cgsecurity.org

I appreciate all the help you have provided.

Any suggestions how to deal with that?

I wonder how that information is coming back.

The drive is toshiba kxg50znv512g. Those are 512 GB devices (the 512g is even part of the model name).
https://www.memory4less.com/toshiba-xg5 ... g50znv512g

Thanks for your feedback. Any thoughts on why TestDisk thinks the drive size is twice what it is?

"TestDisk 7.2-WIP, Data Recovery Utility, January 2020
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sdb - 512 GB / 476 GiB - CHS 62260 255 63
The harddisk (512 GB ...

The format now is NTFS. It was NTFS before the quick format as well.
The system is Windows 10.
The way the quick format happened was I externally attached a new drive. As expected Windows popped up a "disk needs to be formatted" message. I pressed OK, and it popped up the message again, and I ...

That's what I'm afraid of. It seems odd though, that a quick format would do that. Isn't that what a full format would do? Is it possible that quick format acts differently on an SSD?

Yes, I did use -a. I still have the command in the history:

C:\Program Files\smartmontools\bin> smartctl -a /dev ...

When I asked the system admin last week who configured the system he said they don't encrypt drives. However, I don't know this drive came from and I'll have to see if they know. It's an SSD drive. I wonder if that drive was used and if the previous user had it configured as encrypted. I don't think ...

Is there a way to find out if it was encrypted? I'm not an expert so I would appreciate any pointers that could lead me in the right direction. Thank you.

I should mention, this is a Toshiba SSD drive

Thank you for your suggestion. I tried it. It found zero files (even though there should be thousands of pics). In the following screen it is asking "Create an image_remaining.dd (511974 MB) file with the unknown data (Answer N if not sure) (Y/N)"
I assume it means the image it'll create will be ...