jaclaz

And indeed, without ALSO the MBR and DISK SIGNATURE you won't be able to boot the restored "backup" easily. jaclaz

If I understood you right, you are looking for something that will compare "newly added" files to a list of "old files" MD5 list? But how would the "newly added" files be actually "added"? I mean, maybe you need also another function (or two) like a "folder watching" utility and/or a "file adding" one. Which kind of files are we talking about? I mean big sized like - say - videos or smallish like - say - batch and text files? The performance of an OS with a folder with thousands of files may be slowed down considerably when using a file manager like Explorer. Something like this: http://www.datamystic.com/filewatcher.html http://leelusoft.blogspot.com/2010/07/watch-4-folder-22.html Which could "trigger" a batch or whatever that: calculates the MD5 checksum for the new files only and compares them one by one to the saved list of MD5 for the "old" files then IF match deletes the "new" file IF no match doesn't do anything jaclaz

Remember that DriveImageXML images drives , NOT disks! JFYI: http://www.911cd.net/forums//index.php?showtopic=22984 A number of tools you can use: If I were you right now I would try ODIN: http://odin-win.sourceforge.net/ or Clonedisk: http://erwan.l.free.fr/clonedisk/ Good ol' Selfimage did work allright, though: http://www.softpedia.com/get/System/Back-Up-and-Recovery/SelfImage.shtml If you want to use ImageX, you might probably want to read this thread: http://www.911cd.net/forums//index.php?showtopic=19355 Particularly the part about the "queer" license ImageX has (or maybe had at the time ) http://www.911cd.net/forums//index.php?showtopic=19355&st=132 jaclaz

You are missing the important bit. The general idea with datarescuedd is to make partial images. When you hit a bad spot, you "jump" over it, skipping a reasonable" number of sectors. If the skip is not enough, you try skipping some more. Once you have reached disk's end, you re-try the skipped areas backwards. You may still have "holes" in the image, but if a sector is "bad" it is "bad" at least without specialized hardware and "lower level" tools. You can fill this "holes" with empty sectors and finally have an image from which *some* data can hopefully be recovered. Just get what you can, without "insisting" on bad spots. "Something", though worse than "everything", is still MUCH better than "nothing". jaclaz

Not at all. Anything is interesting. As long as you: do not "publish" non-redistributable MS (or other third party) code/binary files your tutorial/illustrative document does not contain "cracks" or ways to circumvent activation, proper licensing, etc. it is allright (and much appreciated) to share it. (here or elsewhere) jaclaz

If the bearing/motor is stuck, the only things possible to attempt are: open the drive (in a "clean room" or similar) and attempt UNstucking the bearing manually open the drive (in a "clean room" or similar) and attempt transplanting the platters on another working drives BOTH require (besides some "special" tools/environment) a VERY good experience in the specific tasks. To unstuck a bearing a certain force is needed, like: good : http://forum.hddguru.com/hard-drive-bearing-motor-tool-t11827.html bad : http://forum.hddguru.com/barracuda-7200-fell-plates-won-spin-t7040.html mind you there is NO guarantee whatsoever that the UNstuck bearing will still allow the platters to rotate properly (centered, smoothly, etc.) but it is still far easier than doing a platter transplant and it is worth anyway an attempt. jaclaz

WHY? I mean, I don't have any use for the "other" (main, boot, working) drive. The "right" files for the drive should be only: image[0-51200].dd MBR_HardDisk1.dat BootSector_DriveF.dat BootSector_DriveG.dat BootSector_DriveH.dat Ther is nothing actually wrong in the MBR_HardDisk1.dat (same contents of image[0-51200].dd) exception made for the extended partition marked 05 (CHS mapped) instead of 0F (LBA mapped). I don't believe TESTdisk can have the output you posted, unless the problem is in the actual EPBR's. First partition (what becomes "F:") is from LBA 63 for 41913522 up to 41913585 First EPBR is at LBA 41913585 Second partition (first volume inside Extended, what becomes "G:") has a "strange" sectors before of 65. Third partition (second volume inside Extended, what becomes "H:") has "standard" sectors before of 63. BOTH volumes inside extended have "crazy" values for $MFT and $MFT mirror placement. Let's have a look at the actual EPBR's. IF the data in the sectors you posted is correct you have: the extended partition from sector LBA 41913585 for 153452880 i.e. 78,567,874,560 bytes Inside it you should have (unless I am mistaken): 63 hidden sectors for the first EPBR 89,755,088 sectors for the G: NTFS filesystem (45,954,605,056 bytes) 1 exceeding sector for PBR mirror 63 hidden sectors for the second EPBR 63,697,656 sectors for the H: NTFS filesystem (32,613,199,872 bytes) 1 exceeding sector for PBR mirror Values #2 and #5 don't make much sense as they don't respect 255/63 geometry. Let's try with three more files - hoping we'll get the actual EPBR's and the PBR mirrors: Start at sector 41,913,580 for 100 sectors Start at sector 131,668,730 for 100 sectors Start at sector 195,366,365 for 100 sectors jaclaz

