• Content count

  • Joined

  • Last visited

Community Reputation

0 Neutral

About ngpc

  1. Hi, Does anyone have an experience in using a software to record a telephone call ? Any good software or hardware recommendation ? The function I am looking for is that the computer software can dial a phone calls and record the conversation correspondingly. It would be very appreciated if you can help ! Thanks ngpc
  2. Hi, I got a similiar problem and got it solved by a technical expert in last week. While my situation is that my computer can recognise the drive but cannot access the data, a bit different from you ... You can go to this link also a part of this forum MSFN , see if my expereince can provide you some references..
  3. You are welcome. I could tell you, but then I would have to kill you... Seriously: any hex/disk editor, possibly one that offers templates Beeblebrox, the DSFOK toolkit, IMDISK which you already "met". Ken Kato's VDK: Optionally with my pseudo GUI for it: My small CHS/LBA spreadsheet: (keep an eye on that thread, I am in the process, hopefully in a few days or maybe weeks, to publish a MUCH enhandced v2.0 of it) My small MBRBATCH/MKIMG: And a number of other tools, depending on what is the problem at hand. Remember that however usually a skilled carpenter is more important than the actual tools he uses. You'll need some time to learn and digest the info you can find in the below mentioned site (and it's links) and more generally take your time browsing around in boot-land: Also remember that the right approach to data recovery is avoiding needing it. (BACKUP!) The "mother of all MBR/filesystems sites", the Starman's Realm: And of course the good ol' "Primer": I would also suggest you getting acquaintaned to "ol' DOS" programs, like Ranish Partition Manager: and the several other DOS tools recommended by Daniel B. Sedory (the Starman) And with Qemu: Optionally using Qemu Manager GUI: You can apply a similar method/approach. Not a "similar value", a value can be either of two things: Right Wrong (no space for "similar") Sure, that's the "proper" approach, NEVER write anything on the "problematic" device if you are not sure (and double sure) about what you are writing and what effects it may have. jaclaz Thanks Jaclaz, Don't kill me until one day, I become as professional as you are, ha ha .... Anyway, thanks so much for your help in the past week and your generous sharing of your knowledge ! I did learnt a lot ! ngpc
  4. Hi Jaclaz, Thanks Again for sharing ! May I know that which tools you are using for viewing the MBR structure/data of my defective usb, can I download it from some sites ? Is there any recommended site which documented the introduction of MBR or file system structure analysis? I am quite interested in data recovery after this learning experience . And finally, can I apply the similiar value of my case to some usb which show the same symptoms but with different memory sizes say 2G, 4G, 8G..? And I only experiment this on the extracted image file. hope to hear your advise... ngpc
  5. HI Jaclaz, Just a curious question ! I just suppose I can use the XP format function to reformat my usb, it seems there is still a lot of steps to reformat it... May I know that " What is the difference between using the XP format function to format the usb instead of using the procedure you have mentioned in the last email. I know your procedure may trying to config the usb in a new structure ... Sure, I will try your procedure and learn more about that, it is interesting. While I just want to learn more if there is any technical reasons... Besides, after the TestDisk recovery, I retrieve all the file data and also see some file named as below -rwxr-xr-x 0 0 594 22-Oct-2008 18:38 _UTORUN.INF -rwxr-xr-x 0 0 110654 5-Oct-2008 16:57 _JIEF.CMD Are they created repeatedly by virus , I saw a lot inside the file usb_full.img.... ? Like to hear more ! Thanks ! ngpc
  6. Hi, I finally retrieve all my data from the USB by following the process, you can try and see if this can help your situation... Jaclaz's trouble shooting is really professional... You can check it out yourself... ngpc
