jaclaz

@ilko I'll throw this on the table (and quickly hide my hand behind my back ): http://reboot.pro/topic/19516-hack-bootmgr-to-boot-windows-in-bios-to-gpt/?p=197690 jaclaz

EFI/UEFI works in it's (sometimes) mysterious ways, recent Windows booting on UEFI (but also on BIOS) works as well in mysterious stupid ways. From what you posted, right now (though you might not know this) you have one drive (or partition or volume) that is the only one that the UEFI/EFI firmware will chainload (or boot). This volume is the smallish around 100 Mb in size formatted as FAT32 that gets no drive letter normally. In it there is a file: \efi\microsoft\boot\bootmgfw.efi which once executed will access the settings stored on the file: \EFI\Microsoft\Boot\BCD this latter file currently should be containing two entries, one for the WIndows 8.1 that you call W811_1 and one for the Windows 8.1 that you call W812, and when you boot you are prompted to choose which one among these two you wish to boot, probably on a screen similar to this one: If you prefer right now you seem to have a dedicated to UEFI boot volume containing the EFI bootmgr and BCD with the two 8.1 entries, the idea is to add to this BCD the three entries for the three windows 7's. This can be done with the "built-in" BCDedit, but since you are not familiar with it and you already have EasyBCD you can well use this latter, the file that will be modified will be anyway the BCD in the FAT32 partition. What you may want (optionally) to do could be to get rid of the senselessly big graphics screen and use the good ol' selection screen, *like* here: http://winaero.com/blog/how-to-avoid-two-reboots-with-windows-8-1-and-windows-7-dual-boot/ jaclaz

Well, there are a few decisions that you have to take yourself. EasyBCD is nothing but a wrap around the BCDedit functions and grub4dos (using BTW a now obsolete version of it), the exact way you use it (and the grub4dos included with it) may make a difference, but you seem to be missing (understandably) some of the gritty-nitty details, what programs like EasyBCD - independently from whether they are "good" or "bad" - are "user friendly" but they do hide the actual way they work. Since you are using UEFI the grub4dos won't be actually involved at all, since it is BIOS only, unless you use CSM. All in all what you want to do is to multi-boot between 5 Operating Systems 2 8.1's and 3 7's (i.e. of the same family and "recent enough") each installed to an "own" volume/partition. This can be achieved in different ways, the easiest would be to use your current "boot" drive (what the good MS guys would call a "system" volume) and add to that 8.1 instance of \boot\BCD or \EFI\Microsoft\Boot\BCD the other 4 ones or do the same using you. This way when you boot you will have a screen allowing you to choose between the 5 OS. If you have some time to dedicate to the matter, you would better study a bit the actual boot sequence of recent Windows NT systems, but basically on BIOS: Bios chainloads MBR code MBR code chainloads PBR code PBR code chainloads BOOTMGR BOOTMGR code accesses \boot\BCD allowing to choose between multiple entries Once the choice has been made, the chosen WINLOAD.EXE is executed and the chosen Windows is loaded on UEFI UEFI looks for a FAT32 partition on disk (the 100 mb partition which is "Active and Boot" in your screenshots) UEFI then chainloads the \efi\microsoft\boot\bootmgfw.efi bootmgfw.efi code accesses \EFI\Microsoft\Boot\BCD allowing to choose between multiple entries Once the choice has been made, the chosen WINLOAD.EXE is executed and the chosen Windows is loaded So, basically you just connect the second disk and add the relevant entries to your BCD using either BCDEDIT or the EasyBCD you already use. jaclaz

Is that a MBR style or a GPT style disk? <- rhetorical question, it is a GPT disk as seen in the posted screenshot On MBR disks only up to 4 primary partitions are possible (or 3 + 1 Extended partition containing logical volumes). On GPT disks all partitions are primary, it's normal, on Windows systems you can make up to 128 of them. jaclaz

I don't think that you will ever be able to recover specifically the " Sims 2 Saves folder" what you report is exactly the effect of the overwriting I mentioned in the previous post . The fact that you estimate that the KernelEx+ & SP5 project can be rewritten form scratch up to the level it was until yesterday in just one month (if I get this right ) represents however very good news . jaclaz

Yep still someone should be able to find two couples of integer numbers where: a/b=0.9412 and c/d=0.9826 with b and d both small enough, to be credible, let's say (given that the population is 56, less than 200 or 300 including visitors, is not like every human being is connected at a same time). 0.9412 can be easily obtained with a=16 and b=17 (and of course their multiples) but to get 0.9826 I cannot find any value that satisfies the formula. Closest I can find is c=623 d=634 jaclaz

