HDD GURU FORUMS
http://forum.hddguru.com/

Scrambled data?
http://forum.hddguru.com/viewtopic.php?f=7&t=8119		 Page 1 of 1
Author:  pcimage [ November 29th, 2007, 13:47 ]
Post subject:  Scrambled data?
Hi all,

This ones got me stumped!

Seagate Momentus 40Gb Drive.

In good shape (1 or two bad sectors, but nothing serious)

Can see two partitions (one ~27Gb another ~15Gb).

But no data :-(

Even a raw scan finds nothing except these files..

INDEX.BTR
INDEX.MAP
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP

Even a hex search for "FILE" produces nothing except the above "hits". On a good drive, I find thousands and thousands.

Sector edit with Winhex sees "data" across the whole drive, but nothing meaningful.

Any ideas?

It's apparently come out of a Packard Bell standard laptop, nothing unusual.

Any help would be gratefully received!

Cheers

Sean
Author:  sempre [ November 29th, 2007, 14:48 ]
Post subject:  Re: Scrambled data?
Hi pcimage!!

It does not see given with the publisher hexa in all surface of hdd?
Case yes does not have what to recovery....
they had probably given one wipe in hdd...

I wait to have helped!
Author:  pcimage [ November 29th, 2007, 15:36 ]
Post subject:  Re: Scrambled data?
Hi Sempre,

I can see "data" all over the HDD with hex editor (such as WinHex), but no file signatures :-(

Trouble is, I'm not dealing with the end-user. Through a dealer, who has tried some software solutions himself.

End user is not PC literate, so unlikely he's wiped it.

Thanks for your reply.

Sean
Author:  sempre [ November 29th, 2007, 15:46 ]
Post subject:  Re: Scrambled data?
Hi pcimage!

Please it can give more details of the case?

Which type of operational system was used?

Which type of partitions?

How it presented the problem? (story of the final user)

The more information on go to help to understand better!

But I want to help!
:roll:
Thanks...
Author:  pcimage [ November 29th, 2007, 16:04 ]
Post subject:  Re: Scrambled data?
Many thanks Sempre!

It was XP.

Two NTFS Partitions.

The first couple of hundred sectors are OK, look normal.

The there are a few thousand of a repeated string (cant remeber what, but something like: F6 64 05 7B F6 64 05 7B F6 64 05 7B etc etc)

Then random looking characters till the end of the drive.

Not sure of situation leading up to failure, I'll see if I can get more info out of the client tomorrow.
Author:  pcimage [ November 30th, 2007, 16:49 ]
Post subject:  Re: Scrambled data?
I'm thinking this one is a non-starter.

Tried everything I can think of (inc. Photorec, thanks Sempre for that tip).

Used: DE, Winhex, GetDataBack, R-Studio, RecoverMyFiles, RecoverMyPhotos....Nothing :-(

At the most 9 files of crap are found.

The rest of the drive has no valid file signatures.

The client swears the drive in not encrypted, but I can't see any other explanation. Surely a virus couldn't zap the whole drive?

Any input gratefully received.

This one is not a big money-earner but is annoying me!!

Sean
Author:  sempre [ December 1st, 2007, 8:12 ]
Post subject:  Re: Scrambled data?
Hi my friend!

Virus?

the action of a type of virus can be possible!
Somebody of fórum already found some situation here similar?
We go to help to arrive at a conclusion of this case!
:idea:
Author:  rchadwick [ December 1st, 2007, 12:49 ]
Post subject:  Re: Scrambled data?
I've heard rumors of Viruii who could encrypt the drive, but have never seen it. Supposedly the files were encrypted one at a time over weeks or months so the user wouldn't notice. It's possible the files were simply overwritten and destroyed instead of encrypted, but possibly they were modified so as to be recoverable. There are ways that might give you a better answer..

1) If they are encrypted, there should be a piece of the live virus somewhere to decrypt it. A virus scan may find it, and research will tell you what that virus does.

2) With a piece of the live virus, you can expose it, or perhaps the entire drive, on a machine you don't care about (VirtualPC is good for this), and see if it trashes the drive the same way.
Author:  hddbug [ December 1st, 2007, 13:03 ]
Post subject:  Re: Scrambled data?
Did you tried RAW recovery , by putting most of the file signatures? As these softwares try to get files from Mft's and If MFT's are badly damaged , these softwares may not give results. I know some of the tools which try to get files by searching headers ( you can define custom signatures ) . This is useful when viruses like "Blackworm" converts files into 1 Kb.
I will try to get solution from our software team.
Best Luck
Hddbug
Author:  Odiferous [ December 8th, 2007, 3:14 ]
Post subject:  Re: Scrambled data?
Sean,


Have you checked that the firmware is 100%?

I had a Maxtor in recently with similar problems - garbled data that wasn't recognised - some bad modules appeared to be causing the corruption.

Duncan
Author:  pcimage [ December 8th, 2007, 8:09 ]
Post subject:  Re: Scrambled data?
Duncan,

It looks OK to me, but I'm no expert on Seagate f/w.

Sean
Author:  CK [ December 13th, 2007, 10:13 ]
Post subject:  Re: Scrambled data?
Sounds to me like the data is encrypted. Possibly something like Safeguard Easy.
Author:  pcimage [ December 13th, 2007, 13:15 ]
Post subject:  Re: Scrambled data?
Any way to check this?

And/or recover data?
Author:  CK [ December 14th, 2007, 6:24 ]
Post subject:  Re: Scrambled data?
It's a bit of a tough one Sean. Under what circumstances did the drive arrive with you? i.e. Customer deleted data, or was it a physical problem?

Normally when we have a customer with an encrypted HDD, we ask for the original laptop/desktop. If we repair the drive, we image it and insert into the original hardware and see if we get an encryption logon upon startup.

It's always difficult when you are dealing through a third-party because you never get the full story. I'm always wary of what IT support companies do before the drive arrives with us.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/