603 replies to this topic

[erwan.l]

Damn you are so right
1-I did "only" test first partition (my test drive had only one)
2-I need a better test procedure

Thanks again for the testing and feedback : I would really mind a end user screwing his datas because of me.

New version uploaded (version stays the same).

This CHS part really gave a hard time.

/Erwan

[Icecube]

@ Erwan
When visiting your website, it says that it is infected:

Infection Details:

 

URLs:

hXXp://erwan.l.free.fr/clonedisk/

hXXp://erwan.boot-land.net/clonedisk/

 

Infection: js:lFrame-AC[Trj]

http://www.microsoft...atid=2147647751

[Wonko the Sane]

Damn you are so right

Yep, this is "by definition" .

New version uploaded (version stays the same).

This CHS part really gave a hard time.

And it will FURTHER give some.
Current version 1.9.5 - mark II -now writes correctly JUST the Head value (roughly a 33.33% bettered results than before but missing the Cylinder and Sector )


Wonko

[erwan.l]

Infection: js:lFrame-AC[Trj]I believe this is the paypay html code doing that.Try this link : http://erwan.l.free....edisk/body.html and refresh.

[erwan.l]

Version 1.9.6
Can export partition table to html.

All CHS text fields tested successfully on read and write.

[Wonko the Sane]

Version 1.9.6
Can export partition table to html.

All CHS text fields tested successfully on read and write.

Confirmed. All fine and dandy.
Nice idea the HTML export.

BUT, there is still a problem (minor).
There is no input check.
Try setting a set of Starting CHS to (example) 1024/255/64 (write, than read) and you will see what I mean.
IMHO anything bigger than 1023 in the C field should resolve to 1023.
Anything bigger than 254 in the H field should resolve to 254.
Anything bigger than 63 in the S field should resolve to 63.

Or, alternatively if ANY of the three above happens a small hand should come out of the screen and SLAP the demented user hard in the face!

Right now C field with x bigger than 1023 resolve seemingly to 512+INT((x-1024)/2) or INT(x/2)
and S bigger than 63 resolve to "a random number" affecting also the C value

The H field is a different beast.
254 resolves to 254
255 resolves to 255 this is NOT a valid value
256 resolves to 0 this is not an expected behaviour.

If the slap is not an option, a warning and a beep wehen a demented user tries to write "stupid" values might do as well .


Wonko

[erwan.l]

<quote>
IMHO anything bigger than 1023 in the C field should resolve to 1023.
Anything bigger than 254 in the H field should resolve to 254.
Anything bigger than 63 in the S field should resolve to 63.
<quote>

Very good point : change implemented, clonedisk updated (still on version 1.9.6)

[Wonko the Sane]

Very good point : change implemented, clonedisk updated (still on version 1.9.6)

D@mn , I did prefer the SLAP-IN-THE-FACE solution , but you are right, on 9" and 10.1" netbooks it wouldn't be effective enough




Wonko

[Icecube]

@ erwan.l
Can you read and check:
http://forum.avast.c...p?topic=84409.0

VirusTotal: 20/ 44 (45.5%)
http://www.virustota...526a-1315516986

[sambul61]

Does this tool work to shrink an IMG file with OS installed on it? OR, it shrinks the partition inside IMG, but the IMG file size remains the same? In this case, what tool(s) can shrink the IMG file?

[Wonko the Sane]

Does this tool work to shrink an IMG file with OS installed on it? OR, it shrinks the partition inside IMG, but the IMG file size remains the same? In this case, what tool(s) can shrink the IMG file?

Once you have shrinked the partition (with whatever tool) you can truncate the .img file.
A suitable app is fsz, part of the DSFOK toolkit:
http://members.ozema...eezip/freeware/



Wonko

[sambul61]

Thanks! Is it possible to shrink IMG with Qemu tools? Can Qemu create IMG file instead of RAW? Or what packages can create an empty IMG?

Any commercial packages can shrink IMG?

[Wonko the Sane]

Thanks! Is it possible to shrink IMG with Qemu tools?

No.

Can Qemu create IMG file instead of RAW? Or what packages can create an empty IMG?

