ngpc

Hi, Does anyone have an experience in using a software to record a telephone call ? Any good software or hardware recommendation ? The function I am looking for is that the computer software can dial a phone calls and record the conversation correspondingly. It would be very appreciated if you can help ! Thanks ngpc

Hi, I got a similiar problem and got it solved by a technical expert in last week. While my situation is that my computer can recognise the drive but cannot access the data, a bit different from you ... You can go to this link http://www.msfn.org/board/index.php?showto...133933&st=0 also a part of this forum MSFN , see if my expereince can provide you some references..

You are welcome. I could tell you, but then I would have to kill you... Seriously: any hex/disk editor, possibly one that offers templates Beeblebrox, the DSFOK toolkit, IMDISK which you already "met". Ken Kato's VDK: http://chitchat.at.infoseek.co.jp/vmware/vdk.html#top Optionally with my pseudo GUI for it: http://home.graffiti.net/jaclaz:graffiti.n...ts/VDM/vdm.html My small CHS/LBA spreadsheet: http://www.boot-land.net/forums/index.php?showtopic=2959 (keep an eye on that thread, I am in the process, hopefully in a few days or maybe weeks, to publish a MUCH enhandced v2.0 of it) My small MBRBATCH/MKIMG: http://www.boot-land.net/forums/index.php?showtopic=3191 http://www.boot-land.net/forums/index.php?showtopic=5000 And a number of other tools, depending on what is the problem at hand. Remember that however usually a skilled carpenter is more important than the actual tools he uses. You'll need some time to learn and digest the info you can find in the below mentioned site (and it's links) and more generally take your time browsing around in boot-land: http://www.boot-land.net/forums/ Also remember that the right approach to data recovery is avoiding needing it. (BACKUP!) The "mother of all MBR/filesystems sites", the Starman's Realm: http://mirror.href.com/thestarman/asm/mbr/index.html And of course the good ol' "Primer": http://www.ranish.com/part/primer.htm I would also suggest you getting acquaintaned to "ol' DOS" programs, like Ranish Partition Manager: http://www.ranish.com/part/ and the several other DOS tools recommended by Daniel B. Sedory (the Starman) And with Qemu: http://www.nongnu.org/qemu/ Optionally using Qemu Manager GUI: http://www.davereyn.co.uk/ You can apply a similar method/approach. Not a "similar value", a value can be either of two things: Right Wrong (no space for "similar") Sure, that's the "proper" approach, NEVER write anything on the "problematic" device if you are not sure (and double sure) about what you are writing and what effects it may have. jaclaz Thanks Jaclaz, Don't kill me until one day, I become as professional as you are, ha ha .... Anyway, thanks so much for your help in the past week and your generous sharing of your knowledge ! I did learnt a lot ! ngpc

Hi Jaclaz, Thanks Again for sharing ! May I know that which tools you are using for viewing the MBR structure/data of my defective usb, can I download it from some sites ? Is there any recommended site which documented the introduction of MBR or file system structure analysis? I am quite interested in data recovery after this learning experience . And finally, can I apply the similiar value of my case to some usb which show the same symptoms but with different memory sizes say 2G, 4G, 8G..? And I only experiment this on the extracted image file. hope to hear your advise... ngpc

HI Jaclaz, Just a curious question ! I just suppose I can use the XP format function to reformat my usb, it seems there is still a lot of steps to reformat it... May I know that " What is the difference between using the XP format function to format the usb instead of using the procedure you have mentioned in the last email. I know your procedure may trying to config the usb in a new structure ... Sure, I will try your procedure and learn more about that, it is interesting. While I just want to learn more if there is any technical reasons... Besides, after the TestDisk recovery, I retrieve all the file data and also see some file named as below -rwxr-xr-x 0 0 594 22-Oct-2008 18:38 _UTORUN.INF -rwxr-xr-x 0 0 110654 5-Oct-2008 16:57 _JIEF.CMD Are they created repeatedly by virus , I saw a lot inside the file usb_full.img.... ? Like to hear more ! Thanks ! ngpc

