14-06-2024, 04:50 PM
WD MyBook (Green) 1.5TB, badly buggered, raw read errors - the data is now recovered as best can be and returned to client.
However, in the process of recovery I noticed some oddities with reported disk space
From the outset the recovered data was 335GB obtained by using testdisk on the original drive
TreeSize showed me the disk should have had around 5000GB, in fact two of the largest folders respectively reported 250GB and 150GB each, yet test disk was only able to recover 150GB and 50GB respectively for each
I imaged the original disk with HDDsuperclone to a 4tb external drive (30 odd hours to complete), test disk was then able to recover more, from those two folders 250gb and 150GB iirc. I have also run a free space scan with Photorec on the cloned drive to recover any missing/deleted files etc
at this point I also took a Macrium Reflect image of the cloned drive.
and here is where it gets weird, the Macrium Reflect image is reporting around 500GB in size when mounted in windows (893GB free of 1.36TB) when Macrium Reflect is supposed to image only the data and ignores free space. The image file itself is also 500GB
But when I open that MR image and get the size of all contents it is only around the 335GB mark, same as testdisk recovered. Somewhere there is 150GB+ unaccounted for in that image file... Recycle bin and system volume info are negligible and accounted for
So somehow or rather MR must know that the extra data is there and including it even though it isn't there...
I ran photorec freespace scan on the mounted MR image just in case but it found no files in that extra space?
I'm not sure if this is likely to be real data and how to go about finding it in a more meaningful way than Photorec which bastardised the file names, or is it just the reporting of the partition sizes that has got a bit messed up...
Sorry its a bit rambling but wouldn't mind any thoughts on this, client is happy with the data, I just wouldn't mind some clarity around this extra/missing space
However, in the process of recovery I noticed some oddities with reported disk space
From the outset the recovered data was 335GB obtained by using testdisk on the original drive
TreeSize showed me the disk should have had around 5000GB, in fact two of the largest folders respectively reported 250GB and 150GB each, yet test disk was only able to recover 150GB and 50GB respectively for each
I imaged the original disk with HDDsuperclone to a 4tb external drive (30 odd hours to complete), test disk was then able to recover more, from those two folders 250gb and 150GB iirc. I have also run a free space scan with Photorec on the cloned drive to recover any missing/deleted files etc
at this point I also took a Macrium Reflect image of the cloned drive.
and here is where it gets weird, the Macrium Reflect image is reporting around 500GB in size when mounted in windows (893GB free of 1.36TB) when Macrium Reflect is supposed to image only the data and ignores free space. The image file itself is also 500GB
But when I open that MR image and get the size of all contents it is only around the 335GB mark, same as testdisk recovered. Somewhere there is 150GB+ unaccounted for in that image file... Recycle bin and system volume info are negligible and accounted for
So somehow or rather MR must know that the extra data is there and including it even though it isn't there...
I ran photorec freespace scan on the mounted MR image just in case but it found no files in that extra space?
I'm not sure if this is likely to be real data and how to go about finding it in a more meaningful way than Photorec which bastardised the file names, or is it just the reporting of the partition sizes that has got a bit messed up...
Sorry its a bit rambling but wouldn't mind any thoughts on this, client is happy with the data, I just wouldn't mind some clarity around this extra/missing space
This world would be a perfect place if it wasn't for the people.
Sharesies | Buy Crypto | Surfshark VPN | Cloud Backup
Sharesies | Buy Crypto | Surfshark VPN | Cloud Backup