Jump to content











Photo
* * * * * 4 votes

CloneDisk


  • Please log in to reply
603 replies to this topic

#51 niteflyer

niteflyer
  • Members
  • 6 posts
  •  
    Germany

Posted 14 August 2009 - 07:22 AM

@erwan:

Hi NiteFlyer,
That could easily be added.
By default, all will be checked so the entire mbr would be saved.
Advanced users could save only portions of the mbr.
Then I guess I will add a concat feature in clonedisk as well so one can re assemble 2 files together to reconstruct a mbr (or else).


Thanks for considering the restore options. To make it clear: the function "Save MBR" can remain as is. The options will only be evaluated when restoring the MBR, which will replace the checked sections in the MBR of the selected target disk with the sections of a saved MBR file.

@jaclaz:
"Reserved" mean the two bytes after the disk signature, which are usually 00h (see wikipedia), but I could imagine that some applications implement DRM in these two bytes, so that it could be useful to be able to restore or not restore these bytes.

MBR____
|CODE (First 440 Bytes+2 Ending Magic Bytes)
|SIGNATURE (4 bytes)
|DATA (Partition Table 64 Bytes)
_____|1st Partition Entry (16 bytes)
_____|2nd Partition Entry (16 bytes)
_____|3rd Partition Entry (16 bytes)
_____|4th Partition Entry (16 bytes)


This does not correspond to wikipedia: code is 440 bytes, followed by signature (4 bytes), followed by "reserved" (2 bytes). I guess we have to investigate, which one is correct...

#52 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 14 August 2009 - 09:11 AM

This does not correspond to wikipedia: code is 440 bytes, followed by signature (4 bytes), followed by "reserved" (2 bytes). I guess we have to investigate, which one is correct...


I see. :unsure:

I have never seen anything different from 00 in those two bytes.

They are used (bytes at offset 0x01BC + 0x01BD) together with the two (bytes at offset 0x01B2 and 0x01B3) in the "XP Kansas City Shuffle":
http://www.911cd.net...showtopic=21242
http://www.911cd.net...o...1242&st=139

0x1B2 is also used by MBRFix and MBRWiz as "Status Byte".

I didn't mention them as I presumed that people using the "XP Kansas City Shuffle" are a relatively small number and usually "know where their towel is"

Revised proposal ;):
MBR____

	|CODE (First 440 Bytes+2 Reserved bytes + 2 Ending Magic Bytes)

		|Real Code (first 438 bytes)

		|XP KCS (4 bytes 0x01B2  0x01B3 0x01BC 0x01BD)

			|Status Byte (0x01B2)

			|Unused byte (0x01B3)

			|Reserved Bytes (2 bytes 0x01BC 0x01BD)

		|Magic (2 Ending Magic Bytes)

	|SIGNATURE (4 bytes)

	|DATA (Partition Table 64 Bytes)

	_____|1st Partition Entry (16 bytes) 

	_____|2nd Partition Entry (16 bytes) 

	_____|3rd Partition Entry (16 bytes) 

	_____|4th Partition Entry (16 bytes)

:frusty:

jaclaz

#53 joakim

joakim

    Silver Member

  • Team Reboot
  • 912 posts
  • Location:Bergen
  •  
    Norway

Posted 14 August 2009 - 09:20 AM

This does not correspond to wikipedia: code is 440 bytes, followed by signature (4 bytes), followed by "reserved" (2 bytes). I guess we have to investigate, which one is correct...

The "2 ending magic bytes" are actually located at the very end of the first sector (and not the "2 reserved ones"), looking like it belongs to to the partition table (as its on the same line as the fourth partition in your hex editor,, but not part of that). No need to investigate that further.

Joakim

#54 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 14 August 2009 - 10:40 AM

The "2 ending magic bytes" are actually located at the very end of the first sector (and not the "2 reserved ones"), looking like it belongs to to the partition table (as its on the same line as the fourth partition in your hex editor,, but not part of that). No need to investigate that further.

Joakim


@joakim
to avoid misunderstandings, the two reserved bytes we were talking about are those at offset 0x1BC and 0x1BD.
The two "magic bytes" are the last two on the sector 0x1FE and 0x1FF, and yes, they are NO mistery. ;)

:frusty:

jaclaz

#55 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 3041 posts
  • Location:Nantes - France
  •  
    France

Posted 14 August 2009 - 11:48 AM

@jaclaz:

Yes, I know one could use several workarounds to assemble/patch a MBR-file, but I am expecting something like this from a GUI-tool (see attachment). The restriction that we may only write in units of 512 bytes does not prevent from changing certain portions within this sector in memory before writing it to disk: read the target-MBR to memory and replace the checked options with the corresponding sections of a saved MBR-file and finally write it back to disk. ceca...

