| Author | Message | ||
     Mijan (Mijan) |
Hy i have used winhex and fell in love with its simplicity and superb apearance, great software. I have 3 questions Q1. I am trying to create an image (sector by sector)copy of a hard disk. does winhex access the drive in NBDR or through the bios ? Q2 can the image that is created be split into say 1GB chunks ? Q3 I know this is all windows orientated but is there a dos program available for imaging a hard disk, again splitting the image into 1GB chunks ? Thanks in advance | ||
| Stefan Fleischmann (Admin) |
1) I don't know what NBDR means. Under Windows 9x/Me, WinHex accesses a physical hard disk through the BIOS, in all other cases through the OS. 2) Not a raw image, but a WinHex backup of a disk can be split. 3) Sorry, don't know. | ||
| Malhenry (Malhenry) |
I am trying to recover data off of two MF2-DD floppies for a friend and I have 2 questions: 1st>>>>What are the steps to image a floppy disk? Also, I tried: 1) Tools | Open Disk | Logical Drives | Removable Media (A) | OK and got: An error occurred while accessing drive "A:". 2) Tools | Open Disk | Physical Media | Floppy Disk 0 | OK and got: *** Sector could not be read 2nd>>> Does this mean the diskettes are bad? Thanks! | ||
| Stefan Fleischmann (Admin) |
> What are the steps to image a floppy disk? Tools | Disk Tools | Clone Disk Select the floppy disk as the source and an image file as the destination. > Does this mean the diskettes are bad? Yes, apparently there are physical defects. You could try to image the physical floppy disk and have WinHex ignore bad sectors. Hopefully there are still a lot of readable sectors. However, depending on how important the data on the floppy is, I recommend asking a company for help that offers data recovery with a hardware laboratory. | ||
| Clay Hamlet |
I have a LMSI/Plasmon/Philips 12" 12GB optical drive and platters that I am trying to do a low level sector dump from. The drive works and the platters can be recognized. The device is attached with an Adaptec 2944UW High Voltage Differential SCSI and uses ASPI drivers under DOS and early Windows. Can anyone tell me if WINHEX or any other tools can read and output this data??? Thank you! | ||
| Stefan Fleischmann (Admin) |
If the drive is accessible from Windows 2000 or XP and can be opened in WinHex with Tools | Open Disk, yes. | ||
| Al |
I have WinHex (Forensic version) and need to be able to see an optical disk in a LF-5010 Drive. There are no drivers for windows 2000, however when the PC boots The Adaptec 2940au displays it as SCSI # 1 and if I go into the control panel then the device manager the LF-5010 hardware is recognized, but I can't get to it to do a low level clone to another disk. If anyone has any solutions, I would be happy to hear them. | ||
| Stefan Fleischmann (Admin) |
You could also try under a different Windows version (Windows 9x/Me) or under DOS (with Replica). | ||
| Al |
Replica dosn't seem to recognize the SCSI drive.. am I missing something? | ||
| Stefan Fleischmann (Admin) |
Replica is supposed to recognize all drives recognized by the computer's BIOS. | ||
| Mike Montgomery (Mikem22) |
It may be listed as 'Removeable' in the physical drive list. Mike | ||
| Julie Fang |
Hi Stefan, Have you come across any articles that discuss about the DOs and DON'Ts of disk imaging (using Symantec Ghost or any other 3rd party imaging software)after the OS is hardened? Will this cause instability and integrity problem to the cloned hard disk? Thank you. | ||
| Jim Bishop |
I am trying to image blocks of sectors from a Phillips LM4000 MO platter (12", 5.6gb). Have built a PC with DOS 6.22, Adaptec 29160 SCSI & ASPI, old Corel SCSI drivers (which specifically handle this media). Have a Phillips LF4100 standalone reader. System boots & loads everything fine, assigns "G" to the drive. Have tried Replica 1.3 but it seems to only like "Hard Drives". Does the newer version of Replica handle a configuration like this ? The media is specificed as 1024 bytes/sector. | ||
| Stefan Fleischmann (Admin) |
No, sorry, X-Ways Replica is a hard disk cloning and imaging tool only, for hard disks that are recognized by a computer's BIOS only. | ||
| Carol Stimmel |
I am trying to get an MD5 hash for a cloned drive. The destination was wiped prior to use. I need to be able to put in the last sector and hash to that because of different drive sizes. I may or may not be able to obtain the drive geometry of the source drive. Can I do this with WinHex? | ||
| Stefan Fleischmann (Admin) |
Yes, you can. 1) Open the cloned drive. 2) Ctrl+A (select all) 3) Position | Go To Sector: x (=the last copied sector + 1) 4) Press cursor key to the left, to get to the last byte in the last copied sector) 5) Alt+2 (defines the end of the block at the current cursor position) 6) Tools | Calculate Hash (will now calculate the hash on the selected block only) The drive geometry is irrelevant. | ||
| Carol Stimmel |
Awesome. Only confirmation is on Step 5, did you mean Alt-F2? Nothing happened for me, so wasn't sure whether I would get confirmation If this works, you better believe I'll be a buyer and a religious zealot. I've not found an easier solution except by going into dos and banging out command lines. Thanks - Carol | ||
| Stefan Fleischmann (Admin) |
Maybe set a darker block color in Options | General Options, so that you see the block selection ending at the current cursor position after pressing Alt+2. The new block selection should also be obvious in the status bar. If Alt+2 for some reason does not work, you could also right-click the byte at the current cursor position (=the end of the last copied sector) and select "End of block". | ||
| David Wilson (Drindles) |
I would like to be able to preview a remote system via a network connection and acquire data from the remote system at the logical, physical and selected file level. I have Xways Forensic. How would I do such? | ||
| Stefan Fleischmann (Admin) |
I recommend EnCase Enterprise ($×××,×××) for the acquisition and X-Ways Forensics for the actual examination. | ||
| Mike Montgomery (Mikem22) |
Another option is WInternals Administrator Suite. This has options where you can mount a network drive as a local drive where the remote machine is either started in DOS or Windows .. Brilliant tool! but again, $xxxx Mike | ||
| Ronnie Harris |
Please tell me if WinHex will do this for me: Make an image of a bootable (under Win CE) CF Card, save the image to hard disk. Then load this image to a new CF card, and have the new CF card be bootable and work in the end device identically with the source bootable CF card. Sorry if this is an elementary question! | ||
| Stefan Fleischmann (Admin) |
When you open the CF card in WinHex, you can see all the sectors that can be copied to an image and from the image back to another CF card. Copying all these sectors should be sufficient to render another card bootable. Yes, WinHex can copy sectors from a card/disk to an image and back to another card. | ||
| Dean |
dd and netcat can be used to image across a network and both are free tools. |