Good day guys!
I have an external HDD to examine; from the suspect statement is that was fallen down….
When I am using in the 64 bit workstation its showing that it's in NTFS file system… Same time when I am using 32 bit workstation its showing it's a RAW file system…
EnCase is not giving preview
FTK imager also not giving preview
But WinHex is giving the prove it contained a lots of files
But I am very urgent to view those external HDD… any tools can possible
If WinHex can see it then use X-Ways forensics to examine it. It's made by the same people and should be able to at least get an image from it.
Has it got an EFI partition? This will be seen by Vista, but not XP.
Look at sector 1, does it start EFI PART. Also, the file type in the partition table of the boot sector will be 0xef
Good day guys!
I have an external HDD to examine; from the suspect statement is that was fallen down….
Not sure if I understand you correctly, but do you suspect that the disk has been damaged? If so repeted attempts to start and read the disk can encrease the damage. Best solution is to let a data recovery company open it up in a lab and clone the platters.
If its in fine working order a bit by bit copy shuld do. Since the file system seems damaged you could try some data recovery software.
I assume you have removed the disk from its enclosure, and are reading it directly with a SATA/PATA write blocker? If not it could be a damaged controller on the ext disk.
Good day guys!
I have an external HDD to examine; from the suspect statement is that was fallen down….
Not sure if I understand you correctly, but do you suspect that the disk has been damaged? If so repeted attempts to start and read the disk can encrease the damage. Best solution is to let a data recovery company open it up in a lab and clone the platters.
Have you removed the drive from the external enclosure? What is the native HDD interface on the drive itself? If you think there is physical damage (do you hear a clicking sound when trying to operate?) then stop using it and do get it to a clean lab that can recover the media by physically dissembling it before further damage occurs.