Partition issues - please help

[medix08]

Partition issues - sectors.

Hi all,

I'll do my best to be as concise as possible:

I have a 250GB HDD, with an OS installed on it (XP Embedded). Here's how the situation looks like:

First partition is used by some Korean disk cloning software (or an image of the system) - Clonix. Second one is assigned to Win XPE OS, the other two are irrelevant. I wanted to make a live CD out of them, using Clonezilla Live. It made perfectly good copies of all but one partition - the Clonix one - in short, it was unable to make an image of it due to sectors error - the number of sectors declared for this partition exceeds the actual number of occupied sectors. The Clonix partition (formatted in NTFS) is invisible under any OS, no letter assigned - presumably due to this sector number inconsistency, same goes for the file structure - unreadable. I am unable to repartition the disk using Gparted for example, due to the stated sector error - the software simply refuses to repartition and crop it to the actual size - but the partition itself is perfectly visible. The HDD is brand new (the system in question was restored using the Clonix LiveCD), the WinXPE works perfectly too.

My impression is that someone wanted to protect the HDD from cloning using this simple method. The company that manufactured this system is long dead, not much info lying around.

I guess that if I could somehow adjust the number of sectors (i.e. correct it) without destroying the data on the first partition I would be then able to make a live Clonezilla CD out of it.

Any ideas how to get the sector number back to its correct value? Thanks in advance for your suggestions.

Attachments

situation.png (8.66 KiB) Viewed 9797 times

[Vulcan]

Assuming you have the ability to re-image the HDD when required, so that it doesn't matter if you trash the existing data (I'm not 100% clear on that point), and assuming that the active partition is the XPe partition, then you could just view and manually edit (what is guess is) the normal MBR, using a hex editor with the drive attached (but obviously as a non-boot drive) to another system. Or did you already try that?

[fzabkar]

As Vulcan has essentially said, let's see sector 0.

Two freeware disc editors are HxD and DMDE.

[HaQue]

I wonder if VM Ware physical 2 virtual converter would convert it to a VM and then you could image that?

the system in question was restored using the Clonix LiveCD

do you have the ability to do that again and specify a different target?

what kind of sizes are we talking about?

have you tried dd in linux?

[medix08]

Update:

Here's what I managed to find out, my previous findings seem to be wrong:

seems that the HDD contains a hidden partition - which is used by the OS to start (I presume) - that's why doing a LiveCD of it won't work - it doesn't clone the hidden one. Here go the screens containing all information I could find:

Gparted

GParted info.

DiskGenius, HDD without any alterations.

HDD 'as is' - no changes yet.

Scanned for partitions, found hidden restore (?) partition.

HDD scanned for partitions, WINCLON found - I suppose it's meant to serve as a restore of sorts - or a copy-protection.

partition content

contents

the autoexec.bat inside it contains:

@echo off
path=C:\

rem CTM-ES

SHSUCDX /D:CD0001
C:\DosClon.exe

Now... is there any reasonable way to make Clonezilla LiveCD out of the whole HDD using some tricks? When I unhid the partition, mounted it, saved the GPT the WIN XPe failed to run - presumably due to changing paths etc.

Thanks in advance for your suggestions.

Attachments

clonix_files.zip

partition files

(1.02 MiB) Downloaded 399 times

[HaQue]

Hi, I think I know what you are trying to do. You want to run the WinXP partition right? Ok, so you were able to clone the XP partition with clonezilla? I would try it this way. Get a hard drive, clone the xp partition from the original disk, then image the hard disk with your partition image. Now you need to make it bootable, so you can do something like use Microsoft diskpart.exe, and do something like:
select disk 0
select partition 1
active
exit

and/or boot with a winXP rescue disk, and from the recovery console type FIXBOOT and/or FIXMBR.

If I was fixing it, I would be able to go "by feel" for the problem, but it is a bit more difficult to do it without the hardware.. for me it is anyway

after that you will see if winXP will boot or not as a result of any copy protection that may be there.

I would bet the hidden partition is a feature to restore such as hit F7 at boot time to restore.

BTW, you do know that the menu system is in config.sys don't you?
cheers

[HaQue]

also, check out http://www.cgsecurity.org/wiki/TestDisk

[fzabkar]

My take on the situation is that there were originally 4 MBR partitions. The first was a 7GB NTFS partition and the second was a 3GB FAT FreeDOS partition.

At some later time the second partition was deleted and the first partition extended in order to merge the two, thus creating a single 10GB partition. This process affected the partition table in sector 0. However, the NTFS volume was not reformatted, so it remained at its original size.

