Page 2 of 2
Re: Custom format specification: VHD, Virtual HD Image
Posted: Tue Dec 18, 2012 9:49 pm
by AKazak
Alt wrote:I'm waiting for the next R-Studio version, it has some improvements in processing known file types. It's going to be released soon.
When the release is expected?
Re: Custom format specification: VHD, Virtual HD Image
Posted: Wed Dec 19, 2012 1:07 pm
by Alt
We're testing it.
I've a question:
does the second sector (Sector 1) of all VHD files contain this string at the beginning:
63 78 73 70 61 72 73 65 - FF FF FF FF FF FF FF FF ?
or a part thereof?
Re: Custom format specification: VHD, Virtual HD Image
Posted: Thu Dec 27, 2012 4:40 pm
by AKazak
Alt wrote:
I've a question:
does the second sector (Sector 1) of all VHD files contain this string at the beginning:
63 78 73 70 61 72 73 65 - FF FF FF FF FF FF FF FF ?
or a part thereof?
Exactly! I analyzed all VHD files I have in HEX editor and the
second sector (Sector 1) always starts with:
Code: Select all
63 78 73 70 61 72 73 65 ff ff ff ff ff ff ff ff
00 00 00 00 00 00 06 00 00 01 00 00
Re: Custom format specification: VHD, Virtual HD Image
Posted: Fri Dec 28, 2012 10:32 am
by Alt
1. Download the latest version of R-Studio.
2. Use this file description file:
<?xml version="1.0" encoding="UTF-8"?>
<FileTypeList version="1.0">
<FileType id="113" group="Disk Images" description="Virtual PC Virtual HD Image" features="" extension="vhd">
<Signature from="begin" offset="512">\x63\x78\x73\x70\x61\x72\x73\x65\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF</Signature>
<Signature from="end" offset="512">conectix\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00</Signature>
</FileType>
</FileTypeList>
3. Disable all other file types when scanning.
4. Pray that the files aren't fragmented.
And good luck for file recovery.
Re: Custom format specification: VHD, Virtual HD Image
Posted: Fri Dec 28, 2012 12:20 pm
by AKazak
Alt wrote:4. Pray that the files aren't fragmented.
Thank you!
The deleted files are on external USB drive. Does it guarantee non-fragmented write? How do I know if the files are fragmented?
Re: Custom format specification: VHD, Virtual HD Image
Posted: Sat Dec 29, 2012 2:45 pm
by Alt
File fragmentation mostly depends on how often data was being deleted, written, and overwritten on the disk. Also, if those VHDs were static or dynamic. Nothing can be said conclusively until the end of data recovery. And if it's successful, the recovered files weren't fragmented. Otherwise, a lot of causes may make data recovery fail. Starting from some bugs or imperfect data recovery algorithms of R-Studio to mistakes during the process of data recovery to fragmented files.