reallymine Test sectors needed

I can work on this again. I'm going to dump the existing concurrent code and build everything to have tests at every level.

I need to go back through all the issues and ask for permission to integrate the posted sectors, both decrypted and encrypted, as test data. (TODO make a list of all of those here)

In the meantime, I'd be happy to have random sectors to use as test data for as many configurations as possible. Ideally I would have data from random points in the disk, so not exclusively MBRs and GPTs, but of course use your best judgement when providing data.

Aug 04 '18 14:08 andlabs

I have a bunch from drives that RM already supports. Do you want them, too?

Aug 04 '18 17:08 themaddoctor

From a 3TB drive with OXUF943SE chip: keyblock:

00000000  53 49 6e 45 01 00 00 00  02 00 64 01 29 2c 84 00  |SInE......d.),..|
00000010  01 00 00 00 c9 9a d0 06  be 08 23 f9 57 80 36 f8  |..........#.W.6.|
00000020  91 53 06 ad 47 69 45 93  67 50 eb d8 73 ad f1 4c  |.S..GiE.gP..s..L|
00000030  89 28 3c 91 c7 7f 75 03  5a 10 3f 41 72 86 b3 1b  |.(<...u.Z.?Ar...|
00000040  7a d2 a3 6e 1a d8 85 74  11 9e 57 52 b0 83 06 0d  |z..n...t..WR....|
00000050  8f cd 11 f3 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000060  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000090  ff ff ff ff ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000a0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000b0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000c0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000d0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000e0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000f0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
00000100  ad de d2 ba ad de d2 ba  e3 00 00 00 e3 00 00 00  |................|
00000110  00 00 00 00 00 00 e0 4a  00 00 00 00 e3 00 00 00  |.......J........|
00000120  a7 f5 02 00 00 08 00 80  f4 39 00 80 00 00 00 80  |.........9......|
00000130  50 3a 00 80 d9 31 03 00  02 00 00 00 00 00 00 00  |P:...1..........|
00000140  9c 3a 00 80 60 3a 00 80  00 00 00 40 01 00 00 50  |.:..`:[email protected]|
00000150  88 a3 50 5d 01 00 00 00  50 3a 00 80 d9 2f 03 00  |..P]....P:.../..|
00000160  0c 01 00 80 20 00 00 00  3f 5d 03 00 60 3a 00 80  |.... ...?]..`:..|
00000170  50 3a 00 80 33 d1 02 00  23 9c 01 00 00 02 00 00  |P:..3...#.......|
00000180  0c 06 00 02 00 07 00 d0  00 00 00 4b 0c 06 00 02  |...........K....|
00000190  00 07 00 d0 00 0e 00 00  3c 3a 00 80 00 00 00 4b  |........<:.....K|
000001a0  ff 00 00 00 48 3a 00 80  84 00 00 00 ac 3b 00 80  |....H:.......;..|
000001b0  0e d0 07 00 0c ff ff de  c1 1d 00 80 0c 00 00 00  |................|
000001c0  00 d0 07 00 c1 1d 00 80  84 00 00 00 0e d0 07 00  |................|
000001d0  d0 07 00 00 67 60 03 00  01 00 00 00 84 00 00 00  |....g`..........|
000001e0  ac 3b 00 80 0e d0 07 00  84 00 00 00 84 00 00 00  |.;..............|
000001f0  01 00 00 00 5f b5 01 00  ac 3b 00 80 00 00 ff ff  |...._....;......|

DEK: bd45d998a71d9ddc87112e88e9f6a3481fda2487b894240bba7499c5f9def6fc

Aug 04 '18 17:08 themaddoctor

From a different 3TB drive with OXUF943SE chip:

DEK: 2c679f053cb6fc526775dc5f6f6bbd90dd14a782afc22ae8afa854e2256f0048

keyblock (sector 5860533120):

00000000  53 49 6e 45 01 00 00 00  02 00 64 01 cb a1 84 00  |SInE......d.....|
00000010  01 00 00 00 34 60 f1 d6  45 22 56 1f fe a9 78 87  |....4`..E"V...x.|
00000020  f4 f4 e6 46 d4 19 22 87  27 cb ba 54 8f e7 e4 9a  |...F..".'..T....|
00000030  23 72 21 d1 01 f1 b6 d4  88 11 3f a0 92 56 c5 db  |#r!.......?..V..|
00000040  53 1c 6c 86 1a d8 85 74  11 9e 57 52 b0 83 06 0d  |S.l....t..WR....|
00000050  8f cd 11 f3 ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000060  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000070  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000080  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000090  ff ff ff ff ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000a0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000b0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000c0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000d0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000e0  ad de d2 ba ad de d2 ba  ad de d2 ba ad de d2 ba  |................|
000000f0  ad de d2 ba 00 02 00 00  00 02 00 00 00 02 00 00  |................|
00000100  00 00 00 00 e9 bf 02 00  bd 04 00 00 e3 00 00 00  |................|
00000110  00 00 00 00 00 00 e0 4a  00 00 00 00 e3 00 00 00  |.......J........|
00000120  a7 f5 02 00 00 08 00 80  f4 39 00 80 00 00 00 80  |.........9......|
00000130  50 3a 00 80 d9 31 03 00  02 00 00 00 00 00 00 00  |P:...1..........|
00000140  9c 3a 00 80 60 3a 00 80  00 00 00 40 01 00 00 50  |.:..`:[email protected]|
00000150  88 a3 50 5d 01 00 00 00  50 3a 00 80 d9 2f 03 00  |..P]....P:.../..|
00000160  0c 01 00 80 20 00 00 00  3f 5d 03 00 60 3a 00 80  |.... ...?]..`:..|
00000170  50 3a 00 80 33 d1 02 00  23 9c 01 00 00 02 00 00  |P:..3...#.......|
00000180  0c 06 00 02 00 07 00 d0  00 00 00 4b 0c 06 00 02  |...........K....|
00000190  00 07 00 d0 00 0e 00 00  3c 3a 00 80 00 00 00 4b  |........<:.....K|
000001a0  ff 00 00 00 48 3a 00 80  84 00 00 00 ac 3b 00 80  |....H:.......;..|
000001b0  0e d0 07 00 0c ff 7f f7  c1 1d 00 80 0c 00 00 00  |................|
000001c0  00 d0 07 00 c1 1d 00 80  84 00 00 00 0e d0 07 00  |................|
000001d0  d0 07 00 00 67 60 03 00  01 00 00 00 84 00 00 00  |....g`..........|
000001e0  ac 3b 00 80 0e d0 07 00  84 00 00 00 84 00 00 00  |.;..............|
000001f0  01 00 00 00 5f b5 01 00  ac 3b 00 80 00 00 ff ff  |...._....;......|

