How to DR an overwritten NTFS?

[gcgm]

My customer has a big problem and it's now mine. According to him, his computer was infected by a virus and one of his HDDs showed this error after a restart:

e:\ Is not accessible. The disk structure is corrupted and unreadable.

The drive is in good condition with no physical damage and no bad sectors. When I ran DE on the drive (DiamondMax Plus 9 Calypso 6Y080L0/P0), this was shown:



http://fax2inbox.com/photos/ss1.jpg (image url enclosed by img tags but image not shown )

When I showed my customer the directory structure, he said that wasn't the structure in the drive at all! He was very certain the drive's NTFS wasn't something he could recognize. I imaged the whole drive (80GB) into a image file and used a hex editor to view some of the contents by searching for some familiar strings that he (the customer) could remember and we found them. So it seemed the NTFS has been overwritten completely.

My question is: can the original directories and files still be recovered using DE? If yes, what are the directions to proceed?

Has anyone experienced such a problem before?

Thanks so much for reading this.
Jeff

[-BR-]

Hi Jeff

DE is an exepcional utility for imaging and recovering data when you think that drive might fail!
But since you managed to make an image of the whole drive, I assume this hdd is good

To recover deleted data or formated partition, I think it's faster to use conventional software like R-studio
This also have the benefit of leaving your expensive PC3000 hardware free for more complicated cases

-BR-

[steven]

lot of Automatic Logical ecovery that u can use to cover such case.
but the chance of recovery depend to logical condition in the HD.

[gcgm]

Hello BR & Steven,

Thank you for your replies!

I used DE to do a MFT scan of the first 1,000,000 LBA of the drive. The result was the same, ie. it showed the same virus modified directory/file structure and not the original structure. I'm a little worried. I'll now try R-Studio as suggested to see what the result will be. I'll keep posted on this board.

Jeff

[gcgm]

To recover deleted data or formated partition, I think it's faster to use conventional software like R-studio
This also have the benefit of leaving your expensive PC3000 hardware free for more complicated cases

-BR-

Hi -BR-,

I took your suggestion and tried out R-Studio. Wow! It's fast and all important data directories and files were recovered! I totally agree with you that the PC3K SHC should be left free to do more challenging tasks.

Thanks,
Jeff

[-BR-]

You are welcome

-BR-

[edbrandt]

Bump: I understand R-Studio was good for this kind of task, but is there an "one click solution" in Data Extractor for repairing broken partition tables?

Thanks!

-Espen

[Nick_TS]

Hello Espen,

Source of the post I understand R-Studio was good for this kind of task, but is there an "one click solution" in Data Extractor for repairing broken partition tables?

Yes, you can use Quick Disk Analysis, in this case.