| Author | Message | ||
     Dan Schless (Dschless) |
Is it possible to invoke the 'Restore Image' command via a script? | ||
| Stefan Fleischmann (Admin) |
No, but "Restore Image" is just a loop reading sectors from an image and writing them to a disk anyway, so a script can do the same thing. | ||
| jalev Username: jalev Registered: N/A |
But how to do that, I am trying to restore image to disk, how to write to disk? Open "C:\foo\created_image.img" InterpretImageAsDisk Assign EndOfDisk GetSize Dec EndOfDisk Block 0 EndOfDisk CopyIntoNewFile "E:" this does not work | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> I am trying to restore image to disk, how to write to disk? Please see the user manual or program help for an overview of available script commands. In order to write data to a disk, open the disk ("Open"), write to it ("Write"), finally close it ("Close"). As explained above, in order to restore an image back to a disk, you would need a loop that reads data from the image and writes it to the disk, like ... { Read Buffer 1024 NextObj Write Buffer NextObj }[...] ... > CopyIntoNewFile "E:" > > this does not work As the name of the command suggests and the program help and user manual explain, this command copies data into a file. "E:" is not considered a file by WinHex. | ||
| jalev Username: jalev Registered: N/A |
Thank you Stefan. If the image is the actual row date from the MMC, and I would like to write it back to mmc. How do I make that if file name is needed ? When reading the Image from drive, there is option that not to write empty data blocks. How to do this wia script? e.g I have 1 GB memory card, I would like to create script that reads the raw image (excluding emty data blocks) so lets say the memory card actually contains just 100 MB, the actual raw image is about that size as well, but, when restoring the image back to disk, memory cards will match. Thank you for your professional assistance | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Sorry, I do not understand at least your first question. About the second question: If by "empty data blocks" you are referring to unallocated (free) cluster, please be advised that images (raw images or evidence files) in WinHex always include all free drive space. | ||
| jalev Username: jalev Registered: N/A |
Hi Allmost one month has gone.. I had problems to write raw image back to mmc card through mmc reader connected via USB. The reason was that I did not figure out how to give the name of the target. that is what I ment for restoring image back to disk. Anothet interesting issue here is that I would like to have A) truncated raw image B) write that back to MM Would be great to find some examples how that can be done | ||
| jalev Username: jalev Registered: N/A |
Hi, Dear Stefan, I am trying to make this happening. Open c:\image_file.img //window 1 InterpretImageAsDisk //Treats a raw image as disk Open 80h //opens MMC as physical media. window 2 { Read Buffer 1024 //read from window1 NextObj //switch window Write Buffer //write to window 2 NextObj }[...] How do I define the end condition? is it so that it coud be disk size / block size used for reading? GetSize/blocksize Could this kind of script be able to restore image file back to disk. Thank you really much, I appriciate your knowledge. | ||
| jalev Username: jalev Registered: N/A |
I am wondering could this be done also this way: Open c:\image_file.img //window 1 InterpretImageAsDisk //Treats a raw image as disk Assign EndOfDisk GetSize Dec EndOfDisk Block 0 EndOfDisk read buffer EndOfDisk open 80h NextObj //switch window Write buffer close NextObj //switch window close I hope you could give me some hints what is best way to restore image back to disk. I am also looking for opportunity how to create image without reading empty data blocks when making the image. Is this same as truncated image. Thank you | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> I am wondering could this be done also this way: If the disk is small and all data fits into available memory, yes, otherwise you would need a loop and copy smaller chunks of data at a time. > NextObj //switch window You would need this in a loop as mentioned above, but after opening a disk that window becomes the active window automatically, so you must not call NextObj in your example. | ||
| jalev Username: jalev Registered: N/A |
Hi I used this kind of script: But I am getting error message: The buffer IF filing up. Flush all modifications to the disk now? [YES][NO] How to avoid this and automate that procedure? script: MessageBox "Attention: all windows will now be closed without prompting." CloseAll Turbo On Open C:\foo\test_image.img InterpretImageAsDisk Assign EndOfDisk GetSize Assign i (EndOfDisk/1024) Open 81h { Read Buffer 1024 NextObj Write Buffer NextObj } [i] MessageBox "Sample script execution complete. Image Created." | ||
| Jens Kirschner Username: admin3 Registered: 4-2004 |
By default, the "Open" command opens in editable mode, which requires a save to flush out data. However, you can avoid that by opening your image file as Open "C:\foo\test_image.img" in-place That way, all changes will be written automatically and no intermittent questions should arise. As an aside, reading only 1k at a time very likely slows down the process unnecessarily. Run a couple of tests using various sizes and you'll see that other sizes will probably get different times needed for the overall process. | ||
| jalev Username: jalev Registered: N/A |
Thank you I used: Open "C:\foo\test_image.img" in-place But still the same message appeared, Then I used in-place for both, image file and disk opening. No effect, execution stopped again for this message. How to go around? If I am writing to the Memory card connected via USB, and the block size is 512, should I respect the block size when writing data to avoid possible problems? | ||
| jalev Username: jalev Registered: N/A |
I used read-only mode and added save command to the loop { Read Buffer 1024 NextObj Write Buffer save NextObj } [i] seems to work fine, allthought restoring image via script is long process, but wheb using Assign i (EndOfDisk/1048576) it was quite fast, but when comparing original disk and created disk from image. there is something wrong.. I need to investigate more on this.. do you have some ideas? | ||
| Jens Kirschner Username: admin3 Registered: 4-2004 |
If you use Assign i (EndOfDisk/1048576) then, of course, you also need to use Read Buffer 1048576 Otherwise, you will only image 1KB out of every 1MB. | ||
| jalev Username: jalev Registered: N/A |
What a stupid mistake, I am sorry for that, what is the function for that "save" command I removed that and it now seems working ok. I dont get anymore that "flush" promt. So No I am restoring image with script above. Why the results are not equal the original disk? | ||
| Jens Kirschner Username: admin3 Registered: 4-2004 |
Depends on what you mean by "not equal". Option 1: The image size actually is not an integral when divided by 1048576, i.e. the last couple of bytes might have been left off! Option 2: Either the source or the target have been modified by Windows in the meantime, making them unequal. Happens a lot if either of those drives actually has a drive letter assigned. Option 3: Source and target are of different sizes, so the new target might have additional MB or GB that are left untouched after restoring the image. | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
In your script posted on Dec 5, 2006 - 11:37, you read from the hard disk and write to the image file? Judging from the title of this topic, you would rather want to do the opposite. Also you would rather open the hard disk that you are writing to in in-place mode, not the source image file. | ||
| jalev Username: jalev Registered: N/A |
Hi 1 Creating the image from the mmc 2 writing that back to another mmc is done soon after image is ready Both card are equal and formatted. This is the complete script for reading the image from mmc: MessageBox "Attention: all windows will now be closed without prompting." CloseAll Open 82h read-only Assign EndOfDisk GetSize Dec EndOfDisk Block 0 EndOfDisk CopyIntoNewFile "C:\foo\test_image.img" CloseAll MessageBox "Sample script execution complete. Image Created." This is the compete script for writing image back to another mmc from the image file located in pc. MessageBox "Attention: all windows will now be closed without prompting." CloseAll Open "C:\foo\test_image.img" read-only InterpretImageAsDisk Assign EndOfDisk GetSize Assign i (EndOfDisk/1048576) Open 81h { Read Buffer 1048576 NextObj Write Buffer NextObj } [i] CloseAll MessageBox "Sample script execution complete. Image Created." |