Let's talk of physics. Two different solids (or even liquids if not compressible) cannot be at the same time in the same place. Same happens to bytes (and sectors), whatever you copied or installed to that volume has to go somewhere, and this somewhere is the same place where something else was before. This is called to overwrite, i.e. to write a new value in the same place where a previous value was written, effectively making what was written before in that same place lost forever. So, anything that was overwritten is lost forever and cannot be retrieved through any means. The more you overwrite, the less amount of non-overwritten sectors you will have left and thus the less amount of data you can recover. Now, 50 Gb surely lost on a (possibly full up to the brim ) 1 Tb volume represent anyway a rather small percentage, roughly 1/20 or 5%, but of course, if the volume contained 50 Gb of files, it was perfectly defragmented and you just wrote to it (after having formatted it twice ) 50 Gb of data it is more likely that the percentage of irrecoverable data is in the 90 to 99.99% range. ... if you are a postilion by trade: https://en.wikipedia.org/wiki/My_postillion_has_been_struck_by_lightning probabilities of the latter do increase noticeably, JFYI. jaclaz

Hmmm, particularly Pitcairn, with its population of 56 people might be not on the high priority list of MS (or Apple for that matters) marketing. Anyway, it is interesting, this graph here: http://gs.statcounter.com/#desktop-os-PN-daily-20151201-20151231 Shows how on 12th december 2015 OSX was 100% , on 28th december Windows 8.1 was 100% and in several dates, 3/4/6/19/22 and 31st december Windows 7 was 100% . It remains a mystery how Windows 10 managed to make 94.12% on the 15th and Linux managed to make 98.26% on the 24th December. jaclaz

I cannot understand the "got", do you mean that you copied to the re-formatted volume 50 Gb worth of files and actually re-installed an XP on it? Each single byte that has been written to the volume after the formatting has overwritten (irrecoverably) the byte that was there before, would you think that this increases probability of recovery? jaclaz

There is no issue that need a change to the Rules, then, users that are definitely the "second" bot (the one that usually provide the link to the "miracle" tool that should solve the problem of the "first" bot) are already banned/tagged etc. (besides removing the link). Where it is clear - really clear. beyond any reasonable doubt - that the OP is the "first" bot then the thread is anyway deleted or hidden, but if there is even a remote probability that the first poster may be a real person nothing is done. You have to understand that a nick and an IP address while a very valuable asset for a "real person" are not of particular value for SPAMmers, if the nick is blacklisted they simply generate a new one and almost the same goes for the IP, and you cannot really-really ban an IP unless there are very serious reasons, while I don't know for sure how these things work, I can well imagine that these SPAMmers may use some mechanism to proxy or spoof their real IP, so maybe what you ban is a service that other people may use (legitimately). In these times of Wi-Fi everywhere, think of the damage to the "ecosystem" you could make if you ban accidentally (say) the IP of (say) a Starbuck coffee shop or the one of an Internet Cafè pr similar piblic or semi-public access point, you prevent a number of people from accessing the site while at the same time doing very little against the actual SPAMmer. jaclaz

