Anyone work in data forensics?

DHR

DHR

DHR

Soldato
Joined
30 Apr 2003
Posts
3,476
Age old story, mate, not backup etc. lost family pictures from a single USB disk yadda yadda *facepalm*

Effectively drop box has been syncing down and overwriting files, he's out of lucky from paying for professional recovery and I suspect the data has gone either way.

I've offered to at least take a bit for bit forensic copy of the drive and have a poke around on the copy?

Anyone done this recently either as an amateur or pro?
 
Is it solid state drive or mechanical drive?

I had used data recovery years before. It is paid by the amount of data. I lost my entire photo video archive to a raid failure. Managed to get back 80% of the data.

my drive was mechanical so it wasn’t very difficult I believed.

I think with solid state they may have to replace components on the board etc to get it read again.
 
If the drive is still working then it's a lot easier to at least give it a go. The likes of Recuva are usually pretty good at recovering stuff so you may as well give it a go. To be honest I think most companies can't offer much more as they normally specialise in hardware or actual failures of drives.

I think the main questions are:
- How big is the disk?
- How much data is there to recover?
- How long ago since it was overwritten?
 
Thanks both, it's a 1tb, unknown amount of data to recover ATM, overwritten a couple of days ago but not used since :)
 
Solid state is generally well beyond amateur data recovery.

If mechanical and it hasn't been messed with too much you should be able to pull something - Recuva has usually worked for me.
 
Sorry missed the main question, it's a trad hdd

Rroff said:
Solid state is generally well beyond amateur data recovery.
Click to expand...

Out of interest and complete ignorance I assume it's down to the manner in which space is reused on ssds?
 
DHR said:
Sorry missed the main question, it's a trad hdd



Out of interest and complete ignorance I assume it's down to the manner in which space is reused on ssds?
Click to expand...
Not quite. Data recovery software doesn’t work well with solid state data retrieval. The data on the solid state is unlikely to have been overwritten, just new data written to another sector.

where with HDD the data could have been overwrite. But the information can be very easily retrieved. As previously mentioned, try some data recovery softwares first.
 
Donnie Fisher said:
+1 for photorec ... takes a long time, but recovered an absolute ton of photos I had lost in a similar manner. IIRC it doesn't necessary recover the full filenames all the time, but it saved my bacon once (imagine realising youd lost a friends wedding photos type thing ! )
Click to expand...

You're right - it doesn't recover filenames or folder structure, but for carving files from unallocated it's very good.
 
Most free even some paid softwares will not be able to recover folder structures. I can’t remember the one I used for my own DIY recovery a few years ago, that software created folders but the folders weren’t named as per original naming m. They were some sort of hex code. Also on a HDD the same sector you can have multiple imprints of files written to that sector before. So that software created root director based on that and subsequent sub directors. Come to think of it, the folders were probably named as sector address.

but you should t be too concerned about folder structures as long as files are recovered. To a large extent if the software dumps all the files into a single directory, it is better that way so you can see all the files in one place and sort them out yourself.

with software recovery, you will never ever get your data back in the form that it was represented in the original drive. The file record of the drive is usually corrupted or damaged which is the reason why you can’t read the files in the first place.
 
You must log in or register to reply here.
Back
Top Bottom