Dell Diagnostic / Recovery Partition Identifiers - EnCase 7

Encase is an analysis program rather than a data recovery program - though there is often a very large overlap between these areas.

To recover files, DO NOT wrote anything to the drive - ie don't touch the recovery partition. This will possibly just reinitialise the drive and potentially overwrite data.

I am concerned that SSD often comes with TRIM that will clear down areas of data if deleted or removed. If this has happened, your data is probably lost.

I would start with some simple data carving to determine if the files you want, eg JPEGs, .DOC(x) still exist. Carving does not depend on the file system partitioning etc. If your files can be seen (as nameless files) then continue with the file system. If the files can not be found because the SSD has erased them, there is no point searching further.

Thanks Michael.

I don't have the drive itself, I'm working of an EnCase Image File.

The partition recovery tools in EnCase only go so far and aren't producing the result I was hoping for… If I restore the partiions to the locations the Case Processor identifies, the smaller partition shows up fine but the larger partition remains as a whole heap of unallocated space. I ran the EnCase File Carver over the top of it and while it manages to cache about 35GB of data, EnCase itself doesn't show any results from the carve.

The partition recovery results don't seem right to me so I've played around a little and managed to expand the unallocated space into 2 seperate Volume Slacks, both of which contain heaps of raw data in the unallocated space. I ran file carver over this but again, no results.

A colleague has mentioned that locating and restoring the Dell Recovery or Diagnostic partition would restore both partitions and enable the file system for recovery but I can't see anything anywhere on how to actually do this!

Have you heard of this before and any ideas on how to go about it?

I've gone through this guide here http//www.goodells.net/dellrestore/fixes.shtml but as I'm working with an image and not the drive itself, the bulk of the instructions and the option to use dsrfix.exe to recover are is not really available to me.

I've gone through this guide here http//www.goodells.net/dellrestore/fixes.shtml but as I'm working with an image and not the drive itself, the bulk of the instructions and the option to use dsrfix.exe to recover are is not really available to me.

… which is a good thing, as that page and the tools in it are related to a rather old "recovery scheme" DELL used.

The good guys at DELL tend to completely change the way they setup the Recovery partition/option every couple years or so, what is in that page (or other pages on Dan Godell's site) may (or may not) apply to what you actually have.

But IMHO you are using the "wrong" (no offence intended) overall approach, as mscotgrove stated before, what you want to do is more recovery than forensics, what I would do (not necessarily a good idea, mind you)

1. forget about Encase
2. convert the .e01 image to RAW
3. throw at the RAW disk image some recovery tools (like TESTDISK or DMDE) and see what they think of the current structure of the MBR data and whether they can find unindexed volumes in the image

[/listo]
then if the recovery of the partition is successful, think about replicating the procedure inside Encase (or run Encase on the "fixed" RAW image instead).

jaclaz

I can't imagine that the recovery of a hidden dell partition would suddenly make the partition you believe to be there "usable"
Think this is one of those time to go back to basics, you know where the start of the partition is and you say you can see the "NTFS" hex, but have you decoded that sector to make sure there is a valid NTFS boot record?
If not, you could either manually decode it or use something like winhex (you could extract the sector using Encase) which has the template function to decode it for you.
If it turns out it is a valid NTFS boot record then there are a few more things you can look at
Inside the NTFS boot record you will have the cluster of the $MFT file, check it is in that location
Raw hex search through that partition are for $MFT, $Bitmap etc to see if there are any MFT entries for the essential NTFS files.
If you have both a valid boot record and a valid MFT, then its probably an Encase bug, try using X-Ways/FTK/Something else to verify.