onlit4regs

sorry, after making the command you asked me, I've seen that extent2 and 3 were at "0" size ! unfortunatly, I've merged all the extents and I have as a result, a beautiful file, full of "0xFF" values only !! I've also opened all the extracted extents, it's the same, 0xFF everywhere .... so, I guess I can leave this file alone , and I will try on another one thanks again

hi Jaclaz, so, I'm extracted all the extents from the faulty hard drive (with errors of course). I'm trying to inject them in a new file using: fsz c:\newfile.pds 548864 then: dsfi c:\newfile.pds 0 0 extent1.dd then: dsi c:\newfile.pds 8192 0 extent2.dd and I receive the error: c:\newfile.pds: no data available any idea what's wrong ? thanks again !

hi jaclaz well, I've done the test again, and I've finally succeeded in getting my test file on G: restored. (the offset on my drive G: was 2048 !) I've also succesfully restored an "already working" file on the image file, I have now the right sectors ! so, I've decided to try on a faulty file now. unfortunatly, when trying to extract the 1st extent of 16 sectors only, drdd said: read error at ....: incorrect function read error at ....: semaphore delay has expired .... and several times !! do you think this extent is usuable ? certainly not is this really lost ? is this because of the unbrick ? a problem with the unbrick ? thanks

yes I'm sure I've used the right physical drive number, as stated in windows disk manager this G: drive has only a primary partition. I'm not sure that it was really created under windows xp, I can't remember how to check the offset and cluster size on this partition ? anyway, that was just a hint for understanding why the drdd didn't work on the mounted image of my faulty drive ? but it seems it's not associated ....? thanks a lot

I've closed drdd before viewing the image. I've tried with selection also the physical drive in drdd same result with pldd, I've done a few test, it's the same with my image file on G:\ BUT when I try the same image on my C: drive, it works !!! so, this may be also the same problem with the image mounted drive letter ? any hint on why it works on C: and not further ? my G: partition is a good one, it's a single partionned disk in NTFS. thanks

on a working drive and a working file: myfragi.cmd g:\test.jpg 1 52254759 418038135 3104 g:\test.jpg in drdd, I've extracted the sectors, but file is not a valid image. (I didn't use fsz nor dsfi this time) I've enclosed the drdd capture, just to be sure I am not wrong with values on DMDE, when opening the image my500gb.img, and selecting the previous image test file, I have the same LBA: 6158983, vol.sec:6158920, clus:769865 when opening with DMDE the mounted logical drive of IMD, the LBA is 6158920, vol.sec:6158920, clus:769865 (on the Open NTFS Volume message box, start offset is set to 0)

something is going wrong on what I've done I tried on a file that was readable on my image: myfragi returns this: 1 769865 6158983 624 f:\photos\PHOTOS~1\35ANSM~1.JPG in drdd, you wrote to x512 for the LBA start but values are in sector, so I have left the values from myfragi: start: 6158983 (sectors) - I can not write 6158983*512 = 3153399296, it doesn't fit in the software (only nine digit not ten) size: 624 (sectors) then : fsz c:\test.jpg 319488 and finally: dsfi c:\test.jpg 0 0 c:\image[3153399296-3153718784].dd and the image is unreadable (it was OK in windows explorer on my500gb.img) I've misunderstand something in the values for drdd thanks a lot

This will create an empty file of that size in bytes. Then you use: dsfi C:\mytemp.dat <offset> 0 <filechunk.dd> which means copy to C:\mytemp.dat, starting from offset <offset> for all it's length (0) the <filechunk.dd> where offset is the offset in BYTEs of the filechunk and the <fileschunk> is the name of the file extracted with datarescuedd, the first chunk with your data should be image[2030112256-2030120448].dd (where obviously 2030112256 is made by the LBA offset*512=3965063*512=2030112256 and 2030120448 is the offset+the length, i.e. 3965063*512+16*512=2030120448) The use of a spreadsheet is advised as it will produce the exact command lines faster and without the risk of typing errors. jaclaz ok, just to be sure I understand the offset in the dsfi command, for the second chunk, I'll have to use: dsfi c:\mytemp.dat 8192 0 filechunk2.dd (16*512 = 8192) is that right ? thank a lot

here we go with your magic batch ! Ext: Lcn: LBAstart: Sects: File: 1 495625 3965063 16 f:\montage\2011-tmp.pds 2 28135076 225080671 16 f:\montage\2011-tmp.pds 3 48751063 390008567 32 f:\montage\2011-tmp.pds 4 48797290 390378383 64 f:\montage\2011-tmp.pds 5 50038742 400309999 128 f:\montage\2011-tmp.pds 6 26068714 208549775 128 f:\montage\2011-tmp.pds 7 94098378 752787087 136 f:\montage\2011-tmp.pds 8 74619826 596958671 120 f:\montage\2011-tmp.pds 9 95440487 763523959 152 f:\montage\2011-tmp.pds 10 106615323 852922647 104 f:\montage\2011-tmp.pds 11 95441871 763535031 152 f:\montage\2011-tmp.pds 12 48579698 388637647 24 f:\montage\2011-tmp.pds

so, the command I used was: getfileextents F:\myfile.txt and always get the same error: initFileTranslation: invalid descriptor on a "good" partition, it worked ! no problem. It's only with the mounted image that cause problems. with myfragmenter, I have more results: MyFragmenter.exe -i f:\montage\2011-tmp.pds MyFragmenter v1.2, 2008 J.C. Kessels Commandline argument '-i' accepted. Processing: f:\montage\2011-tmp.pds Fragment list: Extent 1: Lcn=495625, Vcn=0, NextVcn=2 Extent 2: Lcn=28135076, Vcn=2, NextVcn=4 Extent 3: Lcn=48751063, Vcn=4, NextVcn=8 Extent 4: Lcn=48797290, Vcn=8, NextVcn=16 Extent 5: Lcn=50038742, Vcn=16, NextVcn=32 Extent 6: Lcn=26068714, Vcn=32, NextVcn=48 Extent 7: Lcn=94098378, Vcn=48, NextVcn=65 Extent 8: Lcn=74619826, Vcn=65, NextVcn=80 Extent 9: Lcn=95440487, Vcn=80, NextVcn=99 Extent 10: Lcn=106615323, Vcn=99, NextVcn=112 Extent 11: Lcn=95441871, Vcn=112, NextVcn=131 Extent 12: Lcn=48579698, Vcn=131, NextVcn=134 134 clusters, 12 fragments. Finished, 1 files processed. what do you suggest for next step ? thanks a lot

