search

andlabs / reallymine

WD MyBook encrypted hard drive decryption (still WIP).
https://github.com/andlabs/reallymine/issues/38
GNU General Public License v3.0
216 stars 48 forks source link

Test sectors needed #73

Open andlabs opened 6 years ago

andlabs commented 6 years ago

I can work on this again. I'm going to dump the existing concurrent code and build everything to have tests at every level.

I need to go back through all the issues and ask for permission to integrate the posted sectors, both decrypted and encrypted, as test data. (TODO make a list of all of those here)

In the meantime, I'd be happy to have random sectors to use as test data for as many configurations as possible. Ideally I would have data from random points in the disk, so not exclusively MBRs and GPTs, but of course use your best judgement when providing data.

themaddoctor commented 6 years ago

I have a bunch from drives that RM already supports. Do you want them, too?

themaddoctor commented 6 years ago

From a 3TB drive with OXUF943SE chip: keyblock:

00000000  53 49 6e 45 01 00 00 00  02 00 64 01 29 2c 84 00  |SInE......d.),..|
00000010  01 00 00 00 c9 9a d0 06  be 08 23 f9 57 80 36 f8  |..........#.W.6.|
00000020  91 53 06 ad 47 69 45 93  67 50 eb d8 73 ad f1 4c  |.S..GiE.gP..s..L|
00000030  89 28 3c 91 c7 7f 75 03  5a 10 3f 41 72 86 b3 1b  |.(<...u.Z.?Ar...|
00000040  7a d2 a3 6e 1a d8 85 74  11 9e 57 52 b0 83 06 0d  |z..n...t..WR....|
00000050  8f cd 11 f3 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000060  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000090  ff ff ff ff ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000a0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000b0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000c0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000d0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000e0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000f0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
00000100  ad de d2 ba ad de d2 ba  e3 00 00 00 e3 00 00 00  |................|
00000110  00 00 00 00 00 00 e0 4a  00 00 00 00 e3 00 00 00  |.......J........|
00000120  a7 f5 02 00 00 08 00 80  f4 39 00 80 00 00 00 80  |.........9......|
00000130  50 3a 00 80 d9 31 03 00  02 00 00 00 00 00 00 00  |P:...1..........|
00000140  9c 3a 00 80 60 3a 00 80  00 00 00 40 01 00 00 50  |.:..`:.....@...P|
00000150  88 a3 50 5d 01 00 00 00  50 3a 00 80 d9 2f 03 00  |..P]....P:.../..|
00000160  0c 01 00 80 20 00 00 00  3f 5d 03 00 60 3a 00 80  |.... ...?]..`:..|
00000170  50 3a 00 80 33 d1 02 00  23 9c 01 00 00 02 00 00  |P:..3...#.......|
00000180  0c 06 00 02 00 07 00 d0  00 00 00 4b 0c 06 00 02  |...........K....|
00000190  00 07 00 d0 00 0e 00 00  3c 3a 00 80 00 00 00 4b  |........<:.....K|
000001a0  ff 00 00 00 48 3a 00 80  84 00 00 00 ac 3b 00 80  |....H:.......;..|
000001b0  0e d0 07 00 0c ff ff de  c1 1d 00 80 0c 00 00 00  |................|
000001c0  00 d0 07 00 c1 1d 00 80  84 00 00 00 0e d0 07 00  |................|
000001d0  d0 07 00 00 67 60 03 00  01 00 00 00 84 00 00 00  |....g`..........|
000001e0  ac 3b 00 80 0e d0 07 00  84 00 00 00 84 00 00 00  |.;..............|
000001f0  01 00 00 00 5f b5 01 00  ac 3b 00 80 00 00 ff ff  |...._....;......|

DEK: bd45d998a71d9ddc87112e88e9f6a3481fda2487b894240bba7499c5f9def6fc

themaddoctor commented 6 years ago

From a different 3TB drive with OXUF943SE chip:

DEK: 2c679f053cb6fc526775dc5f6f6bbd90dd14a782afc22ae8afa854e2256f0048

keyblock (sector 5860533120):

