I'm new at this and this is the first time I've run accross this problem - I made an image copy of a drive and encountered numerous bad sectors, etc. Took 20 hours to copy. After running recover sofware from LC Technologies aginat the imaged disk - almost all the .xls, .pdf, .doc, zip files are unreadable. When opened they all report encoding issues or just show unreadable chars ??? Interestingly enough the .dbx files from OE are generally readable. There are several programs like BCWipe on the disk as well as a version of cryptext. My thought is that the combination of the secure delete, the encryption and the disk errors made the files the way they are.. Any thoughts ?? or any suggestions for me to prove this theory ??
Thanks for the help.
What did you use to make your image? It is possible that you imaging process has failed.
Finding that some of the recovered files are corrupt from using DR COTS products is fairly common. Many of these tools rely on identifying file types through their file signatures. This means that the beginning of a file can be identified, but not its size/end (footer). Therefore they pull out lots more data than the original file had (not knowing where to stop). Or if the file was fragmented, and the software is set to process unallocated clusters. It will extract consecutive clusters, thus pulling out parts of other files…
I’m not too sure why you are using file recovery software on an image? If you are performing an examination looking for evidence of wrong doing (use of file wiping software for instance), then recovery software is not the best solution. You want to be able to view the file structure. This will let you know whether or now file wiping software such as bcwipe has been used. Just an observation from you post…..If bcwipe has been used in earnest you chances are you would not be finding any of the types you mention…. The software may be present, but simply not recently used
Andy
What was the size of the drive?
How many total bad sectors?
Thanks for the replies –
The drive is 60gb (not sure how many bad sectors in total - i remember the first encounter mentioned 64 sectors but I can't rememeber the rest)
I used Ghost for the image with the -IR switch. This gives me an exact dup of the disk to work with. Would you suggest something different ??
I can see what you mean with the restore software grabbing more than it should if it can't get a firm read on the file info – what would you recommend for the restoring of deleted material ?
I'm not sure I'd know what to look for in the file structure ?? Are there any good whitepapers or books you'd recommend to outline where to start ??
There is a lot to this – and I'm just getting started..
thanks again –