Hey there, a couple of doubts that other user may like to share answers to. I am imaging a 750Gb WD disk, with one very weak head. I used the option to only image discoverable partitions, to save time. (This is a great feature and has worked perfectly in the past). But this was a little weird, it DID find a partition, spanning about 90Gb in one continuous block at the start of the data. I have normally seen them all over the disk.

I am about 3 days into the imaging session, and the client tells me the disk in reality had one one partition, spanning the entire 750Gb! There was also no recent format, or re-install.

So:
- under what conditions might Atola make a mistake in calculating used partitions?
- how can I open up the sectors to scan to take in to account the whole disk, without re-staring and loosing the last 3 days of imaging?

Thanks in advance.

What is the MBR information in sector 0?

_________________
Luke
RAID Data Recovery

much appreciated Luke:

Viewing Master Boot Record at: 0

Disk signature: 01 00 00 00

Partition 0:
Boot Indicator: 128
System ID: 6
Starting Sector: 63
Sectors: 183140937

Partition 1:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0

Partition 2:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0

Partition 3:
Boot Indicator: 0
System ID: 0
Starting Sector: 0
Sectors: 0

AISI, Atola did not make a mistake. The partitioning information is correct, if you assume a sector size of 4096 bytes.

(183 140 937 + 63) x 4096 = 750 145 536 000

To confirm whether this is the case, look for a FAT boot sector at sector 504 (= 63 x .

_________________
A backup a day keeps DR away.

Looks like a very smug theif stole part of your formula Franc!

Not sure what you mean by that, but if you are referring to the spaces in the numbers, then that's how Google's calculator returns its results.

BTW, I suspect that the OP's drive may have been inside an enclosure that was configured with 4KB LBAs.

_________________
A backup a day keeps DR away.

Hi Franc, after the 63 x there is a "cool" smiley.. you may not have emoticons turned on and not see what I do..
I think it interpreted your bracket as a mouth..
cheers

"8)" without the quotation marks=

_________________
PC Image Data Recovery
www.pcimage.co.uk

spot on, though I fear my attempt at humour went down like lead balloon !!

I think Frank is correct about the 4K USB bridge. Can you provide the contents of sector 504 to confirm that it is an NTFS boot sector?

It would appear that Atola isn't able to handle this, yet. You will need to get a full clone of the drive and then connect the clone to the bridge or use R-Studio to interpret the 4k sectors. DDI with DRE or R-Studio over the network can target the data to be cloned.

I ran into a case recently where DDI was having an issue with an odd sector size, Yarek connected remotely to confirm that it wasn't just me and he supplied me with a fix the next day. Perhaps you can get a quick fix from Atola, as well.

Good luck.

_________________
Luke
RAID Data Recovery

Had a similar issue with a 4Tb drive on Atola, so 4k sectors may well confuse it

_________________
PC Image Data Recovery
www.pcimage.co.uk

We are looking into the 4K issue right now.

Regarding your second question:



Assuming you are running v3.x software, you could simply create a new imaging session with all parameters set to defaults. It will copy only those sectors that weren't copied with any previous session(s).

If you are running an older release (v2.x), then you could stop the imaging process, and then change the parameters of the existing session to image all sectors (then hit Resume). Once again, Insight will never re-image what has already been imaged, unless you explicitly delete all imaging history.

_________________
Dmitry

This was standard laptop drive, no external enclosure, windows 7 pro. Looking at build date I would say the machine was on its original install. Doubt 4K sectors are factor.

Sector 504 is empty.

Any more ideas?

I agree that I should simply run the whole disk, but this has me wondering. Poking around past the last sector with data as informed by atola, I don't see much worth imaging........ BTW disk as a WD7500BPVT

THanks again.

Windows 7 defaults to sector 2048 as the boot sector of the first partition. Sector 63 is the default for Windows XP and earlier. Moreover, Windows 7 would have created an NTFS partition (type 07), whereas Atola is reporting "System ID: 6". I'm assuming "system ID" is Atola-speak for "partition ID", in which case type 06 would be a FAT partition.

What is in sectors 63, 552, 2048?

_________________
A backup a day keeps DR away.

According to WD's specs, the WD7500BPVT has 1,465,149,168 user sectors per drive. Assuming this drive were installed in a 4KB sectored enclosure, it would then report 183,143,646 LBAs.

If we convert this to CHS values, then ...

183,143,646 LBAs / 63 sectors-per-track / 255 heads-per-cylinder = 11400.16 cylinders

If we now compare this against the partition data, then ...

(183 140 937 + 63) / 63 / 255 = 11400

Therefore ISTM that the partition size is not arbitrary.

_________________
A backup a day keeps DR away.

Viewing NTFS boot sector at: 63

OEM: 7082687983524649
Bytes per sector: 512
Sectors per cluster: 8
Reserved sectors: 32
Number of FATs: 2
Root entries: 0
Sector count (small): 0
Media Type: 248
Sectors per FAT: 0
Sectors per track: 63
Number of heads: 255
Hidden sectors: 63
Sector count (large): 61448562

Unused: 59950

NTFS number of sectors: 8589934592
MFT starting cluster: 393217
MFT mirror starting cluster: 0
Clusters per file record: 128
Clusters per index block: 20
Serial number: 2314926406578872399
Checksum: 1095114784


552 = 0

Viewing NTFS boot sector at: 2048

OEM: 7884708332323232
Bytes per sector: 512
Sectors per cluster: 8
Reserved sectors: 0
Number of FATs: 0
Root entries: 0
Sector count (small): 0
Media Type: 248
Sectors per FAT: 0
Sectors per track: 63
Number of heads: 255
Hidden sectors: 2048
Sector count (large): 0

Unused: 8388736

NTFS number of sectors: 204799
MFT starting cluster: 8533
MFT mirror starting cluster: 2
Clusters per file record: 246
Clusters per index block: 1
Serial number: 2044114060326648450
Checksum: 0

If you could show us the MBR code and boot sector code, then that will tell us which OS was responsible for each sector.

As for the "NTFS boot sector at: 63", that appears to be a FAT boot sector. The sector count of 61448562 corresponds to about 31GB at 512 bytes per sector. That's about what you would expect if you tried to create a FAT32 partition in Windows XP and later.

Sector 2048 does appear to be a standard NTFS boot sector, but its size amounts to about 104MB (= 204799 x 512). That's the size of the reserved partition in a Windows 7 system. There must be a second NTFS boot sector at about the 104MB mark. You should also be able to locate its backup by reverse searching the drive.

In short, it does appear that the drive's owner is not telling you the truth.

_________________
A backup a day keeps DR away.

Dmitry, in 2.2.x the only way I can change the imaging range is by starting a new imaging session. I would guess this ignores the copied block list from the previous session?

"passes"
"settings" (not range)
"heads"
"email notification"

are the only available tabs in "settings".

regards

@mediaman, have you tried http://findandmount.com ?

It sounds like a dating technique, but it's actually a free tool that locates and works with partitions in readonly mode, much as one would in Windows Explorer.

_________________
A backup a day keeps DR away.

mediaman, I don't have that version on hand, but I can help you via Teamviewer. PM me your Teamviewer details and I will have a look.

_________________
Dmitry