Custom format specification: VHD, Virtual HD Image

A forum on data recovery using the professional data recovery software R-STUDIO.
AKazak
Posts: 6
Joined: Tue Nov 20, 2012 2:01 am

Re: Custom format specification: VHD, Virtual HD Image

Post by AKazak » Tue Dec 18, 2012 9:49 pm

Alt wrote:I'm waiting for the next R-Studio version, it has some improvements in processing known file types. It's going to be released soon.
When the release is expected?

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Wed Dec 19, 2012 1:07 pm

We're testing it.

I've a question:
does the second sector (Sector 1) of all VHD files contain this string at the beginning:
63 78 73 70 61 72 73 65 - FF FF FF FF FF FF FF FF ?
or a part thereof?

AKazak
Posts: 6
Joined: Tue Nov 20, 2012 2:01 am

Re: Custom format specification: VHD, Virtual HD Image

Post by AKazak » Thu Dec 27, 2012 4:40 pm

Alt wrote: I've a question:
does the second sector (Sector 1) of all VHD files contain this string at the beginning:
63 78 73 70 61 72 73 65 - FF FF FF FF FF FF FF FF ?
or a part thereof?
Exactly! I analyzed all VHD files I have in HEX editor and the second sector (Sector 1) always starts with:

Code: Select all

63 78 73 70 61 72 73 65 ff ff ff ff ff ff ff ff
00 00 00 00 00 00 06 00 00 01 00 00

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Fri Dec 28, 2012 10:32 am

1. Download the latest version of R-Studio.
2. Use this file description file:
<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="1.0">
<FileType id="113" group="Disk Images" description="Virtual PC Virtual HD Image" features="" extension="vhd">
<Signature from="begin" offset="512">\x63\x78\x73\x70\x61\x72\x73\x65\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF</Signature>
<Signature from="end" offset="512">conectix\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00</Signature>
</FileType>
</FileTypeList>
3. Disable all other file types when scanning.
4. Pray that the files aren't fragmented.

And good luck for file recovery.

AKazak
Posts: 6
Joined: Tue Nov 20, 2012 2:01 am

Re: Custom format specification: VHD, Virtual HD Image

Post by AKazak » Fri Dec 28, 2012 12:20 pm

Alt wrote:4. Pray that the files aren't fragmented.
Thank you!
The deleted files are on external USB drive. Does it guarantee non-fragmented write? How do I know if the files are fragmented?

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Sat Dec 29, 2012 2:45 pm

File fragmentation mostly depends on how often data was being deleted, written, and overwritten on the disk. Also, if those VHDs were static or dynamic. Nothing can be said conclusively until the end of data recovery. And if it's successful, the recovered files weren't fragmented. Otherwise, a lot of causes may make data recovery fail. Starting from some bugs or imperfect data recovery algorithms of R-Studio to mistakes during the process of data recovery to fragmented files.

Post Reply