CnW Recovery

Not enough server storage is available to process this command

2012-01-31T02:09:00.000-08:00

I recently upgraded an XP system to have a larger hard drive for data storage. The new drive is a 1.5TB drive, replacing the previous 500GB drive. The PC is about 5 years old but still works well, and has 3GB of RAM.

On a recent disk imaging process, it came up with errors writing to the drive. It indicated not enough resources. I tried a reboot (to clear down any untidy memory) but errors kept appearing. I then tried writing from a different machine via the network. This displayed the error message
"Not enough server storage is available to process this command". As a second test I tried to copy a 350GB to the same drive. After seconds, this Windows only command failed.

I determined that the error being returned was m_loSError 1130, or 0x46a

The next stage was Google with this error message and sure enough I have not been the first to receive it. Also, very nicely there is a fix by changing a registry setting.

http://support.microsoft.com/kb/304101

Subsequent testing shows that the system is now stable, and I can copy a 350GB file to the same disk drive. As a spin off, I have improved the error reporting of my software to assist with other users hitting he same problem.

How to read XFS on Windows

2012-01-18T03:44:00.000-08:00

I often read about problems people have reading Unix formats on a PC. Linux has many features that allow a new file system to be loaded and hence read disks in non Ext/2/3/4 format.

One solution for a PC is to use CnW to just read the data files from the foreign file system. 95% of the time this will be a satisfactory solution, though there will be occasions were read and write are required. CnW does not write to non PC file systems.

By using a copy of CnW Recovery software files can be read from many Unix disks, including XFS and Reiser. It also included Macintosh. The demo will read the files, but not actually save any.

CnW is designed as a data recovery tool, rather than this general reading tool, so file selection is limited, for instance there is no drag and drop. However, there are extensive file filter tools so file of a certain date, size or name/location may be selected or skipped.

When presented with a problem of accessing data from a foreign drive, CnW may well provide a simple solution. As a bonus deleted files can also be found.

Ubuntu disk formatting

2012-01-12T09:09:00.000-08:00

Recently I was using Ubuntu V11.10 to create a sample Unix disk. I am no greate fan of Linux, but I have to say that V11 is getting close to a system that could be used by 'normal' users and not just geeks that love long command lines with millions of options. On the negative side it does seem to be influenced by the Macintosh.

However, one currious problem I ran into was with formatting a disk. I wanted to reformat an old Windows disk into Unix. The old disk was a valid disk, so had a partition identifier set in the boot sector, and naturally it was set as 7 for NTFS. I formated the disk, copied some files over and went to use the disk. Rather oddly, it was recognised as an NTFS disk - but corrupted. I discovered this was because the partition ID was still 7, rather than 0x83 I would have expected for Reiser.

The solution was two fold - it is posible in Ubuntu to edit the partition info, and in CnW it is possible to select the correct type of disk.

The warning that I doubt I am the first to create this problem and it is possible that a corrupt NTFS disk is infact a Unix disk. Be aware!

Reiser and program development

2011-12-31T11:09:00.000-08:00

Software development can be a slow process, but in many respects that is the best approach. But this slow process should ideally be a series of small developments, each tested and reviewed on a continuous basis.

An example is the Reiser handler for CnW Recovery. This was written in response to a an internal job to recover files from a failed HP Media Vault device. The disks were OK, but the RAID had failed. The development required was both support for JBOD (Job bunch of disks) and the complex Reiser format. The job was done, and all data recovered. ie Version 1 worked.

The next requirement came to read deleted files. Deleted files on Reiser, according to many Internet sites is not possible, so CnW developed a method that works to about 80% success, a figure that varies and depends on many factors.

When software is released, there are often problems as unseen configurations, or failures crop up. One by one these are fixed, and the product improves. Currently, there is a good engine for HP Mediavault recovery, and many successful recoveries have been performed.

Along with a good engine, an easy to use interface has to be developed, and here the problems can expand. Users can be extremely computer literate, or beginners. Most users are not experts in data recovery and so there are many terms and concepts unfamiliar to them. A good place to start is with the Help system, but not many users think they need this. There is also the expectation that because one can turn a computer on, one is an expert in all fields of computing, including data recovery.

One solution to this problem is to give no options, and only a single path through the software. For predictable failures, and known configurations this can be implemented, and an example in CnW is the wizard for failed mini DVDs, to produce a new video disk. For devices such as a HP RAID, there are several variations, and different requirements. To this end, the chosen approach has been to try and trap errors, and give possible solutions. At the same time, intelligence is built into the program to try and determine the original configuration, and point to a solution.

With HP Raid disks many users do not know if the disk is a mirrored disk, or a pair of disks. Routines can be built into the program to indicate that the single disk is probably the second of a pair, or that an extra disk is likely to be required, and configured as a JBOD.

The overall result of this development is a program that will result in fewer calls for support, and a quicker solution for users who do not want to read the manual, but just get a solution.

Fake software

2011-11-28T10:59:00.000-08:00

I recently needed to purchase another copy of Microsoft Office 2007 for a new laptop. Being fairly expensive, I searched Amazon for a deal. As the product has now been replaced with 2010 I hope to get some old stock. I found a copy at about £175 and purchased.

I received the package very quickly, but the CD was warped, and would not load. Having already got a package, I decided to load my old (and I think idenical CD) but use the new product code (registration number) to licence the software. However, the product code was not valid. After a very short correspondence with the supplier, I returned the package and received a full refund.

Attempt number 2 was no better. This time, eBay. The CD was good, product code worked when installing but when I came to online registration, I was told the code was a contfeit one. Again, the supply has promised to refund my purchase, and I have every confidence that this will happen.

My third attempt is as I have to pay the full cost, I have now purchased Office 2010 (just over £300) and am waiting for delivery.

One area that has surprised me is that both, probably fake items looked 100% genuine. I compared every thing with with my original genuine item and the only difference was manufacture in Ireland rather than Singapore. The full refund did eventually arrive.

Moral, you get what you pay for - but office professional is a bit expensive these days.

Flash memory address decoding

2011-11-22T09:10:00.000-08:00

Flash memory chips are very different to logical hard drives, or even USB memory sticks. With a hard drive, acessing sector 0 always takes one to sector 0. Where the sector is stored on teh disk is actually irrlevant as the disk controller takes care of this.

For a flash memory chip, there is also a controller that takes care of where a sector is stored. However, this controller is also the interface to the USB port and can fail. The solution then is to remove the flash memory chip (with a hot air gun) and read the data directly. By missing out the flash controller chip, it is often possible to read data on the memory chip - BUT the flash controller chip has to be emulated.

Flash memory in some respects is a compromise as there are limitations on how it can be written and read. Data can only be read in blocks, often equivalent to 8 or 16 sectors and it is best to districute where the data is written on the chip. Blocks can fail, so have to be remapped, and they can also wear out. Another aspect is that before a block can be overwitten it has to be cleared down, so writing can be a two stage process, and hence slower than reading.

The flash controller chip controls all of the above and has methods to obtain optimum performance. This involves storing the data in areas that do not physically relate to the logical address. When recovering data it is necessary to decode this mapping . This blog entry describes one useful method that uses CnW to help.

Most memory chips are part of a FAT controller system. The problem to solve is to determine where blocks of data are stored. The solution described is ony a small part of the whole process but one that can help considerably. If the start of a memory device can be created, then the basic disk parameters can be determined, eg cluster size and address of cluster 2. The memory (working with a disk image) can be scanned using search for Directory Stubs and this will produce a log of file names and logical addresses. The same memory image can now be carved, and this will produce some valid files, often JPEGs that will be validated and have a valid date and length.

The clever bit now is to find a file that has been carved, and also read, by matching the file length exactly. This will then give the logical address from the directory scan and the physical address from the carving. If different, then the mapping is wrong, but you can see how far out the mapping is, and hopefully work out why.