00000000  53 49 6e 45 01 00 00 00  02 00 64 01 cb a1 84 00  |SInE......d.....|
00000010  01 00 00 00 34 60 f1 d6  45 22 56 1f fe a9 78 87  |....4`..E"V...x.|
00000020  f4 f4 e6 46 d4 19 22 87  27 cb ba 54 8f e7 e4 9a  |...F..".'..T....|
00000030  23 72 21 d1 01 f1 b6 d4  88 11 3f a0 92 56 c5 db  |#r!.......?..V..|
00000040  53 1c 6c 86 1a d8 85 74  11 9e 57 52 b0 83 06 0d  |S.l....t..WR....|
00000050  8f cd 11 f3 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000060  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000090  ff ff ff ff ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000a0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000b0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000c0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000d0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000e0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000f0  ad de d2 ba 00 02 00 00  00 02 00 00 00 02 00 00  |................|
00000100  00 00 00 00 e9 bf 02 00  bd 04 00 00 e3 00 00 00  |................|
00000110  00 00 00 00 00 00 e0 4a  00 00 00 00 e3 00 00 00  |.......J........|
00000120  a7 f5 02 00 00 08 00 80  f4 39 00 80 00 00 00 80  |.........9......|
00000130  50 3a 00 80 d9 31 03 00  02 00 00 00 00 00 00 00  |P:...1..........|
00000140  9c 3a 00 80 60 3a 00 80  00 00 00 40 01 00 00 50  |.:..`:.....@...P|
00000150  88 a3 50 5d 01 00 00 00  50 3a 00 80 d9 2f 03 00  |..P]....P:.../..|
00000160  0c 01 00 80 20 00 00 00  3f 5d 03 00 60 3a 00 80  |.... ...?]..`:..|
00000170  50 3a 00 80 33 d1 02 00  23 9c 01 00 00 02 00 00  |P:..3...#.......|
00000180  0c 06 00 02 00 07 00 d0  00 00 00 4b 0c 06 00 02  |...........K....|
00000190  00 07 00 d0 00 0e 00 00  3c 3a 00 80 00 00 00 4b  |........<:.....K|
000001a0  ff 00 00 00 48 3a 00 80  84 00 00 00 ac 3b 00 80  |....H:.......;..|
000001b0  0e d0 07 00 0c ff 7f f7  c1 1d 00 80 0c 00 00 00  |................|
000001c0  00 d0 07 00 c1 1d 00 80  84 00 00 00 0e d0 07 00  |................|
000001d0  d0 07 00 00 67 60 03 00  01 00 00 00 84 00 00 00  |....g`..........|
000001e0  ac 3b 00 80 0e d0 07 00  84 00 00 00 84 00 00 00  |.;..............|
000001f0  01 00 00 00 5f b5 01 00  ac 3b 00 80 00 00 ff ff  |...._....;......|

sector 0:

00000000  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000010  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000020  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000030  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000040  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000050  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000060  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000070  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000080  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000090  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000a0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000b0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000c0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000d0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000e0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000f0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000100  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000110  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000120  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000130  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000140  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000150  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000160  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000170  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000180  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000190  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001a0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001b0  bc 52 63 04 7f da bd 47  b1 2a a2 6f e9 1e ea 58  |.Rc....G.*.o...X|
000001c0  fe 22 70 cc ee 46 ea 29  b3 73 e0 1e fc 4a e3 e9  |."p..F.).s...J..|
000001d0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001e0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001f0  f3 b3 44 13 9e 29 44 67  6c 0a a1 a0 e1 e1 a5 61  |..D..)Dgl......a|

sector 0, decrypted:

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000100  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 fe  |................|
000001c0  ff ff ee fe ff ff 01 00  00 00 fe ff ff ff 00 00  |................|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
andlabs commented 6 years ago

Yeah, including those already supported. Going to write this program right this time, so it breaks for fewer people. It's long past served my own needs, but I want to make it useful in general.

themaddoctor commented 6 years ago

My PDF will tell you how to handle the OXUF keyblocks. I'll see about uploading more samples.

themaddoctor commented 6 years ago

samples.zip

This is everything I think I have, including the OXUF ones I posted above.

