Music Server Recovery

Its not unusual to see odd data recovery jobs walk in the office. This one was one where the client had a music server that stopped working and needed to recovery his 450 gigabytes of music back. This was odd in the fact the company making the music server had gone out of business and could not longer support the product. The client had tried to recover the data himself but the drive was not recognized by his Windows computer.

As always we conducted an initial analysis and examination to identify any possible mechanical or electrical issues with the drive. IN this case the drive was functioning properly. A review of the data area initially revealed no file system or data.  A review of the partition table in a hex editor found no normal partitions. There was data in the normal location that the partitions should exist but it was not in the correct location or normal format. We were able to identify the partition naming convention uniquely used by the manufacturer and ultimately found that the drive had old FAT16 and FAT32 partitions. Following the end of one partition entry to the beginning of the next we were able to chain the partitions together and identify the four partitions (of the eight) that held the customers data. Using X-ways forensic tool we rebuilt the partitions and identified the file structure and the data files. This of course was not the end of the work.  The music server company had applied a unique formatting to the individual music files. The first sector of the file contained information about the author, song name and album. Then there were three empty sectors before the correct music file header information was located. Cutting these first four sectors and saving the file allowed the music file to play properly.  We did this for one file, but remember there was 450 gigabytes of music files.  In house we built a script to recursively go through each file, open the file, cut the first four sectors and save it again. The script was able to correct the file headers so we could provide the data to the client.


Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s