Quickbooks .qbw file recovery
I am dealing with a case at present whereby I need to recover .qbw files (quickbooks). The drive (an exteral ethernet NAS) has been formatted as a Linux partition, and has no folder structure (other than an empty hardlinks directory on the root). The quickbooks software is for Windows so I'm a little puzzled at the Linux partition. I do not know any history of the drive, other than - a 'data recovery' has been attempted and this is possibly responsible for the Linux partition. Or the Linux OS is a cut down version used to run the NAS.
Anyone ideas for recovery of .qbw files, which will now possibly be in the unallocated? I could do with the header and footer….. of some extraction/repair tool. Or if anyone knows of a script/EnScript I'd be grateful.
If it was a Ness it can be raid right?
Probably best way would be with the header and footer. How big is the drive?
I don't think it was part of a raid as there is only the one disk, its a large disk too 120GBs. I agree best option is to extract data using the header & footer, but can't find a footer.
why do not you scan it with somethimk just to see is there anyhing else.
If you have the header information, open a hex editor and search on that. With that you may be able to find the file, then you can manually restore it. Also in Winhex at least you can attempt to do data carving with just the header, obviously it's more reliable with both the header and footer since it knows where to stop.
I guess you don't have a working .qbw file that you can look at to get the info, huh?
Correct, I want to carve out the .qbw file. I have a header signature, but no footer. I have EnCase so finding hits for a header isn't a problem, its knowing where to stop. There is no file structure what-so-ever, its all unallocated clusters.
Wo puts 1 drive in NAS?
It is more helpful if actually offer some kind of suggestion or help rather than silly remarks. The disk isn't mine, its a job I'm working on. I'm also too busy to banter with you now.
If anyone sensible has any ideas…. It's not a raid, it's a single disk that is administered through a web page interface. It sits on a network via an Ethernet connection. I think the OS running it is a cut down version of Linux. The drive has damaged/bad sectors (at it first few thousand sectors) apparently from a sudden power failure…. If anyone has any experience of extracting .qbw files from U/A, perhaps by calving them out using file signature/magic number - header & footer information please drop me a PM.
ok "expert first of all wgat is the droive and can you reed after them?
What is the drive model. what happened, what was the operating sistem.
exteral ethernet NAS?
no it is not.
Never mind, if translator on hdd it self is bad you can get same errors , tell us model number and manufacturer.
and one more thing how do you connect it, to yoour pc over ethernat cable?
Again if anyone has any sensible replies, the file system is XFS. Anyone aware of tools for file recovery of an XFS file system?
Do you know the filename? You could try and locate the inode table entry for the file. Failing that search for remnants of a Master File Table. Sounds to me that it may have been a NTFS partition at one time. Either one would tell you the starting and continuing extents for the file you are looking for.