i just did 2 things copy all data to my laptop using External usb hardrive mount ( Copy + Paste ) and tried to recovery search using EaseUS data recovery and recuva, but didn't recover or write anything on the hard drive
Well, this couldn't have worked.
Simple copy/pasting only copies files 'registered' by the file system.
When files are being deleted, they are not really 'taken off the drive'. The space where they ware saved is being released instead.
Therefore you either need to (1) work on the original drive (NOT recommended!) or (2) on an image of the drive (recommended).
now i will follow ur steps and Clone my hard-drive and check Jack pywallet.
Keep us updated. For cloning you might want to boot a linux live distro and use
dd.
I used FTK imager 4.2.0 to clone the hard drive just managed to finish one, i made 2 copies .E01 and dd don't know the difference but better to take precautions
now i downloaded Autopsy 4.9.0 for windows with GUI and started examining the 'evidence' .E01 still under process analyzing files