I don't know what's happening. Maybe the image itself has some corrupted data? Anyway, do the following: re-attach the drive to a Xp machine in a USB enclosure run HDhacker: http://dimio.altervista.org/eng/ you want to save: the MBR or first sector of PhysicalDrive (the PC inner hard disk is \\.\PhysicalDrive0, if you don't have other HD's the USB attached one will be PhysicalDrive1) the PBR or first sector of each and every partition you can see (LogicalDrives) Additionally, run again Drdd. You want to save the initial part of the hard disk, starting from (if the drive was partitined under 2K/XP) sector 0 to sector 100 or (if the drive was partitioned under Vista or 7) from sector 0 to sector 2100. (sectors NOT megabytes) Compress all the resulting files into a .zip archive and either attach the resulting archive to yur next post or upload them simewhere and post a link. jaclaz

Are you implying that Italians do it better? Sure, that's a known fact. jaclaz

... taking the generic - actually Linux derived - example given on diddy's guide and assuming that it will be the "right" syntax for a PE 1.x .... The good news are that you are not the first one to do so: http://reboot.pro/9696/ http://reboot.pro/9696/page__hl__mkisofs__st__26 jaclaz

Just for the record Diamond.exe OFF-TOPIC posts/thread: Quantum compressor (pre-MS) here: ftp://ftp.sac.sk/pub/sac/pack/quant097.zip jaclaz

You can most probably get/rebuild a valid \I386\ source, but it is a "manual" operation and a lengthy/cumbersome one. Generally speaking those images ALSO have a \I386\ directory, but cannot say if this is your case. Have a look here (and links within): jaclaz

Of course they exist. Problem might be if you gonna like their price (examples): http://www.iogear.com/product/GUW2015VKIT/ http://www.ramelectronics.net/wireless/wireless-hdmi/wireless-pc-to-hdtv-adapter-usb-av2010/prodUSBAV2010.html http://www.ramelectronics.net/computer-parts/computer-cables/monitor-cables/wireless-display-extension/gefen-gtv-wvga-sr/prodGTVWVGASR.html http://www.ramelectronics.net/wireless/wireless-vga/gefen-gtv-wvga-lr/prodGTVWVGALR.html It must be really hard to live with a broken google.... Above links found in under 5 miutes time googling for "VGA wireless".... jaclaz

It seems like you have a well garbled MBR DATA. What happens with "Quick Search", and if still "meaningless data is found", with "Deeper Search"? jaclaz

You are welcome. If you have access to some tool capable of moving/resizing partitions you can (partially) fix the current situation. What you can do is to resize the second partition to respect cylinder boundary. What I think you cannot do "plainly" with those tools is to have the second partition as first (as it should be). <- but this is a "minor" deviation from "standard" I want to ressure you, if all it is required by that netbook is to do some e-mails, navigate the internet and more generally "used normally", the current setup won't create any problem. If you are going to "play" with it using on it partitioning tools, installing other Operating Systems and the like, there is a concrete possibility that this non-standard situation may "trick" some program into doing something "non appropriate" (which I presume it is what happened to the XP install when it formatted the disk - keeping the previous partitioning scheme and creating the "wrong" Sectors Before value in the bootsector/PBR). If the "E:\" volume doesn't contain DATA (or - as you should) you have a backup of the data, the procedure would be: delete the "E:\" volume and Extended partition containing it move the "C:\" primary to the beginning of the disk resize it to respect cylinder boundaries recreate an Extended partition in the rest of the disk recreate the "E:\" volume inside the Extrended partition restore (if any) the data to the E:\ volume If you are "home" user, there are a few such tools freely available, examples: http://www.partition-tool.com/easeus-partition-manager/comparison.html http://www.paragon-software.com/home/pm-express/ Point is that most probably they won't resize/move the actual system volume from which they are run, so you will need something like a PE running them from USB. I have not experience with this kind of tools as I tend to do my partitioning by hand and never resize/move partitions, maybe there are some other available programs capable of doing the changes that are more easily bootable from USB, first thing that comes to my mind is parted Magic: http://partedmagic.com/doku.php creating a USB key with it through Unetbootin: http://unetbootin.sourceforge.net/ should be a breeze. jaclaz