As I tried to explain to you several times by now a .img and a .raw file are BOTH RAW images, i.e. a sector by sector image of a disk.
A RAW image (not "empty") is composed of:

• a MBR
• some hidden sectors
• one or more partition(s)
• sometimes unused sectors

.IMG is simply a conventional extension that is commonly used for RAW images.
A static VHD is nothing but a RAW image with a single descriptor sector appended to it.

Or what packages can create an empty IMG?

You don't need "a package" fsz can create an empty file.
Or you can use Clonedisk allright, check untder "Tools" for RAW image.
Then you have to fill it with the MBR, and partition table and format the partition(s) in it.
There are simple tools, like:
http://reboot.pro/3191/
otr the simplified hddimage:
http://reboot.pro/9033/
http://reboot.pro/9033/page__st__36
but before using them you will probably need to take some time to digest the basics of what are a disk image contents, the MBR, the partitions, the bootsectors, etc.
Otherwise, once you have the empy file, just mount it in a suitable Virtual DISK driver (IMDISK will NOT do) and partition/format it "normally".
Probably the easiest would be Total Mounter:
http://reboot.pro/fi...4-totalmounter/
or, since you use 7 or Server 2008, use clonedisk to convert to .vhd, mount it natively, partition/format it, than use clonedisk to convert it back to RAW.

Any commercial packages can shrink IMG?

Cannot say.


Wonko

[erwan.l]

Does this tool work to shrink an IMG file with OS installed on it? OR, it shrinks the partition inside IMG, but the IMG file size remains the same? In this case, what tool(s) can shrink the IMG file?

Hi Sambul61,

Clonedisk creates an image of either a partition or a disk.
On top of that, you can choose to apply gzip compression on the fly meaning the img will be compressed within a gzip file once the operation has completed.

Regards,
Erwan

[trmpluym]

The download-link does not work anymore.

Is there a new download-link ?

[trmpluym]

Sorry, found it !

http://reboot.pro/fi...e/24-clonedisk/

Maybe a good idea to update the first post ?

[ito pedalracer]

Hi

I planned to use Clonedisk exclusively for imaging purposes, since it is free, small, portable (WinFE) and versatile.
I made a raw bit2bit image of a 1GB flash drive for testing various recovery tools and some work flawlessly with
the image made by CloneDisk. Even the forensic FTK Tool can load this raw image.
But then I downloaded the trial of Easy Recovery Pro from Kroll that appeared in a new version (V10 !): http://www.krollontrack.de/

This proggi claims to lod raw images and other ones too. However, I can not load a CloneDisk raw image ?!

Any ideas?


thank you!

[erwan.l]

Been a while : new version out with a newer (better / simpler?) GUI...

 

Here attached some screenshots.

 

Cheers,

Erwan

Attached Thumbnails

• 
• 
• 

[Wonko the Sane]

NICE! (the old multitab interface WAS a little clogged/not intuitive).

If I may (a very little thing at first sight , I know):

http://www.collinsdi...english/unmount

http://www.collinsdi...nglish/dismount

It's almost the same thing, but dismount gets me the feeling of "getting off the bike (or horse)".

And traditionally "unmount" has been used.

http://www.computerh...unix/umount.htm

ftp://ftp.chatnfiles.com/WinSitedotcom/winsite-march-96-4-of-4/info/pc/winnt/misc/unmnt10.zip/index.html

 

Wonko

[erwan.l]

Hi Wonko,

 

Thanks for the feedback.

 

About dismount, indeed it is always hard for me to put a word on a windows API/control code (deviceiocontrol + FSCTL_DISMOUNT_VOLUME ) which MS defines as "Dismounts a volume regardless of whether or not the volume is currently in use. For more information, see the Remarks section."

 

I would not want to confuse us all with the unix u(n)mount command.

 

This windows control code "only" discards current opened handles : I could then rename it by "close current opened handles" ?

 

Also not to be confused with ioctl_volume_offline which, this time, really "unmount" the volume

 

Regards,

Erwan

[erwan.l]

Side note : i have also created a tutorial on how to use QuickPE and CloneDisk to backup a drive.

 

See here.

 

Regards,

Erwan

[Wonko the Sane]

Would "remove drive letter" or "remove mountpoint" be easier to understand?

 

Wonko

[v77]

Not about the software but about the download page: I think the used font is too small.

[erwan.l]

Not about the software but about the download page: I think the used font is too small.

 

changed to font 12

[v77]

changed to font 12

 

Much better, thanks!