Where can the files be? :)

[edbrandt]

Ok, I had this case which was straight-forward. Customer did "something" while sorting files on a external HD, and suddenly (within a second) approximately 10.000 files were gone. She doesn't know the name of any file/folder missing, other than that we are talking about pictures and videos backed up from phone and camera. I don't expect people to remember file names of pictures (img0000542.jpg etc), but perhaps a folder name? But no..

Anyway... I've done logical recovery of all files in unallocated areas, plus files in the $RECYCLE.BIN folder, which was approximately 22.000 files. But these were not the files she was missing.

She has also looked through existing folders, to check if the missing files accidentally was dragged into a sub-folder. But no luck.


I would believe (at least some of) the files should have been in one of these places, but apparently not. As the disappearing happened very fast, I don't believe the files have been moved to another drive (local pc).

Any idea what can have happened? Did I miss anything?

Thanks

-Espen

[Blizzard]

What model is the hard drive? Some Western Digital external HDDs support TRIM.

[lcoughey]

No bad sectors when getting the clone? FAT32 or NTFS?

[edbrandt]

@Blizzard: It was a Toshiba drive
@lcoughey: The drive was in good shape, no bad sectors as I can remember

[DataMedics]

Was chkdsk run? Perhaps they're all now all renamed to be .CHK files in a directory like Found.000. Or perhaps was more data added to the drive since the files were deleted?

[Alex_TS]

Hello,

Source of the post @Blizzard: It was a Toshiba drive

Is it USB drive?

Source of the post FAT32 or NTFS?

How much MFT records you can find using RAW recovery on MFT table map?