Price of disk drives

2011-11-02T03:32:00.000-07:00

I got a nasty shock yesterday when I cam to purchase a new disk drive. I've had a few in house failures recently, and a few weeks ago I purchased a new 2TB Western Digital drive from PC World. I was in a hurry for one so did not investigate much on price, but was happy with £79.99. Yesterday, I required another one, and checked on line with my normal supplier and it looked like the £79.99 was in fact a very good price. I drove back to PC World (about 10 miles away) only to discover that 2TB drives where now about £120. The best value I could see (GB per pound) was a 3TB WD Green drive for £169.99.

At check out I queried the price rise and was informed about floods in the Far East. A bit of Google research later in the day suggested that the Western Digital plant may be under water. There are press concerns about no availability, and price rises.

On drives, I personally like the WD Green range as they run very cool. Speed may not be as fast as some, but as much of my work still includes a USB2.0 connection, speed is not a major issue.

Corrupted Macintosh Disk

2011-11-01T04:10:00.000-07:00

On many disks there is often a critical sector. On a Macintosh HFS disk it is often located at sector 0x40042, it starts with "H+" and points to the equally critical Catlog and Extents area of the disk. It is known as the Volume header. On a 'good' day there is a duplicate at the end of the disk.

A recent disk I received was missing both the 0x40042 sector and the one at the end of the disk and so recovery became a rather more manual process than normally happens. The disk was a 1TB drive containing over 900 GB of data, mainly music related. Various areas of the disk had failed and so I started with an incremental image.

The incremental image had a problem that when some sectors were attempted to be read, the drive failed in a way that only a power off and on reset would kick it back into life. This was tedious, but overall probably more than 98% of the disk was imaged.

The next problem was to reconstruct the parameters that sector 0x40042 would have provided. The area where the catalog is often found was searched, and a catalog could be found there, with a length of 0x2000 bytes (ie 16 sectors long). A Mac catalog entry starts with two pointers, pointing the entry before and after as a linked list chain. By looking for pointers that were different by the value of 2, it is a good guess that the one being looked at is the value in the middle. For example, pointers 0x12bb and 0x12bd were found which indicates that the actual catalog value is 0x12bc, and this was in sector 0x8ecf0. By subtracting 0x12bc0 sectors from 0x8ecf0 the location 0x7c130 was established as the catlog start location (in sectors).

By examining the disk, a few Volume header sectors were found, and these indicated that the catalog should start at cluster 0x781e. With a typical 8 sectors per cluster, this maps to offset 0x3c0c0. When this value is added to 0x40040 (the volume start location) we get to 0x7c130 and good assumption that the Volume header has senible values. The rather harder to determine extents map was then used from the dummy Volume header.

Once these values were entered by hand into the CnW Mac recovery option screen, data was recovered

Overwritten memory chip

2011-10-31T03:38:00.000-07:00

Data recovery is all about get data back when it has been lost. Often this is possible but there is one case when it just cannot be achieved. The problem is when the physical area,sector has been overwritten.

Whe a file is deleted, normally the index, or directory entry is removed. When a disk is formatted, generally only the key areas on the disk are written to. In both of these cases, old data will exist, and programs such as CnW Recovery will find the data.

When a sector is overwritten, the data is lost. If there are no backups of the data, there is nothing that can be done. There are suggestions that with a hard drive, unless data is overwritten 7 times, then it could be recovered - the author is extremely sceptical of this due to the exceptionally high density of current disks. What may have been possible 20 years ago, is no longer the case. For memory chips, it is also very definate. There is no scope of reading slightly off track and getting data back. It could be argued that routines that process wear leveling could point to old data, but this would only be a maximum of about 5% of the data, from any period of the disk. It will not contain a complete photo.

With cameras, because there is no editing, there is no requirement for any backups. The conclusion is that an overwritten photo is lost. Take care.

More Digital Signature issues with IE9.0 and Norton

2011-07-04T01:19:00.000-07:00

My last posting talked about digitally signing software for downloads. Unfortunately this is only half of the solution. I am sure that Microsoft and Norton are working in most people's best interests, but this does not help the way that CnW operates. With CnW, the idea is to give users the latest updates (and even bug fixes) as soon as possible. This is done by updating the main software package maybe once or twice a month. The changes are small, but incrementally ensure that the produce evolves, and responds to customer feed back.

Part of IE9.0 and Norton security is how long any download has been on the internet. This period is monitored to see if there has been any negative feedback about the product. Norton suggests there is a 1 week learning time, which would man that CnW software would be viewed as dubious for maybe 50% of it's time.

The next plan to try and resolve this issue is to move to the common pattern of having a installer tool, and then in effect an update program. In this case, the installer can be written, and will not be changed for a considerable period of time, maybe a year. The installer will then download the main, and frequently updated data from it's own secure environment. Everything will be digitally signed, but the installer can be recognised by IE9.0 and Norton as a stable, safe program. IE9.0 and Norton will only see the stable installer, though Norton will obviously also monitor any future updates.

Software signing and IE9.0

2011-07-01T04:59:00.000-07:00

Internet security can be a large issue. To this end, IE9.0 has very 'tough' security measures added to try and protect users from downloading unsafe software. If a user tries to download an unsigned program, there are severe warning messages and it can be difficult to download or run the program.

To overcome the above problem the program has to be digitally signed, with a secure certificate. This can be an expensive process but fortunately there are solutions for small companies. One such company - that CnW have used - is Global Sign. This gives a digital signature which can then be traced back to Global Sign. Having this on the program now means that Internet Explorer V9 does not scream that the software could be very dangerous.

The other security measure that is causing problems is Norton Insight. This can warn that the software is new, and may be dangerous. The solution can be to get listed on their White List (is not a Black List). The problem here is that listing can take a few weeks, and with CnW this is when the next release may have been made. If a company does a single release each year this is not a problem, but for a small company doing regular updates to keep pace with new solutions, and customer requests, then Norton is not very friendly. Unfortunately, Norton does not seem to recognise the digital signature. I do not know what the ultimate solution will be.

Solid State devices

2011-06-03T09:28:00.000-07:00

Many products are deemed to be dead long before they eventualy die entirely. Magnetic tape for datya storage is one, but there is a very important market for tape, though for the home user and small business, disk back up is now a much more viable proposition. The next prediction is the death of the rotating hard drive.

We are all used to solid state memory for cameras, telephones and many video devices. The capacity keeps increasing, and cost keeps coming down. Just starting to come in are solid state drives for laptops and desk top computers. As there is no head seek time, or rotational delay, reading can be very fast and many users are added them as the system drive in a PC. They report impressive performance in boot up and launching programs. It is noit all good news, as writing can be slow, and there is an issue of limited write cycles. Basically, sector will wear out if used too often. The solution to the last point is that chip controllers use a feature called wear leveling, so when a sector has been used too many times, it will be physically moved to another location, while still keeping the same logical address.

Data recovery of such SSDs has two main problems. If the controller dies, then it is necessary to work with the chips directly. These means they have to be unsoldered from the board and read. This means pointing a hot air gun at the chips and removing them, with out damage or over heating. It is possible, and not quite as bad as it sounds. The major problem though comes next. Manufacturers do not publish their wear leveling routines. As the chips are not meant to moved between devices, there is no requirement for any standards - all that matters is that when a sector number is requested, the correct data is returned. The physical sector is not relevant in any way.

CnW are now looking at such drives, and memory chips and will be developing tools to assist with recovery

Backup procedures

2011-05-26T07:34:00.000-07:00

I often meet customers who say - I was about to back it up but....

Last week I suffered a serious problem with a Window 7 64 PC. It had become corrupted - probably due to device drivers - in a way that it would not respond to either mouse or keyboard. It booted up, I could see it over the network, but not control anything.

It is a Dell computer, and did not come with a Windows disk, but I had made a repair disk. I managed to boot into repair mode and first tried to go back a few restore points, however nothing worked.

I have a few backup prodcures in place, so was not too worried. The methods I have are

On line carbonite
Weekly Microsoft backup to a local RAID - in a separate box
Periodic disk images using Macrium Reflect
Very critical code (my source code) is backed up every 8 hours onto another PC, local but in a different room.

