Embedded Files
If the data on the drive is important, take it to a specialist!
While examining the drive, it became apparent that finding files on all of them would be straightforward and simple. Each drive came from a Windows computer (one Windows 8.1 upgraded from 8 and the other Windows 7) and was formatted with NTFS. Encryption in Windows didn't become standard until 8.1 with BitLocker, although it still seems not on by default.
I recommend going to the site's Hard Drive & NTFS section first to learn more about NTFS and how hard drives operate.
Initial Steps:
I started by pulling the drives from the laptops and using a SATA USB adapter to connect the drives to a computer. I cloned both drives using the Disk Utility installed on Ubuntu by default.
While disassembling the laptops, I had issues with how certain manufacturers allow drives to be swapped. However, older computers tend to allow drives to be swapped easily. Newer computers may, however, prove to be more difficult as drives may be soldered onto the board (in this case, I mean SSD since hard drives have been phased out).
Figure 1: Disassembled Laptop with Hard Drive on Bottom Right.
Cloning and SMART DATA:
I encountered errors during the cloning process of one of the hard drives. The first attempt to clone a drive failed, while the second attempt produced a message indicating that certain data could not be read (Figure 2). This prompted me to investigate the SMART data of the drives after the cloning process. The SMART data revealed that one of the drives had failed the self-tests (Figure 3), indicating significant issues with the drive's health and performance. The other drive's SMART data also showed poor conditions as well (Figure 4).
Figure 2: Drive Error Message
Figure 3: Black Laptop Drive's SMART Data
Figure 4: Silver Laptop Drive's SMART Data
File Extraction:
After cloning the hard drive, I utilized a utility tool called 7-zip, which allowed me to browse the drive's img files and selectively extract data. The availability of pre-existing tools streamlined the entire process, making it less time-intensive and complex than initially expected. Using established tools and techniques allowed for a relatively smooth and efficient data recovery process.
Figure 5: 7-zip Tool used to Browse Laptop img Drive
Figure 6: A recovered JPEG
Mini Test on Thumb Drive:
In order to further test the capabilities of file exploration and recovery, I formatted a small thumb drive to have a 10 MB NTFS partition and added a test image (Figure 7) and text file, which I subsequently deleted. Using the same process as with the hard drives, I then cloned the partition to see if I could easily locate and recover the test files.
I modified my Python codes slightly to look for JPEG files but found that the original code performed better. While I was able to recover an image, it was only a small thumbnail version (Figure 8) of the original test image that was likely generated automatically by some application. Additionally, I discovered that plain text files do not have unique file markers, so I had to use a hex viewer to locate the text.
Figure 7: Test JPEG
Figure 8: Recovered Test JPEG
To recover all deleted files on the drive quickly, I utilized a tool called PhotoRec. This excellent free tool is user-friendly and allows for quick and efficient recovery of all deleted files.
Page updated
Google Sites
Report abuse