I was so busy the last days that I completly forgot my hard drive issue !
so, here is what I've done for this grown image:
- datarescuedd the faulty drive in a single image of all sectors (with a lot of reading errors)
- mksparse <path>\my500GB.img 500105281536
- dsfi <path>\my500GB.img 0 0 <path>\thewhatever136GB.img
And if you access this "my500GB.img" with dmde you can actually see the $MFT, but if you try opening/mounting it with IMDISK you have issues (like being prompted to format it and/or in the IMDISK control panel NOT seeing NTFS as "filesystem")?
Do I get this right?
If yes, you can try the following, using TESTDISK on the "my500GB.img" as follows:
be sure to choose to Create a log, follow the above and post the log and a description of what it says on screen (since the disk was originally partitioned on XP, do reply "No" to the question about it having been partitioned under Vista as it should speed up things).
It is also possible that (for any reason) the IMDISK (which works at a "somewhat higher level" than other virtual drivers) have different kinds of issues with the image, it is possible that *somehow* it fails to detect the offset to the partition (BTW are you prompted to choose an offset when mounting the image?), another thing you may want to try is (on XP, NOT
on 7) the VDK driver:https://sites.google...tchatvmback/vdk
optionally using my pseudo-GUI for it:http://jaclaz.alterv...ts/VDM/vdm.html
BUT better if creating a .pln file for it, by hand
or using the little batch here:http://www.forensicf...r=asc/start=42/
Can you confirm that the first sector of the "my500GB.img" is identical to the MBR sector you initially posted?
(Would it be possible that you got the MBR and PBR "right" with hdhacker form the "original disk" and that somehow when you made the image either of them is not there/is corrupted?)
Edited by jaclaz, 07 October 2012 - 12:10 PM.