Blunders Of Data Recovery

[Jared]

I'm not sure what (or who) happened here, but I just got in an SAS drive for recovery. Imaging went well, only a few bad sectors near the beginning but when I look at the data it's almost all zeros. Ran a scan in R-Studio and found some random data near the middle, but nothing useful. Then I notice that where the EXT 3/4 partition should start, there's another MBR partition table.

Looks like someone tried cloning their own drive and went the wrong direction .

 

[pclab]

I'm also struggling a WD from a USB enclosure (I have asked the client the model...). I have decrypted it with PC3K (it found the key), but I can't get nothing.... :evil: :evil:

 

[LarrySabo]

Looks like someone tried cloning their own drive and went the wrong direction .

I've done that, once, when I cloned the donor to the patient on a Bandura. Fortunately, I had an image so no data lost.

 

[Jared]

I'm also struggling a WD from a USB enclosure (I have asked the client the model...). I have decrypted it with PC3K (it found the key), but I can't get nothing.... :evil: :evil:

Is the key in the SA the same as the magic sector near the end? I've seen cases where they were different and you just have to find the one that works.

 

[pclab]

Hey Jared

The Key is the same.
Here are some photos of it.
What do you think?

 

[jol]

[post]4309[/post] Here are some photos of it.

no, it's not
but let's pretend it is, can you upload sec. 0x800 (2048) ?

 

[Jared]

That MBR in picture 3 looks like a decrypted MBR. Are you sure it's even encrypted? Also, could be software encrypted. I just was dealing with one where bitlocker was actually the culprit.

 

[pclab]

I have imaged the drive with encription on and off and did some scans.
Can't get nothing.
I'm trying to get more info from my client's client.

 

[pclab]

Hi Jol

Here they are.
Thanks

 

[jol]

the screenshot of the MBR says that there is a single partition begins @ sector 2048 and the size is 3,907,024,896 sectors.
but @ sec. 2048 I see only 0x00
so... something is definitely wrong