HDD GURU FORUMS
http://forum.hddguru.com/

imaging doubt "all partions with data"
http://forum.hddguru.com/viewtopic.php?f=19&t=28157
Page 1 of 2

Author:  mediaman [ March 13th, 2014, 14:19 ]
Post subject:  imaging doubt "all partions with data"

Hey there, a couple of doubts that other user may like to share answers to. I am imaging a 750Gb WD disk, with one very weak head. I used the option to only image discoverable partitions, to save time. (This is a great feature and has worked perfectly in the past). But this was a little weird, it DID find a partition, spanning about 90Gb in one continuous block at the start of the data. I have normally seen them all over the disk.

I am about 3 days into the imaging session, and the client tells me the disk in reality had one one partition, spanning the entire 750Gb! There was also no recent format, or re-install.

So:
- under what conditions might Atola make a mistake in calculating used partitions?
- how can I open up the sectors to scan to take in to account the whole disk, without re-staring and loosing the last 3 days of imaging?

Thanks in advance.

Author:  lcoughey [ March 13th, 2014, 14:58 ]
Post subject:  Re: imaging doubt "all partions with data"

What is the MBR information in sector 0?

Author:  mediaman [ March 13th, 2014, 19:38 ]
Post subject:  Re: imaging doubt "all partions with data"

much appreciated Luke:

Viewing Master Boot Record at: 0

Disk signature: 01 00 00 00

Partition 0:
Boot Indicator: 128
System ID: 6
Starting Sector: 63
Sectors: 183140937

Partition 1:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0

Partition 2:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0

Partition 3:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0

Author:  fzabkar [ March 13th, 2014, 20:58 ]
Post subject:  Re: imaging doubt "all partions with data"

AISI, Atola did not make a mistake. The partitioning information is correct, if you assume a sector size of 4096 bytes.

(183 140 937 + 63) x 4096 = 750 145 536 000

To confirm whether this is the case, look for a FAT boot sector at sector 504 (= 63 x 8).

Author:  HaQue [ March 14th, 2014, 1:59 ]
Post subject:  Re: imaging doubt "all partions with data"

Looks like a very smug theif stole part of your formula Franc!

Author:  fzabkar [ March 14th, 2014, 2:56 ]
Post subject:  Re: imaging doubt "all partions with data"

HaQue wrote:
Looks like a very smug theif stole part of your formula Franc!

Not sure what you mean by that, but if you are referring to the spaces in the numbers, then that's how Google's calculator returns its results.

BTW, I suspect that the OP's drive may have been inside an enclosure that was configured with 4KB LBAs.

Author:  HaQue [ March 14th, 2014, 3:43 ]
Post subject:  Re: imaging doubt "all partions with data"

Hi Franc, after the 63 x there is a "cool" smiley.. you may not have emoticons turned on and not see what I do..
I think it interpreted your bracket as a mouth..
cheers

Author:  pcimage [ March 14th, 2014, 5:45 ]
Post subject:  Re: imaging doubt "all partions with data"

"8)" without the quotation marks= 8)

Author:  HaQue [ March 14th, 2014, 8:36 ]
Post subject:  Re: imaging doubt "all partions with data"

spot on, though I fear my attempt at humour went down like lead balloon !!

Author:  lcoughey [ March 14th, 2014, 9:39 ]
Post subject:  Re: imaging doubt "all partions with data"

I think Frank is correct about the 4K USB bridge. Can you provide the contents of sector 504 to confirm that it is an NTFS boot sector?

It would appear that Atola isn't able to handle this, yet. You will need to get a full clone of the drive and then connect the clone to the bridge or use R-Studio to interpret the 4k sectors. DDI with DRE or R-Studio over the network can target the data to be cloned.

I ran into a case recently where DDI was having an issue with an odd sector size, Yarek connected remotely to confirm that it wasn't just me and he supplied me with a fix the next day. Perhaps you can get a quick fix from Atola, as well.

Good luck.

Author:  pcimage [ March 14th, 2014, 11:11 ]
Post subject:  Re: imaging doubt "all partions with data"

Had a similar issue with a 4Tb drive on Atola, so 4k sectors may well confuse it :-)

Author:  Dmitry Postrigan [ March 14th, 2014, 12:57 ]
Post subject:  Re: imaging doubt "all partions with data"

We are looking into the 4K issue right now.

Regarding your second question:

Quote:
- how can I open up the sectors to scan to take in to account the whole disk, without re-staring and loosing the last 3 days of imaging?


Assuming you are running v3.x software, you could simply create a new imaging session with all parameters set to defaults. It will copy only those sectors that weren't copied with any previous session(s).

If you are running an older release (v2.x), then you could stop the imaging process, and then change the parameters of the existing session to image all sectors (then hit Resume). Once again, Insight will never re-image what has already been imaged, unless you explicitly delete all imaging history.

Author:  mediaman [ March 14th, 2014, 13:17 ]
Post subject:  Re: imaging doubt "all partions with data"

This was standard laptop drive, no external enclosure, windows 7 pro. Looking at build date I would say the machine was on its original install. Doubt 4K sectors are factor.

