[SOLVED] Strange data recovery issue

[slippyjim]

Hi,

I have been given a WD 2TB 3.5" Sata USB HDD from my friend as he could no longer access any files after he knocked it off the table and the USB connector was damaged. He had not had any problems with the drive up to this point and said it contained 500GB of music only and no other files.
I have removed the HDD from the case and connected it to my PC directly via sata, it span up ok with no strange noises but didnt appear in This PC. So I went to disk management and it says it is not initialised which I thought was a little strange so I started on data recovery
I tried my old version of Get Data Back NTFS - instantly said no NTFS partition found
Then I tried Get Data Back FAT - 5 hours later said no FAT partition found
On to Disk Drill and a 24 hour scan later it finds documents, pictures, archives and videos (total 6GB) but no music files. It also found 1 partition - HFS with path \Partitions\HFS\file000000.dmg
A lot of the files seem to be related to the WD manual as far as I can see
I asked him if he had ever used this HDD with a Mac and he said no its only been used with Windows, maybe the dmg file is the mac WD software?

So any recommendations on what to do? Other software to try?

Thanks

 

[DSzymborski]

I would try Recuva, but I suspect that this hard drive is well past the point where software recovery is an option.

 

[slippyjim]

I have tried Recuva but it doesnt recognise the drive as there are no partitions.
I could initialise and format it and then try.

I forgot to say in Disk Drill it says
Smart Status Bad - C5 Current pending sector count - Current 200 - Threshold 0 - Raw value 000000000018 - Status Bad
But when I did a full scan with HDD Regenerator (which has always worked for me) it found none

It seems weird because I've recovered data from seemingly much worse hard drives than this before

 

[CountMike]

I have tried Recuva but it doesnt recognise the drive as there are no partitions.
I could initialise and format it and then try.

I forgot to say in Disk Drill it says
Smart Status Bad - C5 Current pending sector count - Current 200 - Threshold 0 - Raw value 000000000018 - Status Bad
But when I did a full scan with HDD Regenerator (which has always worked for me) it found none

It seems weird because I've recovered data from seemingly much worse hard drives than this before

If it was running when it fell it most probably had a head crash damaging either heads or surface where Fat table is stored.

 

[img]

Hi,

I have been given a WD 2TB 3.5" Sata USB HDD from my friend as he could no longer access any files after he knocked it off the table and the USB connector was damaged. He had not had any problems with the drive up to this point and said it contained 500GB of music only and no other files.
I have removed the HDD from the case and connected it to my PC directly via sata, it span up ok with no strange noises but didnt appear in This PC. So I went to disk management and it says it is not initialised which I thought was a little strange so I started on data recovery
I tried my old version of Get Data Back NTFS - instantly said no NTFS partition found
Then I tried Get Data Back FAT - 5 hours later said no FAT partition found
On to Disk Drill and a 24 hour scan later it finds documents, pictures, archives and videos (total 6GB) but no music files. It also found 1 partition - HFS with path \Partitions\HFS\file000000.dmg
A lot of the files seem to be related to the WD manual as far as I can see
I asked him if he had ever used this HDD with a Mac and he said no its only been used with Windows, maybe the dmg file is the mac WD software?

So any recommendations on what to do? Other software to try?

Thanks

Did the drive spin when the accident happened? If not, you have a good chance (if it's an older WD model).

WD enclosures hardware encrypted in default, so it is normal behavior if the drive shows up in disk management as uninitialized and no data found by any software.

Buy the very same enclosure on e-Bay (or just the crypter / decrypter PCB is enough) and swap it with the failed. Your data has to be intact if no other hardware damage happened due to the fell.

Crypter / decrypter PCB Board no.s: 4061-705094-001, 4061-705094-004, 4060-705149-000, 4061-775213-000, etc.

If it's a newer series model with built-in MCU decryption you have to take it to a pro data recovery company unless you have a BGA rework station.

 

[fzabkar]

Disk Drill probably found the unencrypted Virtual CD (Smartware) at the end of the user area.

 

[img]

Disk Drill probably found the unencrypted Virtual CD (Smartware) at the end of the user area.

It's possible, I used Disk Drill only once, years ago but failed so I am not following that software how is evolving...

I just said that if we disconnect a MyBook or MyPassport drive from it's [de]crypter board and attach it to the PC directly on SATA connection, it shows itself uninitialized.

I just wrote it 'cause I could have been misunderstood at first, I hope I don’t look rude.

 

[fzabkar]

It's possible, I used Disk Drill only once, years ago but failed so I am not following that software how is evolving...

I just said that if we disconnect a MyBook or MyPassport drive from it's [de]crypter board and attach it to the PC directly on SATA connection, it shows itself uninitialized.

I just wrote it 'cause I could have been misunderstood at first, I hope I don’t look rude.

You are perfectly correct. I was just trying to explain why the OP was able to find some unencrypted files on an encrypted drive. In fact a lot of the raw files are probably accidental positives, eg bogus SWF files.

When the HDD is behind the USB-SATA bridge, the small VCD region at the very end of the drive is enumerated by the OS as a separate virtual optical drive. When you remove the bridge, the OS sees everything as a single hard drive. You can probably see the VCD files with DMDE.

 

[img]

You are perfectly correct. I was just trying to explain why the OP was able to find some unencrypted files on an encrypted drive. In fact a lot of the raw files are probably accidental positives, eg bogus SWF files.

When the HDD is behind the USB-SATA bridge, the small VCD region at the very end of the drive is enumerated by the OS as a separate virtual optical drive. When you remove the bridge, the OS sees everything as a single hard drive. You can probably see the VCD files with DMDE.

Ok, I wasn't sure about what's missunderstandable in my comment as English is not my native language. The living speech (or hands + feet pantomime ) always the best with tones, mimicry actions, nonverbal gestures, etc.

You're absolutely right about the virtual partition and about the unreasoned swf files too: they was the culprit why I discarded this Disk Drill many years ago.