Jump to content

jaclaz

Member
  • Posts

    21,300
  • Joined

  • Last visited

  • Days Won

    53
  • Donations

    0.00 USD 
  • Country

    Italy

Everything posted by jaclaz

  1. Just for the record, there is more than one way to skin a cat (the cat won't like any of them, though ): http://alternativeto.net/software/agent-ransack/ For NO apparent reason : jaclaz
  2. Possible. You should upgrade to some recent hardware jaclaz
  3. Risking to go WAY Off Topic anyone has attempted a DIR of the WINSXS folder in a Windows 8 install or WAIK PE 4.0? I would say that the side by side mechanism - IMHO in itself a good idea, only very badly implemented - has been vastly abused. .Net is obviously nonsense bloat (still IMHO), being often in itself as big as or larger than a "normal" WHOLE Win 9x install. jaclaz
  4. Not really. There is nothing like a $MFT backup, there is a $MFT mirror, which actually holds just first four records of the $MFT. What you report makes little sense (the manually disconnection of the cable(s) being related), if the disk was encrypted, unecrypting it in case of corruption should not have been possible, which means that there was a corruption of the filesystem while it was mounted (and the corruption itself was encrypted by Bestcrypt). The TESTDISK log shows how the $MFT is corrupted. The MBR and PBR seem apparently fine (though the MBR code looks like corrupted, but it has no relevance if not for booting. BUT, the MBR has LBA start 2048 and Num Sectors 117960704, i.e. 2048+117960704=117962752 total sectors, the PBR has 2048+117960703(+1)=117962752, while the image taken with datarescuedd has 60390005760/512=117949230 sectors. The image *somehow* misses seemingly 117962752-117949230=13522 sectors This seems like indirectly confirmed by the TESTDISK log (though it provides another difference): 60398080512-60390005760=8074752, -8074752/512=15771 Try opening the K:\image[0-60390005760].dd with dmde: http://softdm.com/ it may be able to parse the corrupted $MFT and allow at least the recovery of some files. jaclaz
  5. Yep, the begin offset is 63 allright but those data do not make much sense. They are not the actual data related to a file, those correspond to entry #531 in the $MFT, possibly the $MFT entry for that file, according to the data till now gathered. In the "upper right" pane right click on the file name, you will have a set of choices, right now you seem like having chosen "Open MFT file (hex Editor)", while you want to choose the bolded "Open (Hex Editor)". Can you see in the lower right pane the beginning of the file? If yes, you will also see the LBA, vol.sec, Cluster and sec. of the actual file. Is this file recoverable? Save them somewhere for the moment. The strange thing is that you seemingly have valid data in both the MBR and the PBR, the $MFT is apparently there allright, as seen by dmde, but the filesystem driver fails to mount the volume (both through Imdisk and VDK). I am confused. Try another thing before anything else (on the "my500GB.img"). Open it with DMDE, does it show a window titled "Partitions - dmde 2.4.4"? Can you see two entries in it, the first one being: Image:<path>\my500GB.img etc. and the second: <label> Primary (A) NTFS (07) 500 GB EBCF 63 <some number> ? If yes, if you select the second the "Open Volume" button should become enabled, press it. A new popup should appear, titled "Open NTFS volume" with some data (post this data). Then press "Open" button. This way DMDE is using the data coming from the MBR and PBR (and not the results of the NTFS search). In the lower right pane you should see (first line): LBA:6291519 vol.sec 6291456 Clus:786432 sec.0 (MFT 0) If you open again the image, and this time you choose instead "NTFS Search" (start it and wait until "NTFS 0" appears, then press "start/stop") and then select the "NTFS0" and click on the "Open volume" you should get the same: If this is what happens, I am wondering what prevents the NTFS mounting with both IMDISK and VDK. jaclaz
  6. Sure, imagine that you need to buy a Photoshop CS6 License in order to be licensed to use a "MS Paint like" lousy program on your lousy tablet. (or try to do some serious photoediting with your fingers instead of a pen). "Not that bad" is relative. And what if a company has a new, revolutionary, (BTW moronic) approach of only using Surfaces and "The Cloud" (which is actually what the good MS guys are pushing for)? They don't even have the hardware to actually install one of the senselessly bloated "complete" Office suites, in order to be allowed to run the RT version on their tablets. Additionally (and only slightly OT) using "seriously" Excel without direct access to Fn keys and without a Numeric Keypad is a lot like doing Muay Thai with both your hands tied behind your back and your legs tied together and to to the pavement... jaclaz
