I am working on a project for a client, whose spouse erased some
damaging conversations off of a Sony ICD-P320 voice recorder. I was
hoping to that the device would be assigned a drive letter via usb and
could be imaged through windows, but no such luck. The client saved
the recordings to their desktop in *dvf form but they were also
deleted from there. The client also burned a CD, but their spouse
also took the CD. I am losing my mind. I have searched by file
headers for any *dvf file, also looked for anything with a dvf
extension, but nothing!!! The only references I have to any dvf file
is the registry for the MRU *dvf files and a reference to one of the
files in an info2, and a .lnk file from where the CD was burned. The
files were transfered on a Friday, and the files were deleted that
Sunday. The computer was booted on Monday, but shutdown immediately
when the client realized their files were gone. Does anyone have any
experience with finding information from USB devices which dont assign
drive letters?
getting the deleted files back should be straight forward if a lot of disk writing hasn't been going on. Google is your friend, theer are a lot of freeware/shareware and commercial progs for recovery deleted files such as Recover4All etc. Most commercials have a d/l demo that will show you what they can recover and then you can buy if you like what you see.
Bill
Thanks for the quick reply. I use either encase or ftk on most cases, but neither are finding the files from the hard drive. I have googleing for days. This forum is the last hope. I am thinking there has to be some way to be able to look at what was on the voice recorder itself. Unfortunately, herein lies the problem. The device is not assigned a drive letter when it's plugged into the usb, so I have no way to "grab" the device for analysis purposes. Is there a way to maybe map a drive letter to a device by it's hardware ID?
Have you tried looking at it or imaging it from linux?
Try this…
Check the setupapi.log file for references to the Sony voice recorder being installed. This will help determine the driver what was used, as well as the date that it was first connected.
Now…which key was the Sony device referenced under, enum\USB or enum\USBStor?
Everything I've been able to find on this device tells me that the device should have been recognized as a storage device, but I'm thinking that maybe a Sony driver needed to be installed.
Another possibility is this…if the Sony voice recorder was plugged in and assigned a drive letter, and then unplugged and another USB removable storage device plugged in and assigned the same drive letter, you won't be able to tie the drive letter assignment to the Sony device.
HTH
Following on from Harlan's post, if you go into disk management is it seen there?
If so you could just assign a drive letter
or am i missing something
paul
To my dismay, it does not show up in disk management. It does show up the device manager, but only as a USB device, not in the disk drives area. I have also tried tweaking the registry to see if I could trick windows into seeing it as another usb drive, but thus far no luck.
I would have to wonder about the files that were deleted from the computer on Sunday but not recoverable on Monday. A regulary deleted file should show up somewhere.
I borrowed one of these units and hooked it up. It doesn't show as a hard drive or storage device, but lets me copy recordings to computer. I have deleted them and found them with a number of tools, including ProDiscover, FTK, and Recover4All.
Gonna try to access the device in Linux with dd after court today.
Bill
BTW, is there any way the client could be pulling your string and the files were never on computer or any other possible "untruth" in the scenario?
Happens to me all the time.
That thought had crossed my mind. If I didn't have those references in the registry for recently run *.dvf files and also in the info2 I would think that they were messing with me. The unit was brand new, and the client had not copied files like this before, so there is plenty of room for user error, but everything registry related points that a folder was created on the clients desktop, then simply vanished???