Data recovery issues

[cavemantf]

I am desperately trying to help a friend recover some data (photos mostly) from their hard drive - it's an ide Western Digital 500Gb drive. They reported that the drive was working one day, then 'not' the next - "it might have been a virus..."

I started with the obvious stuff - downloaded the WD diagnostic software (dos) and ran a quick check which showed no problems (I will be running a long test over night tonight to make sure)

The drive shows up as unpartitioned (and remains so!)- but I had to initialize it (hope this didn't cause any damage!). I have tried all of the programmes suggested in another forum (Spinrite, GetDataBack, Stellar Phoenix Recovery Plus, to name a few.) The purely 'recovery' programmes report 'no files found'. The disk readers (DiscExplorer for FAT32/NTFS and others) show something strange. The opening sectors of the drive contain only the message stating that no OS is loaded on the disc, followed by a significant amount of nothing (no boot sector/mbr/file system etc) Then about 50Gb in (guessing) it changes from '00' to 'FF' (in the hex view) or 'EOF' (end of file) in the text/FAT 16 view. It appears that 90% of the HDD has been overwritten with 'FF' unless I'm misreading something here?

I've pretty much given up any hope of retrieving the data, but was wondering if anyone could shed any light on what might have happened, or maybe have a recovery strategy (obv. we're not paying for forensic recovery, but it would be nice to know if anything else is available to the consumers now!)

 

[G0AOZ]

I'm afraid to say that I think initializing the disk was probably a bad idea. I believe that initializing zeros the file tables (MFTs), and has probably destroyed the structure, hence you see virtually nothing when running programmes like GetDataBack, which is one of my favourites for data recovery. You could try Easy Recovery Pro as this has several different types of file recovery including raw data, but I suspect the initialization has probably killed the realistic possibility for data recovery on this drive unless you want to pay big bucks...

ROGER - G0AOZ.

 

[cavemantf]

Thanks for the reply - I fully appreciate what you are saying, however surely even it that were true - the programmes that read the raw data on the disc would still be able to see the data? As I posted above, when reading the disc directly with programmes like DiscExplorer (and a couple of DOS based ones) all I see is empty zeros, then the last three quarters of the disc is filled with "ff" throughout - almost as though the disc has been overwritten? Initializing may fry the MFT, but it shouldn't affect the actual data?

 

[kjv1611]

If you really want to keep trying, here are a couple possibilities:

1. Try the Active Partition Recovery program - it's free if you want to attempt recovering a partition to an image file, the paid version recovers the partition in place.

2. Try with a different computer or hard drive controller just to be sure. I don't think it'll help at this point, but it's a pretty easy/quick method if you've got another machine handy.

Active Partition Recovery works sometimes when others won't, but I'm thinking your chances are getting pretty slim based on your original post. If there is no back, and the data is important, then I think it'd be worth giving the one more try.

--

"If to err is human, then I must be some kind of human!" -Me

 

[cavemantf]

Thanks for that - I did try a couple of partition recovery programmes - can't remember if Active Partition Recovery was one of them - will give it a try. I have already pulled the drive from the original machine and have it hooked up to one of my spares so no joy there unfortunately

Has anyone seen the "FF" covering a drive before? Any idea if that's what's actually on the drive, or if the reader programmes are just reading nonsense? I still have to do a long scan with the WD tools to make sure there isn't anything physically wrong with the drive (quick test was clean) - any point running chkdsk?