I was 100% confident, and still remai this way, that all important documents and files are safe. Th problem came with recovering the operaing system.

The first stage was to use the Microsoft image which is created evry week. The recovery mode allows for this to be restored, but it did not want to recognise the RAID box. However, the files were copied onto a USB drive, and was then visible. In the mean time, I took a complete image copy of the problem drive so that all updated files could be recovered as required.

The disk was then updaed with the microsft image, but this would not produce a bootable drive. It always came up in recovery mode, and often indicated that there were bad directories etc.

The final stage was to restore the partition, and boot sector from the Macrium backup. This was a few months old, but gave the pomise of a working system. I was very pleased that this worked, and it immediately booted and started running. The system then spent some time updating a few months of Norton and Microsoft patches. The recent file were copied back, some from disk, and some from carbonite, and all is now working correctly. No files or data lost.

My concern remains on how good the Microsoft backup system is. In the next few months I will try and receate a complete backup and see if it works.

DVD+RW apparently blank

2011-05-06T08:43:00.000-07:00

I recently had a DVD+RW for recovery. It was from a camcorder and had probably been reformatted.

On initial examination the start of the disk was OK, but the majority was blank, ie all the sectors were filled with zeros. I could read the sectors and no error messages were displayed. Every indication was that the disk had been blanked, as if thee had been a full format.

When the disk was examined on hardware designed to read blank disks it was very interesting that the disk was not blank. There was a significant amount of video still on the disk and CnW software did a recovery, and then generated a new video disk.

The concern is that standard hardware gave every indication that the disk was blank - so do not rely on standardard hardware if there is a possibility that the data may actually still exist. CnW Recovery services will always assist anyone with such possible disks.

Finding owner of data

2011-04-26T01:52:00.000-07:00

On a recent walk along a Californian beach I found a compact camera, covered in sand and salt water. The camera was very dead, but out of interest I eventally managed to extract the 2GB SD memory card. After drying it out, it was readable with errors. When totally dry, it read without errors.

I was keen to try and contact the owner and return the photos, over 500 of them. Unfortunately, there is very little on a memory chip to tell you about an owner, only the camera, and date and time of the photos. From this I could determine that the last photo had been taken about 10 days before I found the camera. I did try and add a 'Found camera' to a local lost and found website, but no reply.

Recently, I did a bit more investigation by looking at the photos more closely. Obviously the owner was a young person, with lots of photos in night clubs, no names identifiable, but also some at a college. One photo though I do hope will be a major clue is that it includes, possibly the owner, or close friend holding a college certificate with their unusal surname name on it. A bit of Googling took me to Facebook, and I hope a perfect match. (The name and college course both match, and the photo looks similar). I have now sent a message to the person, and am waiting for a reply.

The moral of the story is that if you want goods returned, it can be helpful to have some return details stored with it.

As a post script, the owner did contact me and a DVD of photos was sent. I have just received a very nice letter of thanks.

Virus issue

2011-03-06T05:49:00.000-08:00

I don't often get involved in fixing PC problems, but recent jobs involved the same type of issue. The PC starts to report serious errors, and show problems with boot sector and other critical areas of the disk. It all looks rather real, and very worrying. However, in both cases it was caused by a similar, but different Fake Anti Virus program. I think if you continue there was an offer of the program to fix the issue - in exchange for some $$$s.

The approach I tooks was to remove the drive from the laptop and create an image for security purposes. I then ran Norton which tracked down several viruses, and removed them. This is where the two viruses behaved differently.

Virus one did not want to be removed by Norton and started each time the machine booted. The problem was that a startup function (go to msconfig) was launching the virus at startup each time. By removing this start up line - and seeing the program it was starting (it had a randomly generated name) the PC was then OK. The free AVG virus checker was added to the PC to try and prevent this happening again. A report a few weeks after this event indicated that eveything has been OK.

Virus two was removed by Norton, but left the PC in a state where no program would actually launch from explorer. Various 'Googled' ideas pointed to the registry, but this did not help. Launching the command prompt was also very difficult and the start program launcher did not work. A solution to this was rather unusual, but worked, and hence I am including it here. Do Ctrl-Alt_Del and b ring up the task manager. Under the top menu item 'File' thre is a run command. This worked and a command window was opened. It did not seem possible to change file attributes to make sure that a .exe was launched so evenually the PC was restored to a restore point from afew weeks earlier. Everything then nearly worked.

On examining the PC there were issue with McAfee antivirus which was not running, and also 18 months of Vista updates had not been loaded - 90 patches althogether. The 90 patches were installed, McAfee updated and this worked. PC now all OK, but all automatic updating was set to 4am when the PC is normally turned off. This was changed to a time when the PC was likely to be on and hopefully the problem will not arise again.

In both cases, no data was actually lost

Parallel Programming

2011-03-03T04:19:00.000-08:00

Modern proessors are not getting much faster, 3GHz has been a fast processor for about 7 years. They are getting wider. It started with hyperthreading and then multiple cores. Almolst every processor is now a multiple core, and current Intel chips have 4 cores with hyperthreading, making in effect 8 cores.

Unfortunately, most programs just use a single core and so performance gains are not very significant. The solution is to use parallel programming so that different tasks are performed in different cores. This may sound simple but unfortunately many computing tasks are sequential. In data recovery it is sequence or read disk, analyse data and save data. The other problem is each time a task is split there is a processing overhead. This means that benefits may not be very significant.

An example of the limited benefit mentioned above is a simple program I wrote to experiment with parallel programming. It was purely an exercise with in memory manipulation - ie no hard disk access. The first example was single threaded and took 35 seconds to run, using a single core. The next example was using the 'parallel_invoke' function and used all possible cores. When running it looked impressive with all 8 cores running at 100%. However, the time was not reduced by a factor 8, but only roughly halved to 15 seconds. Although this would be a worth while time gain its shows how overheads of a new task eat into the gains. I am sure that a bit of tweaking could have made the improvement better, but the warning is that a PC may be running at 8 * 100% but actually alot of this may be house keeping.

In a real world example I have added some parallel processing into CnW Recovery software. The area was to do with calculating MD5 hash values while writing data to the output drive. As these processes do not depend on each other, they can run at the same time sharing the same memory buffer. The result was a reduction in time from about 3 hours 30 mins to 3 hours 10 mins. This is worth while but not very dramatic. However, it will be possible to add SHA-1 hashing with no extra time penalty and that would be a major benefit.

WD disk not responding

2011-02-07T08:11:00.000-08:00

A recnt Western Digital 500GB disk was spinning, but not recognised by a PC with USB connector. The next test I always try is with Ace Laboratories PC-3000 which is designed to test abd refirm driver firmware. At first this would not recognise the disk under general routines, but when the WD funtion tests were tried some response was found. It was not enough to recognise which family the drive belonged too, and so this was a case at looking at all the PCB layouts and matching a photo. Eventually the short list was 4 possible drive types, of which Tornado 2D was found to work.

The PC-3000 did a series of tests, and end of which it was possible to view a sector.

I did not know how long this reading would last so I started a Read to file and this moved very slowly, but positively. After a few hours the reading sped up to an acceptable rate. Over night over 200GB was imaged, but then the reading had gone painfully slow. I stopped the read and confirmed that other areas of the disk could be read without significant delays. The problem with PC-3000 is that it is not very good at reading sections of disks in an easily managed way.

The next stage was to carefully disconnect the SATA cable from PC-3000 and connect a PC (USB) SATA connector, without turning the drive power off. To my delight, the PC would read the disk anda process of incremental imaging was continued. I started with the final 200GB or so of the disk, and slowly worked back to the area that caused so many problems. When I had managed to image probably over 99% of the I decided the return rate was probably too small to consder worth continuing. The image produced a very healthy recovery of the disk, thanks both the PC-3000 and Incremental Imaging.

Windows 7 update

2011-01-31T09:51:00.000-08:00

I recently wrote about upgrading a PC from Vista to Windows 7. The cost was about £80 for software upgrade and £25 for extra memory.

