The file, .mrimg, does not have a fixed File header signature. It has same ending, with 0x5F5F37393234313030365F323635315F313144345F00;
It seemed that the files, .mrimg, always save the RAW boot sector of a volume starting from the file position, offset 13 byte. Nowadays, the most Windows system and boot partitions are NTFS. So, it seems the file, .mrimg, has the same data, 0xEB5290, on the offset 13 byte to 15 byte.

Download Winhex. (Winhex is free to view/find sectors.)
Run it with administrator right.
Open the menu, "Tool->Open Disk".
On the menu, "Search->Find Hex Values..."
Search the value "EB5290" with the option "Cond:offet mod 512=13"
Using this way, you can try to find the file header of the file, .mrimg

Then, search the nearest value "5F5F37393234313030365F323635315F313144345F00" to find the file ending of the .mrimg file.

Best regards,
Thomas
http://www.lazesoft.com

A quick side question: I just did a 'forensic clone' using Macrium Reflect which says it is sector by sector but it only took an hour or so - does this seem a little fast for a 1TB drive or is that about the norm? The 'Deep Scans' of the drive all took about 9 hours.

Is there another tool that would be better to clone the drive sector by sector?

Also, I had a great response from Thomas at Lazesoft who replied to me with:

--------------------------------
Hello Chew,

Thank you for contacting us.

I have posted on the forum. But, it might need time to be displayed.

The file, .mrimg, does not have a fixed File header signature. It has same ending, with 0x5F5F37393234313030365F323635315F313144345F00;
It seemed that the files, .mrimg, always save the RAW boot sector of a volume starting from the file position, offset 13 byte. Nowadays, the most Windows system and boot partitions are NTFS. So, it seems the file, .mrimg, has the same data, 0xEB5290, on the offset 13 byte to 15 byte.

Download Winhex. (Winhex is free to view/find sectors.)
Run it with administrator right.
Open the menu, "Tool->Open Disk".
On the menu, "Search->Find Hex Values..."
Search the value "EB5290" with the option "Cond:offet mod 512=13"
Using this way, you can try to find the file header of the file, .mrimg

Then, search the nearest value "5F5F37393234313030365F323635315F313144345F00" to find the file ending of the .mrimg file.

Thank you,


Best Regards,
Thomas
-----------------------------------------

Ok, am actually trying Lazesoft's sector by sector cloning instead. Seems to be taking the amount of time that I would have expected.

Ddrescue (Linux)

already have written above by "Fzabkar"

(1 TB) per (9 hours) = 30.9 MB per second
http://www.google.com/search?q=1+TB+per ... per+second

(1 TB) per (1 hour) = 278 MB per second
http://www.google.com/search?q=1+TB+per ... per+second

1 hour is too fast.

Just to add a little to Thomas's post ...

_________________
A backup a day keeps DR away.

Great, thanks guys.

The disk is still cloning. 8 hours so far and time left says 16 hours so just a waiting game right now.

So I just went and confessed to my client.

Turns out she had a 3rd backup.



Oh wow, the relief is just pouring off me. Man did I get off the hook this time!

Thank you so so much to all those that helped me - I really appreciate it so much, so nice to find helpful people in a forum like this!

Buy a lottery ticket, today! That's the polar opposite to the worst things that can happen in data recovery.

_________________
Sabo Computer Repairs & Data Recovery

A customer that know what they are doing on their own. Buy her a lottery ticket, too.

_________________
Hard Disk Drive (HDD), Solid State Drive (SSD, SATA, NVMe, etc), USB Flash Drive and RAID Data Recovery Specialist in Massachusetts

I would still try to recover the image file. I doubt that such cases would come up very often, so this would be a rare opportunity to learn.

BTW, kudos to you for your honesty. Call me a cynic, but I suspect that many shops would try to pass off the data loss as a drive failure rather than human error.

_________________
A backup a day keeps DR away.

Haha, I should buy a lottery ticket!

This was a good lesson for me and luckily it had a happy ending - I will definitely be insisting that all future client's data are in 3 places at all times.

Thanks fzabkar, it was hard to face up but I know I wouldn't have gotten over it if I hadn't come clean. And luckily for me it all worked out in the end!

I took a clone of the drive so I can still play around with retrieving the image if I get a chance. For now I'm just going to go for a surf watch a movie and hopefully sleep tonight for once

Deleted