| Author | Message | ||
     Steven Young Username: stevenbnh Registered: N/A |
On two images that I have restored I receive the error message "Incomplete image? 4 sector(s) possibly missing according to file system." This has also been verified by extracting the image to a file and using the option "Interpret Image File as Disk" from the specialist menu. This is only an issue when using the WinHex backup (.whx) vs. the Raw image(.dd, .001). Viewing the Boot Sector from the restored image (either drive or file) the boot sectors shows that there is supposed to be 204,796,556 sectors. During the restoration of the image it shows that there are only 204,796,552 sectors to be restored. It also shows that there is only 204,796,552 in the "Scope sectors" when WinHex backup is chosen, but this is disabled for a Raw image. This topic appears to have been covered under the "Forensic" version and not for the "Specialist v14.4 SR-1" version. Thank you, Steve | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
This is not an error message. Only a hint that reminds you that according to the boot sector the image lacks 4 sectors (volume slack). This is what you may get when you image the logical drive letter and not the partition from the physical disk. Just the normal way how Windows provides access to the sectors. But what you choose to image is entirely up to you, and you can have WinHex omit the message if it bothers you. Time and again I think about removing that message altogether because it was meant for informational purposes but rather provokes questions. | ||
| Steven Young Username: stevenbnh Registered: N/A |
Makes perfect sense now, the 8 sectors/cluster doesn't evenly fit into the size 204,796,556. Typically I had always imaged the complete drive, having only 40 GB and 1 partition, but since replacing this drive with with a 500GB primary drive dedicated to the OS, I decided to limit the partition to 100GB in order to keep the time to create and size of the image to reasonable limits. My two cents is to keep the message in, but perhaps add the loss is due to volume slack and that no data is lost or maybe include this in the help documentation. At the time of rebuilding the disk I was assuming some potential data loss, but it did help me to realize the missing offset values as I was rebuilding my partition table, where the sector counts weren't adding up as I was calculating the values for the subsequent partitions. Thank you very much for the quick response. Steve | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> perhaps add the loss is due to volume slack and that no data is lost That is usually easy for the user to determine, who will know how the image was created and what sectors he wanted to cover with the image, and that's why the software leaves that conclusion to the user. Also there may be more sectors missing than just volume slack. The software cannot possibly know what data is missing or lost or whether the user wanted to include all volume slack or not or how many sectors he wanted to include at all or whether the image later has been truncated or corrupted. General remark: The most powerful tool available to the user is his or her brain. WinHex and X-Ways Forensics are not meant to render the user's brain obsolete. They simply can't do that. They are rather meant to stimulate and assist it. |