@erwan:
Can you implement this?


thinking out loud :
-when restoring, should it be from a full mbr and then i would pick the requested parts from the mbr file, or should it be from one file being a part of a mbr (and then we should have radiobuttons not checkboxes)? (i would go for choice 1)
-same for backuping : it should be radio buttons to dump a file being a part of a mbr to eventually concat these parts back to a full mbr later.

#56 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 14 August 2009 - 12:23 PM

thinking out loud :
-when restoring, should it be from a full mbr and then i would pick the requested parts from the mbr file, or should it be from one file being a part of a mbr (and then we should have radiobuttons not checkboxes)? (i would go for choice 1)
-same for backuping : it should be radio buttons to dump a file being a part of a mbr to eventually concat these parts back to a full mbr later.


I imagined that just as the Winbuilder interface for .scripts, different "level" or "hierarchical" checkboxes.
I would only Save/Store/Backup "full" MBR's and then use the interface to get from the "full" parts the single items.

:frusty:

jaclaz

#57 niteflyer

niteflyer
  • Members
  • 6 posts
  •  
    Germany

Posted 14 August 2009 - 12:33 PM

I would only Save/Store/Backup "full" MBR's and then use the interface to get from the "full" parts the single items.


I agree with that. That keeps things simple and compatible with MBRs generated by other tools. That's why I only wanted the restore part to be modified with restore options.

I prefer checkboxes, maybe only with a verification that at least one is checked or be sure to restore nothing when none is checked. Maybe you could issue a warning for that case or disable the restorebutton.

#58 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 3041 posts
  • Location:Nantes - France
  •  
    France

Posted 14 August 2009 - 03:22 PM

I agree with that. That keeps things simple and compatible with MBRs generated by other tools. That's why I only wanted the restore part to be modified with restore options.

I prefer checkboxes, maybe only with a verification that at least one is checked or be sure to restore nothing when none is checked. Maybe you could issue a warning for that case or disable the restorebutton.


Version 1.5.2 can now restore specific parts of the MBR.
I basically reproduced the screenshot you attached some posts ago.

Regards,
Erwan.

#59 ktp

ktp

    Silver Member

  • Advanced user
  • 773 posts

Posted 15 August 2009 - 05:28 AM

Yesterday I deleted by error a logical partition on an external USB HDD and had difficulties recovering it using many tools like Testdisk, Partition Recovery...

I had an MBR and track 0 backup but it not useful since it does not change anything (since the extended partition did not change in size).
What I need is a complete backup of the MBR and all the logical partitions links (?) and EPBR (Extended Partition Boot record).
Is there a backup utility than can do this (and can restore upon an accidental logical partition deletion)?.

#60 online

online

    Silver Member

  • Advanced user
  • 767 posts

Posted 15 August 2009 - 07:42 AM

@ktp

Take a look here http://smallsrv.com/recovery/

#61 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 3041 posts
  • Location:Nantes - France
  •  
    France

Posted 15 August 2009 - 08:22 AM

Yesterday I deleted by error a logical partition on an external USB HDD and had difficulties recovering it using many tools like Testdisk, Partition Recovery...

I had an MBR and track 0 backup but it not useful since it does not change anything (since the extended partition did not change in size).
What I need is a complete backup of the MBR and all the logical partitions links (?) and EPBR (Extended Partition Boot record).
Is there a backup utility than can do this (and can restore upon an accidental logical partition deletion)?.


Hi ktp,
If you provide me detailed specs, I could may be add this feature to clonedisk.
logical partitions links ? EPBR?

Regards,
Erwan.

#62 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 15 August 2009 - 09:12 AM

@ktp
I've NEVER seen in my life that TESTDISK cannot recover a partition if it was just deleted. ;) ;)

For your specific problem, start a new thread with details and I may be able to help you. :frusty:

About backup, Beeblebrox can "navigate" allright in the Extended Partition "chain":
http://students.cs.byu.edu/~codyb/

@erwan.l
The data is dynamic, you need to parse the MBR to find the address of the FIRST EPBR.
The entry in MBR has partition ID 05 or 0F:
http://www.win.tue.n...on_types-1.html
and points to FIRST EMBR or EPBR, this is still mostly valid and one of the easiest to follow:
http://www.ranish.com/part/primer.htm
EACH EPBR has two entries, one "for itself" and one for NEXT EPBR.

As suggested above, try using beeblebrox on a disk with an Extended Paretition and several Logical Volumes inside it and everything will become clear.

:unsure:

jaclaz

#63 ktp

ktp

    Silver Member

  • Advanced user
  • 773 posts

Posted 15 August 2009 - 01:10 PM

@online
Thank you for the link to the utility.

