RAW Partition - Zeroed?

[Brad324]

Hello Everyone,

First time posting here so I'll try to be as thorough as possible.

I recently built a new computer and all went very well. A couple days ago I set up a network and tried to copy pictures and files from my old computer to my new, to have a backup. I went to access my old computers D: drive, which is a storage partition, and found it to have RAW format.

The old computers drive is a 640GB WD Black and has 2 partitions, C and D. Windows Vista 64 is installed on C, and the computer still boots no problem. I haven't used the computer for a couple weeks, and as far as I recall the D drive was completely fine when last I used it.

I stopped using the computer so I wouldn't risk overwriting data, and removed the drive. Using my new computer, I connected the drive and ran a few data recovery trials to see if any programs I could purchase would find my files.

After trying several programs including Easeus, Active@ Data Recovery, OnTrack and more, I came to the conclusion I'd need professional help. I used one of the programs (forget which) to create an image of the D drive on my new computer incase anything were to happen, so I could possibly use that to recover the data. After successfully creating the image I took a break from trying to fix this because I was stressed out, and came back to it with the idea of using a hex editor to view the disks content.

I used WinHex to view the contents of the disk image I had created and found all zeros!! Frantically I checked all of my drives and found lots of information in all of them except for partition D of my old computers drive.

Now I've basically given up hope of recovering any data, but I'm curious as to what happened. Has anyone seen anything like this? I know there was viruses a while back that erased the first megabyte of your partition table or MBR, but I can't find anything on a virus zeroing a hard drive!

Any insight would be greatly appreciated!

Thanks!

Brad

 

[jonathanrhunter]

Not really a good explanation for it other than the disk getting formatted. I'm sure they are out there, but I really don't see a virus wreaking that kind of havoc. But who knows.

 

[Brad324]

Hey guys,

Just got back home, trying to decide what to do next...



My thinking is it can't be a hardware problem or the C drive would be affected. However this happened it must have been a program of some sort, and it was either run by me or by a malicious program or virus. I'm assuming that because it only wiped the D drive, it was probably based in the C drive so I think a format is in order. Maybe I should zero the rest of the drive?

I don't actually know how to zero the drive, and I don't really know how long it would take, but I'm assuming that it would take at least as long to write zeros as it would anything else. The drive being zeroed must have taken an hour or so I'm guessing...

Also, I have a theory that maybe the original problem was due to a power out or something that caused me to lose the partition table, rendering the drive RAW with information still stored just not accessible. I'm thinking that maybe one of the recovery programs I ran could have been some kind of zeroing program that is advertised as recovery but instead destroys the drive? Anyone heard of something like that?

Brad

 

[Brad324]

Yeah, the disk has 0's all through the D drive from sector 8 million something to the end, and random hex values before that. Safe to say data is gone. I zeroed the entire drive last night after taking what I could salvage off. It took 6 hours to zero the whole thing so it must have taken at least 2 hours to have initially zeroed it. I've never had a program to zero a drive on my computer before so however it happend it was unintentional. Whether it was an error by me with the recovery software or a program/virus that did it I have no idea, but I seriously doubt it was me or anyone who has access to the computer.

Anyways, all is well, got 3 backups of my data now so it should never happen again!

Thanks for the replies!

Brad