Jump to content

onlit4regs

Member
  • Posts

    35
  • Joined

  • Last visited

  • Donations

    0.00 USD 
  • Country

    France

About onlit4regs

Profile Information

  • OS
    XP Pro x86

onlit4regs's Achievements

0

Reputation

  1. sorry, after making the command you asked me, I've seen that extent2 and 3 were at "0" size ! unfortunatly, I've merged all the extents and I have as a result, a beautiful file, full of "0xFF" values only !! I've also opened all the extracted extents, it's the same, 0xFF everywhere .... so, I guess I can leave this file alone , and I will try on another one thanks again
  2. hi Jaclaz, so, I'm extracted all the extents from the faulty hard drive (with errors of course). I'm trying to inject them in a new file using: fsz c:\newfile.pds 548864 then: dsfi c:\newfile.pds 0 0 extent1.dd then: dsi c:\newfile.pds 8192 0 extent2.dd and I receive the error: c:\newfile.pds: no data available any idea what's wrong ? thanks again !
  3. hi jaclaz well, I've done the test again, and I've finally succeeded in getting my test file on G: restored. (the offset on my drive G: was 2048 !) I've also succesfully restored an "already working" file on the image file, I have now the right sectors ! so, I've decided to try on a faulty file now. unfortunatly, when trying to extract the 1st extent of 16 sectors only, drdd said: read error at ....: incorrect function read error at ....: semaphore delay has expired .... and several times !! do you think this extent is usuable ? certainly not is this really lost ? is this because of the unbrick ? a problem with the unbrick ? thanks
  4. yes I'm sure I've used the right physical drive number, as stated in windows disk manager this G: drive has only a primary partition. I'm not sure that it was really created under windows xp, I can't remember how to check the offset and cluster size on this partition ? anyway, that was just a hint for understanding why the drdd didn't work on the mounted image of my faulty drive ? but it seems it's not associated ....? thanks a lot
  5. I've closed drdd before viewing the image. I've tried with selection also the physical drive in drdd same result with pldd, I've done a few test, it's the same with my image file on G:\ BUT when I try the same image on my C: drive, it works !!! so, this may be also the same problem with the image mounted drive letter ? any hint on why it works on C: and not further ? my G: partition is a good one, it's a single partionned disk in NTFS. thanks
  6. on a working drive and a working file: myfragi.cmd g:\test.jpg 1 52254759 418038135 3104 g:\test.jpg in drdd, I've extracted the sectors, but file is not a valid image. (I didn't use fsz nor dsfi this time) I've enclosed the drdd capture, just to be sure I am not wrong with values on DMDE, when opening the image my500gb.img, and selecting the previous image test file, I have the same LBA: 6158983, vol.sec:6158920, clus:769865 when opening with DMDE the mounted logical drive of IMD, the LBA is 6158920, vol.sec:6158920, clus:769865 (on the Open NTFS Volume message box, start offset is set to 0)
  7. something is going wrong on what I've done I tried on a file that was readable on my image: myfragi returns this: 1 769865 6158983 624 f:\photos\PHOTOS~1\35ANSM~1.JPG in drdd, you wrote to x512 for the LBA start but values are in sector, so I have left the values from myfragi: start: 6158983 (sectors) - I can not write 6158983*512 = 3153399296, it doesn't fit in the software (only nine digit not ten) size: 624 (sectors) then : fsz c:\test.jpg 319488 and finally: dsfi c:\test.jpg 0 0 c:\image[3153399296-3153718784].dd and the image is unreadable (it was OK in windows explorer on my500gb.img) I've misunderstand something in the values for drdd thanks a lot
