data recovery question

[pcpete]

This is more a general question , but is pertinent to a job we are working on. We had a computer with a failing hardrive. We were able to clone all but about 300,000 sectors. When we used regular windows file explorer on the clone we got what seemed like a nice recovery, at least no errors. A percentage of the photos were corrupted, with some sections missing. We then had rstudio do a complete scan on the drive and we seemed to get a similar amount of corruption. If we were to do a raw recovery are we likely to get more good pictures?

 

[lcoughey]

This is more a general question , but is pertinent to a job we are working on. We had a computer with a failing hardrive. We were able to clone all but about 300,000 sectors. When we used regular windows file explorer on the clone we got what seemed like a nice recovery, at least no errors. A percentage of the photos were corrupted, with some sections missing. We then had rstudio do a complete scan on the drive and we seemed to get a similar amount of corruption. If we were to do a raw recovery are we likely to get more good pictures?

It depends if unread sectors are within the files. If you didn't use a good clone app that logs the bad sectors and allows multiple pass imaging, you may have more holes than you think.

 

[pcpete]

It depends if unread sectors are within the files. If you didn't use a good clone app that logs the bad sectors and allows multiple pass imaging, you may have more holes than you think.

we uses a hardware imager with multiple passes with a log

 

[lcoughey]

we uses a hardware imager with multiple passes with a log

What hardware imager are you using that doesn't allow you to show which files are affected by the unread sectors?

Sent from my BBF100-2 using Tapatalk

 

[pcpete]

What hardware imager are you using that doesn't allow you to show which files are affected by the unread sectors?

Sent from my BBF100-2 using Tapatalk

We know just a bit. It is a ddi. If the $MFT is corrupted, could any imager tell you? We need to take the time and learn more the 10% of its features

 

[Markverhyden]

Corrupted photos? As in if you open abc.jpeg you get an unrecognized file error? Or it opens with only part of the image.

 

[pcpete]

Corrupted photos? As in if you open abc.jpeg you get an unrecognized file error? Or it opens with only part of the image.

part of image

 

[Markverhyden]

part of image

I'd bet that's a file missing part of the data. Depending on image size it may span more than one sector. Seen similar symptoms when a file download/transfer is interrupted.

 

[Larry Sabo]

Might be worth trying some of @Joep's disktuna software on them and see what they yield.

 

[lcoughey]

I'm on my phone at home, calling it a day. You should post your DeepSpar questions on the DeepSpar forums. You can learn a lot there.

 

[Joep]

Large portion of the files people send to me for repair is corrupted after recovery. Large portion of those is simply incorrectly recovered. In case of bad sector it depends what cloner does when it hits a bad sector.

Original

Bad sector filled with zeros

Bad sector filled with 0xFF bytes

File cut-off

In Windows photo viewer 0xFF filled bad sector and cut-off look same, in that case file size is the give away.

In case of file system damage you mostly get files that will not open at all and without thumbnail - or - thumbnail without matching content. In that case repair is almost always impossible and the solution it to try to carve the files.

If and how bad sector handling can be improved is not my expertise, ask Luke instead.

 

[Joep]

Two quick attempts to repair bad sector files (zeros / 0xFF), still needs inpainting and some color correction.

 

[labtech]

in DDI, once the cloning process is complete, typically the procedure is to wipe the unprocessed blocks on the destination drive. I forget what the default fill-in pattern is on DDI nowadays. You can test on a dummy drive to determine that.
When running data recovery software, look at the damaged/corrupt file in hex for the fill-in pattern. If it contains gaps of unread blocks, then it is due to bad blocks.

I believe you are nearby Boston, somewhere in the suburbs. I am up and down 495/95/93/90 almost on a daily basis. If you would like a second opinion with a full clone and data extraction with "corrupt files" separated due to bad blocks, would happily do it for you for free one time, just to build a relationship. I pick up devices for recovery for free 40 miles radius of Boston.