Custom format specification: VHD, Virtual HD Image

A forum on data recovery using the professional data recovery software R-STUDIO.
AKazak
Posts: 6
Joined: Tue Nov 20, 2012 2:01 am

Custom format specification: VHD, Virtual HD Image

Post by AKazak » Tue Nov 20, 2012 2:12 am

Greeting!

I try to create a custom format XML to recover a large (~200 GB) file of VHD format.
As per format, the start and end signatures of VHD file are absolutely the same and have length 512 bytes starting from "conectix".
Here is the current version of the XML file:

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
  <FileTypeList>
    <FileType id="113" group="Disk Images" description="Virtual PC Virtual HD Image" extension="vhd">
        <Signature from="begin" offset="0">\x63\x6f\x6e\x65\x63\x74\x69\x78\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00</Signature>
        <Signature from="end" offset="512" size="512">\x63\x6f\x6e\x65\x63\x74\x69\x78\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00</Signature>
    </FileType>
  </FileTypeList>
In the result, however, I get only 2 files of 512 bytes.

What could be my mistake and how can I improve?

Thank you in advance for the detailed reply!

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Tue Nov 20, 2012 11:01 am

I would remove size="512" from the end signature.

AKazak
Posts: 6
Joined: Tue Nov 20, 2012 2:01 am

Re: Custom format specification: VHD, Virtual HD Image

Post by AKazak » Wed Nov 21, 2012 2:23 pm

VHD file has the following structure:
Image
where
512-byte signature is highlighted in blue, and
a magic part of signature (the same for all VHD files) is highlighted in yellow.

512-byte signature is unique for every VHD file, but the same at the beginning and at the end of a single VHD file.

Should I use a different VHD format specification XML file?
Last edited by AKazak on Thu Nov 22, 2012 2:41 am, edited 1 time in total.

AKazak
Posts: 6
Joined: Tue Nov 20, 2012 2:01 am

Re: Custom format specification: VHD, Virtual HD Image

Post by AKazak » Thu Nov 22, 2012 2:40 am

Alt wrote:I would remove size="512" from the end signature.
I removed size="512" from the end and started scan again:

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
  <FileTypeList>
    <FileType id="113" group="Disk Images" description="Virtual PC Virtual HD Image" extension="vhd">
        <Signature from="begin" offset="0">\x63\x6f\x6e\x65\x63\x74\x69\x78\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00</Signature>
        <Signature from="end" offset="512">\x63\x6f\x6e\x65\x63\x74\x69\x78\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00</Signature>
    </FileType>
  </FileTypeList>
The result is still the same: only 2 files of 512 bytes have been found.

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Thu Nov 22, 2012 5:23 am

OK. Let's start debugging the description. Remove the signature for the file end, and see what R-Studio finds. Just to see that the signature for the file beginning is correct. Once through, we'll start debugging the signature for the end.

Guest

Re: Custom format specification: VHD, Virtual HD Image

Post by Guest » Tue Nov 27, 2012 2:31 am

Alt wrote:OK. Let's start debugging the description. Remove the signature for the file end, and see what R-Studio finds. Just to see that the signature for the file beginning is correct. Once through, we'll start debugging the signature for the end.
Scan resulted in 2 VHD files found and one of them has similar size. But when I recovered it to a different HDD and tried to mount, I got the following error:
Image

Then I looked inside and discovered, that the ending signature is missing.
I suppose that R-Studio scan engine should look for presence of starting and ending signatures in order to properly recover a VHD file.

What is your next suggestion?

Guest

Re: Custom format specification: VHD, Virtual HD Image

Post by Guest » Tue Nov 27, 2012 6:39 am

Please try to place a sample Original.vhd on a HDD, delete it using Shift+Del and recover with the current vhd.xml .

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Wed Nov 28, 2012 5:09 am

I downloaded the files and will look at them soon.

Guest

Re: Custom format specification: VHD, Virtual HD Image

Post by Guest » Fri Dec 07, 2012 12:40 pm

Alt wrote:I downloaded the files and will look at them soon.
Have you played with recovery of the test VHD file?

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: Custom format specification: VHD, Virtual HD Image

Post by Alt » Mon Dec 10, 2012 3:32 am

I'm waiting for the next R-Studio version, it has some improvements in processing known file types. It's going to be released soon.

Post Reply