I have no idea what is "sector status" or why in it 90% of sectors are fine. What is needed is a clone or a "forensic sound" image of ALL the sectors involved, a sector level copy. You need to understand some of the basics of cloning/imaging, and in order to do so you need to be informed on some basic disk/filesystem structures. A disk (a new disk device, from factory) contains sectors, i.e. groups of bytes, usually 512 are indexed in an addressing structure called LBA (Large Block Address) that numbers them starting from 0 to the last sector. When you access or retrieve sector 0 you are getting the first absolute sector of the whole device which usually holds the MBR (Master Boot Record) The procedure of initializing a disk (under Windows NT systems) will write the MBR to first absolute sector or sector LBA0. The MBR contains some bootable code and some space for a partition table. The procedure of partitioning creates one or more entries in the partition table, basically where (at which LBA sector) the partition (or volume) begins and how big it is (these are the partition or volume extents). The procedure of formatting creates a filesystem in the space allocated in the partition table. A filesystem, generally speaking, consists in an addressing structure that lists the addresses where any given file or folder resides and where there is unused space where a new file can be written to. When you write a file to a volume the filesystem structures are updated so that they reflect the metadata of the file or folder (name, extension, dates/times, etc.) the address (using a different unit of measure, the cluster, which represents one or more sectors) of the file and how big (how many clusters it occupies) it is (these are the file extents, in a perfectly defragmented volume every file occupies a number of contiguous clusters and each file has a single extent, when the volume becomes fragmented during use a file may be stored on several, even hundreds of extents). When you initially format a volume this "index" is "blanked" i.e. all the space on the volume becomes marked as "unused" (allowing to write to that space new files). The same happens if you re-format an existing volume, but the actual clusters (groups of sectors) are not touched (under XP and earlier). So, files are still there exactly as before but you have lost (forever) their "address" (more correctly their file extents data). There are a few cases (particularly on large volumes with many files) when a re-format only blanks the initial part of the "index" and as well some cases where a new blank index is created in a different position than the previous one. In these cases, parts of this "index" and be recovered (this is what dmde can do) and consequently any file that is listed in the recovered parts of this index can usually be recovered, even if fragmented, with its filename and extension. If the re-format has completely blanked the "previous index" this is not possible, and you need to attempt file based recovery (what Photorec can do). Most files do have "patterns" (usually in the first few bytes or "header" or in the last few bytes or "footer") that allow to identify them as a given filetype and some file types also contain other metadata, that may include their filename and their size. What Photorec (and similar software) do is to attempt to recognize a file type and then use the metadata it can find in it to recover the file. For a contiguous file that contains this info it can succeed. For a contiguous file that contains not this info it may also succeed (losing filename and giving a "tentative" extension). For a non-contiguous file the software needs to make a number of guesses, and very rarely a fragmented file can be recovered at all, most of the times you get only some fragments of it. The first step is to make an EXACT copy of the original (that is a "forensic sound" image or clone). Usually an image of the whole disk is made, but in the case of a re-formatted volume (provided that in the "accident" the size of the partition has not been changed) making an image or clone of just the volume is OK. Such an image is the 1:1, byte by byte, sector by sector copy of the partition/volume extents (see above). As an example if the partition began on sector LBA 63 and was (say, for the sake of the example, you cannot make such a small partition/volume) 37 sectors in size, the image of that partition would be made out of sectors 63-99 and be 37x512=18944 bytes in size. The copy is performed by a software tool that can get direct disk access such as the mentioned ones. A few (like dd and similar) need to be given the exact start sector address and size, some are "smart enough" to get the extent from the parittion table (such as the mentioned DMDE or PartitionSaving). In your case, given that the partition/volume that was accidentally re-formatted was around 1 Tb in size, the resulting image will be also 1 Tb in size, and you need a device with enough capacity to host it which means, if you are going to make an image, a disk bigger than the size of the image to allow for the (NTFS) filesystem structure of the volume where you will write the image or an identical (or bigger) hard disk if you are going to clone the whole hard disk (from sector 0 up to the last sector of the disk). Example #1, in case of an image, if your partition was 1 Tb in size, you will need at least a 1.5 Tb disk on which you will create a partition that, once formatted, will have more than 1 Tb of free space. Example #2, in case of a clone, if the disk hosting the partition is 2 Tb in size you will need a 2 Tb disk as target (or a bigger one) I hope now this is a bit more clear. jaclaz

Well, even here we need to make a distinction, there are a few people that panic and in the haste of a serious issue multi-post on half of the internet, this is understandable, they are doing this only when they have this serious issue and they readily understand how this is counter-productive and silly once told and never do it again. (no real problem/issue) Then there are a few people that - no matter how many times you tell them, and no matter in how many different ways you try to "educate" them - will continue to do that as they believe (wrongly) that this approach will provide more and better replies. Even if they are totally wrong and curiously stubborn with this approach, while one may ban them from the one or the other board, still they don't IMHO deserve to be tagged as "spammers" on a worldwide network. More or less it would be a form of censorship, effectively preventing them to join a number of places that make use of these SPAM listings , nothing much different from marking them with the scarlet letter an S in this case . jaclaz

I guess we are at a standstill. You said you formatted a volume. There are NO deleted files in this case, and there are NO new files on the formatted volume unless you after having formatted it also copied to it files. The correct procedure has been given to you, whatever steps diverging from said procedure, particularly doing *anything* before step #1 is very likely to reduce (dramatically) any chance to recover any file. To make a clone image you can use dd booting from a Linux or something similar from Windows, like dsfo/dsfi or clonedisk or even the mentioned dmde has a provision for this, but you need to have handy a device (hard disk big enough) to host the image (or to make a direct clone of the whole harddisk) Some of these tools are mentioned here: http://reboot.pro/topic/19730-dmde-basic-disk-imaging-test-and-results/ http://www.msfn.org/board/topic/100299-disk-imaging-software/ All in all I would suggest you to use: http://www.partition-saving.com/ because it is very well documented and can be used from different OS's. jaclaz

