Data Recovery

[Morrison5891]

How is it possible for data recover software not to find ANY files? I've run 5 different data recovery programs on a hdd and its finding NOTHING at all. Am I missing something? Can someone please help!?

 

[MrUnknown]

very, very very bad corruption.

hard drive was wiped before you got to it.

what kinds of files are you trying to recover and in what manner? (slave, bootdisk, etc)

 

[Morrison5891]

Trying to recover photos only. Its a laptop hdd. I have it connected to my machine via a use adapter.

I've tried using Getdataback, O&O Diskrecovery and a few other programs. I've tried a format recover and i've tried searching for files

 

[Morrison5891]

I've tried everything... None of the software i've tried has recovered any files. I find that kinda weird... shouldn't it at least find something? There are no errors on the disk. I've even tried Spinrite and still nothing! Yes, i've tried Recuva

 

[NYJimbo]

Get any program that will display the sectors on the drive and scroll through some of it. If you find patterns of fill then you can pretty much assume the drive is wiped.

 

[Morrison5891]

Even if the drive has been "wiped" There still has to be a way to recover the pics. If the partition was deleted and a new one created... can you recover that?

 

[computergeek1]

Have you tried photorec.

 

[Kenhelms]

Hook it up to a disk diag program that will read the smart status, check and see how many hours the drive has on it.

there may be circumstances that the client hasnt made you aware about and its possible that it is a truly blank hard drive(as in new).

If secure wiping software was used, and not just the standard freeware wipes...your only bet would be electron microscope recovery. which is in the 50k+ range.

I would suggest trying R studio which is very good at raw recovery. Ontrack is as well. you are working from a sector image and not the actual drive right? If you have tried 5 different softwares without write block hardware inplace, you may be causing more corruption to the files you wish to recover.

Edit(just saw a couple of posts came in while I was typing)- yes you can recover if a partition table was deleted. Contrary to popular NCIS/CSI tv shows though...there are sometimes when data just cant be recovered, so you never want to guarantee that you can recover data.

 

[Morrison5891]

Just finished scanning with that. Still nothing!

 

[Kenhelms]

Just finished scanning with that. Still nothing!

did you check to see if the drive is even used?

It would also help to know why recovery is needed in the first place.

When you said "any files" do you mean any period, or any photos. did it recover any garbage files at all? was the computer running any kind of encryption?

If it was a sparse encryption you wouldnt be able to see the files without some specialized procedures

 

[MrUnknown]

if a drive was even remotely properly wiped, software can not recover anything. even a basic wipe of making everything 0 will remove pretty much any possibility of recovering using software. Formatting is not a "wipe."

Honestly, if nothing was recovered using any of the programs you mentioned, then I would assume it is gone unless you want to pay Drive Savers or some other company. The simple fact that *nothing* turned up (not just pictures, any file at all), I would suspect a wipe or severe hard drive failure somehow reporting the wrong data on the drive.

I do not have very much experience with encrypted hard drives in laptops (can you read the data without supplying a password?), but if it was encrypted, then you won't be able to recover anything either as it will appear to be random data.

 

[Morrison5891]

did you check to see if the drive is even used?

It would also help to know why recovery is needed in the first place.

When you said "any files" do you mean any period, or any photos. did it recover any garbage files at all? was the computer running any kind of encryption?

If it was a sparse encryption you wouldnt be able to see the files without some specialized procedures

I mean any at all ZERO files... no NOTHING!

 

[Morrison5891]

if a drive was even remotely properly wiped, software can not recover anything. even a basic wipe of making everything 0 will remove pretty much any possibility of recovering using software. Formatting is not a "wipe."

Honestly, if nothing was recovered using any of the programs you mentioned, then I would assume it is gone unless you want to pay Drive Savers or some other company. The simple fact that *nothing* turned up (not just pictures, any file at all), I would suspect a wipe or severe hard drive failure somehow reporting the wrong data on the drive.

I do not have very much experience with encrypted hard drives in laptops (can you read the data without supplying a password?), but if it was encrypted, then you won't be able to recover anything either as it will appear to be random data.

No encrypted data, etc ... The lady I'm doing this for was using her laptop just the other day... Windows crashed, she re-booted and got the message "Operating System Missing" and that's it.

 

[MrUnknown]

Well, unless you're doing something very randomly wrong, such as scanning the wrong drive, then the data is beyond your reach. You should quote for Drive Savers or a similar service.

the fact that *nothing* is recovered is incredibly odd and points to something else happening.

 

[bagellad]

Yes if the customer wants the data no matter what i would send it to one of those recovery labs. I called local places and it was anywhere between 2000 and 750, giving you between 5-20% discount for being a computer service.

If the customer wants the info but isn't willing to pay then I would continue to fool around with it.

 

[Doctor Micro]

I agree with all the other posters in that something is definitely very very odd. If she just had an OS crash, and didn't do anything before bringing it to you and no one else has touched it in the meantime, you should find TONS of recoverable data, even though most or all of it may not be anything you're specifically looking for. Something smells fishy here...

 

[angry_geek]

I just finished recovering data from a drive that had an os reinstall . . . twice. I was still able to get all her d & s folder. Either the controller on your drive is toast, or the heads aren't moving. Time for professional data recovery.

 

[JRDtechnet]

what does the partition tables show? For example an HP system you would see NTFS HP partition and then a fat32 recovery partition.

I doubt it would be the heads or the recovery programs wouldn't work at all.

 

[Morrison5891]

It shows NTFS The drive works fine. I can copy to and from the drive. I copied a few programs and pics to the HDD and then deleted them. Re ran the recovery software, and it found everything I had copied and deleted. This is very weird and i've never seen this before.

 

[JRDtechnet]

I bet someone isn't telling you the complete story. After they had the OS crash they must of used the built in recovery partition to restore their computer or at least tried too, this wiped the partition (perhaps using the secure erase command built into all HD's after 2001) this would kill any chance of getting data back off the drive, sans a few thousand hours with an electron microscope.