It has been worth it. The machine is more reponsive and setting up network connections and printers much easier. The configuration is a 2.4GHz, Core 2 duo PC with 4GB RAM, 750GB hard drive, (250-500 partitions), a 2TB WD green drive, and a 2.7TB RAID. The only slow part to be investigated is the100Mb network.

The WD Green drives are not blistering fast, but they are very cool (in the sense of temperature). This should help reliablity, and mean that computer fans can run less often, giving me a quieter life.

Graphics are not important, so the PC has the standard graphics interface, but Windows 7 aero does work.

Create a DVD with recovered video

2011-01-28T11:31:00.000-08:00

Software development is always looking at ways to improve the use of a program. What often happens is that simple task is being repeated many times, and this indicates that something can be improved.
CnW gets lots of failed mini-DVDs to recover, and has a very high success rate. Copies of the software are also sold to do the same function. The original version would produce a series of files in the standard directory structure for a video disk. The user would then have to use a DVD burning program to create a new video disk. Not every 3rd party burning program works as required, so now the function has been added to CnW. It is a very simple process, so when a disk has been recovered, a blank DVD may be inserted, and a new DVD burnt. This saves both time, and also the chance of operator error, and program incompatiblity.
So for simple video data recovery, that will actually produce a playing DVD at the end look at www.cnwrecovery.com/html/mini_dvd.html

Blank DVD-RW

2011-01-25T01:12:00.000-08:00

I recently received 2 mini DVD-RW disks. When read with normal hardware, every sector was blank, and there were no error messages. However, when read with specialised hardware, it was possible to recovery about 20 mins of a wedding video from each disk.

The moral of this story is what looks blank, may not always be blank. Any forensic investigation should also take this into account. CnW Recovery have developed a method to examine and recover data from areas of a DVD that can not otherwise be accessed. CnW Recovery has a fixed price of £40, no fix, no fee for this type of data recovery. Contact info@cnwrecovery.co.uk for more details

Solved - problems copying files to a Mac from PC disk

2011-01-24T04:14:00.000-08:00

My data recovery is all done on PCs. Often though, the original disk is a Mac HFS+ disk, and the customer wants the data back on a Mac Drive. My process for doing this is to recover the files to a PC drive (NTFS or FAT32) which a Mac will read. By using the AppleDouble format (with hidden ._ files) all resource forks are retained. I then copy the files, using a Mac on to a customer disk. I could have used a program such as MacDrive, but the last version I had did not retain resouce forks.
Most files copy without problems, and the resource fork is correct, but sometimes an error such as -
"The operation cannot be completed because you do not have sufficient privileges for some of the items"

is displayed and the copying stops. This is best described as a pain as the point of stopping has to be determined, and a copy restarted. Eventually I tracked this down to the type of file and established the problem files had the file type 'slnk' or 'hlnk' in the resouce fork. This was trying to associate the file with a program that may not present on the copying Mac. The solution has been to remove this strings in the resouce fork and initial results now allow me to do a copy in one stage.

Bye Bye Vista!

2011-01-18T11:29:00.000-08:00

Doing software development it is essential that your product works on systems customers want to use. This means keeping upto date with standard updates and a few years ago I purchased a Vista system. It did thrown up a few compatibility problems so the purchase was worth while, but somehow the system never worked very well. The PC was a reasonable spec, Core Duo, 2.4GHz with 2GB or RAM.

However, enough has been enough, and my Windows 7 systems seem very stable, so I decided it was time to update the Vista to Windows 7 - 32bit. A search on Amazon brought up a reasonable price, and then a few more GBs or RAM to go to 4GB. The fitting of RAM was easy, though of course, 32 bit Windows only sees 3GBs.

In theory, Vista can be updated to Windows and keep the system intact. Obviously a full backup was done first, and the install was started. At this point a problem arose. The new Windows 7 package was less high end than the original Vista package, and this would not allow for a seamless upgrade. The notes implied that all data would be lost, and a clean install would be carried out. The truth was actually not quiet so bad. On starting the update, about 50GB of files were backed up to a windows.old directory, and this contained all programs and user directory. Obviously the programs are not installed, but copies are made. Unexpectedly, the rest of the hard drive was left unchanged, so all existing directories were left as original. I now just need to clear down a lot of the unwanted 50GB backup.

Overall, the upgrade was very painless and after a bit of personal tweaking, I now have a nice Windows 7 machine which seems to work.

Defragmenting videos from mobile phones

2011-01-05T01:48:00.000-08:00

Mobile / Cell phones typically store videos as .3GP, .MP4 type files. These can be recognised easily in a hex viewer by looking at the start of the file. The second group of 4 bytes will be the string 'ftyp' followed by the exact type of file, eg '3gp5'.

If the files are to be recovered by data carving, then at times the data may be fragmented. CnW is working on a solution to this problem. Fortunately these Quick Time files have a fairly helpful data structure, and so it is possible to both verify, and hence reconstruct files from fragmented stored in different fragments. The basic file struct is 3 main data areas,

ftyp moov mdat

However, the order of moov and mdat can vary. The moov segment stores all pointers and decoding details for the data area, mdat. The mdat area basically contains frames of video and sound. As video frames normally start with the same header string, by decoding the moov it is possible to examine a possible fragment and determine if it does have the correct headers in the correct location. If a match is found then it is possible to apply this fragment to the new image.

The moov fragment is not normally very large and so the expectations are that the complete segment will be found in the first complete fragment, along with the ftyp header. This will be true for the files that store moov straight after the ftyp tag. For files which are ftype - mdat - moov sequence, it is necessary to examine the mdat for frame starts and hence calculate possible values that will be found in a moov segement. The disk then has to be searched for a suitable moov fragment.

The current status of CnW Recovery is for recovery of a ftyp - moov - mdat file. The second variation is under development. http://www.cnwrecovery.com/ for more details of software

MP3 recovery

2010-10-29T15:28:00.001-07:00

A recent job involved a corrupted MP3 player. On plugging it into the PC it displayed as an music player, rather than as a hard drive. A bit of reading the manual showed there were multiple modes for the USB interface to work, and once set in the appropiate mode, I could see the device as a storage device. As expected it was a FAT32, but 6.5GB of it's 8GB capacity was in the FOUND.000 subdirectory, as the result of a chkdsk type command.

The files to be recovered were ones the customer had recorded which were no longer visible. The first recovery attempt was a data carve of the disk and this showed a number of files, of the type required, but no file names or directories. The second attempt was a logical read, but this only showed what was seen directly on the PC. The third attempt was a scan of the disk for FAT directory stubs using CnW recovery software. Interestingly this scan came up trumps. All the files that had been lost (and captured on the chkdsk) were found with valid names and valid subdirectories. When recovered the complete MP3 player was much as originally configured.

Overwritten MAC disk

2010-10-17T09:26:00.000-07:00

I recently received a MAC disk for data recovery. The disk imaged without any sectors errors, and a scan of the disk indicated there was about 70GB of data. However, when I read it, only about 20MB was recovered. The fist thought is that all the daya had been deleted which is not good news for a MAC. When a MAC file is deleted, it also removes the metadata from the directory, making intelligent recovery impossible. The only recovery approach is data carving.However, looking through the disk, several files looked rather PC based, and there were also som FAT32 directory structures. A scan of the disk using the CnW Partition function showed there were about 300 FAT sub directories on the drive. This indicates that the drive was intially a FAT32 drive that had been reformatted as a MAC drive. A bit more examination also indicated that much (but not all) of the FAT was still intact.CnW was set to recognise the partition as a FAT32 and a very complete recovery was made. By examining the log (and sorting on start location) it was clear that the area that th MAC writes most directory information was one where only a few system files originally existed, and so it was likely that very few useful files were lost.Moral - when only a few files have bee found on a disk, it is always worth investigating if it has been reformattted, either to the same, or a different file system.

AVI data carving

2010-09-30T17:05:00.000-07:00

Most data files are written sequentially which means that data carving can have a good guess that the data will typically be sequential. However, recently some AVI files have been found that do not seem to follow this pattern.

