RAW or not to RAW

[slingshot]

Not sure how to get the best result possible from this one.

Customer is a teacher, needs standard office files, pics and vids from drive. Drive had been elsewhere discussed here and after replacing the heads and weeks of imaging I've finally got all that can be read. Unread blocks are located mainly in the first 10% of the drive in a few clumps and then scattered, but remaining 90% of image is read. Bad blocks = 200Mb.

So, using R-Studio, I scan the image and it reveals lots of partitions, all with different start positions and sizes. I've opened 'recognised 11' and it gives me a folder structure of the guys files but they are all junk, even though R-Studio states recovery chances are good (green dots). Usually I would just select the RAW files option and be done with it. But this guy has been messed around a lot already, so I want to be sure I'm giving him the best result that is possible. (I would also like to get paid for this headache of a case )

Is it pointless looking at the rest of the green partitions (each partition takes about 2hrs to process, as he has millions of files) ?

Is R-Studio the best for processing RAW ?

Is Data Extractor better for processing RAW and attempting to split good from bad ?

I always hate the fact that RAW includes lots of corrupted files with the good files, but I don't know of any way that can solve this issue.

Can anyone else help me be better than what I've already managed so far ?

Thanks as always guys.

 

[LarrySabo]

See what ReclaiMe File Recovery trial finds. It's excellent at rebuilding file systems from bits and pieces. Also consider a trial version of UFS Explorer. I just finished a case where ReclaiMe did a great job on a HFS+ file system but a poor job on the Raw recovery, and UFS Explorer did the opposite.

 

[lcoughey]

I'd be inclined to use UFS explorer, connected the the DE map file so you can split the good and damaged files based on the sector map.

 

[slingshot]

See what ReclaiMe File Recovery trial finds. It's excellent at rebuilding file systems from bits and pieces. Also consider a trial version of UFS Explorer. I just finished a case where ReclaiMe did a great job on a HFS+ file system but a poor job on the Raw recovery, and UFS Explorer did the opposite.

Thanks Larry, had it scanning in reclaime for about 8 hours so far LoL, few hours left before I can determine results. Looking good though

 

[slingshot]

I'd be inclined to use UFS explorer, connected the the DE map file so you can split the good and damaged files based on the sector map.

I've got recovery explorer pro but it doesnt have the option to load the ace map.

I've got several other flavours of UFS and Recovery explorer but none do what you are suggesting.

UFS explorer pro does it, but its very expensive :shock:

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

 

[lcoughey]

[post]16835[/post] UFS explorer pro does it, but its very expensive

It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.

 

[slingshot]

[post]16835[/post] UFS explorer pro does it, but its very expensive

It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.

I agree with you, but I don't typically get many jobs that end up in such a mess as this, where there is no catalogue file or MFT to go at. If I have to do RAW recoveries then its usually due to formatting, so theres never a need for good/bad splits. On the other hand, if it could determine what files work and what don't from RAW recoveries, then I'd have much more use for it. However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?

 

[LarrySabo]

However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?

If the corrupted files have a fill pattern because of bad blocks, you can use Corrupted Files Finder to vet files that contain more than your choice of % of fill characters. Not perfect but sometimes helpful.

 

[slingshot]

However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?

If the corrupted files have a fill pattern because of bad blocks, you can use Corrupted Files Finder to vet files that contain more than your choice of % of fill characters. Not perfect but sometimes helpful.

Thanks Larry, I'm sure I could find a use for this one

 

[slingshot]

[post]16835[/post] UFS explorer pro does it, but its very expensive

It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.

I'm comparing the result from reclaime to the task in UFS pro. I do like the idea of being able to work with ace labs images outside of Data Extractor though, and despite using 30GB of RAM and 15 Hrs to build a virtual file system, it may have done a better job. I also like the way you can filter out system files etc with ease, I think I will have to buy it - to see for sure whats best - for this case I'm working on.