energydream2007

Thank you it looks like its working. but the CMD window of dwm is not closing on its own and if i try to close the screen is blinking and looks like dwm restarted, what to do? also there is a watermark, wonder if there is any way to hide it

iv tried that and here is a screenshot of what I got after reboot: cmd window with mostly file not found error and then message window "Your DWM is incompatible with Aero Glass" "retry symbols downloading?" all i did is downloading the 7z, extract the dir to c:\ , and fired up regedit to change the 3 values mentioned

bigmuscle can you please explain how to install the win81_x64_beta3.7z. need some instructions to get it working, appreciate your help

Can someone please explain how to install the win81_x64_beta3.7z. need some instructions to get it working, appreciate your help

...

ok its in process now ("please wait reading mft" and such). il surly update later on

Yes 100% at last.. it took 136 hours. and here is the ntfs scan log if u need: http://www.datafilehost.com/download-620ae091.html plz make me happy

Man the content on the disk is too important il try anything. Just to be clear the disk didnt have an os on it, it wasnt the primary,but storage. When il get home il run dmde and post results UPDATE: as of now DMDE is running for about an hour (and 2%) now and so far i got these results which seems radical if im not mistaken. UPDATE2: 8 hours after started (9% only...) UPDATE3: 32 hours after started (25% only)

Hey all I really need you help - the thing is iv accidentally performed a quick format on an WD Green 2TB drive with XP pro installation. what i want is to recover the whole complete partition as it was (1 ntfs partition was on the disk) include names/structure and all. as of now i dont have a 2TB space to image the disk, so all the recovery tools should be nondestructive, however i do have 2TB free to recovering to. what do you suggest? plz dont hesitate to suggest anything.

Well its not true. UAC have been improved and if you using with standard user its works good. yes vista is stable but in general and not per man specific vista was not stable as 7 they are using smb2 but i did check it and vista was slower access *guest mode is the answer for xp steady state. 14 - i know im using vmware offcourse but it doesnt metter 15 - 7 has good security patches and updates all the time

How can someone agree that win Vista is better then the win 7?? It doesnt know what is talking about at all - cause most of the reasons is fighting back is almost the same he ask you to not include in your "list 7 reasons". Here are more then 7 reasons (and just for you to know i had vista sp2 x64 before windows 7 and it was a good os but 7 is better: 1. UAC big improvements 2. Much better HCL - Hardware computability list 3. Better DWM with no lagging 4. Stable during multi tasking 5. SSD Trim and computability 6. Fast start menu search 7. Faster LAN between computers 8. Better FPS in most games 9. Guest mode 10. XP mode 11.Better pricing 12. No memory leaks 13. Windows 7 make the x64 works finally! 14.Better Visualization computability 15.More secured! what do you think?

From what has been reported till now, the filesystem is lacking the $MFT, i.e. it's main file-indexing structure. I doubt that *anything* can recover *any* more fies than what dmde allowed/allows you to. BUT the rules of thumb are: NEVER give up (untill anything reasonably feasible has been attempted) throw at the stoopid filesystem each and every recovery software you can find (or can think of). Two more good candidates: SCROUNGENTFS (freeware): http://thewalter.net/stef/software/scrounge/ FILE SCAVENGER (Commercial - trial available): http://www.quetek.com/prod02.htm jaclaz Tnx man il try them and others & update update - man PhotoRec did nice job compare to any other file based iv ever tried - recovered 240GB and to sort them by extension iv found a little tool called PhotoRec_Sorter. its just show me that the data is really there (at least most of the 320GB) witch is good news . so basicly the lack of proper $MFT is whats makes the recovery softs the problem of recover my partition as a whole? man i really wanna get that solved. any ideas will be appriciated. im trying now Restorer ultimate and later SCROUNGENTFS. FILE SCAVENGER didnt do the job for now. Update - it seems like ive managed to fix the MFT & Bootsector using TestDisk witch is good but i dont think the MFT is really been fixed. so what is missing? also im experimenting with VDK - iv installed it and mounted the DD image and tried to run chkdsk but im getting "Windows cannot recover master file table" - iv read that maybe ntfs-3g of partedmagic cd can help - im trying it but i cant find the "fix function" talked by that forum. right now im running SpinRite from VMWare on the mounted dd image by VDK. update - from some reason VMware have an error after 21 percent of Spinrite: "The CPU has been disabled by the guest operating system. You will need to power off or reset the virtual machine at this point" and im getting "Devision overflow" error. maybe i need to re-install vmware or something cause iv upgraded my cpu. Anyway, when im trying to open the partition by TestDisk i still have the "cant open filesystem , filesystem seems damaged" error. and when trying to access the drive by VDK (mounted with dd image) im getting "The disk structure is corrupted and unreadable." what do you think is the next step? im trying to search for a tool that will fix the MFT although TestDisk said it OK.

