Hello All,

Today I got one of the weirdest drive:
WD 80GB 3.5 IDE drive fully working without even one single bad sector.
The client told that the drive hold 26GB of JPG and MOV files. He had accidentally done a right click over the drive's partition-> format -> quick format -> OK.
He was swear to god that it was only he had done.
Seems like an easy drive, right? think again:
While connecting the drive directly to a pc I could see an empty partition (NTFS) without any one single file on it but winhex shows that almost all the sectors are occupied with data (or garbage).

No matter what data recovery software I run over the drive it shows me nothing. The same like I run data recovery software over encrypted drive.
I tried with PC3K, winhex, R-studio and some more..
Deep scan, raw recovery and some others technique but nothing.
I also imaged the drive and created one single image file and scanned it but again -> nothing.

I think to myself and to you, how it can be that a drive which is full with occupied sectors that went through only quick format can't be recover after that?
It wasn't part of external drive.

Any advice?

I got the feeling that it was somthing like that but the client told different.
If it was somthing like that, is there somthing to do?

Let's guess that if it was encrypted then I will have the right password but what next?
Any general direction?

Could you upload the first few sectors?

Sector 0 should have a partition table, while sectors 1 through 62 will probably be zero-filled, or they may have a repeating 128-bit hash. From your description, it would appear that the partition table may be intact. Therefore it should tell us where to look for the boot sector. The MBR code might give us a clue as to how the drive was setup, ie it may identify the OS or encryption software.

Sector 63 would normally contain the NTFS boot sector. Does it look encrypted? Could we see it?

_________________
A backup a day keeps DR away.

It MUST be encrypted.

Maybe with bitlocker (win 7) ?

Truecrypt?

Unless it is half of a raid 0? We have had it before where a client has had two drives in raid 0 (stripe) and only sent us one, and when we asked for the other one he told us he had wiped it, reformatted, installed windows and been using it

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!

@pcimage,

Half-RAID0, or generally 1/Nth of RAID0 for any reasonable N, still produces some file names and parts of folder tree with NTFS or FAT filesystems, and also header scan (raw scan) brings up damaged files (because on any given 1/Nth of the RAID0 you get on average 1/Nth of the number of file headers).

This one must be encrypted.

I do also think it's ENCRYPTED.


You are wrong.

_________________
__________
There is no substitute for education and experience
THANK YOU
SHAHI
shahi.mahbub@gmail.com

Really? What if it's a single sector stripe??

Unlikely I know, but possible

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!