I am not at all familiar with the Seagate tools, they may or may not be able to re-create the G-list. (and I have no idea idf this will work without "low--level" formatting the HD BTW "low-level" formatting doesn't exist anymore, at the most is "intermediate level" formatting) 176000 bad blocks in a row is well beyond "normal". This kind of problem is often due to a head crash. As said, insisting on that area may make things worse. You can try changing the Partition ID in the MBR (as an example with MBRWIZ DOS: http://mbrwizard.com/download.php ) to an "unmountable" for windows partition ID, like - again as a example - ID 12, this way the mount manager should ignore the partition. (but we don't know if the "lock" or "freeze" in windows is connected with the actual "disk manager" or with "Mount manager" ). If this trick works, DatarescueDD should be able to access the physicaldrive allright. jaclaz

Try starting again from scratch with the MOTOR contacts insulated, i.e. try following to the letter the tutorial here: http://www.mapleleafmountain.com/seagatebrick.html AFAIK it has never been found why on some drives one needs to insulate the head and on others the motor. jaclaz

Yep, sorry, I mistook first entry in partition table as being FAT32, but the entry is actually for an Extended partition, the bootsectors are BOTH NTFS. Some more details. File MBR_HardDisk0.dat The partition table has two partition entries: Entry/Type/Boot/bCyl/bHead/bSect/eCyl/eHead/eSec//StartSector//NumSectors #0/0F/00/1/0/1/1023/254/63/-/16065/65609460 #1/07/80/1023/0/1/1023/21/20/-/65625525/246952523 The second one: is NTFS, it is Active (i.e. is the one that the MBR code will attempt booting), has balanced CHS/LBA address BUT it is NOT rescpecting Cylinder boundaries, it starts at LBA 65625525 The first one: is an entry for an Extended Partition, it has balanced CHS/LBA, it respects Cylinder boundaries, it starts at 16065 File BootSector_DriveC.dat It is a NTFS partition, it is obviously connected to the second entry in the partition table in the MBR BUT it has sectors before 161585152 (instead of 65625525) File BootSector_DriveE.dat It is also a NTFS partition, it is necessarily connected to the first entry in the partition table in the MBR BUT it has sectors before 63 (instead of 16065) - which is allright - as this is a logical volume inside extended and won't be bootable Now, a "normal" partitioning will have: as first partition a Primary one (and NOT an extended one) the CHS of ALL partitions will respect Cylinder boundaries the "Sectors before" in the partition table will be the SAME as those in the bootsector for Primary partitions "Fixing" the current partitioning to make "drive C" boot should NOT be a problem, all is needed is correcting the "sectors before", please find attached a modified bootsector for drive C that you can try restoring with the same HDhacker you used to create the one you sent. Just try applying it to LogicalDrive C:\ and it should start booting allright without the USB stick connected. But the disk will remain with the three partitioning inconsistencies previously detailed. This should normally create NO problems in "normal" use, but you may find incompatibiilities and problems with some specific kind of software, such as drive imaging/backup and partitioning/resizing ones. Still, something is not clear about HOW this non-standard partitioning happened - maybe there were remnants of a previous partitioning - possibly involving a "hidden recovery partition" - that *somehow* tricked XP into making this botched partitioning. jaclaz BootSector_DriveC_mod.zip

