Jump to content

jaclaz

Member
  • Posts

    21,300
  • Joined

  • Last visited

  • Days Won

    53
  • Donations

    0.00 USD 
  • Country

    Italy

Everything posted by jaclaz

  1. Which kind of info? The file has been found or is it not the "right" one? jaclaz
  2. YEs and no. Basically, there is no real advantage (if not the capability of using more RAM - BTW RAM that you don't actually *normally* need) in *any* normal use. Compare with this recent thread on reboot.pro: http://reboot.pro/17568/ jaclaz
  3. Good. And if you access this "my500GB.img" with dmde you can actually see the $MFT, but if you try opening/mounting it with IMDISK you have issues (like being prompted to format it and/or in the IMDISK control panel NOT seeing NTFS as "filesystem")? Do I get this right? If yes, you can try the following, using TESTDISK on the "my500GB.img" as follows: TESTDISK <path>\my500GB.img http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step be sure to choose to Create a log, follow the above and post the log and a description of what it says on screen (since the disk was originally partitioned on XP, do reply "No" to the question about it having been partitioned under Vista as it should speed up things). It is also possible that (for any reason) the IMDISK (which works at a "somewhat higher level" than other virtual drivers) have different kinds of issues with the image, it is possible that *somehow* it fails to detect the offset to the partition (BTW are you prompted to choose an offset when mounting the image?), another thing you may want to try is (on XP, NOT on 7) the VDK driver: https://sites.google.com/site/chitchatvmback/vdk optionally using my pseudo-GUI for it: http://jaclaz.altervista.org/Projects/VDM/vdm.html BUT better if creating a .pln file for it, by hand or using the little batch here: http://www.forensicfocus.com/Forums/viewtopic/t=1489/postdays=0/postorder=asc/start=42/ Can you confirm that the first sector of the "my500GB.img" is identical to the MBR sector you initially posted? (Would it be possible that you got the MBR and PBR "right" with hdhacker form the "original disk" and that somehow when you made the image either of them is not there/is corrupted?) jaclaz
  4. Can we put you in the basket? jaclaz
  5. UCS-2 Little Endian sounds to me a lot like "Unicode". The simplest check you can make is looking for a hex 00 (if there is at least one, it's Unicode, conversely, if there are none, it's not Unicode - and it is very likely to be "plain ANSI text"). http://betterexplained.com/articles/unicode/ jaclaz
  6. This "practical" misadventure of doveman does raise (at least it raises to me) a couple philosophical or theoretical questions (open to everybody): WHAT is the need for 16 GB? <--"absolute" question WHICH is "better" (i.e. faster/more useful/advisable)? (12 Gb@1600Mhz or 16 Gb@1333Mhz) <--"relative question" and a third one coming purely from curiosity (aimed to doveman only): WHAT the heck are you running on that machine that *somehow* prompted you to decide that the previous 8 GB were not enough? jaclaz
  7. Sure. Even if there are things to be changed, at least it will be an example that works for somebody. Cheers and Regards And that is the good thing about batch/scripts, no need for fancy compilers/build enviroments/SDK's and what not, a few changes in Notepad and everything can be modified and tested. jaclaz
  8. A spreadsheet is what you want. There are several freeware ones. If you provide the actual scope of what you are doing (like all numbers from 0001 to 9999 or every number from 1111 to 9999 or any even (or odd) number between xxxx and yyyy, or whatever) we may provide you an easy formula method to achieve that. jaclaz
  9. It means (hopefully) check, double check, triple check motor contacts and or try again holding the disk vertical: jaclaz
  10. Yes , but the bad idea is providing senseless metrics to help pumping up the success of Windows 8 : Seriously, it's nice to know yet another reason to remain clung to XP or 7 . jaclaz
  11. IF there was one (and was not an OEM one). Another thing I am curious about is how/why someone (apparently on a corporate network) is using Windows 8 before it's release date I mean, I guess there will be lot of troubles for the IT guys when Windows 8 will become common, but actually using a pre-release version? Isn't it "calling for troubles"? jaclaz
  12. Or give the users Administrator powers ..... Only seemingly UNrelated: Out of curiosity, wouldn't an additional XP license be needed for the VM? jaclaz
  13. Before I asked you to try telling me with reference to the video at which point you had the BSOD. I cannot understand this: as well as I cannot understand I know how it is difficult to communicate , but if on this side we do not understand EXACTLY what is happening, it is not "trying to help", it becomes "guessing game". Anyway, it doesn't matter, as BOTH the F6 floppy and the integrated install failed (when initiated from USB - and it is is still possible that Winto Flash is part of the issue), what I suspect (though I have NO way unless I understand when EXACTLY happens the BSOD) is that the issue is with the actual USB bus and has nothing to do with chipset or SATA/AHCI. A way to verify this is if the SAME (at the SAME exact moment) BSOD happens: with the F6 floppy with the integrated drivers with a "vanilla" source If yes, you need to try ANOTHER thing. I need to know EXACTLY how your hard disk is partitioned to help you try a "local" install. If you could post a screenshot of the open disk management on the booted 7 would help. If you could make a copy of the MBR with a disk editor or with HDhacker (you want to backup first sector of physicaldrive): http://dimio.altervista.org/eng/ zip it, upload the archive to some free hosting sitte and post a link to it, it would be MUCH better. Without this information I won't be able to give you any senceful suggestion on how EXACTLY trying this, as the risk is that if the install starts but does not succeed, you will have your Windows 7 not boting anymore, so it would be smart to have a procedure with a possible "way back". jaclaz