There is NO WAY on earth that anyone (not just you) can restore the system to the way it was before the format Maybe it will be possible to recover some files, and there is NO WAY to know in advance how many or which of the files that were on the volume can be recovered. Try re-reading, this time slowly, what was posted earlier. As a numbered list: 1) make a dd-like, "forensic sound", or "sector-by-sector" image of your disk (please confirm that you have a suitable device to contain this image and that you know how, and which tools to use to make such an image). 2) better if you can afford to make two such clone images (one clone from the original and then a second copy of the first image) 3) Get dmde (link given above) and try accessing the image, after having read very carefully the documentation. 4) IF (hopefully) some traces of the previous filesystem can be found, then the files that will be listed will most probably be recoverable with their name and extension and will be valid. 5) Then, once you will have recovered through dmde all recoverable files, and after having verified that the recovered files are valid, you may want to try Photorec (link also given above) that will likely manage to recover a large number of files, with no guarantee whatsoever to have them with the right path/name and extension, and not even with any guarantee of the actual files to be valid (you will need to check them one by one). 6) another, even more troublesome/complex step, if the results of the above will be not satisfactorily enough, would be to do a further pass of both dmde and photorec, after having mapped everything you already recovered on the image and zeroing the corresponding space. 7) a further step will be to reanalyze the image manually. If you need assistance for items #1 up to #3 just ask. For steps #4 and #5 you will probably need some assistance, and as well we can assist you, once you will have get the hang of the use of those programs. For item #6 I can as well give you some instructions/hints, but it starts to be something for which you will need hours, possibly days of practice. Item #7 is well beyond the common knowledge of even advanced users, you will likely need weeks, possibly months of training and practice. If there is the need to go past step #5 it is usually not worth it, while you can repeat steps #4 and #5 many times, using different programs from the ones I suggested, though you will then need to procure the licenses for some Commercial programs. jaclaz

Yep, that would be very logical , but there are two issues with that. #1 the (very few) altruistic people *like*: http://www.msfn.org/board/topic/172296-the-best-third-party-parental-control/ might feel censored #2 the "replying spammer" may make a couple of posts of the "This is cool!" or "Thanks man, interesting stuff" on a couple "random" threads and then he/she/it wouldn't be anymore a first timer, so you will need to put a "limit", which is not anymore 1 post but maybe 2 or 3 and then legitimate users will as well be frustrated by not being able to post a senceful opinion or a valid answer only because the thread was started by someone at his/her/its first (or second or third) post. The only mitigation would probably be to make compulsory to make a post here: http://www.msfn.org/board/forum/76-introduce-yourself/ AND post a reply to the welcome (but this will also make admins/mods obligated to reply there and to do so in a timely fashion). I don't think there is a good solution for this issue. jaclaz

Yep, the idea is that making a "forensic sound" image there is only one "copy pass" from the original device, then the "scans" are performed on the clone. Usually TWO such images are created, so that one can be (if needed) modified in order to attempt recovering the data, and the "original" is never touched (and can hopefully be re-imaged). From what you wrote there is no reason to believe that the actual device (hardware) is failing, but the "forensic image" will allow to preserve the data while allowing (if needed) to modify parts of the image. The #4 question about "how exactly" the format was initiated is more relevant for later than XP OS's (where if a "quick" format was not specified the data would be wiped and thus become totally unrecoverable by *any* means), still it would be interesting because while the Windows XP built-in format command has some "fixed" addresses for very relevant filesystem structures, if the format was performed from another OS or by a Third Party tool, same structures may have been written at different addresses (thus not overwriting previous ones) whilst if the volume was originally formatted by the XP format.com and later re-formatted with the same tool previous structures woudl be cleanly overwritten, with no possibility to recover, if not - maybe - partially. jaclaz

It's not as bad as it seems, as you (Dibya) made me even sadder. The site of the (Commercial) tool you recommended contains some notable pearls of wisdom: jaclaz