The file in question was written using a video camera and it appears that the first section was the data - a series of tagged chunks ofthe starting "00dc" or "00wb". An AVI file contains an index and in this version, the index was added to the first block after the main header information. Thus to carve the files it is necessary to read the header, and then in effect go back to find the blocks used. To make the job possible, the index does conatin the offset and length of each tag. It is therefore possinle to search the raw disk for a cluster that contains a '00xx' tag at a certain location within a block, with a defined length.

xD Memory cards

2010-09-19T01:29:00.000-07:00

Photo recovery from most camera memory chips is fairly straight forward. If deleted, then file can be recovered, largely with original names. Failing that, data carving can be used to extract the photos. The only remaining issue is recovering fragmented photos, something that CnW Recovery software can do with a moderate success rate.

For some xD memory chips, they can be formatted rather than deleted and the end result is every sector (after a blank directory) is full of 0xFF. ie there is absolutely no information left to recover photos from.

There are theories that if you examine each bit on the memory chip you may discover that it is only at 99% the standard level which means it was previously a different level. This would require the complete resources of the FBI, and probably only have a 25% success rate on each chip. It would be far cheaper, and more successful to pay for the holiday again.

The moral as ever is to make sure that when ever photos are taken, they should be transfered to a new source (ideally multiple locations) and verfied before deleting the camera memory. The other advice is not to delete individual photos as there can be two problems. A single mistake can delete all the photos, and also new photos can be fragmeted making future data recovery harder.

Disk drives fails on certain sectors

2010-09-13T08:58:00.000-07:00

I received a disk drive today that often worked, but when it hit a few sectors it would fail, so the the only way forward was a power reset. My normal approach would be to do an incremental image, and restart after every failure. This disk was 1TB so an incremental image would take several hours which I did not have. By doing a partial image of the directory area, I couild determine that the required data, from a single subdirectory was stored over the complete disk.

My approach to save time was to do a selective restore of the required directory but at the same time, when a failed sector was found, change the program so that it would be skipped. The hope was that the requested data would not hit too many failed sectors, each requiring a program change and recover restart.

It will actually be a very useful feature to add to the software so that a hardware reset could be done, and recovery then continue.

Success with XFS deleted files

2010-09-06T02:31:00.000-07:00

After a lot of hard work (and head scratching) it is now possible to recover deleted files from the problem XFS disk. This is a new development within the CnW data recovery software which will recover the file without doing any data carving. In other words, the files are recovered with correct names, original dates, and very largely, correct directory structure.

The process, by necessity is rather slow. It starts with a complete scan of the drive (or in this case, the RAID-0) to locate all existing iNode entries on the disk. These are then analysed, and regenerated to provide a list of possible directory entries. Once the disk structure is know, files can be recovered, including all files that have been deleted.

With all deleted files, there is always a danger that a new file written to the disk after the file was deleted, could overwrite critical data. However, if the recover process is started as soon as the error, or corruption is know, recovery levels will be good.

Another RAID problem

2010-09-01T05:01:00.000-07:00

I rececently received three disks from an Apple RAID. One disk had hardware issues and the RAID was RAID 0, ie all the disks are striped so that 32K of data is written to one disk, then the next 32K to the second disk.

Within the Apple, some files could be recovered, and gthen the while system would hang.

The problem disk had a hardware issue so then when making an image of it, the drive would hang, and the only recovery path was a power cycle reset. By using incremental imaging it was possible to build up an adequate image of the drive. A few sectors had to be skipped, but probably 99.9% were imaged.

To receover the data it was necessary to emulate the Apple RAID. As is typical, the first section, actually a FAT partition was identical on all three disks, but the data section was spread over the three disks, starting at location sector 0x64028. It was necessary to work out both the stripe size and disk order. The stripe size was worked out by fortunately finding a sequential file that had line numbers marked in the text, It was therefore possible to see when there was a jump, in this case after 32K of data, and also the sequence of the disks. The sequence was slightly curious as the disks were marked 1,2,3 but the data in sector 0x6402A was on disk 2, and not disk 1. Thus the order of 2,3,1 was tried and the file system was the readable.

The result was that the CnW incremental imaging, and the RAID option recovered a very large amount of valuable data.

Multi-core processors

2010-08-26T01:44:00.000-07:00

Hardware keeps developing very quickly, and Moore's law which states that the number of transistors in a processor will double every two years is still valid. The speed of operation though has hit a kind of ceiling and 3GHz processors has been fast for about 6 years now. The method of adding more punch to a processor has been with multi processors, and hyperthreading. The problem is that software has not always kept up.

With a lot of data recovery, many processes are sequential. ie read the problem disk, analyse the data, and then write the data somewhere. With multiple processors, probably the best we can manage is 3 parallel tasks. At each end is a bottle neck of a disk drive. The fastest way to read a disk drive is as a sequential stream. If you try and recover from two parts of a disk at the same time, then the drive will spend a lot of time 'thrashing', just moving the head to the new area, and then back to the original area. Overall, the process will be slower. Multiple processors may assist and enable two recoveries at the same time on the PC, but there are always dangers that the USB interface or similar may then end up saturated.

Very few recovery processes naturally make use of parallel processing so normally on a nice 8 core processor, 7 cores remain rather sleepy. CnW are looking at ways to wake a few of the cores up to help with the ever increasing size of disks, but ultimately, the big bottleneck is the speed of reading a disk. eSATA and USB-3 are all helpful parts of the equation, but at the moment, USB-2 just churns along.

Deleted XFS files

2010-08-23T02:02:00.000-07:00

XFS is a popular file structure for NAS devices, both single disk and RAID. A RAID device may be resilient against disk failure (with the exception of RAID 0), but there is nothing to prevent operator error deleting files. With a NTFS disk, a deleted file is marked as deleted, and much of the meta data remains, although the area of the disk that the file used, could be reused.

XFS is less friendly in that the main data within the critical iNode is blanked. Thus flags indicating if it is a directory or file are blanked, along with the file length. Also, the table that stores the locations of all iNodes is also blanked, or filled with irrelevant values. Recovery is therefore deemed as all but impossible.

My challenge this week is to try and disprove this. iNodes still exist, as do cluster runs and resident data within the iNode. Watch this space to see if progress is made. I doubt a solution will be perfect, and there will always be the danger of producng files with a corrupted file structure, but I am curre ntly convinced that something will be possible.

Multiple Partitions on a drive

2010-08-17T03:52:00.000-07:00

To most users the hard disk has a single partition, or just the C: drive. When it comes to recovery, it is very common to see three partitions. A typical pattern is

FAT16 (hidden)
NTFS
FAT32 (hidden)

The FAT partitions are actually hidden and are configured for system recovery purposes. ie, they will often keep a copy of the operating system and so allow a complete reload of the drive in the event of failure. This saves the manufacturer about 50 cents on not providing a boot DVD with the system and assumes that a disk will fail, but these partitions will remain. Users are actually asked to make their own recovery DVDs.

As far as recovering user data, the only partition to be concerned about is the big NTFS partition. This is where holiday photos, wedding photos and MP3 music will be found.

Forensically though, it is possible to store data in these hidden partitions. Suspicions would be raised if the partitions are bigger than expected. On standard example I have looked at the FAT16 partition is about 60MB, and the FAT32 is about 3GB. The disk was a 250GB. A significantly larger FAT32, or a hidden NTFS must raise questions, and so these partitions would need careful investigation for possible hidden files.

On NAS (Network attached storage) systems, there are often multiple partitions (sometimes more than 4). They are normally all Linux and most of the partitions are Ext2/3. The final partition is the location that data is stored in. This final partition could be XFS, ReiserFS or Ext2/3. In this type of configuration one would expect the final partition to be large, and the rest fairly small. The warning sign would be a second large partition.

Seagate 7200.11 drives

2010-08-14T02:07:00.000-07:00

There was a firmware bug a few years ago with Seagate 7200.11 drives. It typically affected 500GB drives and the symptoms were that the drive span, by could not be detected by the BIOS. It only affects a certain firmware, and is generally known as 'bricking' the drive.