Would you consider doing the rewrite in C or C++, so that it is more easily ported?

klturi421 commented 6 years ago

Still needing some test sectors? Mine is a Symwave chip.

andlabs commented 6 years ago

Yes; the more the better for now. As for whether I should write this in C; if that can make it more easily integrated into something like a Linux loopback device, sure; the problem is what libraries do I use for crypto?

themaddoctor commented 6 years ago

openssl's libcrypto

The linux device mapper already supports AES. I handle the byte shuffling with my own kernel module. FYI

klturi421 commented 6 years ago

Here's what I have. I noticed that the key sector and Key sector decrypted look exactly the same. I used the commands as provided in reallymine but they came up the same. Hopefully this helps and if there are any other files I could provide let me know.

This is from a 3TB Symwave.

DEK.txt Dumpfirst.txt Dumplast.txt Keysector.txt Keysector-decrypted.txt

themaddoctor commented 6 years ago

@klturi421 Your "dumpfirst" and "keysector" are the same file.

themaddoctor commented 6 years ago

@klturi421 Could you do your dumps in hex instead of bits?

klturi421 commented 6 years ago

@themaddoctor I will work on that this evening once I return home from work.

When I was looking at each file that is something that I noticed. As I mentioned previously I used the standard reallymine commands but noticed that each time I would open certain files that they would still look similar. I'm not sure if that has anything to do with the drive, how its setup, or what. I can confirm that the standard reallymine release is in fact decrypting the image of the drive.

Maybe I should pull the Dumpfirst/Last, and Key Sectors from the image instead?

themaddoctor commented 6 years ago

I rebuilt your keyblock from the binary dump, and checked that the DEK I get is the same. So I don't need anything. I could take a look at the beginning of the disk to see that it decrypts, but @andlabs cares more about that than I do.

00000000  57 4d 59 53 af 92 01 f8  00 00 00 00 02 00 00 00  |WMYS............|
00000010  f6 c7 38 6a 20 aa b8 e2  7d 97 25 87 e2 ce 83 8f  |..8j ...}.%.....|
00000020  c8 48 4b 7d 99 db 54 4e  31 d4 5e 2a e7 64 24 01  |.HK}..TN1.^*.d$.|
00000030  6f a4 1c 1f 13 8f 40 2c  15 88 b9 b5 72 b1 03 20  |o.....@,....r.. |
00000040  f3 65 eb 88 91 70 f9 e7  09 9a ee cb 58 05 ad 97  |.e...p......X...|
00000050  e3 6e b3 6d 5f 78 c9 cd  fe cb 85 c0 43 50 06 8d  |.n.m_x......CP..|
00000060  0f b6 50 6e 1a 36 30 8c  8e 25 9b fa 32 26 6b 6a  |..Pn.60..%..2&kj|
00000070  04 02 72 61 c0 a9 f3 65  a1 b4 b5 55 0c d4 e7 c7  |..ra...e...U....|
00000080  f1 52 3b f2 46 b3 e8 69  00 00 00 00 00 00 00 00  |.R;.F..i........|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0  00 f4 a9 2b 00 00 00 00  00 10 00 00 03 00 00 00  |...+............|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200
klturi421 commented 6 years ago

@themaddoctor - Received a notification of you saying something about my key sector being incomplete. Just to follow up with that and the previous notifications, that's what happens each time I run the commands as provided. My theory is that because the drive was connected to Windows after being removed from the enclosure may have partially corrupted that information.

themaddoctor commented 6 years ago

@klturi421 I removed that comment. The problem was at my end. Sorry. The keyblock is complete.

themaddoctor commented 5 years ago

randomroh.zip

Here's a new INIC keyblock and 2MB dump. The MBR and GPT table were overwritten by Windows, but the NTFS headers are still encrypted.

themaddoctor commented 5 years ago

soulbrix.zip

Keyblock from a JMS538S 2TB drive.

themaddoctor commented 5 years ago

nganton.zip

Keyblock and dump of first 2MB from a Symwave 2TB.

themaddoctor commented 5 years ago

kalshebikalim.zip

Keyblock and 2MB dump from a JMS538S drive, size forgotten.

themaddoctor commented 5 years ago

rosinx-JMS538S-2TB.zip

JMS538S 2TB MyBook, including a copy of sector 0

themaddoctor commented 5 years ago

Here are rosinx's sectors 2048 and 2049, both before and after decryption:

