how to recover red x marked files

Post a reply


This question is a means of preventing automated form submissions by spambots.
Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:

BBCode is ON
[img] is ON
[url] is ON
Smilies are ON

Topic review
   

Expand view Topic review: how to recover red x marked files

Re: how to recover red x marked files

by Data-Medics » Mon Dec 26, 2016 2:28 pm

We don't charge anything for the evaluation, but if it was cleared by T.R.I.M. running on the system there is nothing we'd be able to do.

Also, our lab is scheduled to be shut down for a few weeks in January, so we wouldn't even be able to look at it until the end of next month at this point. We're all going to be out of the country.

Re: how to recover red x marked files

by j8sonp » Sat Dec 24, 2016 10:03 pm

@ Data-Medics, I haven't had any luck with the recovery so far. I'm assuming you're with data-medics.com? How much would it cost for you guys to take a look at this thing?

Re: how to recover red x marked files

by Alt » Thu Dec 01, 2016 6:58 am

Guest wrote:Is that true if it was a "quick" format? Because that's what I did. I think I'm getting fairly close to the right parameters. Below is a recovered image. The top 1/10 of the image came out but the rest is corrupt. I'm going to give that parameter instructional a shot over the weekend. Thanks for the help so far guys.
TRIM can be invoked at any time after the system has freed disk space. Be it file deletion or disk format.

Re: how to recover red x marked files

by Data-Medics » Wed Nov 30, 2016 7:11 pm

If TRIM trimmed it out, nope. No way to recover zero'ed out flash memory. Might be able to pull some random sector chunks left over from the wear leveling patterns, but that'll be useless for data recovery. Perhaps a bit of forensics to prove a crime, but not enough to have useful data.

Re: how to recover red x marked files

by Guest » Wed Nov 30, 2016 4:30 pm

Is that true if it was a "quick" format? Because that's what I did. I think I'm getting fairly close to the right parameters. Below is a recovered image. The top 1/10 of the image came out but the rest is corrupt. I'm going to give that parameter instructional a shot over the weekend. Thanks for the help so far guys.


Image

Re: how to recover red x marked files

by Alt » Wed Nov 30, 2016 3:24 pm

Data-Medics wrote:Ah, seeing those screenshots is very telling. Sandisk doesn't make any HDDs but they do make SSDs. If you formatted the SSDs it is very likely that TRIM zeroed out the blocks after the format. Try looking at the data of one of these corrupt files and see if it's just full of zeros.
That's right! That slipped from me. Sure. I don't even know if a highly professional data recovery specialist can recover the data.

Re: how to recover red x marked files

by Data-Medics » Wed Nov 30, 2016 3:16 pm

Ah, seeing those screenshots is very telling. Sandisk doesn't make any HDDs but they do make SSDs. If you formatted the SSDs it is very likely that TRIM zeroed out the blocks after the format. Try looking at the data of one of these corrupt files and see if it's just full of zeros.

Re: how to recover red x marked files

by Alt » Wed Nov 30, 2016 9:00 am

Actually, you need to find a correct offset for the RAID. This article may help you to find it: Finding RAID parameters. It's about RAID5, but can be used for RAID0.

Re: how to recover red x marked files

by Guest » Tue Nov 29, 2016 10:36 pm

So it is RAID 0 according to the BIOS. I was able to get that it's 128 kb block size from it. Now I'm not sure what to select from "Block order" and "Number of rows". I tried scanning again with default settings and 128 kb block size and the drive shows up as green now. However, anything I recover from it is still corrupted.

Image
Image
Image
Image

Re: how to recover red x marked files

by Data-Medics » Tue Nov 29, 2016 5:52 pm

If it's just a 2 drive RAID 0 it shouldn't take me more than 5 min to determine the settings for you if you'd like. PM me and I can probably take a quick look for you.

Top