  7. Start from here: read a few posts. And/or see this: jaclaz
  8. Then (if it results as accessible on the othe PC), clean thoroughfully the USB related entries in the Registry on your PC and try again, see: and links therein jaclaz
  9. No, this has nothing to do with the bricking or the unbricking, those are related to the device being inaccessible, now you have access to the device (and to one of the structures on it) but not to another structure (partition/volume/filesystem) on it. This could be caused by a "simple" corruption of the filesystem (or one of the identifiers/indexes) or a physical corruption of some sectors on the device. Start a new thread, now you are not anymore in the 7200.11 unbricking, but in "generic" data recovery. jaclaz
  10. ... and you didn't fint this one yet : jaclaz
  11. Win+R simply opens the "Run" dialog/popup. In it you have to type some commands. You can use some tool (like Nircmd): http://www.nirsoft.net/utils/nircmd.html to set focus to the already active CMD window and paste/execute in it some command. This still seems completely unlike being a GOAL (or if it is a goal, it appears like a senseless one ). BTW, you seem like having a tradition of being reluctant in providing the actual scope of what you are asking for, posting instead "vague" or "generic" examples, which everytime need some back and forth rounds of questions to actually get what the actual question is about. (and hopefully provide an appropriate solution/answer/advice) jaclaz
  12. I am failing to see the difference between what you initially asked and the result of what was suggested, can you try expanding on what you want to achieve? Additionally, I presume that your actual GOAL is NOT that of having one or more CMD.EXE windows echoing to screen "Hello World" , please do state the actual GOAL, there might be different ways to achieve that. Be aware of the risk of slipping on a chocolate covered banana : http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/put-down-the-chocolate-covered-banana.html jaclaz
  13. More loosely you have too many variables in the equation, at least: WinSetupFromUSBwith GUI beta (8) and Install from USB a senselessly BIG hard disk, additionally SATA an inane amount of RAM unverified behaviour of the BIOS (IDE emulation mode settings) uncertainties on the drivers used My proposal (as a test) is: FORGET about the whole "install from USB stuff" make a single, FAT 16 or FAT32, 1 Gb in size Primary, Active partition Remove as many RAM sticks as you can set the BIOS to "IDE emulation mode" (or similar) use the good, ol' WINNT.EXE way: http://www.911cd.net/forums//index.php?showtopic=16713 jaclaz
  14. In your case you should wait another 12.42 minutes, then re-do from start. Seriously, there are three possibilities: the actual command went through BUT (for *any* reason) there was not feedback of it's execution the actual command went thorough BUT (for *any* reason) it was not actually executed the actual command didn't go through (again for *any* reason) and thus wasn't executed The same "remedy" applies to ALL three, after having waited a "reasonable" amount of time (that in this case means no more than 2 hours, i.e. double what was reported as longest time - which BTW I somehow believe to be a non-that-much-reliable report as the thingy should last at the most a few minutes, ten at the most), stop everything, check if the drive was unbricked, if not, start again from scratch. To put it more bluntly , the ONLY choice you have is to do the above. There is no particular "order of operations" for the "shut down", to be on the safe side it is anyway "advised" to: close terminal switch PC off switch "other" PSU off then redo in the opposite order (as you already did correctly ): switch "other" PSU on switch PC on open hyperterminal jaclaz