Hi, I finally retrieve all my data from the USB by following the process, you can try and see if this can help your situation... Jaclaz's trouble shooting is really professional... You can check it out yourself... ngpc

Hey Jaclaz, I just take a risk to try the remaining recovery procedure as I am so eager to see the result... So you bet... I finally GOT it... Wow, EXCELLENT ! All the file are back, they are back...... A very BIG THANKS to YOU.... I really appreciate your patience and professional advise... I learnt a lot from this process and have much fun.... Interesting ! BTW, there is still a few questions here, can you help me to claify a bit: As I reopened the image file, I found my useful file as well as some Virus files or virus information. So my question is : 1/ Will the virus file still have effect on my C drive when I copy the data from this USB_full image file back to my C drive ? 2/ When I use the virus cleaning program to scan the G: virtual drive, it detect the Virus (See attached txt file) and going to kill them, so does it mean that the virus will become inactive (seems sleeping) when the USB_full image is not being recovered, but when it is being recovered now, the virus become active and will start to infect other drives who ever came across it ? 3/ Before I format my Defective USB , if I plug it into the computer , will the virus infect my computer ? 4/ Will the stand alone USB_full image file which has the virus file lock inside become active if I keep the image file ? Curious to know that... Thanks ! ngpc TDisk_retrieving_record_eith_Virus_info.txt Virus_Scan_Result_2009_5_23_after_USB_full_IMG_on_Virtual_Disk.txt

Jaclaz, I just try upto this step and stop because I got the number return that is different from you , can you advise.? 1*FAT16 >32M 0 1 1 987 18 25 2021945 <--you should see this, if not something was made wrong before (Your code) 1*FAT16 >32M 0 1 1 1019 8 25 2021945 Is the no. important? ngpc

Really Thanks! Looking forward to that ! ngpc

HI Jaclaz, I have run FC command and compare the 2 files, USB_100.img and USB_100_new.img, the system return no difference... I have attached the USB_550.img zip file for analysis... Are you mean that as ImDisk Virtual Disk Driver cannot open the USB_full.img file and USB_100.img file, so it can be predicted that the values fo these files are corrupted, am I right ? Besides, if the TDisk can do something for my USB, can you teach me some instructions and then I can check it during the weekend... I have run a test of the USB_100.img and USB_full.img in the TDisk software, TD report some findings of the these files, the result is attached inside the txt file , the two files report the same result as shown in the txt file. Hope this can help to provide more info.... Thanks! ngpc usb_550.zip TDisk__anaylse_result_of_USB_full_image_file__1.txt

Hi Jaclaz, When tried to open the image file , the ImDisk reported that it cannot open the file, see attached screenshot.. Hope this provide more information to you! Thanks ! ngpc IMDISK_operation_Question_2.doc

Hi Jaclaz, As I tried again, I can mount the G: dirve with the value 32 in the image file offset row as you mentioned in the first window. Then what should I do next in the second windows after I click OK in the first window . I find there is a file G: c:\dsfok\USB_full.img 987.3MB in the second window... Do I need to "Format" it or something else.. Besides, do you have an MSN account such that I can send my feedback to you and do the adjustment as soon as possible, what do you think about this.? I am open to this... Thanks! ngpc IMDISK_operation_Question_1.doc

Hi Jaclaz, I am a bit stuck at here as I am not quite familiar with the technical operation of the IMDISK, can you explain more about it . I have captured the screenshot for your reference. After open the ImDisk, the Mount new virtual disk panel ask me to select a Image file, so I choose the USB_full.IMG which I saved in C:\dsfok. The ImDisk automatically assign some values below the file selection bar after my selection. So I come up one question, Do I need to click check for the box before "Copy image file to memory" the box before " Removable media" and "Read Only Media" Then I tried to ignore the check boxes , I click OK, the second screen come up as in the screenshot ImDisk Virtual Disk Driver Then what should I do next ? I am not quite understand when will I see something as you mentioned in your email, can you claify a bit: if IMDISK does not auto-detect the number of hidden sectors, supply 32 as the number of hidden sectors (skipped blocks) Hopefully you should be able to find your data in the image mounted as a volume. If everything is at it should be, we may try wiping the stick with 00's and re-apply to it the saved image. If anything appears not as it should on the mounted image, next step would be running TESTDISK on the image. Can you further advise , Thanks you! ngpc IMDISK_operation_Question.doc

