This is a really strange case... all the file starts appear to be where they should be, but the sizes are all set to 16Kb rendering them all useless. It's like it was a chkdisk process gone wrong or something. Though the customer swears it was a virus. I can find all the files in RAW it seems, so it's definitely not Cryptolocker or anything like that (not encrypted).
But I just can't think of any method to link the files found in RAW with the file start locations... any ideas?