00000000  af 1e b3 dd 23 52 39 08  8f 2c f1 38 cf 9c f6 ee  |....#R9..,.8....|
00000010  e5 b3 51 b0 55 aa 67 e8  a0 45 0e 2f 2c 46 10 95  |..Q.U.g..E./,F..|
00000020  95 e0 f3 f6 f9 5e bb 5d  53 b3 33 70 4e b2 fa 53  |.....^.]S.3pN..S|
00000030  dd 09 f9 59 56 17 65 a5  ab 11 13 7d 12 a8 68 d6  |...YV.e....}..h.|
00000040  47 f9 e8 7d ea e8 78 b5  05 6a 9f 49 9c 7e 6b 59  |G..}..x..j.I.~kY|
00000050  e2 3b f8 50 fb 52 d6 87  dd 33 be 23 cb db 2b 78  |.;.P.R...3.#..+x|
00000060  39 37 91 c7 ed 59 81 89  78 7d 6f 92 a6 c4 05 6d  |97...Y..x}o....m|
00000070  8e 28 b1 85 72 a9 9e f7  16 74 37 9c dc 37 e9 84  |.(..r....t7..7..|
00000080  eb 1a 99 fd 1c 65 cf 21  a4 85 dd 4c d5 68 ae 0a  |.....e.!...L.h..|
00000090  32 43 a9 61 a7 f6 9f e1  d2 9d 61 84 85 08 ef 9c  |2C.a......a.....|
000000a0  3f d2 40 86 05 17 1e b6  2b 6b 88 22 91 4c db 8a  |?.@.....+k.".L..|
000000b0  7f b1 3b 4d 26 4f 43 dc  b2 cd d8 a0 31 10 6a b3  |..;M&OC.....1.j.|
000000c0  45 67 33 90 4c 2d 5d d4  7e 30 8a 49 6e 36 5d d2  |Eg3.L-].~0.In6].|
000000d0  1b f5 ee 56 9d e0 8f 5e  1a 63 70 8f 2d 1c e1 99  |...V...^.cp.-...|
000000e0  db 7c 60 58 c9 a1 8c 31  93 bb 3d 54 71 c1 a0 71  |.|`X...1..=Tq..q|
000000f0  1a 8f 24 4c de 53 22 15  cd 2d e2 89 f3 53 63 82  |..$L.S"..-...Sc.|
00000100  8c e6 ca 5e a2 3e b0 68  b5 9b 32 a5 39 02 a6 7a  |...^.>.h..2.9..z|
00000110  c2 bb 59 74 c3 02 07 80  f6 fc c0 6b e5 9b c9 aa  |..Yt.......k....|
00000120  0d 39 b2 a5 f6 3d 5f 50  b8 69 e9 96 80 35 71 75  |.9...=_P.i...5qu|
00000130  3e c3 f3 21 00 54 4e 3c  c1 66 c7 6d 35 90 7c 76  |>..!.TN<.f.m5.|v|
00000140  21 8d 3d e3 8c e7 4e 58  2d 34 3c 19 f8 bf ce 21  |!.=...NX-4<....!|
00000150  a8 70 5c 89 b4 79 2b ed  19 75 10 e3 a7 9d 47 29  |.p\..y+..u....G)|
00000160  95 7a bb 4b bf c3 a5 b4  89 50 77 73 af 7d a9 28  |.z.K.....Pws.}.(|
00000170  0e 4d a6 19 be 60 1f 46  a9 64 ee 5f a6 33 9b 53  |.M...`.F.d._.3.S|
00000180  7e 05 88 f7 d0 e2 9e 5a  23 d0 ad 9e 45 12 e0 fd  |~......Z#...E...|
00000190  cb 65 8e a4 de 11 cf 7a  0c 36 34 93 55 87 43 35  |.e.....z.64.U.C5|
000001a0  ca 13 12 5c 6c 51 88 1e  6e 9f 3a b3 a6 08 a3 3f  |...\lQ..n.:....?|
000001b0  5b ca 97 7f f5 d0 67 ad  d8 ea a8 18 ac 3a f0 4d  |[.....g......:.M|
000001c0  48 c1 99 80 50 3f cc 90  07 3c 57 dd ba 90 9b 09  |H...P?...<W.....|
000001d0  d0 6c 8d f3 50 a3 d3 47  e1 02 79 59 60 dd 6c 95  |.l..P..G..yY`.l.|
000001e0  db a4 14 a2 c9 5e c6 84  66 5e c3 2e 56 e0 4b 3a  |.....^..f^..V.K:|
000001f0  13 70 1a ea 7e 75 0c d8  f6 6d 59 11 1f 4f 73 93  |.p..~u...mY..Os.|