Fortunately CnW Recovery do have a fix for this problem, and has had a high success rate, with complete data recovery. Contact CnW for more details if you think your drive has been affected.

The above problem is not be confused with another common Seagate failure of bearing seizure. The disks spin at 7200 rpm (ie fast) and sometimes the bearing sieze. The solution is a skilled replacement of the platters into a different drive case, only to be undertaken in a clean room with qualified operators. A drive has several platters and the radial alignment between the platters has zero tolerance. ie if the platter moves a micro degree out, all the data will be lost. CnW does not have a solution for this problem, but can recommend companies who can help.

Windows 7 64 bit

2010-08-13T04:07:00.000-07:00

64 bit operating systems have been about for several years now and the hardware probably even longer. In the 1980s, it was a very slow move from 8 bit to 16 bit, and then from 16 bit to 32 bit. At last, with Windows 7, 64 bit operating systems are now becoming common, even on laptops, and the key selling point is that the once enourmous 4GB memory limit is now lifted. At a 1980 Intel seminar, it was suggested that 1MB of RAM was all one would ever need! In the course of my programming I now sometimes request 200MB buffers to help with sorting.

Although the operating system is 64 bit, the majority of applications are still 32 bit. The biggest nightmare has been critical support for drivers and other base level drive type programs. I have have been using Windows 7-64 since November 2009 and it is still a pain that the 64 bit Windows Explorer is not supported by Adobe Flash. I also have a nice standard HP printer that does not have a 64 bit driver, and has be used with a fiddle to make it look like a different PCL printer. For CnW Recovery software, support for the hardware dongle has only just been launched.

I like Windows 7, partly because it is on a fast Quad core PC, with 6GB or RAM, and much better than Vista. Whether the 64 bit apsect is worth anything, I am not sure, but I am convinced that this is the way forward., I just wish device drivers for old hardware kept pace.

For recovery purposes, I am looking forward to exploring the multi-tasking features that Visual Studio 2010 has. Disks are getting bigger and bigger, speed is becoming more critical.

A fun tip, you may not be aware of on Windows 7 is the 'Window Key and Tab'. Try it, it is more fun that Alt Tab.

Apple Drives

2010-08-12T00:04:00.000-07:00

I am often asked which make of drive is good and which is bad. The answer is like trying to recommend which type of car to buy, but there are two drives which should be replaced today if you have one.

The two problem Apple drives are both Segate Momentus (2.5"). The models are

Momentus 5400.2 Firmware 7.01
Momentus 5400.3 Firmware 3.CAE

If you have either of these two drives, then backup up all data today, and have the drive replaced. If the drive dies (this afternoon) physical recovery is all but impossible.

All makes and models of drive fail, but these are currently possibly the worst.

Video thumbnails on recovery

2010-08-11T01:20:00.000-07:00

When evaluating a demo recovery program it is often very difficult to know if the data you require will be recovered by the licenced copy. Recovering DVDs has an added complication as many DVDs fail in a way that they can not be read by standard DVD readers.

The latest version of CnW Recovery has a wizard to recover Mini DVDs from video cameras. The wizard will first examine the disk to see if readable, and then will extract the video chapters, as MPEGs. For commercial reasons, the demo will not save these files to the hard drive, but will display th first few seconds of each chapter to give confidence that data will be recoverable. The licenced version will continue with a routine to recreate all the IFO files and merge the chapters into a standard VOB all within the stanard VIDEO_TS directory structure.

Decimal or Hex

2010-08-09T03:06:00.000-07:00

I have a personal pet hate of people who use decimal numbers when Hex number make far more sense. On an NTFS disk, the first MFT sector is very often 6,291,519. I cannot remember this number, but 0x60003F is actually very easy. It is made up of a disk partition starting sector of 0x3F, and a cluster size of 8 times the starting cluster of 0xc0000.

When analysing a disk many times sector number make far more sense in Hex than in decimal. Another example can be to determine the cluster size based on file start locations. with a series of start locations such as 512, 640, 1824, 2368 there is no clear patter, but the same numbers in hex are 0x200, 0x280, 0x720, 0x940 it will be a good guess that clusters are probably 0x20 sectors in length.

CnW Recovery software allows for both decinmal and hex to be used, and many menus have an option box to switch between the two. Although it may be easy at first, it is well worth getting used to thinking in Hex when working on disk contents and this helps even more when a complex number is actually made up of several sections. An example maybe a date which has 5 bits for seconds, 6 bits for minutes etc. A decimal number is pretty meaningless, but a hex number is much clearer - though ultimately it is best viewed as a binary number.

Think Hex. Many numbers make far more sense in hex when investigating a disk and computer data. Windows comes with a nice calculator that will flip between decimal and hex when required.

Old joke - There are only 10 types of people in the world, those who understand binary, and those who don't.

Slack space in NTFS

2010-08-08T07:23:00.000-07:00

Slack space on a file system is data that is within allocated clusters, but not actually used. When a file is allocated space on NTFS is normally allocates a number of clusters, and a cluster is often 16 sectors in length. Thus, if a file is say 5K long, then there will be 3K of the cluster which is allocated, but does not contain file information. Also, no user will ever see the contents of this 3K of slack space.

Forensically, slack can be useful as it may contain data from previously deleted files. The data will not be complete but it could conatin between 1 and 8191 bytes of useful (for an 8K cluster). CnW actually has an option to collect these fragments and storfe then in a big file with a header for each length of slack data from each incomplete cluster. It should be noted that slack space will only be found in the final cluster of a file. Thus for a 31K file, there will be 3 complete clusters, and the final cluster will have 1K of slack.

For NTFS, slack space does not stop here. To optimise disk usage, small files are stored after the MFT entry in the 1024 MFT block. The maximum size of file maybe about in the region of 5-600 bytes. Thus when analysing a disk for data in the slack area it is essential to examine each MFT for possible data after the MFT, maybe from previous uses of the block. Again, CnW Recovery has a feature so that all MFTs can store the slack in a specific file, again separating each entry with a header. For more details www.cnwrecovery.com/html/ntfs_forensic.html

Reiser FS

2010-08-07T02:13:00.000-07:00

Linux is still a niche operating systems but has many very keen fans. With Windows, there are two file systems that may be used, NTFS and FAT, but with Linux (and Ubuntu) it is possible to install several file systems and so there have been many developments each trying to be better, or faster. The most common file systems as Ext2/3, XFS and ReiserFS (version 3).

The most significant feature of ReiserFS is the way it stores the data on the disk. With FAT, each file always takes at least a cluster (maybe 16K). With NTFS each file over about 500 bytes always takes a cluster, while small files may be stored with the directory entry in the MFT block of 1024 bytes. ReiserFS will use blocks to full capacity. Thus with a 4K block, it may actually contain 5 to 20 files, or the start of a long file. This can mean that the disk can be used with virtually no slack or wasted space.

From the recovery view point this makes data carving a nightmare. For most file systems, data carving always examines just the first bytes of a sector to determine if the sector contains a file start. For the same to be true with ReiserFS, it may have to check every byte, or if the data is 64 bit aligned, every eigth byte in order to detect all possible file starts. Fortunately though, long files normally start on block starts, so normal carving will work, but in order to find all short files, a lot more care has to be taken.

MFTs and NTFS

2010-08-06T01:36:00.000-07:00

Probably the most import element of the NTFS file system is the Master File Table (MFT) structure. This is the block of data that stores information on every file. It contains the file name, dates, size and location on the disk. An MFT entry is normally 1024 bytes long, which means that at times, the file data for a short file (maybe less than 500 bytes) can be stored in this dirctory element, so avoiding having to allocate a 4K area of disk for a small file.

The MFT is made up of several elements, and the most important for receovery purpose are the file allocation locations, file name and the date metadata. On an NTFS disk, the file allocation informtion gives a starting location, and then the number of clusters in the data run. For fragmented files, there are extra staring locations (actually relative locations to the previous start). Occasionally, all the file information can not be fitted into a single 1024 block, so there is a system for chaining multiple MFT blocks.