But I don't think you will get anything meaningful. I thought a bit over the matter and it seems to me like two things are possible: the partition was NTFS formatted using a "strange" program that puts the $MFT in the first (or last) million sectors (and that have then been wiped by the WD tool) the WD tool does something "more" than just wiping the first and last million sectors If the "P" doesn't let you see any file (or no more file than dmde did), the next logical step would be to attempt a file-based recovery (please read as PhotoRec): http://www.cgsecurity.org/wiki/PhotoRec The "quality and amount" of recovered files can vary greatly with very low percentages for heavily fragmented volumes and high ones for not fragmented ones - but you will have anyway to open each recovered file and re-name it. jaclaz Ya man i cant see any files when pressing P. i thought that PhotoRec is just for pics but im running it now and it see alot more extensions. man i really wanted to recover the whole partition - file based just not going to do the job. what more options do i have? il do anything to recover just tell me what do you think.

OK Il delete the modified ones and run the new fixed commands + try with testdisk command Il update soon Update - i ran the fixed commands and now run the testdisk command witch seems to find lost partiton man: iv chosen the backup to a log file option witch gives me the next window that im not sure what is the proper step: Waiting for your instructions

OK iv downloaded and extracted the fake images and the dsfok. (man 6kb to 976MB thats some super compression ) I guess that after im altering the copy image with the new sectors through dsfi commands i need to mount it with VDK? (well il take step by step and then will talk about vdk ). 1st i need to wait 7 minutes to the copy of the image to be complete. (tnx for all the help man ) Update - the 1st dsfi command is at 175000MB and keep going that was the command: Update - 1st dsfi command completed: Now starting the 2nd dsfi command witch is: 2nd command as completed: P.S - i can see that the fake images as been expanded as the result of those commands (0-512000000 to 298GB & 319558320640-320070320640 to 595.7GB) Waiting for VDK instructions (or the proper next step)

Weird. about DMDE - i dont have a problem to buy it but the files he showing to me is almost exactly as any recovery soft showing me to recover (witch is always between 11 to 27GB) - and offcourse its nowhere near the capacity iv used - (almost all the drive) about "fake" pre-formatted image plan - yes im now making a copy of the image (witch will take some time casue its on caviar green slow drive). p.s. - TestDisk see just physical disks no?. p.s - can i mount the DrDD image with DaemonTools and such? What to do now? (or just wait for the copy image to created and then proceed)

Problem is that from the view you posted the $MFT seems corrupted. Try clicking on $MFT on the left, then on any folder and inside the folder try recovering a single (smallish) file. (BE CAREFUL as to use a folder on ANOTHER drive as target for the recovered file). I am wondering what the heck can have hapened. Can you right click on the actual image you made and choose Properties (and post screenshot)? I have some doubts about the TinyHexer screenshots you posted. How big is the image you have (in bytes)? jaclaz Well the recover of the file (mp3) was ok and the file is ok. I did suspected the image iv created (using getdataback) and already deleted it before saw this post But created a new one with DrDD and scan for NTFS using DMDE: New DMDE serch results using new Image by DrDD and the new open volume results: New open volume And here is the properties of the new image of DrDD: Properties (don mind the language) In bytes the size is: 320,070,320,640 / 320,070,324,224 (as presented in the window posted). About tiny hexer - tell me if to scan the new image and how proceed in our process tnx man

