| Author |
Message |
   
John Downing
Username: jodown007
Registered: N/A
| | Posted on Monday, May 4, 2009 - 22:05: | |
I am a new/basic WinHex user and purchased the program to try and recover files from a botched RAID setup. I have not been able to recover my mp3 or mpeg files correctly. (Using WinHex version 15.2 SR-2) I am using the "file recovery by type" since I can only seem to get the "Recover/Copy" method to find files that I can already see on the drives. mp3 recovery problem: 1. WinHex finds deleted mp3 files on the drives but saves them all to the output folder at the Default file size no matter what the actual file size is. The audio files play correctly, but either cutoff midway or continue to play after the audio is complete depending what the original file size was. Mpeg recovery problem: 1. I cannot find a File Type listed for mpeg's on the "file recovery by type" file list. 2. During my .jpg file recovery search the .mpeg files are recovered to the output fold as hundreds of small .jpg's. Any help in recovering these two file types would be appreciated. Thank you |
   
Alfons Kramer
Username: admin3
Registered: 4-2004
| | Posted on Tuesday, May 5, 2009 - 9:29: | |
The RAID must be reconstructed from the individual disks before an recovery attempt. Otherwise the files appear to be cut into stripes of for example 64KB in size. One needs WinHex Specialist license to accomplish that. This license has also some more advanced recovery options. MPEG-files are currently in the 'check only' file signature table, because they do not have a file signature, only a block signature. If one likes to recover MPEG-files anyway, one has to move the signature definition form the 'check only' table to the 'search'-table. |
   
John Downing
Username: jodown007
Registered: N/A
| | Posted on Tuesday, May 5, 2009 - 19:04: | |
Thank you for the response... I am unable to figure out where the 'check only' file signature table is located. Would you mind giving me more information on how to move a signature definition to from the 'check only' table to the 'search table?' Also, do you have any comments/suggestions on my mp3 file recovery issue detailed above? And lastly, the option for reconstructing a RAID is available (not grayed out) on my WinHex program. Do you have any suggestions on how to accomplish this correctly? It looks complicated and I do not want to mess the drives up more than they are already. Thank you. |
   
Stefan Fleischmann
Username: admin
Registered: 1-2001
| | Posted on Tuesday, May 5, 2009 - 19:31: | |
> I am unable to figure out where the 'check only' file > signature table is located. It is part of the forensic edition of WinHex only, i.e. X-Ways Forensics. I will send you that line via e-mail instead. > Would you mind giving me more information on how to move > a signature definition to from the 'check only' table to > the 'search table?' Select the line in a text editor, cut it, and paste it as a new line in the File Header Signature Search.txt file. > Also, do you have any comments/suggestions on my mp3 file > recovery issue detailed above? The file size is generally unknown when you do file carving, and MP3 is not among the file formats where WinHex can find out the original file size by examining the data structures of the files, hence the default file size is used. That's the very purpose of having the default file size. If some of your files are truncated, increase the default file size. Too large does no harm (aside from wasting some drive space), too small means incomplete. The file size is known if the files can also be found in the data structures of the file system, either immediately when the volume is opened, or as part of the particularly thorough file system data structure search. > the option for reconstructing a RAID is available (not > grayed out) on my WinHex program A specialist license is needed for that feature. > Do you have any suggestions on how to accomplish this correctly? You open the individual component hard disks and select them in the Specialist | Reconstruct RAID System dialog box in the original order, and specify the correct parameters like stripe size (which you would need to know, or you need to experiment). > looks complicated and I do not want to mess the drives up > more than they are already. Nothing is changed on the disks. |
   
Aldo Krstic
Username: tomwaits
Registered: N/A
| | Posted on Monday, Aug 24, 2009 - 13:27: | |
Dear Sirs,\r\n First of all excuse me for my English. I already buy Western digital product(500 GB my book) a 7 months ago.Was fantastic solution for me. But now I'm afraid that I lose all data inside. Doesn't work: there is no driver !!!? Already try on home PC and my HP laptop with other USB cable. And finaly wrote that is empty ? Isaw on properties that is half full. Realy don't know what to do.If I lose everything what is inside I will be very sad 'cause I collect this for a years. Please,help me to fix my problem. I will be exceedingly appreciate. Awaiting your reply, With best regards, Aldo Krstic 21000,Split,Croatia |
   
Alfons Kramer
Username: admin3
Registered: 4-2004
| | Posted on Monday, Aug 24, 2009 - 13:45: | |
The first question is: Did a headcrash occur? Had the drive been exposed to mechanical shock during operation? If so, only a professional data recovery service can help. If not, one can try to do a data recovery by software tools. We do offer trial versions of our products which are capable of data recovery. First you might consider Davory. A more experienced person could consider WinHex as a data recovery tool. |
   
Terry Greenwood
Username: greenwood
Registered: 3-2006
| | Posted on Monday, Aug 24, 2009 - 15:15: | |
"Already try on home PC" - do you mean you tried connecting the disk inside the enclosure as an internal disk in your PC ? |