  14. I thought that Popular Mechanics were "serious" people, and not clowns, 3/4 of what they posted as the 10 best things in 2012 either do not exist or there is no way they actually could have tested 'em, I mean, we already have the good gizmodo guys for the news and for the "Press Communncations". Casually, the image seen here: http://windowsteamblog.com/windows/b/bloggingwindows/archive/2012/10/04/21-days-and-counting.aspx has obviously been printed on the cubify printer (wirelessly), have a look at the actual cubify site: http://cubify.com/index.aspx And compare with the reference for the explanation for the Windows 8 NCI and logo: I know how it is good to introduce computers and stuff in primary school, but the idea was to do it because in due time the children would have grown up with some more knowledge, not that of having all humanity revert to primary school .... jaclaz
  15. I thought that was exactly why batches were invented But, as we have seen httpdisk is a good "generic" solution, whilst GWT is amuch better specific one (much less actual download). The idea (mine) is to enhance GWT (or get some other programmer involved in making a tool capable of making use of the linked to library) giving it "partial CAB download features" . If you prefer, it is a three stage thing: timotheus had a nice idea (but failed in the practical "legal" implementing of it ) now it is about replicating it with using the tools we have already handy next will be to find a better way for doing #2 jaclaz
  16. NO. You ALREADY have a 32 bit NT based system running on that machine. NOTHING prevents you from using that NT based system (Windows 7) to access the files on the USB stick and copy them to the local hard disk, then, INSTEAD of booting the setup, you run the setup by using WINNT32.exe or The issues may be depending on how EXACTLY is the hard disk partitioned AND you might want to have some provisions to not "get stuck" if the install - for any reason - fails. Please describe EXACTLY how the internal hard disk is partitioned (a screenshot of the Wiondows 7 disk management would do). And still, your description of what you are doing and of what happens is severely lacking DETAILS (that might make the difference). Now that you have the drivers integrated, WHEN EXACTLY does the BSOD occur? Please state the exact time with reference to the provided example video and describe EXACTLY what you see before the BSOD. OR - better - try again with a "clean", "vanilla" source, if the behaviour is the same, then the issue is likely with the drivers, WHICH EXACT drivers were you using/found when trying with F6 (link please)? Which EXACT make/model of USB floppy disk are you using? Is it possible that this: is related? jaclaz
  17. Well, we are not one inch nearer to anything after this post. I still fail to understand (actually because you omitted to describe it ): WHAT EXACTLY happens when booting(with the PCMCIA slot empty) WHAT EXACTLY happens whn booting (with the PCMCIA slot with the card inserted WHAT EXACT version the drivers you are using are WHAT EXACT version/type of card you have (please find yourself a link to some resources describing it and post the link) WHAT EXACTLY happens after that stop error went away (is the card "seen" anywhere in the OS, etc.) etc., etc. I do understand how it is difficult for someone that actually has the machine before him/her be aware that the people wiling to help are NOT there and cannot see what happens, and that because of this everything must be described with the uttermost detailed accuracy, but you are seemingly wanting to set a new record to the omission of relevant information... jaclaz
  18. And also completely unreadable. jaclaz
  19. Maybe it is an issue with the actual USB/wintoflash. Read again my first post and try a "local" install using WINNT32. It may (because of the different partitioning convention used) but I doubt it, and anyway you would have not a 0x0000007b or you would have one in another "moment" of the install. jaclaz
  20. NOT really because he quickly formatted - or at least this is what was initially reported. (even if the command went through). In any case not a smart attempt: NO fiddling of any kind until you have a dd-like copy! Of course if the format command was without the quick switch, the whole disk, sector by sector has been written with 00's. And again it is easy to understand what happened, a "quick" format is a matter of minutes, a "full" one is of hours. jaclaz
  21. Yes/no. Meaning that the the 0,1,2 etc. are httpdisk (virtual) "device" numbers, if the "0" is "busy" it should mean that you have another instance of httpdisk running/making the device busy. these two: issued form a freshly reboted systems should be perfectly equivalent. jaclaz
  22. Would something like this be useful? http://www.winarchiver.com/virtual-drive.htm http://www.pismotechnic.com/pfm/ I don't think so, as - if I get it right - the issue is the size of the actual "archive" that needs to be fully downloaded to extract from it a few files But there is this: http://www.codeproject.com/Articles/15397/Cabinet-File-CAB-Compression-and-Extraction jaclaz
  23. Just in case: https://help.ubuntu.com/community/HowToMD5SUM http://twiki.org/cgi-bin/view/Wikilearn/CdromMd5sumsAfterBurning Under windows I would try : dsfo \\.\D: 0 0 NUL (where D: is the drive letter of your CD/DVD drive) jaclaz
  24. Not really (or not any soon ), but is good to see how the young padawans can feel the force.... I have still at least 850 years before me : jaclaz
  25. I think that GWT needs to be modified by JFX httpdisk should work allright. Post the EXACT command line you attempted issueing. There is NO mount directory at all, a new drive letter is used. If the image is a disk image you need not any parameter, if it is a .iso you need the /cd one, examples: httpdisk /mount 0 http://server.domain.com/path/diskimage.img d: httpdisk /mount 1 http://server.domain.com/path/cdimage.iso /cd e: Do check the given link: http://reboot.pro/13049/ jaclaz
×
×
  • Create New...