I am dealing with a case at present whereby I need to recover .qbw files (quickbooks). The drive (an exteral ethernet NAS) has been formatted as a Linux partition, and has no folder structure (other than an empty hardlinks directory on the root). The quickbooks software is for Windows so I'm a little puzzled at the Linux partition. I do not know any history of the drive, other than - a 'data recovery' has been attempted and this is possibly responsible for the Linux partition. Or the Linux OS is a cut down version used to run the NAS.
Anyone ideas for recovery of .qbw files, which will now possibly be in the unallocated? I could do with the header and footer….. of some extraction/repair tool. Or if anyone knows of a script/EnScript I'd be grateful.
Andy
If it was a Ness it can be raid right?
Probably best way would be with the header and footer. How big is the drive?
I don't think it was part of a raid as there is only the one disk, its a large disk too 120GBs. I agree best option is to extract data using the header & footer, but can't find a footer.
Andy
why do not you scan it with somethimk just to see is there anyhing else.
If you have the header information, open a hex editor and search on that. With that you may be able to find the file, then you can manually restore it. Also in Winhex at least you can attempt to do data carving with just the header, obviously it's more reliable with both the header and footer since it knows where to stop.
I guess you don't have a working .qbw file that you can look at to get the info, huh?
Correct, I want to carve out the .qbw file. I have a header signature, but no footer. I have EnCase so finding hits for a header isn't a problem, its knowing where to stop. There is no file structure what-so-ever, its all unallocated clusters.
Andy
hello!!!
Wo puts 1 drive in NAS?
Nikola -
http//
Ermmmm…… NetDisk……..!!!
It is more helpful if actually offer some kind of suggestion or help rather than silly remarks. The disk isn't mine, its a job I'm working on. I'm also too busy to banter with you now.
If anyone sensible has any ideas…. It's not a raid, it's a single disk that is administered through a web page interface. It sits on a network via an Ethernet connection. I think the OS running it is a cut down version of Linux. The drive has damaged/bad sectors (at it first few thousand sectors) apparently from a sudden power failure…. If anyone has any experience of extracting .qbw files from U/A, perhaps by calving them out using file signature/magic number - header & footer information please drop me a PM.
Andy
ok "expert first of all wgat is the droive and can you reed after them?