@jaclaz
> I've NEVER seen in my life that TESTDISK cannot recover a partition if it was just deleted.
The fact is that my USB HDD has one primary entirely truecrypted. This partition is not found by TestDisk (even after Deep Search), it is not even shown as Unknown paritition as with other utility like Partition Recovery.

After deep search, TestDisk finds the candidate for lost logical partition but the browse file (key P) said bad file system and did not show any files/directories structure as it should be.
Partition Recovery at start gives me immediately the lost partition with correct label, size and preview (directories structure and files), but then it cannot recover because no available space to move to inner logical extended partition !

#64 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 15 August 2009 - 02:33 PM

The fact is that my USB HDD has one primary entirely truecrypted. This partition is not found by TestDisk (even after Deep Search), it is not even shown as Unknown paritition as with other utility like Partition Recovery.


I often wonder what kind of military, industrial, or personal secrets people has that requires encryption. ;) (or how many nosy other people with actual access to that particular disk they have surrounding them)

With all due respect for your choices ;), I personally find that the single most "stupid" thing to do with DATA is to play with them, encrypting them, putting unneeded passwords that you'll soon or later forget and so on. :frusty:

As said, if you start a new thread with details I may be able to help you.

:unsure:

jaclaz

#65 ktp

ktp

    Silver Member

  • Advanced user
  • 773 posts

Posted 15 August 2009 - 03:21 PM

@jaclaz

For the lost partition, I already managed to recover it from my backups (two copies). This is not the encrypted partition. The mis-deleted partition is a public one.

For the need of encryption, this is for the case my (small) USB key (thumb-size) could be lost (or stolen), although the probability is low.
My key is used for rescue (myself and others) and also as portable applications/data (travelling, no own notebook etc...). Some data are personal (login, password, SSH keys, documents...) that must be protected (or at least cause sufficient delay for cracking them so that I can change my login/password in the mean time after the USB key is lost/stolen).

For me TestDisk has a flaw: if a partition is encrypted, it does not display them (with size etc...) as unknown, but considers it as unallocated space. So if you recover another deleted partition, and hence need to rewrite the MBR, then the encrypted partition would be lost!

#66 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 15 August 2009 - 04:14 PM

Some data are personal (login, password, SSH keys, documents...) that must be protected (or at least cause sufficient delay for cracking them so that I can change my login/password in the mean time after the USB key is lost/stolen).


For which you can use FILE encryption allright, as opposed to FILEsystem encryption. ;)

:frusty:

jaclaz

#67 niteflyer

niteflyer
  • Members
  • 6 posts
  •  
    Germany

Posted 17 August 2009 - 07:41 AM

Version 1.5.2 can now restore specific parts of the MBR.
I basically reproduced the screenshot you attached some posts ago.

Regards,
Erwan.


Wow, that was fast and it works! Thank you very, very much. 5 stars !!! :unsure: :frusty: :unsure: ;) ;)

Although I have experienced a crash of CloneDisk while testing. Here is what happened on my WinXP Pro SP2, IDE-Quantum Fireball (1GB), SATA-Samsung HD103UJ, SATA-Samsung 403LJ (Physical Drives 0-2). OS is installed on physical drive 1 on logical drive C, both partitions of physical drive 0 show up as drive D and E in Windows Explorer, all other partitions are hidden:

While testing I had one open Explorer window showing the Desktop, one instance of the HexEditor HxD and CloneDisk. I took a MBR-Backup of drive #0, made copy to fill the whole sector with FF, which was successfully restored (without Advanced options) to physical drive #0. Then I selected the Magic bytes from the backup for selective restoration and CloneDisk crashed after selection of the backupfile (Windows: Application had a problem... etc. Sorry for inconvenience... etc). The details identified shell32.dll (or shell.dll ???) as the problem.

After restarting CloneDisk, I saw that the Magic bytes were restored successfully and all following tests with the other sections did not reveal this error any more. Don't know if you have to care about this seriously; it's just for information.

#68 oriensol

oriensol

    Frequent Member

  • Advanced user
  • 216 posts
  •  
    India

Posted 01 September 2009 - 02:50 AM

@ erwan.l

Thanks for this fantastic tool.

Can I suggest you add a check for the disk sizes before allowing the disk to disk cloning?

#69 fuwi

fuwi

    Frequent Member

  • Expert
  • 135 posts
  • Location:Switzerland
  •  
    Switzerland

Posted 16 September 2009 - 11:35 AM

@erwan.l

Thanks for this tool!

Can you make (in a future release) that the GUI starts centered on the screen?
When starting Clonedisk in WinPE with 600x800 screenresolution, it looks like this:
Posted Image

fuwi


#70 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 3041 posts
  • Location:Nantes - France
  •  
    France

Posted 16 September 2009 - 08:31 PM

Hi Fuwi,
Good point indeed.
This is now fixed.
Download it again and it should be centered on your desktop.