So now we have the original 7GB NTFS volume inside the merged 10GB partition. The original FreeDOS volume remains intact because the NTFS volume has not encroached upon it.

The file system error reported by GParted identifies two clusters, 1762174 and 1762175, which occur at or near the end of the volume.

1762174 clusters x 4096 bytes per cluster = 7217864704 bytes

Size of NTFS volume = 7217865216 bytes

ISTM that there may be some kind of anomaly at the very end of the NTFS volume, just prior to the FreeDOS volume. I would use a disc editor to search for and examine the aforementioned clusters, and I would also locate the FreeDOS boot sector.

As for the cloning problem, I suspect that you are trying to create a "logical" clone rather than a "raw" image. The latter is a sector-by-sector image which pays no attention to the data within each sector, whereas the former copies the actual files and therefore requires that the file system be intact. It appears that Clonezilla and GParted have analysed the file systems and uncovered some kind of integrity issue which understandably prevents them from proceeding.

[HaQue]

It would be interesting to know what system or at least what type of system this is out of. If it is an embedded OS, and it runs, for example, a milling machine or some kind of robot, then I have seen some weird-ass implementations. The so called SCADA stuff is either bodged together by a hardware guy until it works - no patches or changes ever happen... or it is a standard system with ridiculously hard to crack software like Mastercam(not impossible though after 6 weeks of work you can emulate the dongle...so Bob tells me).

If the first partition is a cloning/recovery tool, and the second is the OS, where is the source used for recovery? on one of the data partitions, or some media.

I would be careful playing around with the original, if there is no backup pla.

[medix08]

Hi again, I've managed to fix the situation partially, while tinkering with the filesystem. Knowing that the system is a Win XP embedded and presuming the MBRs are more or less the same for both 'casual' and embedded XPs (that boot from C:, that is), I've copied the first 446 Bytes from my own 'good 'ole computer' using DMDE (thanks for the tip!) and left the original GPT intact. I've also run chkdsk /f on the HDD that was the subject of my experiment (brand-new 250GB WD Black) - all went smooth (the XP Embedded system on that HDD has been restored earlier, using a Live CD - provided by aforementioned Clonix). Clonezilla (set to 'skip NTFS checks, force bad sectors copy' etc.) was finally able to make images (working in image->disk mode) of partitions and I was able to make LiveCD .iso out of them. This, however, did not mean the end of difficulties. The situation now is that I'm perfectly capable of restoring the OS on all 250GB WD black HDDs, but when trying to restore it on older ones, e.g. Seagate 32508 - Clonezilla informs me that it is unable to restore partitions, due to the lack of available disk space (funnily enough, it informs me that the unpacked disk image requires 251GB of free disk space, and only 250GB are available) and quits. I've tried to 'crop' the 250WD Black by re-partitioning, leaving 2GB of space unassigned and re-building the .iso again, but the result is the same all the time when working with said disk. Am I missing something or is this an expected behavior?

[Vulcan]

is this an expected behavior?

Yes. Not all "250GB" drives from different manufacturers are exactly the same size (though different models from any one manufacturer usually are the same). Therefore an image from one (slightly larger) 250GB drive brand "X" may not fit on another (slightly smaller) 250GB drive from brand "Y".

If you are using Clonezilla to image the whole drive, then repartitioning won't help. Either change your plan for using Clonezilla, or use HPA or DCO (e.g. with HDAT2 or MHDD) to limit the usable drive size, to that of the smallest drive which you want the image to fit, before creating your master image on that drive.

[medix08]

Hi all, thanks for all your help (and sorry for late reply - been on a business trip) - issue solved! All that had to be done was to install the whole image on a smaller capacity HDD, repair the GPT using chkdsk /f, and create a self-unpacking Clonezilla image afterwards. Works like a charm. The only downside is that it on larger HDDs restore leaves some space unallocated - but in the light of answer above it makes sense.

Thank you for all your help and suggestions once more, I wouldn't be able to figure it out without your help.

HaQue - I'm unable to answer your PM directly - I'm too new to this forum - this piece of software is from DVR which was manufactured by Kodicom - Korean DVR manufacturer, which went bankrupt a few years ago. Interesting stuff to play with, especially in terms of customization. But to customize it on a larger scale I needed to create self-installing system images containing all the tweaks I was able to make. That's the short story.

[HaQue]

Thanks for the details, glad you got it sorted out too.
cheers