HDD GURU FORUMS

We had a customer with a severly damaged 3TB WD-drive (WD30EZRX) where 40GB of the data is unrecoverable. The damaged data is scattered all over the drive, and are not in one continuous piece.

Using photorec we manage to salvage about 15000 of the customer's JPEG-files, but _zero_ RAW-files. The customer used primarily Canon's RAW (.cr2) and Olympus (.orf), and photorec claims to be able to identify both these formats.

The customer claims she has thousands, even tens of thousands, RAW-files, so I find it really confusing that none of these were able to be carved out. The customer does photography for a living, and while all her photos are available in JPEG, she really wants the RAW-files.

Can anyone recommend another carver that we can try?

Could you recover the MFTs ? Does the files show up in the list ?

If the drive is severely damaged as in with bad sectors or other mechanical problems, then it is best recommended to create a clone first, ideally with an advanced hardware imager, and then scan or carve for files.

May try R-Studio, UFS Explorer as well.

File Formats Recovered By PhotoRec:
http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

The following URLs have detailed header information.

.cr2 Canon Raw 2 picture (TIFF image):
https://git.cgsecurity.org/cgit/testdisk/tree/src/file_tiff.c

.orf Olympus Raw Format picture:
https://git.cgsecurity.org/cgit/testdisk/tree/src/file_orf.c

You could use DMDE to scan for raw files by signature. CR2 file types are supported natively, but you could add your own file types and signatures.

https://dmde.com/

Tools -> Full Scan
- Raw -> Raw: File Signatures -> Add

labtech wrote:If the drive is severely damaged as in with bad sectors or other mechanical problems, then it is best recommended to create a clone first, ideally with an advanced hardware imager, and then scan or carve for files.

Already done, we have a (3TB-40GB) large file containing the cloned drive and that's what we're working against.

May try R-Studio, UFS Explorer as well.

Thanks. I will give these a shot.

Of course, it may seem obvious, but those particular file types have to be selected in Photorec's options, I don't think that they are by default... (JPEG is, on the other hand, as it's much more common – and it was Photorec's original target, as its name implies.) As a general rule, it's best to select as few file types as possible, by unchecking those which are definitely not to be found on a given volume, because some legitimate files can be truncated by random false signatures of another file type (for instance, “ÿØÿ” or “FF D8 FF” can appear randomly in the middle of a video file, if it's at a cluster boundary it will be interpreted as the begining of a JPG file, and the video file will be truncated to half its length, even if it's not fragmented and could otherwise have been extracted sequentially). In that regard, Photorec's approach is quite rudimentary, despite the fact that it has been compared positively with very expensive forensic sofwares in professional tests. (Two documents I've found on the subject : “A comparative analysis of file carving software”, Timothy Courrejou & Simson L. Garfinkel, 2011, at www.dtic.mil ; and “Advanced file carving : How much are you ignoring?”, Bas Kloet, Hoffman Investigations, 2010, at digital-forensics.sans.org.)

But, as it has been said already, if the bad areas are scattered all over the surface, it should be / should have been possible to at least partially recover the MFT, hence get a partial directory structure, which is much more convenient than a bunch of folders with 500 files in each of them, sorted by the order in which they were extracted instead of their original location, and named after their first occupied sector (which can be very useful for the recovery process but not so much for the end user !). In a case like this both approaches are complimentary : recover as much files as possible using what can be salvaged of the filesystem, then do a thorough file carving, and then remove the duplicates, or let the client take care of that as it can be a painstaking process. (There are quite a few duplicate files finders, my favorite are DoubleKiller, streamlined and efficient, and AllDup, which has some nice extra features but a rather cluttered and unintuitive interface.) R-Studio recognizes both of those RAW file types, so it can search for them as “Extra found files” while scanning for directory structures, thus making those extra steps unnecessary, as long as the detection accuracy for those files is just as satisfying as Photorec's.

And of course, never do that kind of analisys directly on a problematic HDD, that should be obvious for a professional...