Analysing the MFT by hand is not easy, so CnW Recovery have added a feature into the software so that an MFT sector is viewed, then moving the mouse over the data will display the decoded information. For more details, click here www.cnwrecovery.com/html/mft_parse.html.

Hard disk partitions

2010-08-05T02:53:00.000-07:00

A physical hard disk is a sequential series of sectors, typically 512 bytes long, though new disks with sectors of 4096 bytes are starting to appear. Logically, the disk can be split into multiple areas, or partitions. Each partition looks to the operator like a separate file. There are several reasons for multiple partitions such as below

House keeping - to keep disk sizes small
To prevent a logical drive getting bigger than 2TB
To separate data and programs
To have multiple boot mode with different operating systems
Hidden partitions for system recovery

Most drives still use a partition table in sector 0 to define upto 4 partitions, with the option of an extended partition that in effects chains to a new 'boot' sector and allows for an unlimited number of partitions. The maximum sensible number is probably less than 10.

A very common disk failure is for the boot sector to fail, or be corrupted / overwritten. In order to recover the disk data it is necessary to reconstruct the information that was stored in the partition table, and the critical values are the start sector, sector count in partition (the partition length) and the type of file system, eg NTFS, ReiserFS. Fortunately, thsi information can be discovered by scanning the disk and detecting certain elements such as a Bios Parameter Block, or a series of MFT entries. Thisa feature that CnW Recovery software performs as part of it's Partition function.

Which file is a sector in?

2010-08-04T03:22:00.000-07:00

Many forensic investigations will scan a complete hard disk for possible interesting strings. The result will be that the string is found in several sectors, but then there is the problem of discovering which files these sectors relate to.

CnW recovery software has a feature within the log to provide an answer to this question. As CnW retains all locations of file fragments, the sme information can be used to discover if a sector is used within any files. This with thelog, the user can search for a specific sector and it will indicate if it is part of a file, or even files. A sector can be marked as part of several files if one has been overwritten by a later file.

If the sector is not part of a file, then it indicates that the data has been found in unallocated space - whch can of course be carved to obtain possibly useful files

Locating file fragments

2010-08-02T17:50:00.000-07:00

When doing a forensic recovery one very important aspect is to log all actions so that they can be repeated. Recovering a file is reading a sequence of sectors, and many times they are in sequence, but not always. For the files that are out of sequence it is necessary to track each fragment / cluster.

The CnW log has a data column that records the number of fragments in a file. If this number in the log is clicked, each fragment (up to a maximum of 80) will be displayed as the starting sector, an sector run length. Abyone can then examine the original disk and establish how the file has been reconstructed.

Recovering deleted MAC files

2010-08-02T05:39:00.001-07:00

If a file on MAC has been deleted and removed from the trash bin, recovery is difficult. On may operating systems and file systems, a deleted file remains in the directory, but is marked as deleted. With a MAC, the catalog entry is cleared entirely and then the catalog sector is rewritten with no residual information on the file remaining.

The only way to recover MAC deleted files is with data carving. This is a process where the disk is scanned and the start of each sector is examined for known file signatures. For instance, a JPEG file will always start with the bytes 0xFF 0xD8 0xFF then normally a 0xE0 or 0xE1. A clever carving program will then go a few stages further and analyse the data. CnW will try and reconstruct a file name based on metadata within a file, so most JPEGs will be recovered with an original date.

The problem with data carving is that directory structure is retained.

When the file is deleted, so is all the information of where different setions of the file have been saved. Fortunately, most MAC files are sequential so a high recovery rathe can be expected.

Lost file or directory on NTFS

2010-08-01T03:17:00.000-07:00

Occasionally a file, or complete subdirectory may go missing on an NTFS disk. The most common reason actually is operator error, maybe by accidently dragging adirectory into another directory. The way to recover from this situation is to search the disk for a known file, and then work out what has been moved where.

The same problem can also occur when a critical sector fails or is corrupted. This can leave the directory tree with a logical break, and so leave files with no correct location. CnW recovery software has a good solution to this problem. as part of the recovery options, it allows for recovery from file entries. It will either scan the known $MFT (NTFS directory file) for individual MFT entries, or it can scan the complete disk. When an MFT is found it is tested to see if the Master File Table entry is for a file or a directory. If for a file it is recovered, and the directory path then reconstructed as much s possible. For the files that have been lost, a dummy direvctory entry will be created, eg lostdir123, and all files related to the lost directory will be placed together. To find your lost file, either the recovered filoes can be searched, or the log examined to determine the new location

Clicking disk drives

2010-07-31T01:34:00.000-07:00

Often customers for disk recovery say that the computer just stopped. It then often turns out that the computer has been going very slow, or making clicking noises.

Hard disk drives will click when the head cannot locate a track. It will try and recalibrate itself by moving the head as far out as possible, and the clicking is when it hits the end stop. When it does this every second or so, it indicates there is a major problem with the drive. Sometimes the sector will be read, and the clicking will stop, but other times, it will continue and the drive will be dead.

If clicking noises are heard from the drive then this indicates there are problems. The drive may continue for months, or could die a few minutes later. The only safe thing to do is to copy off any files that have not been backed up, followed by a full backup. The next stage is to replace the drive. A new physical drive these days is not expensive, and much cheaper than data recovery.

If the drive does die with clicking noises the most likely reason is that the heads have failed. In maybe 80% of cases they can be replaced, but the cost could be 5 to 20 times that of a new drive. Thus take any clicking seriously with a full backup, and most likely a new hard drive.

CnW Recovery does not work on head replacement, but can recommend companies to assist.

NAS RAID drives

2010-07-30T01:30:00.000-07:00

For a small business, or even home user, the thought of secure data storage is very attractive. Network Attached Storage (NAS) systems are becoming very popular as they may be shared on a network by several PCs, some even purely by wireless interface. The idea of a RAID is that if one drive should fail, the other one will still have the information, so no data should be lost.

Recently, at CnW Recovery I have seen several RAID systems where it is the RAID controller, rather than the drive which has failed. This ends up with multiple, physically working drives, but no way to access the data. Most RAID controllers actually use some kind of Unix file system and recently we have seen XFS, ReiserFS and Ext2 as the data storage. The drives do also typically contain a few Unix partitions to power the Linux based controller system.

To recover the data it is necessary to remove the drives and then logically read the data partition of the drive. CnW software is being developed to make this as easy as possible, and new variations of drive layout are being added on a regular basis.

The main warning of this blog is that a RAID is not quite as secure as the manufacturers might imply, but at the same time, help is on hand to recover the data.

How to avoid data recovery

2010-07-29T11:58:00.000-07:00

This may be an odd item to write about in a data recovery blog, but actually the best kind of data recovery is not to require it. The critical word is 'Backup'. However, I get many customers who say that they were about to do a backup, or where going to do a backup when they had finished their project, university work etc, and then all of a sudden everything is lost.

For a safe backup there are a few critical points

Must be done automatically, or on a regular basis
A backup must be stored on another piece of media
A backup must be stored in a different location
A backup must be tested with the occasional restore

For many users and small businesses a very easy type of backup is an online system that automatically backs files up when they are added to the system, or edited. There are many available, but the one I use is Carbonite as it is automatic, and has unlimited capacity. It ticks all four boxes above.

The different media is essential as if just a different partition is used, this could fail at the same time as the key data partition.

The different location will cover events such as fire and theft. For non sensitive data, then placing a backup drive in the office or home is a good start, or with friends are neighbours.

Another point on backup is the ability to recreate a complete system disk from scratch in the event of a complete failure. For this one requires disk image of the system disk and Acronis is a popular solution, but not one I have tried.

Always think that if any thing is not backed up, it could be lost - so BACKUP now.