GetFileExtents always returns me this error: initFileTranslation: invalid descriptor (even when I try on the file that was recoverable)

sorry, but how to use your batch ? gfe.cmd driverletter: ?? thanks

ok, first checkdisk without parameters returns a lot of messages like this one (sorry it's translated from french): errors corrected in index $I30 of file 42062 .... index verification terminated errors found. chkdsk can not continue in read only mode Then, with /F, a lot of messages like this: errors corrected in index $I30 of file 41863 Sort of index $I30 of file 41863 Restore of orphaned file xxxx.xxx (1198) in file of directory 49 Insert of index entry with ID 311 in index $SDH of file 9 Fix of record segment of security file ... Errors corrected in miror of MFT Errors corrected in "capslock" file errors corrected in bitmap attribute of MFT errors corrected in volume map and finally with /F /R: everything was ok Then, I can see the directory and files under windows !! but of course, still unable to read the dozen of files I'm interested in. should I give a try with the extents now ? (from your procedure in a previous post) thanks a lot

I've done testdisk, Advanced Menu, Boot, and then Org.BS it wrotes backup sector with the original sector then I've made "Repair MFT", it wrotes the Mirror MFT with original MFT I have the same problem mounting with IMDriver, no success under windows explorer should I run a chkdsk now ? thanks

and see the $MFT contents with it? yes, there is no more prompted message on the lower right pane, I can see "FILE:$MFT" with all information about $FILE_NAME, $DATA,$BITMAP, .... under testdisk, I've just searched for partition, display files (only display one empty directory) and that's all I've attached the log did you want other actions in testdisk ? I don't understand which action you mean on checklist #2 thanks testdisk.log.txt

don't know why the size was wrong. I've redone it, it's now clearly 500 105 281 536 bytes I've passed again testdisk on it, with same results as before: can see only one directory, and content is empty. I've tried to mount with IMDisk this new made image my500GB.img, and still same result:

size of image is 500 105 217 024 bytes

hi, I've done the OPEN (Hex Editor) last time, and I've seen the beginning of the file on the lower right pane. This small text file was recovered with success (but not interesting for me !) the values I've given yesterday were from this file. values are: Bytes per sector:512 Bytes per cluster:4096 Bytes per MFT record:1024 Bytes per index record:4096 Total sectors number: 976768002 MFT cluster (or 0): 786432 MFTMirr cluster (or 0): 61048000 Start Offset: 32256 when I click open , I've a choice: Volume does not fit into device: Use this virtual volume size (this is what I've selected) or Use decreased volume size the values from first line are, as you've said: LBA:6291519 vol.sec 6291456 Clus:786432 sec.0 (MFT 0) If this is what happens, I am wondering what prevents the NTFS mounting with both IMDISK and VDK. yes it's the same values on first line thanks for your help

hi Jaclaz, here are the values: LBA : 6292581 vol.sec: 6292518 clus: 786564 so, that's offset 63 as you supposed about the last operation you asked, I have made new backup of First boot sector of logical drive and first sector of physical drive with HDHACKER (so it saved 2 files) , and then filled them with 0, and then what to do with those 2 files ? thanks a lot

absolutly ! testdisk have seen the NTFS partition of 500Go, said structure OK. when pressing "P", there is only one directory displayed, and when entering it, it's empty .... offset is automatically set at 63 blocks when I select my500gb.img vdk driver did the same thing as IMDISK: mount partition, but when trying to access on windows: "this drive must be formatted" yes MBR is the same thanks for your help

hi Jaclaz, I was so busy the last days that I completly forgot my hard drive issue ! so, here is what I've done for this grown image: - datarescuedd the faulty drive in a single image of all sectors (with a lot of reading errors) - mksparse <path>\my500GB.img 500105281536 - dsfi <path>\my500GB.img 0 0 <path>\thewhatever136GB.img thanks a lot

I'm working with the "grown" image (mkparse + dd-ing) - 500go I should test dmde or IMDisk with the small image made by Drdd ?

yes dmde has no problem seeing the directory/file structure on the image file, I see all my favorite files. I've mounted it with IMDisk, with default parameters of size of virtual disk, etc. It showed a new letter, but impossible to browse this letter ! (no filesystem type indicated in IMDisk, and windows can't see the size of partition, file or directory unreable or corrupted ...) so, can't get fileextents to work on it too. ?? thanks

I can't get "getfileextents" to work should I use it on my hard drive or on my image ? how to tell it to search on the drive or image ? parameter seems to be only the filename thanks

hi jaclaz so, I have tried DMDE on the original hard drive, It couldn't display the directory/file structure , it was so long on "reading MFT", more than 4 days to complete only 3% !! so I aborted on this disk, there is a dozen of "most wanted" files for me, which may represents 2 or 3go. I've made my recovery tests on these files. maybe other are readable, but they are not necessary for the moment. so, do you think I should try to image the disk in smaller chunks ? thanks