Sector 504 is empty.

Any more ideas?

I agree that I should simply run the whole disk, but this has me wondering. Poking around past the last sector with data as informed by atola, I don't see much worth imaging........ BTW disk as a WD7500BPVT

THanks again.

Author:  fzabkar [ March 14th, 2014, 16:32 ]
Post subject:  Re: imaging doubt "all partions with data"

Windows 7 defaults to sector 2048 as the boot sector of the first partition. Sector 63 is the default for Windows XP and earlier. Moreover, Windows 7 would have created an NTFS partition (type 07), whereas Atola is reporting "System ID: 6". I'm assuming "system ID" is Atola-speak for "partition ID", in which case type 06 would be a FAT partition.

What is in sectors 63, 552, 2048?

Author:  fzabkar [ March 14th, 2014, 18:53 ]
Post subject:  Re: imaging doubt "all partions with data"

mediaman wrote:
Doubt 4K sectors are factor.

According to WD's specs, the WD7500BPVT has 1,465,149,168 user sectors per drive. Assuming this drive were installed in a 4KB sectored enclosure, it would then report 183,143,646 LBAs.

If we convert this to CHS values, then ...

183,143,646 LBAs / 63 sectors-per-track / 255 heads-per-cylinder = 11400.16 cylinders

If we now compare this against the partition data, then ...

(183 140 937 + 63) / 63 / 255 = 11400

Therefore ISTM that the partition size is not arbitrary.

Author:  mediaman [ March 14th, 2014, 19:24 ]
Post subject:  Re: imaging doubt "all partions with data"

Viewing NTFS boot sector at: 63

OEM: 7082687983524649
Bytes per sector: 512
Sectors per cluster: 8
Reserved sectors: 32
Number of FATs: 2
Root entries: 0
Sector count (small): 0
Media Type: 248
Sectors per FAT: 0
Sectors per track: 63
Number of heads: 255
Hidden sectors: 63
Sector count (large): 61448562

Unused: 59950

NTFS number of sectors: 8589934592
MFT starting cluster: 393217
MFT mirror starting cluster: 0
Clusters per file record: 128
Clusters per index block: 20
Serial number: 2314926406578872399
Checksum: 1095114784


552 = 0

Viewing NTFS boot sector at: 2048

OEM: 7884708332323232
Bytes per sector: 512
Sectors per cluster: 8
Reserved sectors: 0
Number of FATs: 0
Root entries: 0
Sector count (small): 0
Media Type: 248
Sectors per FAT: 0
Sectors per track: 63
Number of heads: 255
Hidden sectors: 2048
Sector count (large): 0

Unused: 8388736

NTFS number of sectors: 204799
MFT starting cluster: 8533
MFT mirror starting cluster: 2
Clusters per file record: 246
Clusters per index block: 1
Serial number: 2044114060326648450
Checksum: 0

Author:  fzabkar [ March 14th, 2014, 19:57 ]
Post subject:  Re: imaging doubt "all partions with data"

If you could show us the MBR code and boot sector code, then that will tell us which OS was responsible for each sector.

As for the "NTFS boot sector at: 63", that appears to be a FAT boot sector. The sector count of 61448562 corresponds to about 31GB at 512 bytes per sector. That's about what you would expect if you tried to create a FAT32 partition in Windows XP and later.

Sector 2048 does appear to be a standard NTFS boot sector, but its size amounts to about 104MB (= 204799 x 512). That's the size of the reserved partition in a Windows 7 system. There must be a second NTFS boot sector at about the 104MB mark. You should also be able to locate its backup by reverse searching the drive.

In short, it does appear that the drive's owner is not telling you the truth.

Author:  mediaman [ March 14th, 2014, 20:42 ]
Post subject:  Re: imaging doubt "all partions with data"

Dmitry Postrigan wrote:

If you are running an older release (v2.x), then you could stop the imaging process, and then change the parameters of the existing session to image all sectors (then hit Resume). Once again, Insight will never re-image what has already been imaged, unless you explicitly delete all imaging history.


Dmitry, in 2.2.x the only way I can change the imaging range is by starting a new imaging session. I would guess this ignores the copied block list from the previous session?

"passes"
"settings" (not range)
"heads"
"email notification"

are the only available tabs in "settings".

regards

Author:  fzabkar [ March 15th, 2014, 1:47 ]
Post subject:  Re: imaging doubt "all partions with data"

@mediaman, have you tried http://findandmount.com ?

It sounds like a dating technique, but it's actually a free tool that locates and works with partitions in readonly mode, much as one would in Windows Explorer.

Author:  Dmitry Postrigan [ March 15th, 2014, 12:32 ]
Post subject:  Re: imaging doubt "all partions with data"

mediaman, I don't have that version on hand, but I can help you via Teamviewer. PM me your Teamviewer details and I will have a look.

Page 1 of 2 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/