Tough Case to Crack , Guys pls. help

[samntha fox]

Hi Good Morning Team

I have got a WD10EXEX 3.5" 1 TB disk from a client to recover a single excel file.

As per client this disk was formatted . This is CMR model.

Currently it is showing 3 partitions  with suspended bitlocker.

As usual client could not give details about whether bitlocker was present previously or not and what has exactly happened.

  I have tried R-studio / UFS / DMDE pro (Dmitry is also in touch) and Disk Drill 

But none of the software could reconstruct previous file system & recover data.

Currently  NTFS file system is present & is fully accessible.

I can give remote access to disk .

Can someone pls. interpret what could be exact  technical issue 

[jpv...@gmail.com]

In response to DMDE screenshots, scanning logical volumes is not usually recommended, but if we look at K: we see $MFT from 2022 with a size we expect after the file system was freshly formatted. So this is NOT freshly formatted in past year and partition hardly contained data. So what does "As per client this disk was formatted" actually mean?

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/6e909dd5-be25-4988-9bac-112ac9c97173n%40googlegroups.com.

[t...@desertdatarecovery.com]

What do the two greyed out 1TB NTFS partitions in the last picture show when opened?

And remember rule #1, customers ALWAYS lie….

 

Tim Homer - Lead Engineer

Desert Data Recovery

+1 (602) 686 2622

t...@desertdatarecovery.com

www.desertdatarecovery.com

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of jpv...@gmail.com
Sent: Monday, October 27, 2025 1:04 AM
To: datarecovery...@googlegroups.com
Subject: Re: Tough Case to Crack , Guys pls. help

 

In response to DMDE screenshots, scanning logical volumes is not usually recommended, but if we look at K: we see $MFT from 2022 with a size we expect after the file system was freshly formatted. So this is NOT freshly formatted in past year and partition hardly contained data. So what does "As per client this disk was formatted" actually mean?

 

------ Original Message ------

From: "samntha fox" <ritesh....@gmail.com>

To: "DataRecoveryCertification" <datarecovery...@googlegroups.com>

Sent: 10/27/2025 5:34:39 AM

Subject: Tough Case to Crack , Guys pls. help

 

Hi Good Morning Team

I have got a WD10EXEX 3.5" 1 TB disk from a client to recover a single excel file.

As per client this disk was formatted . This is CMR model.

Currently it is showing 3 partitions  with suspended bitlocker.

As usual client could not give details about whether bitlocker was present previously or not and what has exactly happened.

  I have tried R-studio / UFS / DMDE pro (Dmitry is also in touch) and Disk Drill 

But none of the software could reconstruct previous file system & recover data.

Currently  NTFS file system is present & is fully accessible.

I can give remote access to disk .

Can someone pls. interpret what could be exact  technical issue 

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/6e909dd5-be25-4988-9bac-112ac9c97173n%40googlegroups.com.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/emad51e964-c022-4e71-abad-7ec0e033bf09%40desktop-8njf1hc.

[samntha fox]

It's been said that driver is more important than car so Ferrari is useless if driver is not capable .

I think exactly same is the case here , I have tools but cannot go so deep like you , Tim & other members .I  clearly lack low level skills .

Appreciate your help & interpretations . Yes I should have scanned physical disk instead logical partitions.

I will update customer that disk is not formatted (I have got this disk from a hardware service provider & not directly from end customer)

As per Dmitry bitlocker was present before format & due to this data is encrypted.

But I feel you are right disk is not formatted at all ( E drive)

Thanks again

[samntha fox]

Hi Tim

Thanks for replying.

Yes You are right . I will check with DMDE again & update you.