00000200  1f 21 d8 a9 84 49 8d c2  30 45 0d 87 b8 a6 be dd  |.!...I..0E......|
00000210  87 a8 11 61 b8 8b 9a 03  f0 7f 8d 41 38 c8 46 a7  |...a.......A8.F.|
00000220  46 43 d9 da e8 1d 9b 3a  d8 88 8f 91 47 4f d3 5a  |FC.....:....GO.Z|
00000230  46 43 d9 da e8 1d 9b 3a  d8 88 8f 91 47 4f d3 5a  |FC.....:....GO.Z|
00000240  46 43 d9 da e8 1d 9b 3a  d8 88 8f 91 47 4f d3 5a  |FC.....:....GO.Z|
00000250  a8 26 f2 55 5f 91 f0 97  d7 d1 97 35 32 c4 6f 78  |.&.U_......52.ox|
00000260  c0 71 9f 50 9b 38 6c 02  70 34 72 fb 50 8c de 15  |.q.P.8l.p4r.P...|
00000270  28 95 06 33 37 67 23 a7  a3 2d cd 1d 74 47 a0 b8  |(..37g#..-..tG..|
00000280  65 c2 07 ca 34 45 99 d1  9a d8 15 52 30 db 0e 5d  |e...4E.....R0..]|
00000290  af d6 67 02 d5 e7 13 0f  84 58 54 8d 57 97 07 11  |..g......XT.W...|
000002a0  dd 34 82 d1 0d 75 0f d4  3a a3 66 dd 7e 83 1a 90  |.4...u..:.f.~...|
000002b0  14 93 77 26 d7 08 8d 05  d9 5b 3f 01 00 86 b0 79  |..w&.....[?....y|
000002c0  65 bb 8e 89 a0 25 90 a9  54 15 60 4f aa be f1 ea  |e....%..T.`O....|
000002d0  b2 02 b2 50 c0 f2 3c 9b  a8 87 3d 21 29 4e 50 98  |...P..<...=!)NP.|
000002e0  1b 56 04 17 a4 29 73 53  a5 9a ac e5 f7 be 3f 8d  |.V...)sS......?.|
000002f0  31 69 a4 3a aa dd 8a af  8d 53 b7 19 26 23 7a f5  |1i.:.....S..&#z.|
00000300  1c 36 51 4c 57 10 c0 f6  dc 05 0a ea 13 a0 fc 4a  |.6QLW..........J|
00000310  50 8c 32 41 a2 f0 a8 11  40 c6 e6 a1 80 87 1d 48  |P.2A....@......H|
00000320  00 bd 46 93 a3 20 a3 38  56 c4 05 82 a5 44 dd eb  |..F.. .8V....D..|
00000330  28 ba b1 bd f4 ad cf e0  a7 06 31 8f 50 12 d1 6d  |(.........1.P..m|
00000340  8c 92 db 46 f9 83 a6 df  f3 c5 8d cc 02 db c8 fd  |...F............|
00000350  45 26 13 82 54 0d 67 26  20 8f d4 9f 64 90 f3 0b  |E&..T.g& ...d...|
00000360  02 28 34 f8 6a 83 10 fc  63 97 05 4d b1 da e7 86  |.(4.j...c..M....|
00000370  b7 b4 69 7d 6b f6 93 4c  71 74 71 18 68 ff 19 f5  |..i}k..Lqtq.h...|
00000380  ca c4 39 72 93 a2 b6 16  d9 cc e8 77 f5 c3 52 a3  |..9r.......w..R.|
00000390  f0 8c 67 dc 6d 1c 8d b6  98 2b 2a 5f 2f 3c e5 2a  |..g.m....+*_/<.*|
000003a0  78 38 89 99 0e 26 4f d1  b4 d9 8d ae 97 fd 1d 49  |x8...&O........I|
000003b0  57 f3 1e 2b 4c c7 f4 ca  74 89 d9 55 d6 7d ff d1  |W..+L...t..U.}..|
000003c0  98 6f 2e 2b da ba d8 70  ea 0d ef 89 3a dc bb f3  |.o.+...p....:...|
000003d0  50 d0 39 5c bc da f9 87  3f 46 3b 1a 29 e7 67 7e  |P.9\....?F;.).g~|
000003e0  c6 ae f9 89 1a 80 1a 46  ba 49 45 27 6c e7 c3 f7  |.......F.IE'l...|