Hi Jaclaz , I just go to the web link you refer get beeblebrox: http://students.cs.byu.edu/~codyb/ I see what you mentioned... Wait to see the next action! ngpc

Dear Jaclaz, I finally got it .... After saving the no. return is 1035206656 bytes. I have attached the USB_100.IMG file . Thanks! ngpc usb_100.zip

Dear Jaclaz, Just need to clarify one thing before I performed the copy action because I am not so familiar with that dsfo software.. Do you mean in the below command, I replace the PHYSICALDRIVEn with the number "1" ? as I only have 1 HDD and 1 USB at this moment? dsfo \\.\PHYSICALDRIVEn 0 0 C:\dsfok\USB_full.img Thanks! ngpc

HI Jaclaz, I have used HDHacker to save the MBR of my USB for your analysis... They are attached... Here is my USB History: I bought this USB drive at about year 2006, only for data storage, it is 1G in size. Due to my work, I always use this USB in other computers for presentation... So sometimes, virus will be detected, while every time, I use Virus Cleaner to scan and clean the virus. It seems work... From the scanning history, this virus has attacked my USB before Trojan-GameThief.Win32.Magania.ahrz G:\yfmqo.cmd And I think Autorun.ini has also infected my USB also... The infection has been occured several times... As far as I remember, after one virus cleaning operation, I found that I cannot click-to-open the USB directly, a window pop up to ask me " Which software you are going to use to open the file" , I found that this is strange and different from what I have performed in the past....Then I mostly click IE Explorer to open the access the USB and it worked. Therefore, I ignored what happen and keep using the USB without suspecting any MBR problems ....I think this should be the sign of the problem of my USB at the very beginning.....am I right ? For this USB, I haven't perform any formatting or partitioning actions after my purchase, I just it as data disk once I bought it.. Hope these info. help Thanks ! ngpc File_for_analysis_of_HDHacker_2009_05_21.zip

Hi Jaclaz, Here is the second captured screen of TD result... Thanks ! ngpc Screen_Capture_of_Test_Disk_Result_part_2.doc

Dear Jaclaz, Thanks very much for your help and resources! I have tried the TestDisk to scan my problematic USB, TD reported there is a "Invalid FAT Boot sector" after I performed the [Analyse] function. Then I proceed to do the [Quick Search] and [Deeper Search] function, TD reported structure OK..... I think this is expected as I haven't made any partition for this USB, I just use it for data storage... Can you further advise what I should do next to solve the problem.... ? I have also attached the screen of the TD report for reference... Would appreciate if you can further advise...... As the total upload cap. only allow 200k... , so I upload the remaining file in the separate email.... Thanks ! ngpc Screen_Capture_of_Test_Disk_Result.doc

What I mean is my computer can recognise the drive No., but when I click on the icon of the USB, it prompt me to format the USB... Do you have any software which can help to retrieve the data or recover the data... Thanks ! ngpc

Hi, Recently, I got a problem, and see if anyone and expert can help ! When I tried to access my usb finger, I found that my computer cannot read the data although the usb drive No. can be seem on the computer, say G: As I click on the usb drive icon, the computer told me that my usb drive is not formatted yet and ask if I want to format it . Then sure I click "No" , all my data is inside. When I use DOS mode to access the usb G: drive, the computer replied that the "Disk sector do not contain the system file " I afraid that the boot sector has been damaged by some virus infection. Can anyone advise how can I save my USB and retrieve the data, any tools and method can help ??? Would appreciate if anyone can offer the help ! Thanks in advance! ngpc