Reconstructing video disk from MPEGs

2010-07-28T02:13:00.000-07:00

Recovery programs are very good at recovering MPEGs but these are not typically viewable with a DVD player. To view the files it is necessary to create a VIDEO_TS directory with .IFO and .VOB files. To convert MPEGS into such a structure it is normally necessary to a 3rd part product such as IFOEDIT. IFOEDIT is a very good (free) program, but it is maybe a bit too complex for many users. CnW Recovery software has a built in tool to recreate a video disk from MPEGS, and for many users this is a straight forward simple function. There is also a nice feature in that it is included as part of the free demo of CnW Recovery software.

Recovery from a formatted disk

2010-07-27T02:28:00.000-07:00

I occasionally receive disks that are perfectly valid, with intact files and file system. However, the history of them is that they have been reformatted,and the original files lost. To make things slightly worse, the file system may have been changed. Thus an original FAT32 disk couldnow be a NTFS or the other way around.

To help detect this, CnW Recovery software has a function on the partition scan that will count the number of MFTs (for NTFS) or directory clusters for FAT disks. It will often be clear at the end of the scan if there was a different file system on the disk at a previous time. It is then possible, using the partition manager to force the disk to act as a certain format, eg FAT32 or NTFS before recovering the files.

Often in instances where the file system has been changed, most of the critical file information will have been overwritten, but fortunately all file systems tend to use different areas of the disk so it possible that a complete MFT (NTFS directory sectors) may still be intact as may be many FAT32 directories. By analysing this remaining fragmenst, it is possible to determine the critical parameters before attempting a recovery.

Often a very complete recovery will be possible, as long as the disk has not been used too much after reformatting.

Hashing in forensic recovery

2010-07-26T03:31:00.000-07:00

With any forensic investigation, the term hashing will appear somewhere. But what is hashing, and how important is it?

Hashing is a digital signature, and therefore is unique for each file or document. The most common standard is MD5 which is a 16 byte number, normally displayed as a string of 32 hex text characters. It is secure because any single bit change, anywhere in the file will produce a completely different hash value. It is also secure because there is no way of working out from the result, what the original data string was.

When a file is recovered, or imaged, the whole file is scanned, and a hash value is produced. In future, if the same file has it's hash value calculated, as long as it is the same, then the file is identical. It would be impossible to tamper with the file without changing the hash value. Thus forensically, the reason for hashing is as part of the chain of custody. If is file is read, then it can be distributed as evidence and as long as the hash remains the same, the file is the same. For this reason, the CnW Recovery software always includes a file hash value in the log for forensic applications.

There are possible dangers with hashing. It can be taken because there is hash value, then the file is true, but it must always be considered that a file could have been tampered with before the original recovery or investigation was made.

The second concern is that the MD5 hashing routine has been broken in forensic terms. ie a file has been modified, and kept the same hash value. To do this takes a lot of skill, and a lot of computing power to discover which 16 byte number has to be inserted at which location in the file to produce an unchanged hash value. The solution to this concern is to use longer hash values, such as SHA-1, SHA-256.

My personal view though is that for 99.999999% of applications, MD5 is adequate, and will always detect accidental and transmission errors. With increasing computer power, it true that the length of the hash will have to increase, and each extra byte will improve the strength by 256 times. However in March 2011, SHA-256 has been added to the forensic log

Why photo recovery sometimes has corrupted photos

2010-07-25T10:52:00.000-07:00

Digital cameras are great, and so are memory chips, but sometimes failures happen and photos are lost. The typical reason is that part of thye chip is corrupted when taking it out of the camera, or plugging into the PC. Data recovery is fairly straight forward, and many recovery programs will produce good results. The problem comes when some of the photos will not open or are otherwise corrupted.

When a memory chip is corrupted, it is very common for the file allocation table (FAT) to be destroyed which means that the normal recovery program can only assume that the photo was stored sequentially, and again many times this is the case. If you are a photographer that has deleted some photo in the camera, either because they were bad, or to save space then new photos will be fragmentd when stored. This means that different parts of the photo will be stored in different areas of the memory chip. The location of each sector (or cluster) used is stored in the FAT, and this is the critical element which may be missing. Hence photos are not recovered correctly.

The solution is a feature rarely found in recovery software that will examine all the memory chip and reconstruct photos even when the fragments have been scattered over the memory chip. Although it may not be possible to be 100% reliable, extra photos will be recovered that otherwise would be lost. For more details see www.cnwrecovery.com/html/jpeg_frags.html

Erased DVD-RW video disks

2010-07-25T05:30:00.000-07:00

Mini video DVD-RW often get either accidently erased, or fail due to camera or operator error. The reason is not too important, but the result can be a video disk that can not be read, and all PCs just state that the disk is blank.

Very few data recovery companies can handle this type of error, but CnW Recovery have developed special hardware to allow such disks to be recovered. As long as the erase was a quick erase, that nomrally takes less than 2 minutes, then the recovery success rate is extremely high. There is a fixed fee of just £40, and no fix, no fee. www.cnwrecovery.co.uk/html/dvd_recovery.html for more details.

Undelete software

2010-07-24T04:09:00.000-07:00

We all make mistakes, and deleted files, or directories is a common one. There are lots of software packages that claim to help, but some can actually make things worse, and all, if not used carefully can add to misery by permanately overwriting file that could have been recovered.

When a file is deleted the process is that either the directory entry is marked as deleted, or in the case of Macintosh systems, and some Unix file systems, the file name and details are also deleted. On most common systems (unless special scrubbing software is included) the data remains unchanged on the disk, but the area the data occupies is redesignated as unallocated. This means that any new file can use the space that was previously assigned to the deleted files. Unless you have the budget of the CIA and FBI combined, it is safe to say that an overwritten sector is just that, an previous data is lost for ever. The danger of downloading a data recovery, or undelete program onto the computer where files have been deleted, is very significant. There is no way to stop the program being copied to areas where the deleted files were, and so data will be lost for ever.

Any use of the computer, or even just leaving it one can cause files in unallocated space to be overwritten. For instance, virus checkers ar always having updates, and does Microsoft. Any web browsing generates many temporary files. Shut down must be as soon as possible. The only safe solution is to turn the computer off and remove the drive entirely. Any other approach, or delay increases the chance of permanant loss. Even shutting down the computer writes files. For many forensic investigations it is often suggested the best way is to literally pull the plug, and not try an organised shut down.

The safe solution is to remove the drive and set it up as a slave drive on a different computer running the undelete, or data recovery software. For critical application, or forensic investigation a write blocker should be used to ensure that no data is written to the slave drive.

When it comes to undelete software, gain it is very dangerous to atually try and undelete rather than recover the deleted files to a different drive. With a FAT device, the locations that the original file are stored in is delted when the file is marked as deleted. Undeleting will therefore just assume that the file is sequential - a good starting point, but not always true. Also, for FAT32 files, the starting point of the file is only partitally known, and very few recovery programs actually determine the correct location. Fortunately CnW Recovery does work out the correct location for files of a known type. See www.cnwrecovery.com/html/fat32.html for more details.

Recovery from a Western Digital 250GB disk

2010-07-23T05:42:00.000-07:00

I received a WD 250 GB disk that span, and was even recognised by the BIOS. However, every sector read failed. When putting it on the PC3000 UDMA system (Russian hard drive recovery product) it indicated that part of the service area of the disk was corrupted. The next stage was a complete backup of all the readable firmware, and service area before the failed translation module was regenerated. It worked, and the drive was then imaged before running the data recovery process of the slightly corrupted NTFS drive.

HP Media vault

2010-07-23T01:21:00.000-07:00

Received a pair of disks recently that were unreadable with with the original HP Media vault. The disks were 300GB and 750GB giving a capacity of just over 1TB. The first disk started with the string "Broadcom NAS Version 1.1 MBR Tag" and did not have a standard boot sector. The second disk had a standard boot sector, but a header suggesting a FAT32 disk.

Both disks actually had Reiser FS as their data structure. After investigation, it was determined that the data was in three stripes, and the locations are stored in sector 1 (ie second on the disk) of each disk. A few enhancements to the CnW Recovery software (http://www.cnwrecovery.com/) and all the data was read and recovered. It was read using the JBOD feature in the RAID option