Well, it’s only a guess but it may works:
I think that user once forget to mount /dev/sda1 as /media/DATA and all data was written on /dev/sdb2 instead of /dev/sda1.
To check this, please, unmount /media/DATA and check files and folders under this path.