Drive was somehow zero-wiped

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
scoticus
Posts: 6
Joined: 17 Feb 2018, 21:59

Drive was somehow zero-wiped

#1 Post by scoticus »

I was creating a Hiren Boot CD. The first try failed and I accidentally tried to create it on a 2TB hard drive. I noticed right away and cancelled the creation, the whole thing happened over about 15 seconds.

The drive now appeared as RAW. I tried using Testdisk as I've used it successfully before, and it found nothing on the initial sweep, didn't do deeper search though. I then tried active@ recovery and ran through a super scan. It found nothing. So I checked it with WinHex, and it appears as though everything on the drive is zero wiped. I only ran these two scans and the initial attempt at a format only lasted 10 seconds. I even ran photorec and it finds nothing.

I tried deshelling the drive, and it's a native usb connection. The only things I can think happened are either somehow one of the scans zero wiped while scanning, or the usb interface is "smart" and telling me there's nothing there when there is. Just wondering if anyone has any idea what might have happened?

Edit: Hard drive is a HD My Passport 2626 2tb USB3.0.

recuperation
Posts: 2736
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Drive was somehow zero-wiped

#2 Post by recuperation »

Please try out if Photorec finds anything.

Such behaviour resembles triggering the secure erase feature realised in a manner by deleting the key for a disc with permanent encryption. Upon such action reading only gives encrypted data.

You can as well have a look at the disc with your preferred hex editor.

scoticus
Posts: 6
Joined: 17 Feb 2018, 21:59

Re: Drive was somehow zero-wiped

#3 Post by scoticus »

As posted, photorec found nothing, hex editor showed all 00's. So if you're right about the encryption, they've designed a device where anybody who knows what they're doing can easily get your data, while any user attempting to recover their own data will lose it forever. Sounds about right. Seeing as the USB interface already appears to be mucking things up, is there any hope that it's just showing 00's but the data is still physically there, or is this low enough level that it's gone forever?

recuperation
Posts: 2736
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Drive was somehow zero-wiped

#4 Post by recuperation »

scoticus wrote: 10 Oct 2020, 15:44 As posted, photorec found nothing, hex editor showed all 00's.
Sorry, yes, you said it!
So if you're right about the encryption, they've designed a device where anybody who knows what they're doing can easily get your data, while any user attempting to recover their own data will lose it forever. Sounds about right. Seeing as the USB interface already appears to be mucking things up, is there any hope that it's just showing 00's but the data is still physically there, or is this low enough level that it's gone forever?
I can't really tell. From what you are saying it sounds pretty disappointing. By curiosity I would have looked at the disk with a disk editor.
To get the certainty you need to contact a professional recovery company.

BitterColdSoul
Posts: 50
Joined: 07 Jun 2020, 20:38
Location: France

Re: Drive was somehow zero-wiped

#5 Post by BitterColdSoul »

Are you absolutely, positively certain that there was indeed data on that HDD that was normally accessible right before the mishap happened ?
It's impossible that a 15s failed format completely wiped a 2TB hard disk drive (a SSD would be a different matter because of the TRIM command -- but I'm wondering if a badly configured computer could enable the TRIM feature on hard disk, magnetic platter based drives... that would be stupid, but stupid things happen all the time in this stupid world !). And both TestDisk and Active@ Recovery are reputed enough that it's highly doubtful that they would mess up with a drive's data ever-so-slightly, let alone in such a disastrous way.
I tried deshelling the drive, and it's a native usb connection. The only things I can think happened are either somehow one of the scans zero wiped while scanning, or the usb interface is "smart" and telling me there's nothing there when there is. Just wondering if anyone has any idea what might have happened?
You could ask at forum.hddguru.com, if an expert over there cares to reply. A HDD with a native USB connection can be tweaked to be connected in SATA, I've never attempted it but it doesn't look too difficult (not beginner's stuff either, though). There are means to access data from a natively encrypted drive connected in SATA (this can be more complicated, as very few people seem to propose that kind of service, but I know at least one guy who does it for a reasonable fee, see my post in the thread linked below).
From here :
you could download a trial version of winhex and check if the hdd gives any data at all. It might give all zeroes in case it has a charger drive inside and something went wrong with the translator. It might be worth checking before you clone 2TB of 00s.
You could quote this and ask for more information -- they seem to be generally quite... whimsical with newbies, or anyone who's not a fellow professional data recovery engineer. I don't know exactly what the translator is and how bad it is when it somehow gets corrupted (or if it's relevant at all to this specific issue, but it seems eerily similar, could be a regular issue with a particular series of drives).

Locked