jaclaz

I am not sure to get the final "scope", EWF is also not "free", there are a bunch or commercial apps besides DeepFreeze that may do what you need: http://alternativeto.net/software/windows-steadystate/ http://www.instantfundas.com/2010/09/5-alternatives-to-windows-steadystate.html Maybe among them you can find something that can do what you actually want to do. jaclaz

Try with: mmc.exe C:\windows\system32\services.msc (assuming you have your windows install in C:\windows\ ) Or in the open window open file C:\windows\system32\services.msc jaclaz

Even after a reboot? If I were you I would build a minimal XPe and test your commands in that environment. Then, if it works there, trace differences. jaclaz

Traditionally StartMenu: C:\Users\"YourUserName"\AppData\Roaming\Microsoft\ Windows\StartMenu\Programs\StartUp is loading rather late, maybe (IF the little tool works on 8 ) : http://www.mlin.net/StartupCPL.shtml you could experiment with other "start on boot" approaches (really cannot say if anything else may work ). jaclaz

Nothing actually helpful, mind you, but it is possible that you are missing some dependencies, example: http://msdn.microsoft.com/en-US/library/ms912912(v=winembedded.5).aspx According to this: http://msdn.microsoft.com/en-us/library/ms932912(v=winembedded.5).aspx you should get an error if the ConfigureEwf fails... Or maybe you need to also call EwfMgrEnable (and reboot): http://msdn.microsoft.com/en-US/library/ms933229(v=winembedded.5).aspx jaclaz

Actually neither , I was just poking a bit at Ponch . But, with all due respect to your decision(s), if they are made public, they are subject to being commented, criticized or used as start point for having some fun (actually the only important thing). As often happens, OT , but not much, we have evidence that when someone uses the "brain surgery" argument: http://www.911cd.net/forums//index.php?showtopic=24353&st=178 the usual "it's all Greek to me" or similar counter-argument: http://reboot.pro/3380/ is nullified by the documented "The rest of this stuff it's English to me." http://reboot.pro/3380/page__st__36 and *any* other counter-argument, including the one about creativity represents a ninja point: jaclaz

Are you talking of this, right? http://msdn.microsoft.com/en-us/library/bb499207(v=winembedded.51).aspx http://msdn.microsoft.com/en-us/library/bb521420(v=winembedded.51).aspx Maybe Ewfdll is called differently during FBA that what you try replicating with Run32dll.exe? I presume you got most of the info you posted from here: http://www.pcreview.co.uk/forums/ewf-mode-change-t3116601.html http://km-dev.blogspot.it/2007/05/xpe-tip-45-ewf-and-cloning.html that give a quite longish set of instructions, did you attempt following them to the letter? jaclaz

There is normally NO /minint folder in a BartpE .iso , but rather a /I386. Normally: on .iso/CD/DVD: /I386 on HD-like media: /minint Just for the record, on CD media is not possible to have a 5 letter folder (unless some "heavy" hex editing is made to setupldr.bin) whilst it is possible to have a 4 letter folder on HD media (typically /I386) so that .iso and HD-media are more "interchangeable" and (badly) written plug-ins with /I386 hardcoded work on HD media as well: http://www.911cd.net/forums//index.php?showtopic=17504 Still JFYI: http://www.911cd.net/forums//index.php?showtopic=23696 http://www.911cd.net/forums//index.php?showtopic=23262 jaclaz

...and not brain surgery either : http://www.borowitzreport.com/2007/09/30/rocket-scientists-not-as-smart-2/ What about creativity? http://www.fastcompany.com/1666930/rocket-science-brain-surgery-andcreativity jaclaz

Not a problem: Quick rule of the thumb: add to the address of the thread: hxxp://www.msfn.org/board/topic/156004-vlc-media-player-new-version-201-portable/ "page__st__<offset_to_post_#> that's page, two underscores, st, two underscores, (number of post -1). jaclaz

No, it is a "marginal issue". The "traditional" Partition ID for the Extended Partition has always been 05. The 0F - which means "05 but LBA" - was introduced to prevent OS's that use CHS from accessing it, just like 0C and 0E. From a NT OS viewpoint a partiion that occupies LBA only accessible space but that is marked CHS doesn't make any "real" difference, as NT will use LBA anyway. Due to the way the LBA only space is mapped in CHS, you have a number of sectors (from 1023/0/1 up to 1023/254/63 that are accessible through CHS) see tony177's PC partition table: For the record, OT but JFYI, newer XP SP and Vista , and later do map them when partitioning as 1023/254/63 up to 1023/254/63, and this is an additional "prevention measure", though there is a serious "quirk" when using XP Disk Management on a Vista or 7 created disk: http://reboot.pro/9897/ Traditionally (though actually "wrongly") partition ID's have been intended as "reliable info of filesystems", while their actual use is that of preventing access/mounting from "legacy" Operating Systems, see: http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/determining-filesystem-type.html http://www.forensicfocus.com/Forums/viewtopic/t=8880/ A number of partitioning tools (or however MBR editing ones) may use 05 improperly, but until you run on that disk an OS or tool that interprets the 05 "literally" there won't be problems. To "fix" it the only thing needed is to change byte 0x1D2 from current value 0x05 to 0x0F. jaclaz

Forget (temporarily ) ANYTHING you read on this Seagate 7200.11 fix ANYWHERE. Try repeating (to the letter) what is written here (and nothing else): http://www.mapleleafmountain.com/seagatebrick.html Report what happens. jaclaz

