I have had a report that when using Switch_E2B.exe under an old version of XP to switch back from a FAT32 .imgPTN file to the E2B partitions, the user managed to corrupt the E2B drive.
It turned out that the MBR had been restored correctly (the original NTFS E2B partition), but the Partition Boot Record contained a FAT32 BPB structure! So somehow XP had managed to re-write the FAT32 BPB over the NTFS BPB sector.
Despite many attempts however, I could not reproduce the user's original corruption issue.
Luckily, the user was able to recover the E2B drive by using the excellent free TestDisk software. This has no fancy GUI, but works very well. The PhotoRec file recovery software also works very well too and I have used it many times to recover files from corrupted HDDs, SD cards and USB drives. It has earned me quite a few drinks from grateful friends over the years!
In this case, the 'Dump' command in TestDisk seemed to do the trick and restore the original BPB and $MFT (NTFS keeps a backup copy and so is much easier to recover than FAT32).
Anyway, this prompted me to look at how XP behaves when using Switch_E2B, and I found that XP Windows Explorer gets rather confused when you switch partitions using Switch_E2B! So the new version of Switch_E2B.exe dismounts the drive volumes before updating the MBR and remounting them. Also, if XP is detected, it now closes all Windows Explorer windows that are displaying the USB drive contents (Vista/7/8/10 does this automatically).
I hope that the new Switch_E2B.exe will be more reliable. It is in E2B v1.77n and will soon be in the MPI Tool Kit.
Please let me know if you find any corruption problems and remember to always backup your E2B drive.
Backing up the E2B drive is really easy! Just copy all the files from the drive to the original download folder on your hard drive. The next time you run MAKE_E2B_USB_DRIVE from that folder, it will make a new E2B drive for you with all your payload files on it - the E2B page describing this is here. You can also make copies for your friends too.
It turned out that the MBR had been restored correctly (the original NTFS E2B partition), but the Partition Boot Record contained a FAT32 BPB structure! So somehow XP had managed to re-write the FAT32 BPB over the NTFS BPB sector.
Despite many attempts however, I could not reproduce the user's original corruption issue.
Luckily, the user was able to recover the E2B drive by using the excellent free TestDisk software. This has no fancy GUI, but works very well. The PhotoRec file recovery software also works very well too and I have used it many times to recover files from corrupted HDDs, SD cards and USB drives. It has earned me quite a few drinks from grateful friends over the years!
In this case, the 'Dump' command in TestDisk seemed to do the trick and restore the original BPB and $MFT (NTFS keeps a backup copy and so is much easier to recover than FAT32).
Anyway, this prompted me to look at how XP behaves when using Switch_E2B, and I found that XP Windows Explorer gets rather confused when you switch partitions using Switch_E2B! So the new version of Switch_E2B.exe dismounts the drive volumes before updating the MBR and remounting them. Also, if XP is detected, it now closes all Windows Explorer windows that are displaying the USB drive contents (Vista/7/8/10 does this automatically).
I hope that the new Switch_E2B.exe will be more reliable. It is in E2B v1.77n and will soon be in the MPI Tool Kit.
Please let me know if you find any corruption problems and remember to always backup your E2B drive.
Backing up the E2B drive is really easy! Just copy all the files from the drive to the original download folder on your hard drive. The next time you run MAKE_E2B_USB_DRIVE from that folder, it will make a new E2B drive for you with all your payload files on it - the E2B page describing this is here. You can also make copies for your friends too.
No comments:
Post a Comment