Someone asked me to recover data from a laptop computer (Sony Vaio), after a Windows reinstall (Windows 8) through the startup recovery procedure.
Prior to that, the computer was malfunctioning : it was stuck on startup, at the login screen, never reached the desktop, even after a whole day. The owner asked her father to fix it, which he did by using the factory restore procedure, since the computer was completely unresponsive. She had not told him that she had personal files on it which were not backed up.
Usually, in such a case, most of the former data can be still retrieved. I scanned the whole drive with R-Studio, then Photorec, but both reputable data recovery softwares found absolutely nothing beyond the current Windows install and the associated softwares, not a single trace of the personal pictures that she had stored on it for instance (the only pictures found are stock pictures from Windows or the installed softwares).
Then I opened the drive with WinHex, to see if it had been completely wiped by a “low level” format : but, second surprise, the main partition was far from empty and appeared full of seemingly random data. (So random in fact that it is not compressible at all : as a test, I extracted three chunks of 1048576 bytes (1MB), compressed them with WinRAR and 7Zip, the resulting compressed files had exactly the same sizes, depending on the compressor used, and slightly larger than the source, 1048844 for the 7Z files, 1048816 for the RAR files – whereas even JPEG or MP3 files for instance can be slightly compressed, by 1-2% on average, despite being already highly compressed.) There's more than 400GB of it, there's not a single sector in “free space” which appears empty, or with any recognizable pattern, this is really puzzling.
So what can it be ? Some kind of drive encryption ? Some kind of virus, maybe a ransomware attack ? The owner uses computers on a basic level, and doesn't remember ever setting up an encryption of any kind. Could the computer have been sold with an encryption system already activated ? Could a security software (a McAfee product is installed as part of the basic install) have implemented it by asking the user a vague question like “do you want to protect your files”, eliciting a clueless “yes” ? If it was a ransomware attack, a “gotcha!” screen would have appeared at some point, at the end of the encryption process, right ? Does that sound like a known issue ? Is what I'm observing (a continuous stream of completely random data) consistent with what encryption normally looks like ? Do ransomware attacks encrypt individual files, or can some of them encrypt a whole partition ? Are there some tests that I could do at this point to determine if this is actually an encryption, and what type thereof ? Is there any chance of recovering anything at this point ?
(That particular issue is adressed starting from the 9th post, the earlier posts are not relevant – at first I had doubts that the drive itself could be faulty, but it's perfectly fine.)
EDIT : Here's a screenshot of R-Studio showing the partitioning scheme of a complete image from that computer's 500GB HDD. So there's only one user partition, the 438GB one ; the others are reserved system or recovery partitions. Only the 438GB one is full of seemingly random or encrypted data. The 301MB and 38GB partitions are not displayed by WinHex.