  8. This will create an empty file of that size in bytes. Then you use: dsfi C:\mytemp.dat <offset> 0 <filechunk.dd> which means copy to C:\mytemp.dat, starting from offset <offset> for all it's length (0) the <filechunk.dd> where offset is the offset in BYTEs of the filechunk and the <fileschunk> is the name of the file extracted with datarescuedd, the first chunk with your data should be image[2030112256-2030120448].dd (where obviously 2030112256 is made by the LBA offset*512=3965063*512=2030112256 and 2030120448 is the offset+the length, i.e. 3965063*512+16*512=2030120448) The use of a spreadsheet is advised as it will produce the exact command lines faster and without the risk of typing errors. jaclaz ok, just to be sure I understand the offset in the dsfi command, for the second chunk, I'll have to use: dsfi c:\mytemp.dat 8192 0 filechunk2.dd (16*512 = 8192) is that right ? thank a lot
  9. here we go with your magic batch ! Ext: Lcn: LBAstart: Sects: File: 1 495625 3965063 16 f:\montage\2011-tmp.pds 2 28135076 225080671 16 f:\montage\2011-tmp.pds 3 48751063 390008567 32 f:\montage\2011-tmp.pds 4 48797290 390378383 64 f:\montage\2011-tmp.pds 5 50038742 400309999 128 f:\montage\2011-tmp.pds 6 26068714 208549775 128 f:\montage\2011-tmp.pds 7 94098378 752787087 136 f:\montage\2011-tmp.pds 8 74619826 596958671 120 f:\montage\2011-tmp.pds 9 95440487 763523959 152 f:\montage\2011-tmp.pds 10 106615323 852922647 104 f:\montage\2011-tmp.pds 11 95441871 763535031 152 f:\montage\2011-tmp.pds 12 48579698 388637647 24 f:\montage\2011-tmp.pds
  10. so, the command I used was: getfileextents F:\myfile.txt and always get the same error: initFileTranslation: invalid descriptor on a "good" partition, it worked ! no problem. It's only with the mounted image that cause problems. with myfragmenter, I have more results: MyFragmenter.exe -i f:\montage\2011-tmp.pds MyFragmenter v1.2, 2008 J.C. Kessels Commandline argument '-i' accepted. Processing: f:\montage\2011-tmp.pds Fragment list: Extent 1: Lcn=495625, Vcn=0, NextVcn=2 Extent 2: Lcn=28135076, Vcn=2, NextVcn=4 Extent 3: Lcn=48751063, Vcn=4, NextVcn=8 Extent 4: Lcn=48797290, Vcn=8, NextVcn=16 Extent 5: Lcn=50038742, Vcn=16, NextVcn=32 Extent 6: Lcn=26068714, Vcn=32, NextVcn=48 Extent 7: Lcn=94098378, Vcn=48, NextVcn=65 Extent 8: Lcn=74619826, Vcn=65, NextVcn=80 Extent 9: Lcn=95440487, Vcn=80, NextVcn=99 Extent 10: Lcn=106615323, Vcn=99, NextVcn=112 Extent 11: Lcn=95441871, Vcn=112, NextVcn=131 Extent 12: Lcn=48579698, Vcn=131, NextVcn=134 134 clusters, 12 fragments. Finished, 1 files processed. what do you suggest for next step ? thanks a lot
  11. GetFileExtents always returns me this error: initFileTranslation: invalid descriptor (even when I try on the file that was recoverable)
  12. ok, first checkdisk without parameters returns a lot of messages like this one (sorry it's translated from french): errors corrected in index $I30 of file 42062 .... index verification terminated errors found. chkdsk can not continue in read only mode Then, with /F, a lot of messages like this: errors corrected in index $I30 of file 41863 Sort of index $I30 of file 41863 Restore of orphaned file xxxx.xxx (1198) in file of directory 49 Insert of index entry with ID 311 in index $SDH of file 9 Fix of record segment of security file ... Errors corrected in miror of MFT Errors corrected in "capslock" file errors corrected in bitmap attribute of MFT errors corrected in volume map and finally with /F /R: everything was ok Then, I can see the directory and files under windows !! but of course, still unable to read the dozen of files I'm interested in. should I give a try with the extents now ? (from your procedure in a previous post) thanks a lot
  13. I've done testdisk, Advanced Menu, Boot, and then Org.BS it wrotes backup sector with the original sector then I've made "Repair MFT", it wrotes the Mirror MFT with original MFT I have the same problem mounting with IMDriver, no success under windows explorer should I run a chkdsk now ? thanks
  14. and see the $MFT contents with it? yes, there is no more prompted message on the lower right pane, I can see "FILE:$MFT" with all information about $FILE_NAME, $DATA,$BITMAP, .... under testdisk, I've just searched for partition, display files (only display one empty directory) and that's all I've attached the log did you want other actions in testdisk ? I don't understand which action you mean on checklist #2 thanks testdisk.log.txt
×
×
  • Create New...