Need some help. I have the above drive which was handed to me for examination (*not evidence*. It is my Boss' drive). Now, I know that it is a 4gb drive thanks to the manufacturers information. But when the drive is plugged in, it shows as a 1.5 tb exFAT drive, and shows it as empty. I happen to know that the drive was not empty, the Boss thought it was trash as it wasn't being read by their computer and came running to me for assistance.
Can anyone recommend another method for file recovery on this drive? I attempted EnCase v5 but that didn't display anything and would not allow me to create an image of the drive. I tried just doing a raw physical exam, but no file tree even shows up and it says the drive needs to be formatted. I am wide open to suggestions, since I am missing something here.
FYI I attempted to recover the files on two machines, a Dell ATG D630 running Win 7 and a Dell Lattitude D510 running Win XP.
Thanks in advance!
If you have access to the hex data on the drive, you might want to check out R-Studio (http//
Otherwise, you might have to dump the raw data off the Flash chip using something like PC-3000 Flash (http//
Those look like great solutions, thanks for the links! I may just try the r-studio, since it specifically mentions exFAT. I'll report back if I get some success!
From what you write it sounds more like a corrupted MBR or PBR than anything else.
Why don't you try doing an actual "dummy" RAW image (dd or similar) and then run TESTDISK (in case it is a partition problem) and/or, if you don't suceed run PHOTOREC on it?
This is "recovery", not "forensics", you should use recovery aimed apps rather than Encase and similar.
jaclaz