How does the computer choose which sectors to write to?

The file, .mrimg, does not have a fixed File header signature. It has same ending, with 0x5F5F37393234313030365F323635315F313144345F00;
It seemed that the files, .mrimg, always save the RAW boot sector of a volume starting from the file position, offset 13 byte. Nowadays, the most Windows system and boot partitions are NTFS. So, it seems the file, .mrimg, has the same data, 0xEB5290, on the offset 13 byte to 15 byte.

Download Winhex. (Winhex is free to view/find sectors.)
Run it with administrator right.
Open the menu, "Tool->Open Disk".
On the menu, "Search->Find Hex Values..."
Search the value "EB5290" with the option "Cond:offet mod 512=13"
Using this way, you can try to find the file header of the file, .mrimg

Then, search the nearest value "5F5F37393234313030365F323635315F313144345F00" to find the file ending of the .mrimg file.

Best regards,
Thomas
http://www.lazesoft.com

A quick side question: I just did a 'forensic clone' using Macrium Reflect which says it is sector by sector but it only took an hour or so - does this seem a little fast for a 1TB drive or is that about the norm? The 'Deep Scans' of the drive all took about 9 hours.

Is there another tool that would be better to clone the drive sector by sector?

Also, I had a great response from Thomas at Lazesoft who replied to me with:

--------------------------------
Hello Chew,

Thank you for contacting us.

I have posted on the forum. But, it might need time to be displayed.

The file, .mrimg, does not have a fixed File header signature. It has same ending, with 0x5F5F37393234313030365F323635315F313144345F00;
It seemed that the files, .mrimg, always save the RAW boot sector of a volume starting from the file position, offset 13 byte. Nowadays, the most Windows system and boot partitions are NTFS. So, it seems the file, .mrimg, has the same data, 0xEB5290, on the offset 13 byte to 15 byte.

Download Winhex. (Winhex is free to view/find sectors.)
Run it with administrator right.
Open the menu, "Tool->Open Disk".
On the menu, "Search->Find Hex Values..."
Search the value "EB5290" with the option "Cond:offet mod 512=13"
Using this way, you can try to find the file header of the file, .mrimg

Then, search the nearest value "5F5F37393234313030365F323635315F313144345F00" to find the file ending of the .mrimg file.

Thank you,

Best Regards,
Thomas
-----------------------------------------

Ok, am actually trying Lazesoft's sector by sector cloning instead. Seems to be taking the amount of time that I would have expected.

chewdrive wrote:Is there another tool that would be better to clone the drive sector by sector?

Ddrescue (Linux)

chewdrive wrote:The file, .mrimg, does not have a fixed File header signature. It has same ending, with 0x5F5F37393234313030365F323635315F313144345F00;

already have written above by "Fzabkar"

chewdrive wrote:I just did a 'forensic clone' using Macrium Reflect which says it is sector by sector but it only took an hour or so - does this seem a little fast for a 1TB drive or is that about the norm?

(1 TB) per (9 hours) = 30.9 MB per second
http://www.google.com/search?q=1+TB+per ... per+second

(1 TB) per (1 hour) = 278 MB per second
http://www.google.com/search?q=1+TB+per ... per+second

1 hour is too fast.

Just to add a little to Thomas's post ...

Code:: Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000000 5F 5F 37 39 32 34 31 30 30 36 5F 32 36 35 31 5F __79241006_2651_ 00000010 31 31 44 34 5F 00 11D4_.

Great, thanks guys.

The disk is still cloning. 8 hours so far and time left says 16 hours so just a waiting game right now.

So I just went and confessed to my client.

Turns out she had a 3rd backup. :shock:

Oh wow, the relief is just pouring off me. Man did I get off the hook this time!

Thank you so so much to all those that helped me - I really appreciate it so much, so nice to find helpful people in a forum like this!

chewdrive wrote:So I just went and confessed to my client.

Turns out she had a 3rd backup.

Buy a lottery ticket, today! That's the polar opposite to the worst things that can happen in data recovery.

A customer that know what they are doing on their own. Buy her a lottery ticket, too.

I would still try to recover the image file. I doubt that such cases would come up very often, so this would be a rare opportunity to learn.

BTW, kudos to you for your honesty. Call me a cynic, but I suspect that many shops would try to pass off the data loss as a drive failure rather than human error.

Haha, I should buy a lottery ticket!

This was a good lesson for me and luckily it had a happy ending - I will definitely be insisting that all future client's data are in 3 places at all times.

Thanks fzabkar, it was hard to face up but I know I wouldn't have gotten over it if I hadn't come clean. And luckily for me it all worked out in the end!

I took a clone of the drive so I can still play around with retrieving the image if I get a chance. For now I'm just going to go for a surf watch a movie and hopefully sleep tonight for once :lol:

Deleted

How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?

Re: How does the computer choose which sectors to write to?