VERY good. Select/highlight in top section "NTFS 0" and click on "Open Volume". It seems that the $MFT has been foind (though size seems "wrong") You should have a view similar to the one attached. Post a screenshot of it. In the view I posted you can see that the $MFT starts on sector 6291519, which is allright for me as I have 63 sectors before. From the other view, (the one you already posted) you can see that the probable start sector is 2048 (which makes sense if it was partitioned under Vista). You can also try clicking (on the new view you created by "Open Volume" to click on the + near $Root and see if you can recognize some files/directories. jaclaz Here: DMDE NTFS0 The $Root contains nothing (as the $MetaData). all the files are in $MFT dir and i do recognize them. how to proceed man?

DMDE 42% - 7 entries now DMDE 85% - 12 MFT Fragment & 1 Volume (NTFS0). will update DMDE Results: Results

Ya thats strange it was just 1 big partition (all 298 GiB). how can that be. Tiny hexer now at sector 20107300 after 23 Hours (cancel it man and try with 46494C4530 in hex value? ). Yes was looking for sector 6291400 in Decimal and start the search to the word FILE0 (with search for text & dos 8 bits options). Here are the sector 6291400: tiny hexer at 6291400 Il try dmde now (that is matter that this soft is shareware for our purposes?) Update - dmde now on 30% and found 5 entries

No there isnt any hidden partition that i can think of. Update - Tiny hexer is still searching witch makes it alot of time man :] (its now on sector 6716000 and keep going since i started the scan - 4 hours). Can you evaluate when tiny hexer will find FILE0? (approximatly) Update - Tiny hexer at sector 6947000 and keep going - il update later man 7050000 Update - at sector 18805000 now and still searching

Here: 6291519 6293504

oops. tnx 2 minutes il post the right pics

I just used GTB until you answered so i can save some time on image creation :] OK so after all created the image and load it as you say and put 6291519 and thats what iv got: input 6291519: input 6293504 to tell you the truth im not sure what im looking at here as i will need a little more help (and by the way tnx for your help very appreciated man )

Good. Very good. Yep. Suggested apps are:. DatarescueDD http://www.datarescue.com/photorescue/v3/drdd.htm or Clonedisk: http://erwan.l.free.fr/clonedisk/ http://reboot.pro/8480/ You want to image the \\.\Physicaldrive or "Drive" as RAW. The extension has really no importance, DatarescueDD uses .dd extension by default, clonedisk .img, but it's just a name. Let's wait until you have the image. Which OS are you running ? (2K/XP is "better" than Vista or 7, you know, "run as admin", "elevated privileges" and such) Under which OS was originally partitioned the disk? The general plan is: create the dd-like image verify where the $MFT is (if found) create a NTFS sparse file same size as the image mount the latter in a virtual drive and partition/format it (hopefully EXACTLY as it was partitioned/formatted before) copy the first million sectors from the newly created and partitioned/formatted image to the disk (or to a second copy of the original image) copy the last million sectors from the newly created and partitioned/formatted image to the disk (or to a second copy of the original image) The result should be a disk with a valid partition and filesystem with a number of $MFT entries pointing to "nowhere" (the ones that indexed now 00ed sectors) and hopefully a number of still valid entries that should allow recovering/copying the files that occupied non-00ed sectors. jaclaz About the image - right now im creating it using GetDataBack: does it will do the trick? or its better try one of the above listed? *Im running Win7 Ultimate x64 (im the admin :] ). if im remember correctly its was last partitioned by Vista x64 but not sure man. (i do remember that the offset was 1024 in 99%). Yes we will wait for the image cause i see there are some steps that il understand after doing the first ones.