Well, clearly 5eraph - usually attentive and knowledgeable - did misunderstand you, and I had the same problem initially. Most "normal" command line programs do output the result of command to "standard output" and not to "standard error" AND normally use a parameter with a prepended slash or dash, it was NOT immediate to understand the question. On the other hand for all we knew, it could have been another kind of command, as an example you can take DISKPART or WMIC, that do behave "differently" from standard commands (and use not the slash or dash for parameters). Giving the exact reference - and when available - a link to the homesite of the program besides would have made your problem (and hopefully it's answer) findable by other members (or "passers-by") having your same problem. I mean, if you have a problem with, say, devtest, do you google for "devtest help" or for "some program some help commands"? This is one of the advantages of a board (as opposed to PM's or e-mail or phone help/support) problems (and hopefully solutions) are public and may be of use to a lot more people than OP. jaclaz

Under which OS (AND using WHICH utility) was the hard disk partitioned/formatted? The partition table is a mess , it uses fractional end cylinders for the NTFS (second) partition. (this should not happen if partitioned under XP with standard system tools). The FAT32 (first) partition on the contrary uses "good" balanced CHS/LBA values, but it starts at a "queer" location, CHS 1/0/1, aka LBA 16065 (instead of the "normal" CHS 0/1/1, LBA 63). The real problem about the flashing dash (or underscore) is however more likely in the NTFS bootsector (drive C:\ ) that has a "Sectors before" value of 161585152 (whilst sectors before are actually apparently 65625525 ! Same happen (though unrelated) to the FAT32 bootsector (drive E:\ ) that has a "Sectors before" value of 63 (which would be normally right) and instead an entry in partition table of 16065. I am wondering how it can have happened to have both "botched" addresses. (I'd like to understand WHAT/WHY before suggesting posible solutions). Also, what is the scope/need for the first (FAT32) partition? jaclaz

Ideally - if you ave enough space available, you should now make a copy of the image (and leave it alone) Then, get TESTDISK: http://www.cgsecurity.org/wiki/TestDisk Read a bit about it's usage. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step http://www.cgsecurity.org/wiki/Data_Recovery_Examples Run it as follows: testdisk_win /log X:\my_path\image[0-100027630080].dd Change "X:" and "my_path" to your actual values. Se if you can list files on the partition(s). Copy them to another disk. Once you have the files safe we can try to "fix" the damaged filesystem. jaclaz

Blank screen with flashing dash is typical of a problematic bootsector. Generally speaking it is due to one of three things: UNbalanced CHS/LBA (unprobable) on some *rare* ( but not much) BIOSes by a non-standard geometry sensed for the filesystem PBR incorrectly set active partition In practice: get HD hacker: http://dimio.altervista.org/eng/index.html boot from the "NC10" (whatever it is) thorugh the USB stick remove the USB stick run HD hacker TWICE, once saving the MBR (first sector of PhysicalDrive) and once saving the PBR or bootsector (first sector of LogicalDrive) (repeat for EACH LogicalDrive listed) compress the files together in a .zip archive and post the .zip as attachment (or upload somewhere and post a link) I'll have a look at them and see if I can suggest you a way out/solution. jaclaz

The redirection can be from BOTH "standard output" and from "standard error" see here: http://www.robvanderwoude.com/redirection.php Some programs may send the output of the "help" parameter to the "standard error". You have no way to know as they appear in the console exactly as "standard output" does. Try: command help > somefile.txt 2>&1 Next time, please avoid "vague" descriptions, like "some help commands", "pertaining to some program", and the like,. STATE the EXACT program and the EXACT command and parameter you attempted issuing, as it is more likely that you won't be misunderstood and possibly have a more "targeted" reply. jaclaz

From what has been reported till now, the filesystem is lacking the $MFT, i.e. it's main file-indexing structure. I doubt that *anything* can recover *any* more fies than what dmde allowed/allows you to. BUT the rules of thumb are: NEVER give up (untill anything reasonably feasible has been attempted) throw at the stoopid filesystem each and every recovery software you can find (or can think of). Two more good candidates: SCROUNGENTFS (freeware): http://thewalter.net/stef/software/scrounge/ FILE SCAVENGER (Commercial - trial available): http://www.quetek.com/prod02.htm jaclaz

Your screenshot is about a Hitachi drive. It seems like the Seagate is NOT seen at all. jaclaz