RAW or not to RAW

slingshot

Member
Screen Shot 2020-09-15 at 23.16.08.png

Not sure how to get the best result possible from this one.

Customer is a teacher, needs standard office files, pics and vids from drive. Drive had been elsewhere discussed here and after replacing the heads and weeks of imaging I've finally got all that can be read. Unread blocks are located mainly in the first 10% of the drive in a few clumps and then scattered, but remaining 90% of image is read. Bad blocks = 200Mb.

So, using R-Studio, I scan the image and it reveals lots of partitions, all with different start positions and sizes. I've opened 'recognised 11' and it gives me a folder structure of the guys files but they are all junk, even though R-Studio states recovery chances are good (green dots). Usually I would just select the RAW files option and be done with it. But this guy has been messed around a lot already, so I want to be sure I'm giving him the best result that is possible. (I would also like to get paid for this headache of a case :) )

Is it pointless looking at the rest of the green partitions (each partition takes about 2hrs to process, as he has millions of files) ?

Is R-Studio the best for processing RAW ?

Is Data Extractor better for processing RAW and attempting to split good from bad ?

I always hate the fact that RAW includes lots of corrupted files with the good files, but I don't know of any way that can solve this issue.

Can anyone else help me be better than what I've already managed so far ?

Thanks as always guys.
 

LarrySabo

Member
See what ReclaiMe File Recovery trial finds. It's excellent at rebuilding file systems from bits and pieces. Also consider a trial version of UFS Explorer. I just finished a case where ReclaiMe did a great job on a HFS+ file system but a poor job on the Raw recovery, and UFS Explorer did the opposite.
 

lcoughey

Moderator
I'd be inclined to use UFS explorer, connected the the DE map file so you can split the good and damaged files based on the sector map.
 

slingshot

Member
LarrySabo":y2yray8a said:
See what ReclaiMe File Recovery trial finds. It's excellent at rebuilding file systems from bits and pieces. Also consider a trial version of UFS Explorer. I just finished a case where ReclaiMe did a great job on a HFS+ file system but a poor job on the Raw recovery, and UFS Explorer did the opposite.

Thanks Larry, had it scanning in reclaime for about 8 hours so far LoL, few hours left before I can determine results. Looking good though :)
 

slingshot

Member
lcoughey":2t856438 said:
I'd be inclined to use UFS explorer, connected the the DE map file so you can split the good and damaged files based on the sector map.

I've got recovery explorer pro but it doesnt have the option to load the ace map.

I've got several other flavours of UFS and Recovery explorer but none do what you are suggesting.

UFS explorer pro does it, but its very expensive :shock:

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?
 

lcoughey

Moderator
slingshot":1ywgwnx8 said:
[post]16835[/post] UFS explorer pro does it, but its very expensive
It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?
As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.
 

slingshot

Member
lcoughey":jsuek5v9 said:
slingshot":jsuek5v9 said:
[post]16835[/post] UFS explorer pro does it, but its very expensive
It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?
As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.

I agree with you, but I don't typically get many jobs that end up in such a mess as this, where there is no catalogue file or MFT to go at. If I have to do RAW recoveries then its usually due to formatting, so theres never a need for good/bad splits. On the other hand, if it could determine what files work and what don't from RAW recoveries, then I'd have much more use for it. However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?
 

LarrySabo

Member
slingshot":18036znw said:
However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?
If the corrupted files have a fill pattern because of bad blocks, you can use Corrupted Files Finder to vet files that contain more than your choice of % of fill characters. Not perfect but sometimes helpful.
 

slingshot

Member
LarrySabo":17e1nkwq said:
slingshot":17e1nkwq said:
However, due to the nature of RAW recoveries recovering overwritten and garbage files, as well as good files, to my knowledge there is nothing that can determine between functioning files and garbage, or is there ?
If the corrupted files have a fill pattern because of bad blocks, you can use Corrupted Files Finder to vet files that contain more than your choice of % of fill characters. Not perfect but sometimes helpful.

Thanks Larry, I'm sure I could find a use for this one ;)
 

slingshot

Member
lcoughey":1bw5hinh said:
slingshot":1bw5hinh said:
[post]16835[/post] UFS explorer pro does it, but its very expensive
It isn't that expensive considering that we get to use it over and over again on jobs that we are billing for.

I'll give it a go in trial mode but it will still be in RAW mode, can it determine good from bad in RAW ?
As long as you are scanning the drive connected to the map file, yes, it will save them out split. But, that will only work if you have the paid program.

I'm comparing the result from reclaime to the task in UFS pro. I do like the idea of being able to work with ace labs images outside of Data Extractor though, and despite using 30GB of RAM and 15 Hrs to build a virtual file system, it may have done a better job. I also like the way you can filter out system files etc with ease, I think I will have to buy it - to see for sure whats best - for this case I'm working on.
 
Top