem?

Normally when we have a customer with an encrypted HDD, we ask for the original laptop/desktop. If we repair the drive, we image it and insert into the original hardware and see if we get an encryption logon upon startup.

It's always difficult when you are dealing through a third-party because you never get the full story. I'm always wary of what IT support companies do before the drive arrives with us.