File Recovery
Posted: 02 Nov 2012, 16:16
Hi All,
Sorry to bother you all, but I think I have a pretty terminal problem with a memory stick that is very important to me.
I went on leave for a few weeks some time back and when I came back my device had stopped working. Basically the usual issue of Windows not seeing the drive. I put it in my desktop PC which is a little more powerful and it did show up on Disk Management, but as unallocated. I even added it as an evidence item on FTK to see if I could read the hard drive that way which worked but everything was showing as zeros.....I have tried all sorts of software and have come across testdisk and photorec today and despite attempting to carry out recovery, I'm still struggling!
Last week I tried using Diskpart and also ran chkdsk. Diskpart would not allow me to clean the USB drive and I think CHKDSK failed also. I am getting various errors from the drive, mainly I/O errors and some errors relating to the FS being "RAW" which I hadn't heard of recently. I did try to reformat the drive as well at some point as I figured if I could at least get the partition back, I could recover the files off the disk....But I dont believe the format ever worked at all and kept failing on me....It sounds weird, but it's almost like the disk is in some kind of "Read Only" mode in the background as I just dont seem able to change anything on this drive.
I tried testdisk and although I got a handle on the command line interface, I was unsure whether my hard drive had been formatted as NTFS or FAT32 (although I think the former is most likely), so I didn't want to get too deep until I knew a bit more about what I was doing.....I am getting a fair few errors on the log relating to "ReadFile The request could not be performed because of an I/O device error" and when I tried Photorec, it just came back to me with zero files carved out.
If anyone has any ideas, I am happy to go ahead and follow the instructions and take screen prints of errors or copy and paste log errors as I'm going along and post them on here. My knowledge on hard drive forensics is "fair", I work in the e-discovery industry and as you can imagine, we frequently get data sent to us where recovery needs carrying out and although I always end up sending the work out to the experts, I do like to try and run some level of internal investigation.
Thanks all, and hopefully you can get this data back for me as I'm pretty screwed without it in honesty!
Thanks
Greg
Sorry to bother you all, but I think I have a pretty terminal problem with a memory stick that is very important to me.
I went on leave for a few weeks some time back and when I came back my device had stopped working. Basically the usual issue of Windows not seeing the drive. I put it in my desktop PC which is a little more powerful and it did show up on Disk Management, but as unallocated. I even added it as an evidence item on FTK to see if I could read the hard drive that way which worked but everything was showing as zeros.....I have tried all sorts of software and have come across testdisk and photorec today and despite attempting to carry out recovery, I'm still struggling!
Last week I tried using Diskpart and also ran chkdsk. Diskpart would not allow me to clean the USB drive and I think CHKDSK failed also. I am getting various errors from the drive, mainly I/O errors and some errors relating to the FS being "RAW" which I hadn't heard of recently. I did try to reformat the drive as well at some point as I figured if I could at least get the partition back, I could recover the files off the disk....But I dont believe the format ever worked at all and kept failing on me....It sounds weird, but it's almost like the disk is in some kind of "Read Only" mode in the background as I just dont seem able to change anything on this drive.
I tried testdisk and although I got a handle on the command line interface, I was unsure whether my hard drive had been formatted as NTFS or FAT32 (although I think the former is most likely), so I didn't want to get too deep until I knew a bit more about what I was doing.....I am getting a fair few errors on the log relating to "ReadFile The request could not be performed because of an I/O device error" and when I tried Photorec, it just came back to me with zero files carved out.
If anyone has any ideas, I am happy to go ahead and follow the instructions and take screen prints of errors or copy and paste log errors as I'm going along and post them on here. My knowledge on hard drive forensics is "fair", I work in the e-discovery industry and as you can imagine, we frequently get data sent to us where recovery needs carrying out and although I always end up sending the work out to the experts, I do like to try and run some level of internal investigation.
Thanks all, and hopefully you can get this data back for me as I'm pretty screwed without it in honesty!
Thanks
Greg