Yep, there is the risk of slipping on a chocolate covered banana ... http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/put-down-the-chocolate-covered-banana.html jaclaz

Not really. Just for the record, once you try backing up a "Never run a NT OS" PC MBR through booting a NT based OS or PE, unless some "special" care is taken, the MBR will change (the Disk Signature is added to it). @tony177 Most probably the issue with your MBR DATA is that you have an Extended partition in the LBA only space marked as 05 (CHS mapped) whilst it should really be 0F (LBA mapped), see: http://www.win.tue.nl/~aeb/partitions/partition_types-1.html this is not a real problem until you run NT based systems only (from 2K onwards) but it may be an issue if using NT 4.0 and some versions of MS-DOS (or more generally DOS). jaclaz

It is too big for attaching it, I uploaded it here: http://depositfiles.com/files/yvtqx6bae jaclaz

I am missing the "base" assumption that forfiles is actually *needeed*. Won't a more "Normal" FOR /F %%A in ('DIR /B /S *.exe' ) DO ( do as well? jaclaz

Is the Windows CD "loud" when loading? (i.e. a lot of noise and vibration from the CD drive when it seeks files)? If yes, it may be still: I have seen defective hard disk cables/connectors behave like that. but if you wish, I would throw in - without additional costs - also a cold solder joint anywhere on the motherboard or HD PCB. Naaah. That's the "normal" approach. You well know how In some cases - when the post date+time sums up to an even number bigger than 6 - I draw randomly a new thread and in it, instead of posting the usual good advice, I simply throw on the table a few (sometimes wild, sometimes educated) semi-random guesses , and then let the OP choose among them which ones he/she feels better with or is more convenient to him/her. Other times I simply post real tall stories and see if the newcomer "buys" them . Once upon a time there was a PC that could not boot from it's internal hard disk. This happened some times, and some other times the PC booted normally. The queer thing was that just by inserting in the CD-ROM drive an XP install disc and bootng from it (but not doing any repair - or more generally operation from it) the next time the PC would boot normally. When the PC doesnt boot it shows however a message "disk read error occurred", but right after a boot CD was just loaded it started booting normally again. After some time of tests (new tests, not always the same ones) it was found how the vibrations induced to the case by booting from a CD made a false contact somewhere in the hardware "behave" (temporarily). The actual cause was never found, nor the problem solved, as the PC's owner found it not convenient (due to a bad back medical condition) to actually doing the only logical thing, i.e. to open the case (and while at it cleaning it's internals), and try re-seating cables/cards/RAM etc. and visually inspect the parts before re-assembling... both the PC and it's owner nonetheless lived happily ever after, with the only issue that the bad back problem became worse and worse each time the user had to bend to insert a boot CD to revive the stoopid PC.... jaclaz

Just in case of need : http://www.timerider.co.uk/laptopcpu.htm http://elektrotanya.com/clevo_d22_d27_m22_m27_sm.zip/download.html jaclaz

They are "very specific" apps, you won't get much info here on MSFN, but Google helps . You need only the basics, in Victoria there will be a "BUSY" indicator, HDAT2 is more complex but well documented, MHDD is possibly the most "difficult" to use. http://forum.hddguru.com/victoria-for-windows-english-help-google-translated-t12829.html http://translate.google.de/translate?prev=hp&hl=en&js=y&u=http%3A%2F%2Fhdd-911.com%2F&sl=ru&tl=en&history_state0= Direct download: http://hdd-911.com/index.php?option=com_docman&Itemid=31 http://hdd-911.com/index.php?option=com_docman&Itemid=31&task=view_category&catid=81&order=dmdate_published&ascdesc=DESC http://hdd-911.com/index.php?option=com_docman&task=docclick&Itemid=31&bid=87&limitstart=0&limit=15 jaclaz

The MountedDevices key lists (in the case of "Fixed" disks) the disk signature AND starting address of the Volume: http://www.911cd.net/forums//index.php?showtopic=19663 If you have BOTH the machine and the disks, if you can find in any of the DosDevices\*: the disk signature and the starting address of a volume on the disk, you can be confident that EITHER the disk OR an image of it has been mounted on that OS. Since we are talking of forensics, DO NOT EVEN THINK of connecting those disks to *anything* if not through a write blocker. The first two keys mentioned by CharlotteTheHarlot will instead assure you that a given device model has been connected and mounted to a given bus. jaclaz

Post some DETAILS on the hardware (make/model) and try describing HOW/WHEN it started happening. jaclaz

Can you confirm it by using Victoria or mhdd or hdat2? If the PCB has some components gone it may not be BSY, but simply "not working". jaclaz

@tony177 I am sure you will make many friends on this board. Have fun while booting (or completely failing to ) that PC . jaclaz

Look, I don't want to be more grumpy than usual , but you come here asking about a problem that you have, that you have NO ideas how to solve and specifically ask other people (supposedly more expert than you are): and when some ideas are given to you, you start criticizing them? You are of course free to ignore them, but please, refrain from citing "not uncommon fixmbr errors" that you "researched on the net", if fixmbr throws a warning about an issue with the partition table, "common sense" (and rest assured a few years of experience of yours truly in this specific field) should tell you to investigate the issue. Of course you are perfectly free to ignore the posted advice . It's my fault , I should have replied properly to your: YES. http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/questions-with-yes-or-no-answers.html jaclaz

I have seen defective hard disk cables/connectors behave like that. In any case the partition issue you reported needs to be investigated and fixed IMHO. jaclaz