  15. I would gladly, but it's not that easy. As a general rule, when posting some file, always compress it to a .zip or 7z archive. Your next step should be to select (in the upper part) the NTFS0 volume and click on the "Open Volume" button. What happens? If everything is OK, you should be able to see SOME of the data that was in the volume. Ideally you should be able to locate some small text only file (like a .ini or .cmd) and verify visually it's contents, then attempt recovering it (to ANOTHER drive). If the attempt is successful, you can either (manually, aka 1 by 1) attempt recovering each file (it seems like there are something like more than 11000 still indexed files, though) or decide (still if these attempts give some good result) to buy a license for the DMDE thingy, even the "Home Personal" edition should do. jaclaz
  16. Changing grub4dos to Syslinux (or viceversa) doesn't change the filesystem. A number of minimal Linux Distro's (like the ones that come with Antivirus) do not have support for NTFS (in the sense that they cannot reside on NTFS formatted filesystems). You may need a FAT32 formattted stick. You should NOT use WAREZ, or however don't talk about them here. jaclaz
  17. Yes (or No). http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/questions-with-yes-or-no-answers.html jaclaz
  18. @pnieset You still fail to report how EXACTLY (with which tools, with which commands, etc., i.e. EXACTLY) you attempted to add those files to a DVD. The error message you posted seems about a non-bootable DVD, but is confused and misses any meaningful detail: Try to read it with an objective mind , how do you suppose that anyone can guess what you have done (and further than that guess which is the issue at hand)? kohlerbkqn seemingly posted about the "official" Toshiba method to create the install/recovery media on DVD, about which you may read about here: https://www.csd.toshiba.com/cgi-bin/tais/support/jsp/bulletinDetail.jsp?soid=2753749&pf=true Why don't you give it a try? If it works it is completely automated. jaclaz
  19. Hmmm. It sounds like there are no traces that TESTDISK can find, which is unusual. Get DMDE: http://softdm.com/ And try opening the disk with it (Drive->Select Drive->choose the PhysicalDrive->NTFS search). And report (post a screenshot) If one (or more) NTFS volume(s) are found, you can access them by selecting and "Open Volume". Another thing, you should try to get (and post in an archive) the first 100 sectors as detailed in so that I can have a look at them. jaclaz
  20. "Keys A: add partition, L: load backup, Enter: to continue" You are between: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#Quick_Search_for_partitions and: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#Save_the_partition_table_or_search_for_more_partitions.3F i.e. since "Quick Search" failed, you want to do a "Deep Search". jaclaz
  21. Only to further clear the whole point is/was not whether the referenced post is a good "guide" or a "bad" guide, simply that it represents NOT a "guide" and at least from me there was not at all a bashng of it, but simply a pointing out how it cannot (IMHO) be called a "guide". jaclaz
  22. Bene intelligo tuae rationes. Hoc nuntium ab innominato instrumento missum erat. jaclaz
  23. Just for the record: http://www.zdnet.com/microsofts-ballmer-not-ready-to-reveal-windows-8-surface-sales-7000006602/ The linked to interview to the Wall Street Journal contains IMHO a pearl): (I bolded the pearl) During an interview with one of unarguably one of the most influential financial newspapers in the West world, the very Top Eecutive of one of the largest software companies worldwide, as an answer to a serious question, provides (senseless) anecdotal evidence AND the interviewer accepts this nonsense? I mean : sounds too similar to : to be plausible .... in 2012 ... and presuming that the very Top Executive of MS does not fly to San Francisco to have dinner with a bunch of morons (or maybe it was a form of flattery raised to the power of n). jaclaz
  24. I am more used to work on command line, it is simply faster, open a command prompt, navigate to the directory where TESTDISK is, type on command line testdisk_win.exe /log press [ENTER] If you double click on testdisk_win.exe you will anyway be prompted to do that: http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step#Log_creation you want to Create a log. jaclaz
  25. ...and on half the internet... http://www.tek-tips.com/viewthread.cfm?qid=1696999 http://www.wjunction.com/53-technical-help-desk-support/156791-auto-create-txt-file-each-folder.html http://stackoverflow.com/questions/13122504/go-to-path-read-txt-file-with-vbscript jaclaz
×
×
  • Create New...