  7. Hey Jaclaz, I just take a risk to try the remaining recovery procedure as I am so eager to see the result... So you bet... I finally GOT it... Wow, EXCELLENT ! All the file are back, they are back...... A very BIG THANKS to YOU.... I really appreciate your patience and professional advise... I learnt a lot from this process and have much fun.... Interesting ! BTW, there is still a few questions here, can you help me to claify a bit: As I reopened the image file, I found my useful file as well as some Virus files or virus information. So my question is : 1/ Will the virus file still have effect on my C drive when I copy the data from this USB_full image file back to my C drive ? 2/ When I use the virus cleaning program to scan the G: virtual drive, it detect the Virus (See attached txt file) and going to kill them, so does it mean that the virus will become inactive (seems sleeping) when the USB_full image is not being recovered, but when it is being recovered now, the virus become active and will start to infect other drives who ever came across it ? 3/ Before I format my Defective USB , if I plug it into the computer , will the virus infect my computer ? 4/ Will the stand alone USB_full image file which has the virus file lock inside become active if I keep the image file ? Curious to know that... Thanks ! ngpc TDisk_retrieving_record_eith_Virus_info.txt Virus_Scan_Result_2009_5_23_after_USB_full_IMG_on_Virtual_Disk.txt
  8. Jaclaz, I just try upto this step and stop because I got the number return that is different from you , can you advise.? 1*FAT16 >32M 0 1 1 987 18 25 2021945 <--you should see this, if not something was made wrong before (Your code) 1*FAT16 >32M 0 1 1 1019 8 25 2021945 Is the no. important? ngpc
  9. Really Thanks! Looking forward to that ! ngpc
  10. HI Jaclaz, I have run FC command and compare the 2 files, USB_100.img and USB_100_new.img, the system return no difference... I have attached the USB_550.img zip file for analysis... Are you mean that as ImDisk Virtual Disk Driver cannot open the USB_full.img file and USB_100.img file, so it can be predicted that the values fo these files are corrupted, am I right ? Besides, if the TDisk can do something for my USB, can you teach me some instructions and then I can check it during the weekend... I have run a test of the USB_100.img and USB_full.img in the TDisk software, TD report some findings of the these files, the result is attached inside the txt file , the two files report the same result as shown in the txt file. Hope this can help to provide more info.... Thanks! ngpc TDisk__anaylse_result_of_USB_full_image_file__1.txt
  11. Hi Jaclaz, When tried to open the image file , the ImDisk reported that it cannot open the file, see attached screenshot.. Hope this provide more information to you! Thanks ! ngpc IMDISK_operation_Question_2.doc
  12. Hi Jaclaz, As I tried again, I can mount the G: dirve with the value 32 in the image file offset row as you mentioned in the first window. Then what should I do next in the second windows after I click OK in the first window . I find there is a file G: c:\dsfok\USB_full.img 987.3MB in the second window... Do I need to "Format" it or something else.. Besides, do you have an MSN account such that I can send my feedback to you and do the adjustment as soon as possible, what do you think about this.? I am open to this... Thanks! ngpc IMDISK_operation_Question_1.doc
  13. Hi Jaclaz, I am a bit stuck at here as I am not quite familiar with the technical operation of the IMDISK, can you explain more about it . I have captured the screenshot for your reference. After open the ImDisk, the Mount new virtual disk panel ask me to select a Image file, so I choose the USB_full.IMG which I saved in C:\dsfok. The ImDisk automatically assign some values below the file selection bar after my selection. So I come up one question, Do I need to click check for the box before "Copy image file to memory" the box before " Removable media" and "Read Only Media" Then I tried to ignore the check boxes , I click OK, the second screen come up as in the screenshot ImDisk Virtual Disk Driver Then what should I do next ? I am not quite understand when will I see something as you mentioned in your email, can you claify a bit: if IMDISK does not auto-detect the number of hidden sectors, supply 32 as the number of hidden sectors (skipped blocks) Hopefully you should be able to find your data in the image mounted as a volume. If everything is at it should be, we may try wiping the stick with 00's and re-apply to it the saved image. If anything appears not as it should on the mounted image, next step would be running TESTDISK on the image. Can you further advise , Thanks you! ngpc IMDISK_operation_Question.doc
  14. Hi Jaclaz , I just go to the web link you refer get beeblebrox: I see what you mentioned... Wait to see the next action! ngpc
  15. Dear Jaclaz, I finally got it .... After saving the no. return is 1035206656 bytes. I have attached the USB_100.IMG file . Thanks! ngpc