You mean that you are still using that hard disk accidentally formatted volume? The first thing to do in this cases is to STOP fiddling with the device immediately, make a forensic sound image of it, and only later think about attempting to recover files. Which OS? XP? Which filesystem, NTFS? How big is the formatted volume in size? How EXACTLY was the format initiated? As a rule of thumb if that is XP you were lucky that the format command is not entirely destructive on XP (on Vista and later, unless it was a "quick" format it would be completely destructive), an in-place format on XP instead might leave enough data to perform some (partially) file system level recovery and some file recovery. The tool of choice in these cases would be: 1) DMDE that should be able to recover some data at file system level http://dmde.com/ 2) PHOTOREC that should be able to recover a large part of the files at file level: http://www.cgsecurity.org/wiki/PhotoRec The difference between file system level recovery and "plain" file recovery is that usually the first - for the data that i can find - can recover file metadata (i.e. name and extension) besides having the capability (again for the partial data found) to recover fragmented files, the second can at the most recover contiguous files, often losing the original name and extension. Recovering data from a formatted volume is a time-taking, difficult/complex and often not successful activity, tools like Photorec that attempt to recover files are exceptionally good, but the output needs to be verified single file by single file, as each resulting file is more than a recovered file, something that the program perceives as a file, each single file format (.bmp, .jpg, .doc, etc.) may have some internal metadata that may increase the probabilities of a valid recovery but there are no certainties. The biggest enemy of file based recovery is disk fragmentation, usually on a perfectly and completely defragmented volume formatted "on place" everything (or nearly everything) can be recovered, but on a fragmented volume it is nearly impossible to recover anythign of value or the amount of time needed for the recovery is so big that it simply isn't worth it. DMDE (or other filesystem oriented data recovery program) on the other hand may be able in this case to recover only a small amount of files, but those fewer files are usually in good condition. You will need some (a lot of) patience to perform a filesystem based data recovery and you will need to get familiar with some filesystem innards and to the way the program works. jaclaz

Another not strictly IOT, but near enough: http://blog.ioactive.com/2016/02/remotely-disabling-wireless-burglar.html jaclaz

It is possible that the N1 command is actually executed but the drive re-locks the terminal. In the original instructions for the 7200.11 and on this post just above: http://www.msfn.org/board/topic/129551-unlocking-terminal-of-seagate-es2-in-bsyled000000cc-state/page-2#entry990628 the drive NEEDS to be restarted after the N1 command, before re-accessing the terminal and issuing the F3 T>m0,2,2,,,,,22 - maybe you can try that. jaclaz

You might see here why: http://forum.chandoo.org/threads/corrupt-excel-xls-file-ole-header-corruption.27361/ (the second post by PaavoNurminen leads to a discussion where PeterWarren had a similar problem and CharlesWater replied to it, suggesting the use of a Commercial tool) this is a two-level SPAMming plot, instead of referencing the Commercial tool they reference another post on some board/site where the Commercial tool is linked to (possibly as a verified solution). Should you by any chance be worried by the issue CharlesMorris had with those corrupted Excel files, be happy , everything is cool, DavidJustesen provided him with a link to the SAME thread started by PeterWarren on community.office365.com and CharlesMorris himself replied stating how the issue was solved (using a Commercial tool): http://www.guru.com/answers/questions/31307/corrupt-excel-xls-file-ole-header-corruption-1.html? (and KayerJenkins kindly added a link to an alternative Commercial tool) jaclaz

Slight correction, if I may : three or more times a year... remember this is a continuous update model ... jaclaz

But we do have them, whether the "common" user will ever read them is another thing. Here is one: http://www.msfn.org/board/topic/170538-what-is-exact-way-for-how-to-convert-pst-to-nsf/ I don't think we should have a sticky for teaching people how to recognize a SPAMmer, but it could be a good idea . jaclaz

Actually it is very easy . Hint #1: Original poster is at his/her first or second post <- (not enough to say anything, but assign 3 points for this) Hint #2: The SPAMmer that replies is at his/her first or second post also <- (now imagine that a perfect stranger takes the time to register on a board just to reply a - usually "vague" or "elementary" question, assign 5 points for this) Hint #3: The SPAMmer that replies provides a direct link to a Commercial tool <- (assign 5 points for this, 7 if the link is a hyperlinked word instead of being a normal link) Example of a "normal" link: http://www.bernardbelanger.com/computing/NaDa/ Example of the same link as a hyperlinked world NaDa NaDa the nice tool that does nothing How much you get? If less than 10 points the post and reply is likely to be OK, if it is 10 or more it is likely to be some form of SPAM. jaclaz

Not exactly my field of experience, but line 431 of core.js of WPI should be: WScript.Sleep(duration); Wscript is a "standard" script parser for the Visual Basic Script language on *any* windows, if you open a command prompt and type in it: Wscript /?[ENTER] a popup window should come up. If it doesn't, it means that for *some reason* your environment is faulty. Try copying the following and pasting it in a new file, name it test.vbs: WScript.Echo "Hello World!"Wscript.Sleep(1000)WScript.Echo "Hello again!"then double click on test.vbs. What happens? jaclaz