Identifying disk reference locations

  johndrew 16:37 26 Dec 2010
Locked

I think this is a problem that techies may find interesting.

Whilst backing up my C: drive using ATI I received the message, "Failed to read data from the disk .." and a reference "155,972,663" - actually there were two references but one will do for this exercise. The archive verified correctly and viewing the contents by heading I can see no problem.

I carried out a full chkdsk /f /r and no problem was found. This leads me to believe there is some other problem or perhaps there is some form of protection on the data which resists copying for some reason.

Does anyone know if there is any way to identify the subject matter at a disk reference easily? If so I would, hopefully, be able to determine what the problem is.

Many thanks in anticipation.

  bremner 17:04 26 Dec 2010

Use a hex editor like this click here to view the disk. Go to the relevant sector and view the file present

  johndrew 20:54 26 Dec 2010

Thanks for coming back.

I have downloaded the software and read the notes. However, I'm not certain that I can either understand exactly how to use the tool (even with the help of the help file) to achieve my aim.

Is there any other reference you could point me at?

Currently I have downloaded the tool and unzipped it to the desktop. I tried inserting the numbers for the sectors reported and saving them but at that point (even if I were heading in the right direction) I am stumped.

I should point out that I am far from being a techie so simple terms and detailed instructions are essential I'm afraid.

  johndrew 11:55 29 Dec 2010

^

  johndrew 12:00 31 Dec 2010

Looks as if I'm not going to get any further aid. I have scoured for advice from Google, read everything I can find and still suffering as much confusion as ever.

To be totally certain I'll leave this open for another day before I close it.

  bremner 12:28 31 Dec 2010

Sorry I did not come back.The editor I gave you seems to be very limited.

Winhex is a slightly cut down version of professional computer forensic tool click here

Download Winhex zip and extract to a folder. From the extrated folder click on Winhex.exe (this will run without installation, you can choose to install from Setup.exe later if you want).

You will be asked if you want to run as a full forensic tool or read only - choose read only.

When the Window opens from the menu bar go to

Tools > Oeen Disk and choose the disk you want to view.

Once open go to the menu bar and choose

Position > Go to Sector

Type in 155972663

The bottom right pane will move to that sector and in the bootom left pane under Cluster No. It will give you the path to the file at that sector.

  johndrew 17:20 31 Dec 2010

Many thanks again for picking up this thread. The link you provided was much superior and provided me with more information. Pity I don't understand what it means.

May I beg a little more of your time and effort to explain, please.

The editor points me at "\WINDOWS\system32\ReinstallBackups\0109\DriverFiles\" when I enter this into Explorer it points me to three files "nvdata.bin nvdisp.nvu nvinfo.pb".

I am presuming it is these that ATI could not backup. To me they appear something to do with NVidia (my graphics cards?) but what and why they couldn't be backed up I have no idea.

When I clicked on them Windows could not open them (the .bin file went straight to a scan by Spybot S&D which found nothing) The sizes are 2.18MB, 28KB and 12KB respectively - the first (.bin) looks big to me - corrupt?.

If I delete them will Windows remake them? Or what action should I take - are they important?

Your assistance is appreciated.

  bremner 17:29 31 Dec 2010

I have no idea what would occur if you deleted them. They seem to be Nvidea graphics drivers.

You could do create a restore point and then rename them - such as oldnvdata.bin etc.

Then delete them and see what happens

  johndrew 20:01 31 Dec 2010

Many thanks. I'll make copies as well and let you know for future reference.

  johndrew 14:57 01 Jan 2011

I made copies and deleted the original file. After a Restart the file was still missing - Windows hadn't replaced it.

I made an ATI backup of the file alone and verified it with no problem. This confuses me as ATI had refused to back it up when in situ.

I have a backup on an external drive made a month ago that was fine. I shall recover this file from that and compare it. If I find anything different to the existing I shall post again if not then I shall consider this thread complete but with an anomaly that I shall need to resolve eventually.

Once again, many thanks for your help.

  Batch 15:11 01 Jan 2011

It's a little late now, but did you try doing the ATI again? It might just have worked 2nd time round.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

OnePlus 5 review

See the work of famous artists playing with toys

iPad Pro 10.5in (2017) review

Comment faire une capture d’écran sur un Mac ?