This is a really strange case... all the file starts appear to be where they should be, but the sizes are all set to 16Kb rendering them all useless. It's like it was a chkdisk process gone wrong or something. Though the customer swears it was a virus. I can find all the files in RAW it seems, so it's definitely not Cryptolocker or anything like that (not encrypted).
But I just can't think of any method to link the files found in RAW with the file start locations... any ideas?
We specialize in data recovery from failed hard drives and RAID arrays among other professional data recovery services. This forum is dedicated to the sharing of information related to the field between other professionals. Our belief is that we are all more successful if we share our knowledge rather than try to keep it all locked up as a secret.