Dmitry Postrigan wrote:mediaman, I don't have that version on hand, but I can help you via Teamviewer. PM me your Teamviewer details and I will have a look.
Dmitry, thanks, I think I have found a solution: use a NEW imaging session with custom range starting one block up from previous session.
fzabkar wrote:If you could show us the MBR code and boot sector code, then that will tell us which OS was responsible for each sector.
As for the "NTFS boot sector at: 63", that appears to be a FAT boot sector. The sector count of 61448562 corresponds to about 31GB at 512 bytes per sector. That's about what you would expect if you tried to create a FAT32 partition in Windows XP and later.
Sector 2048 does appear to be a standard NTFS boot sector, but its size amounts to about 104MB (= 204799 x 512). That's the size of the reserved partition in a Windows 7 system. There must be a second NTFS boot sector at about the 104MB mark. You should also be able to locate its backup by reverse searching the drive.
In short, it does appear that the drive's owner is not telling you the truth.
Viewing Master Boot Record at: 63Disk signature: 80 C6 10 8E
Partition 0:
Boot Indicator: 94
System ID: 111
Starting Sector: 1176528750
Sectors: 1147495794
Partition 1:
Boot Indicator: 79
System ID: 0
Starting Sector: 0
Sectors: 0
Partition 2:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0
Partition 3:
Boot Indicator: 78
System ID: 69
Starting Sector: 1394614348
Sectors: 21337
Viewing Master Boot Record at: 2048Disk signature: 73 73 69 6E
Partition 0:
Boot Indicator: 13
System ID: 79
Starting Sector: 1936269394
Sectors: 1836016416
Partition 1:
Boot Indicator: 112
System ID: 115
Starting Sector: 1917848077
Sectors: 544437093
Partition 2:
Boot Indicator: 67
System ID: 43
Starting Sector: 1818575915
Sectors: 544175136
Partition 3:
Boot Indicator: 114
System ID: 97
Starting Sector: -1450442742
Sectors: 54974
The curios thing is that the File recovery feature of Atola appears to use a different logic to the "
image all partitions with data" as it produces the result shown attached. Showing an initial 104mb partition, as Part 0 and the correct 733Gb rest as Part 1.
- Attachments
-
- FileRec.jpg (21.2 KiB) Viewed 19604 times