View topic - HTS543232A7A384

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

HTS543232A7A384

Page 1 of 1

[ 12 posts ]

Previous topic | Next topic

Author

Message

unknown

Post subject: HTS543232A7A384

Posted: September 15th, 2021, 10:03

Joined: October 21st, 2007, 8:48
Posts: 1712

Hello
Very strange case
Drive in topic came for data recovery.
All sectors shows LBA number.
See the attached example sector :

Attachments:

40000000-40000000.rar [145 Bytes]
Downloaded 394 times

Top

pepe

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 10:48

Joined: October 3rd, 2005, 0:40
Posts: 4754
Location: Hungary

apparently overwritten. Not much to recover from here...
What's the story according to the client?
pepe

_________________
Adatmentés - Data recovery

Top

unknown

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 11:28

Joined: October 21st, 2007, 8:48
Posts: 1712

pepe wrote:

apparently overwritten. Not much to recover from here...
What's the story according to the client?
pepe

The client said that he didn't give it to any company before, after diagnosing ( head 0 dead )
Full resources backed up.
Creating head map.
Start to image with the good head ( H 1 )
Noticed that there's something wrong with sectors.
Randomly checked and I found that weird.

Any ideas?

Top

Lardman

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 11:40

Joined: November 7th, 2020, 5:31
Posts: 1290
Location: United Kingdom

Assume the timestamp is from before you were given the drive, at least you can give the client a date and time for when things went wrong.

Is there anything in the early LBA's to give an indication of what software may have been used.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/

Top

unknown

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 11:49

Joined: October 21st, 2007, 8:48
Posts: 1712

Lardman wrote:

I already called the client.

The problem that H 0 is dead.
I wonder which software did that.

Is it worth to give a try to replace heads and see which content side 0 have ?

Top

Lardman

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 12:09

Joined: November 7th, 2020, 5:31
Posts: 1290
Location: United Kingdom

Id finish cloning H1 and check in a lot more places throughout the drive. If it's consistent you've got to think it was intentionally wiped, especially if the timestamp is before you were given the drive. But you may just be checking in a wiped file location.

2 heads on a 320gb drive if H1 is all wiped then there's very little chance of getting anything of any size off the drive, depends what the customer is asking for - jpegs and documents you might get some but movies and music etc not likely to get anything useable. Having said that I'd be replacing it just to find out :lol:

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/

Top

unknown

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 12:12

Joined: October 21st, 2007, 8:48
Posts: 1712

Lardman wrote:

Yeah me too, I am curious :lol:

Top

Lardman

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 12:12

Joined: November 7th, 2020, 5:31
Posts: 1290
Location: United Kingdom

As an after thought - try a pcb swap just in case, it can't hurt.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/

Top

pepe

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 12:16

Joined: October 3rd, 2005, 0:40
Posts: 4754
Location: Hungary

can't hurt but won't help

_________________
Adatmentés - Data recovery

Top

unknown

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 13:58

Joined: October 21st, 2007, 8:48
Posts: 1712

Also H0 Except 0 and 2048 :lol:

Attachments:

Sectors.rar [1.15 KiB]
Downloaded 407 times

Top

unknown

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 14:03

Joined: October 21st, 2007, 8:48
Posts: 1712

Some one used HDAT

Top

fzabkar

Post subject: Re: HTS543232A7A384

Posted: September 15th, 2021, 15:10

Joined: September 8th, 2009, 18:21
Posts: 16960
Location: Australia

Code:

 LBA:0                  block: 0
 Disk identifier (Windows):
 DE2BBC42h
 Boot  System ID   :   First    :    Last    : Relative : Number of:
 Flag              :Cyl Head Sec:Cyl Head Sec:  Sector  :  Sectors :
 80h 07h NTFS/exFAT:   0  32 33 :   6 127 57 :      2048:    102400:  52.4 MB
 00h 07h NTFS/exFAT:   6 127 58 :1023 254 63 :    104448: 243537920:   125 GB
 00h 0Fh EXTx      :1023 254 63 :1023 254 63 : 243642368: 348626944:   178 GB
 00h 17h NTFS/exFAT:1023 254 63 :1023 254 63 : 592269312:  32872448:  16.8 GB
 MBR signature (0xAA55):
 AA55h

I would examine the boot sectors of the other partitions, eg 104448, 592269312.

FWIW, I calculated the data transfer rate at 8.7 MBps.

https://ipv4.google.com/search?q=(40000000+-+2051)+x+512+bytes+%2F(12+hours+%2B+55+minutes+%2B+28+seconds+-+12+hours+-16+minutes+-+8+seconds)+in+megabytes+per+second

_________________
A backup a day keeps DR away.

Top

Page 1 of 1

[ 12 posts ]

Main » Forums home » Conventional hard drives

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: ccc and 94 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum