G Drive Files Missing
11 views
Skip to first unread message
Philip Shaw
Oct 29, 2025, 5:50:25 PM (5 days ago) Oct 29
to DataRecoveryCertification
Good afternoon. A customer brought me a 1TB G Drive that had been in his wife's Mac. His Windows computer was dying and he wanted to copy some files off before it went kaput. He was able to save off a folder (which he later deleted) but then he couldn't see any of his wife's very important pictures.
Some observations. The drive is now formatted for NTFS which would suggest that it got reformatted at some point. He is a little sketchy on what exactly happened but he is confident a full format was not done on the drive. I have run two full raw recoveries on the drive and gotten nothing but the files from what he saved. The one interesting thing is that when I put the drive on a Macbook Pro it shows no files or folders but Disk Utility says that a little over 100GB is being used. The drive was apparently originally formatted as HFS+ for Windows by Paragon Software. His wife is apoplectic and I would love to get her pictures back but I am not seeing anything to suggest they haven't been written over.
Does anybody have any ideas? Thanks.
Data Recovery Guru
Oct 29, 2025, 5:57:53 PM (5 days ago) Oct 29
to datarecovery...@googlegroups.com
For peace of mind, if you have PC3K, in the DE task, on the current partition showing, select to image/clone the Unused Sector Map (to clone all data blocks not belonging to the current volume).
Fill with pattern or use a new drive (better).
Run scans with various software, ideally with UFS, R-Studio or DE.
If little to no files are found, even in RAW results, then the old HFS+ volume must have been encrypted with FileVault, or the customer is lying where a full NTFS format occurred. Obviously scrolling through RAW space helps with getting a quick visual.
DATARECOVERYGURU TEAM
Offices are open Mon-Fri 9AM to 4:30PM.
Available by appointment outside business hours.
Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026
Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803
Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701
Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903
New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062
--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2Qkbg6Ax3b3LqzZb_3r4_A1P5eN%2B3czwTx5yMq_OOhP%3DnpA%40mail.gmail.com.
Philip Shaw
Oct 30, 2025, 3:08:20 PM (4 days ago) Oct 30
to datarecovery...@googlegroups.com
I imaged the Unused Sector Map and then ran a scan in DE. It is basically the same data I was seeing with a raw recovery. I think this might be a lost cause.
Thanks for the suggestions.
Data Recovery Guru
Oct 30, 2025, 3:11:29 PM (4 days ago) Oct 30
to datarecovery...@googlegroups.com
"The same data" does not help in determining whether there was encryption or not.
What does it mean "the same data"? Very little files? Weird zipped files? System files only?
Anyways, if you feel it is a lost cause, then it is what it is.
DATARECOVERYGURU TEAM
Offices are open Mon-Fri 9AM to 4:30PM.
Available by appointment outside business hours.
Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026
Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803
Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701
Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903
New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062
Philip Shaw
Oct 30, 2025, 3:43:32 PM (4 days ago) Oct 30
to datarecovery...@googlegroups.com
There are thousands of photographs, videos, and documents which are all viewable. Unfortunately, they are all from the data he saved to the drive when this problem started.
Data Recovery Guru
Oct 30, 2025, 3:58:05 PM (4 days ago) Oct 30
to datarecovery...@googlegroups.com
So, it sounds like after the NTFS format he wrote data to the drive. Then yes, not much to do.
For the critical files, the result will be poor or irrecoverable due to overwriting.
DATARECOVERYGURU TEAM
Offices are open Mon-Fri 9AM to 4:30PM.
Available by appointment outside business hours.
Boston: 100 Massachusetts Ave, Suite 500 (5th Floor), Boston, MA 02155Cambridge: 1 Mifflin Place, Suite 400 (4th Floor), Cambridge MA 02138
Dedham: 3 Allied Drive, Suite 303 (3rd Floor), Dedham, MA 02026
Burlington: 1500 District Ave, 1st Floor, Burlington, MA 01803
Framingham: 945 Concord St., 1st Floor, Framingham, MA 01701
Providence: 10 Dorrance St., Suite 700 (7th Floor), Providence, RI 02903
New Hampshire: One Tara Blvd., Suite 200 (2nd Floor), Nashua, NH 03062
Philip Shaw
Oct 30, 2025, 4:21:06 PM (4 days ago) Oct 30
to datarecovery...@googlegroups.com
Thanks again for your help.
Reply all
Reply to author
Forward
0 new messages