Serious Problem with OSFClone ***Please Help!***

[NeoUrsus]

Okay first off thanks for approving my request to join. Here's what's going on.

I've been using OSFClone without a problem for years. I love it. It's the backbone of my operations. However I've run into a problem that has become persistent, and I hope there is some kind of fix.

I have three systems, all with SSD Drives; two Dell Desktops with drives I personally installed, and one ASUS Zenbook using a native 1TB drive. I have cloned all of them successfully but now I notice a problem with the ASUS system.

My two desktop systems will clone just fine. As a matter of fact just yesterday I re-wrote my 500gb SSD back from the latest image without a hitch, and a few weeks ago re-wrote my other Dell's 1tb image flawlessly. But creating an image from the ASUS now seems to be impossible. Here's what's going on. As I said I've cloned the ASUS drive in the past, but had to delete the .img file and wanted to create a new one.

So I go to create a 1tb image using DD to a 2tb destination drive (so there is plenty of room). On the last attempt I even wiped the destination drive for a clean write. However, when I go to check the IMG file, the OSFClone01 Folder is missing. Then after checking the drive for errors in Windows, the folder then appears but the .img file says 0k! Not only is the data missing, but it still takes up 1tb of space on my destination drive! I've used Testdisk in Linux which also does not see the file but still reports the space as being used. I've run into this problem before, so technically this was my third attempt, first ghosting the same drive on an 8tb backup drive which now also does not show the img but has lost 1tb of space. A few years ago I had the same problem and instead just reformatted the 8tb drive and reloaded all my backups and img files. AITA?

So not only am I getting an empty .img file but 1tb of data is missing on two drives and there doesn't appear to be any way of getting back the img or the space without reformatting the drive completely!

What the hell?

So can anyone please tell me how to reclaim the missing drive space, and create a working .img file? I'm worried about my drives as well as the Zenbook needing a re-write because I have a lot of licensed Windows software that was not cheap, and having to re-install all of it one by one would be a nightmare, especially if I have to track down the old keys and what not. Thanks for your help.

[David (PassMark)]

We haven't had this problem reported before. So don't know the cause.

How was the destination drive connected to the ASUS machine? (USB I assume? Or maybe it has space for a 2nd internal drive?)

What file system is in use on the destination drive? (NTFS, exFAT, etc...).
I hope it wasn't FAT32, as it won't support writing a 1TB file.

> the OSFClone01 Folder is missing

Is this a folder you manually created?

> Then after checking the drive for errors in Windows, the folder then appears

This would normally imply disk corruption.
Is the ASUS machine stable in normal use. i.e. could the RAM, CPU or USB interface be bad?

> first ghosting the same drive

Do you mean with the Norton Ghost app?

> reclaim the missing drive space

Doing a disk format should recover the space. But of course you'll loss the data on it.

You can use OSF to mount the destination drive and then browse the file system. But if the drive is corrupt, then it might also throw some errors or show nothing.
(OSF doesn't use the file system but can read the disk sectors directly, so it might give a different result compared to Windows Explorer)

[NeoUrsus]

We haven't had this problem reported before. So don't know the cause.

>>How was the destination drive connected to the ASUS machine? (USB I assume? Or maybe it has space for a 2nd internal drive?)

On the first and second attempt, they were connected via USB. On the third attempt the drive was connected via USB C. I got the fasted transfers that way as well.

>>What file system is in use on the destination drive? (NTFS, exFAT, etc...).
>>I hope it wasn't FAT32, as it won't support writing a 1TB file.

Both Drives are NTSF MBR.

> the OSFClone01 Folder is missing

>>Is this a folder you manually created?

No, it's the folder created every time I make an img file. I'm confused why this is a mystery to you.

> Then after checking the drive for errors in Windows, the folder then appears

>>This would normally imply disk corruption.
>>Is the ASUS machine stable in normal use. i.e. could the RAM, CPU or USB interface be bad?

I suppose that could be true, but on the second attempt, the .img file did show up and it showed a 1tb filesize. But when I went to transfer it, the filesize changed to 0K.

> first ghosting the same drive

>>Do you mean with the Norton Ghost app?

Well I call it "ghosting". No I don't use Norton at all.

> reclaim the missing drive space

>>Doing a disk format should recover the space. But of course you'll loss the data on it.

Yes I have done that but now I'm just going to use my original 8tb drive as the destination. I am thinking it might be the ASUS. I get thermal warnings when imaging this system and the CPU has to be throttled. Perhaps I will rest it on some ice packs and a towel before starting.

>>You can use OSF to mount the destination drive and then browse the file system. But if the drive is corrupt, then it might also throw some errors or show nothing.
>>(OSF doesn't use the file system but can read the disk sectors directly, so it might give a different result compared to Windows Explorer)

Thanks. I will try the ice pack method and report my results.

[David (PassMark)]

It is a bit surprising that the machine can overhead while doing a disk copy, as the CPU and GPU should not be very active during that period.

[Unallocated Clusters]

You could use FTK Imager or Encase Imager to attempt to restore your DD/IMG file to a hard drive; if neither of those tools work, then it is likely a problem with your DD/IMG image file. I know it does not help with your current situation, but the benefit of generating an E01 image file rather than an DD or IMG image file is that one can use FTK Imager to "verify" the hash values of the E01 image file after the fact to test if one's image file has become corrupt.

I agree with David that mounting your forensic image file, or simply opening your current image file in FTK Imager will allow you to extract files and folders to a new drive.

Also there is a tool called DMDE which one can use to repair corrupted imaged files: https://dmde.com/

[David (PassMark)]

With modern SSDs, IMG files can be much faster to write than E01 files. The compression implementation with E01 is awful (limited to around 100MB/sec). SHA1 hash can be used for checking the IMG file. But you can't check the file (E01 or IMG), or restore the file, if the entire file has just disappeared, which is the claim here I think.