000003f0  3e 18 59 21 56 0c ff 1b  b1 46 c9 68 97 bb 2a fe  |>.Y!V....F.h..*.|
00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
00000020  00 00 00 00 80 00 80 00  ff 7f df e8 00 00 00 00  |................|
00000030  00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00000040  f6 00 00 00 01 00 00 00  c5 11 e6 e0 50 e6 e0 3a  |............P..:|
00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|
00000060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|
00000070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|
00000080  55 aa 75 06 f7 c1 01 00  75 03 e9 dd 00 1e 83 ec  |U.u.....u.......|
00000090  18 68 1a 00 b4 48 8a 16  0e 00 8b f4 16 1f cd 13  |.h...H..........|
000000a0  9f 83 c4 18 9e 58 1f 72  e1 3b 06 0b 00 75 db a3  |.....X.r.;...u..|
000000b0  0f 00 c1 2e 0f 00 04 1e  5a 33 db b9 00 20 2b c8  |........Z3... +.|
000000c0  66 ff 06 11 00 03 16 0f  00 8e c2 ff 06 16 00 e8  |f...............|
000000d0  4b 00 2b c8 77 ef b8 00  bb cd 1a 66 23 c0 75 2d  |K.+.w......f#.u-|
000000e0  66 81 fb 54 43 50 41 75  24 81 f9 02 01 72 1e 16  |f..TCPAu$....r..|
000000f0  68 07 bb 16 68 70 0e 16  68 09 00 66 53 66 53 66  |h...hp..h..fSfSf|
00000100  55 16 16 16 68 b8 01 66  61 0e 07 cd 1a 33 c0 bf  |U...h..fa....3..|
00000110  28 10 b9 d8 0f fc f3 aa  e9 5f 01 90 90 66 60 1e  |(........_...f`.|
00000120  06 66 a1 11 00 66 03 06  1c 00 1e 66 68 00 00 00  |.f...f.....fh...|
00000130  00 66 50 06 53 68 01 00  68 10 00 b4 42 8a 16 0e  |.fP.Sh..h...B...|
00000140  00 16 1f 8b f4 cd 13 66  59 5b 5a 66 59 66 59 1f  |.......fY[ZfYfY.|
00000150  0f 82 16 00 66 ff 06 11  00 03 16 0f 00 8e c2 ff  |....f...........|
00000160  0e 16 00 75 bc 07 1f 66  61 c3 a0 f8 01 e8 09 00  |...u...fa.......|
00000170  a0 fb 01 e8 03 00 f4 eb  fd b4 01 8b f0 ac 3c 00  |..............<.|
00000180  74 09 b4 0e bb 07 00 cd  10 eb f2 c3 0d 0a 41 20  |t.............A |
00000190  64 69 73 6b 20 72 65 61  64 20 65 72 72 6f 72 20  |disk read error |
000001a0  6f 63 63 75 72 72 65 64  00 0d 0a 42 4f 4f 54 4d  |occurred...BOOTM|
000001b0  47 52 20 69 73 20 6d 69  73 73 69 6e 67 00 0d 0a  |GR is missing...|
000001c0  42 4f 4f 54 4d 47 52 20  69 73 20 63 6f 6d 70 72  |BOOTMGR is compr|
000001d0  65 73 73 65 64 00 0d 0a  50 72 65 73 73 20 43 74  |essed...Press Ct|
000001e0  72 6c 2b 41 6c 74 2b 44  65 6c 20 74 6f 20 72 65  |rl+Alt+Del to re|
000001f0  73 74 61 72 74 0d 0a 00  8c a9 be d6 00 00 55 aa  |start.........U.|
00000200  07 00 42 00 4f 00 4f 00  54 00 4d 00 47 00 52 00  |..B.O.O.T.M.G.R.|
