Tales of eBay – Part 1

I was recently in the market for a pair of 4 TB hard drives for a duo of USB enclosures that I had picked up a few years ago. So not wanting to spend retail prices I hoped onto eBay and grabbed up a pair for a deal. Few days later the drives arrived in the mail and found their way into the enclosures. So I plug the first drive into my desktop to format it …

… the drive is formatted and named. I was expecting to see a RAW drive, not a partitioned drive. Does that mean that I got a drive with data on it? Ugh…

So fire up 010 Hex Editor and lets take a look at the raw bits. The first page has data, which makes sense since there is a partition on the drive…

Ugh … There IS something on this drive …

Well … something is the word. Applying some digital forensics to the drive (because why gratuitous use of forensic tools), the tools show a structure that looks like a drive with data.

I could use some forensic type tools to carve whatever data might be on here, but I really want to try a new (to me) commercial tool and see if it can recover data from a formatted drive. So I fire up Disk Internals NTFS Recovery, point it at the drive, and tell it to search for the popular files. Let me be clear at this point, this attempt is going to be sloppy, I am aiming to recover ANYTHING, just to get some practice with this tool.

NTFS Recover seems to have found something? Does not look like anything too interesting, just an Outlook archive file. So, I tell the software to recover the file …

Turns out … the recovered file IS an Outlook archive file. No way I am connected that to my outlook to see what is in it – I do not need to know, more over, I could care less what is in the file. I would like to ask WHY can I find anything on a 2nd hand drive … and now … are there more out there?

Stay tuned, I start answering that question tomorrow.