Nice winpe you have there : which version is it?

Regards,
Erwan.

#71 fuwi

fuwi

    Frequent Member

  • Expert
  • 135 posts
  • Location:Switzerland
  •  
    Switzerland

Posted 17 September 2009 - 06:38 AM

Hi Erwan

This is now fixed.
Download it again and it should be centered on your desktop.

Thanks a lot, now it's perfect!

Nice winpe you have there : which version is it?

It's standard PEBuilder with ShellPE instead of nu2menu as shell: http://www.redcl0ud.com/winpe.html
The QuickLaunch-Bar at the top of the screen is from me: http://www.911cd.net...&...st&p=157986

Regards,
fuwi

#72 TheHive

TheHive

    Platinum Member

  • .script developer
  • 4198 posts

Posted 17 October 2009 - 01:16 AM

Thanks for the program.

This should be made into a Script.

On first running it from ISO into NativeEx Project I cannot see the Sizes of the drives untill I use the Infomations tab [Drives' Info]. It can probably combined to show in on the bottom right where the empty space is.

I received an error when looking at the HD info for the running Drive in Vmware.
1.jpg

----------------------------
Error
7.jpg
8a.jpg
8b.jpg
8c.jpg
9a.jpg
9b.jpg
9c.jpg
10.jpg


----------------------------

Suggestion: Have extra option to save the report, instead of having only the option "Send Bug Report"

When trying to send the report while in NativeEX PE I get the error
error loading url.dll
2.jpg


Suggestion: Combine Information tab into the first tab
3.jpg


A few more suggestions:
4.jpg

5.jpg

6.jpg

Info needed in other tabs also.
What is Sparse FIle
When and Why should this tab be used.

What is the BS tab: Just looking at it at first you think of a bad curse word. lol!
When and Why should this tab be used.

What is the MBR tab:
When and Why should this tab be used.

What is the Delete Layout tab: mmm!
When and Why should this tab be used.

What is the Resize tab:
When and Why should this tab be used.
How will it effect a drive that already has data.

What is the Wipe tab:
When and Why should this tab be used.

These should help users that may download the program from another source or that are just testing the program.


Thanks! I missed this post when I was out for some time. Hope youre still around. Or someone can email you.

#73 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 3041 posts
  • Location:Nantes - France
  •  
    France

Posted 17 October 2009 - 06:48 PM

Hello TheHive,
I have fixed the error : seems that some the XML libraries are not always there.
No problem, the program can now run without it.

I have implemented all of your advices except one : the information tab merged into others.
This requires more time to redesign the program.

Thanks a lot for your feedback.

Download new version 1.5.4 and enjoy.

Regards,
Erwan.

#74 TheHive

TheHive

    Platinum Member

  • .script developer
  • 4198 posts

Posted 17 October 2009 - 10:45 PM

Thank you. Youre update fixed the error that was coming up.

In one of the tips included you suggest for the user to not forget to include Scsi Drivers into the Image. how would that be done. Or is there an automatic way to do it.

Is a Sparse file and empty Img container file. If so, would this Img created be read and mounted by ImDisk mounting program.

Can the Raw Gzip Img file be converted to Vmdk? Im guessing the Raw one is just one big file and the gzip one makes the saved image smaller during a backup.

Some cosmetic updates suggestions
1.jpg
2.jpg
3.jpg
4.jpg
5.jpg

Got to get some time to test the Program some more. Specially the conversions and the Backup.


I have implemented all of your advices except one : the information tab merged into others.
This requires more time to redesign the program.

Will look forward to it.


Anyone up to make a script for this?

#75 erwan.l

erwan.l

    Platinum Member

  • Developer
  • 3041 posts
  • Location:Nantes - France
  •  
    France

Posted 18 October 2009 - 10:39 AM

Hello TheHive,
I have applied your cosmetic advices, thanks for that!

About sparse file, you can make a 1gig sparse file on your hard drive but it will take only the real datas in there as occupied space.
You can use it with softwares like imdisk, starwind, etc.
See the attached screenshot where you actually see that only 7mb are taken from HD for a 1gig sparse file.

About vmware drivers, I myself inject them before cloning (add hardware wizard point to the vm drivers included in clonedisk.zip).
But I know you can also inject them offline (i am not an expert there).
Note that the same apply to generic ide drivers for QEMU or ISCSI drivers for iscsi network boot.

The GZIP option is useful only if you want to save file when making a clone of your HD.
Clonedisk can also restore an image from that format.
Unfortunately, a gzip file cannot be used for any other purpose than save & restore.

About scripting, clonedisk has some command line switches that may help.

Regards,
Erwan.

Attached Thumbnails

  • sparse.JPG





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users