slingshot
Experienced DR Tech
Posts: 227
Joined: Fri Jul 21, 2017 7:26 pm

RAW or not to RAW

Tue Sep 15, 2020 6:50 pm

Screen Shot 2020-09-15 at 23.16.08.png


Not sure how to get the best result possible from this one.

Customer is a teacher, needs standard office files, pics and vids from drive. Drive had been elsewhere discussed here and after replacing the heads and weeks of imaging I've finally got all that can be read. Unread blocks are located mainly in the first 10% of the drive in a few clumps and then scattered, but remaining 90% of image is read. Bad blocks = 200Mb.

So, using R-Studio, I scan the image and it reveals lots of partitions, all with different start positions and sizes. I've opened 'recognised 11' and it gives me a folder structure of the guys files but they are all junk, even though R-Studio states recovery chances are good (green dots). Usually I would just select the RAW files option and be done with it. But this guy has been messed around a lot already, so I want to be sure I'm giving him the best result that is possible. (I would also like to get paid for this headache of a case :) )

Is it pointless looking at the rest of the green partitions (each partition takes about 2hrs to process, as he has millions of files) ?

Is R-Studio the best for processing RAW ?

Is Data Extractor better for processing RAW and attempting to split good from bad ?

I always hate the fact that RAW includes lots of corrupted files with the good files, but I don't know of any way that can solve this issue.

Can anyone else help me be better than what I've already managed so far ?

Thanks as always guys.

User avatar
LarrySabo
Data Recovery Master
Posts: 890
Joined: Mon Jan 12, 2015 8:15 pm
Location: Ottawa, Canada
Contact: Website

RAW or not to RAW

Tue Sep 15, 2020 10:35 pm

See what ReclaiMe File Recovery trial finds. It's excellent at rebuilding file systems from bits and pieces. Also consider a trial version of UFS Explorer. I just finished a case where ReclaiMe did a great job on a HFS+ file system but a poor job on the Raw recovery, and UFS Explorer did the opposite.

User avatar
lcoughey
Forum Moderator
Posts: 650
Joined: Mon Jan 12, 2015 12:46 pm
Location: Ontario, Canada
Contact: Website Facebook Twitter Google+

RAW or not to RAW

Wed Sep 16, 2020 11:55 am

I'd be inclined to use UFS explorer, connected the the DE map file so you can split the good and damaged files based on the sector map.

slingshot
Experienced DR Tech
Posts: 227
Joined: Fri Jul 21, 2017 7:26 pm

RAW or not to RAW

Wed Sep 16, 2020 1:02 pm

LarrySabo wrote:See what ReclaiMe File Recovery trial finds. It's excellent at rebuilding file systems from bits and pieces. Also consider a trial version of UFS Explorer. I just finished a case where ReclaiMe did a great job on a HFS+ file system but a poor job on the Raw recovery, and UFS Explorer did the opposite.


Thanks Larry, had it scanning in reclaime for about 8 hours so far LoL, few hours left before I can determine results. Looking good though :)

slingshot
Experienced DR Tech
Posts: 227
Joined: Fri Jul 21, 2017 7:26 pm

RAW or not to RAW

Wed Sep 16, 2020 1:13 pm

lcoughey wrote:I'd be inclined to use UFS explorer, connected the the DE map file so you can split the good and damaged files based on the sector map.


I've got recovery explorer pro but it doesnt have the option to load the ace map.

I've got several other flavours of UFS and Recovery explorer but none do what you are suggesting.

UFS explorer pro does it, but its very expensive :shock:

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

User avatar
lcoughey
Forum Moderator
Posts: 650
Joined: Mon Jan 12, 2015 12:46 pm
Location: Ontario, Canada
Contact: Website Facebook Twitter Google+

RAW or not to RAW

Wed Sep 16, 2020 1:19 pm

slingshot wrote:Source of the post UFS explorer pro does it, but its very expensive

It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.

slingshot
Experienced DR Tech
Posts: 227
Joined: Fri Jul 21, 2017 7:26 pm

RAW or not to RAW

Wed Sep 16, 2020 6:10 pm

lcoughey wrote:
slingshot wrote:Source of the post UFS explorer pro does it, but its very expensive

It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.


I agree with you, but I don't typically get many jobs that end up in such a mess as this, where there is no catalogue file or MFT to go at. If I have to do RAW recoveries then its usually due to formatting, so theres never a need for good/bad splits. On the other hand, if it could determine what files work and what don't from RAW recoveries, then I'd have much more use for it. However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?

User avatar
LarrySabo
Data Recovery Master
Posts: 890
Joined: Mon Jan 12, 2015 8:15 pm
Location: Ottawa, Canada
Contact: Website

RAW or not to RAW

Wed Sep 16, 2020 10:36 pm

slingshot wrote:However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?

If the corrupted files have a fill pattern because of bad blocks, you can use Corrupted Files Finder to vet files that contain more than your choice of % of fill characters. Not perfect but sometimes helpful.

slingshot
Experienced DR Tech
Posts: 227
Joined: Fri Jul 21, 2017 7:26 pm

RAW or not to RAW

Thu Sep 17, 2020 8:09 pm

LarrySabo wrote:
slingshot wrote:However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?

If the corrupted files have a fill pattern because of bad blocks, you can use Corrupted Files Finder to vet files that contain more than your choice of % of fill characters. Not perfect but sometimes helpful.


Thanks Larry, I'm sure I could find a use for this one ;)

slingshot
Experienced DR Tech
Posts: 227
Joined: Fri Jul 21, 2017 7:26 pm

RAW or not to RAW

Thu Sep 17, 2020 8:15 pm

lcoughey wrote:
slingshot wrote:Source of the post UFS explorer pro does it, but its very expensive

It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?

As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.


I'm comparing the result from reclaime to the task in UFS pro. I do like the idea of being able to work with ace labs images outside of Data Extractor though, and despite using 30GB of RAM and 15 Hrs to build a virtual file system, it may have done a better job. I also like the way you can filter out system files etc with ease, I think I will have to buy it - to see for sure whats best - for this case I'm working on.

Return to “Logical Data Recovery & Data Recovery Software”

Who is online

Users browsing this forum: No registered users and 0 guests