Where can the files be? :)

Data recovery from Hard Disk Drives with logical problems

Moderator: Dmitriy_TS

User avatar
edbrandt
New user
Posts: 54
Joined: 04.05.17
Reputation: 2 / (16)

Where can the files be? :)

Postby edbrandt » 29.01.19, 13:56

Ok, I had this case which was straight-forward. Customer did "something" while sorting files on a external HD, and suddenly (within a second) approximately 10.000 files were gone. She doesn't know the name of any file/folder missing, other than that we are talking about pictures and videos backed up from phone and camera. I don't expect people to remember file names of pictures (img0000542.jpg etc), but perhaps a folder name? But no..

Anyway... I've done logical recovery of all files in unallocated areas, plus files in the $RECYCLE.BIN folder, which was approximately 22.000 files. But these were not the files she was missing.

She has also looked through existing folders, to check if the missing files accidentally was dragged into a sub-folder. But no luck.


I would believe (at least some of) the files should have been in one of these places, but apparently not. As the disappearing happened very fast, I don't believe the files have been moved to another drive (local pc).

Any idea what can have happened? Did I miss anything?

Thanks

-Espen

User avatar
Blizzard
New user
Posts: 91
Joined: 29.06.16
Reputation: 4 / (44)

Re: Where can the files be? :)

Postby Blizzard » 29.01.19, 17:22

What model is the hard drive? Some Western Digital external HDDs support TRIM.


lcoughey
New user
Posts: 198
Joined: 12.01.12
Reputation: 7 / (68)

Re: Where can the files be? :)

Postby lcoughey » 29.01.19, 19:44

No bad sectors when getting the clone? FAT32 or NTFS?

User avatar
edbrandt
New user
Posts: 54
Joined: 04.05.17
Reputation: 2 / (16)

Re: Where can the files be? :)

Postby edbrandt » 30.01.19, 09:40

@Blizzard: It was a Toshiba drive
@lcoughey: The drive was in good shape, no bad sectors as I can remember

User avatar
DataMedics
Advanced user
Posts: 579
Joined: 15.12.15
Reputation: 16 / (163)

Re: Where can the files be? :)

Postby DataMedics » 30.01.19, 19:38

Was chkdsk run? Perhaps they're all now all renamed to be .CHK files in a directory like Found.000. Or perhaps was more data added to the drive since the files were deleted?


Dmitriy_TS
Site Admin
Posts: 298
Joined: 01.04.13
Reputation: 8 / (77)

Re: Where can the files be? :)

Postby Dmitriy_TS » 21.03.19, 10:48

Hello,

edbrandt wrote:Source of the post @Blizzard: It was a Toshiba drive

Is it USB drive?

lcoughey wrote:Source of the post FAT32 or NTFS?


How much MFT records you can find using RAW recovery on MFT table map?
With best regards
ACELab technical support
ts.acelaboratory.com
blog.acelaboratory.com


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 1 guest