00000210  04 00 24 00 49 00 33 00  30 00 00 d4 00 00 00 24  |..$.I.3.0......$|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000230  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000250  00 00 00 00 00 00 eb 22  90 90 05 00 4e 00 54 00  |......."....N.T.|
00000260  4c 00 44 00 52 00 00 00  00 00 00 00 00 00 00 00  |L.D.R...........|
00000270  00 00 00 00 00 00 00 00  00 00 66 0f b7 06 0b 00  |..........f.....|
00000280  66 0f b6 1e 0d 00 66 f7  e3 66 a3 52 02 66 8b 0e  |f.....f..f.R.f..|
00000290  40 00 80 f9 00 0f 8f 0e  00 f6 d9 66 b8 01 00 00  |@..........f....|
000002a0  00 66 d3 e0 eb 08 90 66  a1 52 02 66 f7 e1 66 a3  |.f.....f.R.f..f.|
000002b0  66 02 66 0f b7 1e 0b 00  66 33 d2 66 f7 f3 66 a3  |f.f.....f3.f..f.|
000002c0  56 02 e8 95 04 66 8b 0e  4e 02 66 89 0e 26 02 66  |V....f..N.f..&.f|
000002d0  03 0e 66 02 66 89 0e 2a  02 66 03 0e 66 02 66 89  |..f.f..*.f..f.f.|
000002e0  0e 2e 02 66 03 0e 66 02  66 89 0e 3e 02 66 03 0e  |...f..f.f..>.f..|
000002f0  66 02 66 89 0e 46 02 66  b8 90 00 00 00 66 8b 0e  |f.f..F.f.....f..|
00000300  26 02 e8 83 09 66 0b c0  0f 84 5e fe 66 a3 32 02  |&....f....^.f.2.|
00000310  66 b8 a0 00 00 00 66 8b  0e 2a 02 e8 6a 09 66 a3  |f.....f..*..j.f.|
00000320  36 02 66 b8 b0 00 00 00  66 8b 0e 2e 02 e8 58 09  |6.f.....f.....X.|
00000330  66 a3 3a 02 66 a1 32 02  66 0b c0 0f 84 2b fe 67  |f.:.f.2.f....+.g|
00000340  80 78 08 00 0f 85 22 fe  67 66 8d 50 10 67 03 42  |.x....".gf.P.g.B|
00000350  04 67 66 0f b6 48 0c 66  89 0e 72 02 67 66 8b 48  |.gf..H.f..r.gf.H|
00000360  08 66 89 0e 6e 02 66 a1  6e 02 66 0f b7 0e 0b 00  |.f..n.f.n.f.....|
00000370  66 33 d2 66 f7 f1 66 a3  76 02 66 a1 46 02 66 03  |f3.f..f.v.f.F.f.|
00000380  06 6e 02 66 a3 4a 02 66  83 3e 36 02 00 0f 84 1d  |.n.f.J.f.>6.....|
00000390  00 66 83 3e 3a 02 00 0f  84 cf fd 66 8b 1e 3a 02  |.f.>:......f..:.|
000003a0  1e 07 66 8b 3e 4a 02 66  a1 2e 02 e8 e0 01 66 0f  |..f.>J.f......f.|
000003b0  b7 0e 00 02 66 b8 02 02  00 00 e8 22 08 66 0b c0  |....f......".f..|
000003c0  0f 85 16 00 66 0f b7 0e  5a 02 66 b8 5c 02 00 00  |....f...Z.f.\...|
000003d0  e8 0c 08 66 0b c0 0f 84  42 0c 67 66 8b 00 1e 07  |...f....B.gf....|
000003e0  66 8b 3e 3e 02 e8 3f 06  66 a1 3e 02 66 bb 20 00  |f.>>..?.f.>.f. .|
000003f0  00 00 66 b9 00 00 00 00  66 ba 00 00 00 00 e8 e4  |..f.....f.......|
themaddoctor commented 5 years ago

ersanr.zip

From a 2TB JMS538S disk that was corrupted by Windows (no NTFS signatures remain, MBR overwritten).