| Author | Message | ||
     howard@apextechnology.co.uk |
I am piecing back together some corrupt disk data, each chunk is too big to copy and paste (ie several GB each chunk) I have several chunks of data taken from the good areas of a corrupt disk, and I wish to paste these chunks at various offsets on the replacement disk. What would be useful would be a way of clicking on the offset of the replacement disk and "inserting raw data from file" at that point. This facility would equally be useful in inserting data from one file directly into another file where the data is too large to use cut and paste. | ||
| Stefan Fleischmann (Admin) |
Please use Tools | Disk Tools | Clone Disk for that. The ability to uncheck "[ ] Copy entire source" is intended exactly for such a situation. | ||
| howard@apextechnology.co.uk |
Thanks Stefan, that will do it! | ||
| howard@apextechnology.co.uk |
I would like to propose a couple of suggestions for Disk Cloning feature 1. When selecting the source or destination "file of type" it would be useful to have an "All Files" in the drop down menu (Presently only raw image files shown) 2. It would be useful if the status bar info could be highlighted and copied so that sector numbers etc. could be pasted into the dialogue boxes. This is useful as I check the file to verify start positions, but mistakes could happen in re-typing the information into the box. With such a large amount of data (irreversible) a mistake could be costly. Copy/paste reduces the chance of error. 3. When selecting a file for the destination (or source) the choice of start sector does not appear to be allowed (greyed out box) (or have I mis-interpreteed some logic why it is greyed out?). It is only allowed with disks. Sometimes its useful to paste a source file into the middle of a destination file. 4. Just a note -> the number of sectors to copy is only automatically updated when the check box "Copy entire source raw image file" is unchecked and re-checked after changing the source disk/file. Also today I noticed a small bug (I think?) I have a file which is 13957584bytes long. When I select interpret image file as disk (sometimes I do this to see sector boundaries) the file still reports same length in the properties dialogue box, but the display is truncated to the last full sector. The last 464 bytes are no longer displayed in the hex/text view. It displays only 13957120 bytes | ||
| Stefan Fleischmann (Admin) |
1. Simply type "*" in press Enter. "*" is a wildcard that causes simply all files to be displayed. This is standard functionality in any Windows program that uses the standard file selection dialog window. 2. Simply right-click the status bar info and copy what you need. There is a "Status Bar" topic in both the program help and the user manual. 3. Here it the logic: Yes, this is not allowed, because currently Clone Disk can only create and write image files (create = start from scratch, with an initial file size of 0 bytes), not only write to them. As you noticed, there is no such limitation for disks. This is because Clone Disk does not create disks (only hardware manufacturers can do that... ;-), it only writes to them. So if you just want to write to an already existing image file, in other words, treat it like a disk, then interpret it as a disk before and select it from the disk selection window. 4. Yes. Anything wrong with that? Is it your suggestion to disable that behavior? Excuse me, but why should this be a bug?-) There is no such thing as a disk with 27260.90625 sectors. The number of sectors can only be an integer number. WinHex does not support devices with fractions of sectors and is not supposed to do so. If there is an error involved in here, it is to force WinHex to interpret an image as a disk that cannot possibly be an image file... If you really want the last 464 bytes to be represented in another sector, append the missing 48 bytes to the file before interpreting it. | ||
| howard@apextechnology.co.uk |
Thanks for the quick reply :-) 1&2 sorted. For two I previously tried to click and drag the mouse over the number in the status bar, but I see now that the right click gives the details more efficiently :-) 3. >So if you just want to write to an already existing image file, in other words, treat it like a disk, then interpret it as a disk before and select it from the disk selection window. Not sure how to do this as the image file does not appear in the disk selection window, only the physical and logical disks appear (I am probably looking in the wrong place?) I think I am trying to bend the purpose of Disk Cloning to suit writing large chunks of data into various file positions (ie. larger than copy/paste would allow). 4. It would be useful if the number of sectors to copy is updated automatically when the source is changed as the first time I nearly missed it not changing. It may be useful to others. I agree that obviously a disk has to have an integer number of sectors. Actually I probably mis-use the "interpret as a disk" in a slightly lazy manner so that when disecting a file I can see where 512bytes are marked. I don't really want to interpret it as a disk only show where sector boundaries would be. However having the display cut off the last few valid bytes of a file rather than zero fill the remainder of what would be the final sector was not immediately obvious to me. | ||
| Stefan Fleischmann (Admin) |
3. When an image file is interpreted as a disk, it is treated exactly like a disk and is also listed in the disk selection windows in Clone Disk. 4. I disagree. If WinHex has to assume the user does not wish to copy the entire source because that checkbox is not checked, why should it change that number behind the user's back? Maybe the user did already enter the desired number of sectors to copy. What then if the user misses that it does change? I think the current behavior is logical and efficient, and I did not design it randomly. | ||
| Stefan Fleischmann (Admin) |
> I don't really want to interpret it as a disk only show > where sector boundaries would be Possible alternative: View | Record Presentation > rather than zero fill the remainder [...] (WinHex is not designed to make up data that is not there.) | ||
| howard@apextechnology.co.uk |
3 ok - I see I have to "Interpret as disk" and "open" the partition then it appears. Thanks. 4 - I see the logic in your thinking. I did not think you made the choice at "random", it was just I did not know the logic. Yes "View | Record Presentation" will do just fine. Thanks. That solves the last sector display. | ||
| howard@apextechnology.co.uk |
3 - sorry I now see the physical disk appears without opening the partition! My mistake ! | ||
| Ross Johnson Username: ross_winpro_net Registered: N/A |
re: WinHex 14.6 SR-1 Similar to the first post in this thread ... I am piecing back together some corrupt disk data, each chunk is too big to copy and paste (i.e. several GB each chunk) I have several chunks of data taken from the good areas of a corrupt disk, and I wish to paste these chunks at various offsets in the replacement image file (opened as a physical disk). The only method I haver found so far is to select small enough portions for the clipboard to handle and then paste. I am looking for a more efficient method. The solve stated in the second post ... Please use Tools | Disk Tools | Clone Disk for that. The ability to uncheck "[ ] Copy entire source" is intended exactly for such a situation. ... would be great, if the destination dialogue box contained the Interpreted image files as possible targets (i.e. similar to how they show up in the Source box). The above is not intended to be anything other than an explanation of my situation in search of an available solution (if there currently is one?) Thank you, in advance (to anyone) for any ideas/pointers towards a solution. Ross@WinPro.net | ||
| Bill Spernow Username: byteguy Registered: N/A |
Ross, Had a similar problem. I developed a back door work around that took advantage of the fact that the image I was working with was a DD image with 1GB segments. I simply noted the offset of the GB chunks I wanted to piece back together and then related this back to the 1GB segments in the original DD image, tagged those segments and copied/merged them into a single file. I then used WinHex to edit the single file and clean out the data I didn't need. Worked for me, might work for you... Bill Spernow bill.spernow@securitymentors.com | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> would be great, if the destination dialogue box contained > the Interpreted image files as possible targets (i.e. > similar to how they show up in the Source box). Interpreted raw images will show up in the Select Target Disk dialog window in WinHex Specialist/Forensic (not X-Ways Forensics) as of v14.7 Beta. |