sector 0:

00000000  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000010  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000020  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000030  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000040  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000050  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000060  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000070  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000080  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000090  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000a0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000b0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000c0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000d0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000e0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000000f0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000100  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000110  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000120  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000130  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000140  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000150  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000160  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000170  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000180  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
00000190  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001a0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001b0  bc 52 63 04 7f da bd 47  b1 2a a2 6f e9 1e ea 58  |.Rc....G.*.o...X|
000001c0  fe 22 70 cc ee 46 ea 29  b3 73 e0 1e fc 4a e3 e9  |."p..F.).s...J..|
000001d0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001e0  96 31 64 b5 e6 d0 05 14  79 fd 26 c6 5a 2a ad 1e  |.1d.....y.&.Z*..|
000001f0  f3 b3 44 13 9e 29 44 67  6c 0a a1 a0 e1 e1 a5 61  |..D..)Dgl......a|

sector 0, decrypted:

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000100  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000150  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 fe  |................|
000001c0  ff ff ee fe ff ff 01 00  00 00 fe ff ff ff 00 00  |................|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|

Aug 04 '18 17:08 themaddoctor

Yeah, including those already supported. Going to write this program right this time, so it breaks for fewer people. It's long past served my own needs, but I want to make it useful in general.

Aug 04 '18 21:08 andlabs

My PDF will tell you how to handle the OXUF keyblocks. I'll see about uploading more samples.

Aug 04 '18 21:08 themaddoctor

samples.zip

This is everything I think I have, including the OXUF ones I posted above.

Would you consider doing the rewrite in C or C++, so that it is more easily ported?

Aug 04 '18 21:08 themaddoctor

Still needing some test sectors? Mine is a Symwave chip.

Aug 12 '18 23:08 klturi421

Yes; the more the better for now. As for whether I should write this in C; if that can make it more easily integrated into something like a Linux loopback device, sure; the problem is what libraries do I use for crypto?

Aug 12 '18 23:08 andlabs

openssl's libcrypto

The linux device mapper already supports AES. I handle the byte shuffling with my own kernel module. FYI

Aug 13 '18 00:08 themaddoctor

Here's what I have. I noticed that the key sector and Key sector decrypted look exactly the same. I used the commands as provided in reallymine but they came up the same. Hopefully this helps and if there are any other files I could provide let me know.

This is from a 3TB Symwave.

DEK.txt Dumpfirst.txt Dumplast.txt Keysector.txt Keysector-decrypted.txt

Aug 13 '18 18:08 klturi421

@klturi421 Your "dumpfirst" and "keysector" are the same file.

Aug 13 '18 19:08 themaddoctor

@klturi421 Could you do your dumps in hex instead of bits?

Aug 13 '18 19:08 themaddoctor

@themaddoctor I will work on that this evening once I return home from work.

When I was looking at each file that is something that I noticed. As I mentioned previously I used the standard reallymine commands but noticed that each time I would open certain files that they would still look similar. I'm not sure if that has anything to do with the drive, how its setup, or what. I can confirm that the standard reallymine release is in fact decrypting the image of the drive.

Maybe I should pull the Dumpfirst/Last, and Key Sectors from the image instead?

Aug 13 '18 22:08 klturi421

I rebuilt your keyblock from the binary dump, and checked that the DEK I get is the same. So I don't need anything. I could take a look at the beginning of the disk to see that it decrypts, but @andlabs cares more about that than I do.

00000000  57 4d 59 53 af 92 01 f8  00 00 00 00 02 00 00 00  |WMYS............|
00000010  f6 c7 38 6a 20 aa b8 e2  7d 97 25 87 e2 ce 83 8f  |..8j ...}.%.....|
00000020  c8 48 4b 7d 99 db 54 4e  31 d4 5e 2a e7 64 24 01  |.HK}..TN1.^*.d$.|
00000030  6f a4 1c 1f 13 8f 40 2c  15 88 b9 b5 72 b1 03 20  |o.....@,....r.. |
00000040  f3 65 eb 88 91 70 f9 e7  09 9a ee cb 58 05 ad 97  |.e...p......X...|
00000050  e3 6e b3 6d 5f 78 c9 cd  fe cb 85 c0 43 50 06 8d  |.n.m_x......CP..|
00000060  0f b6 50 6e 1a 36 30 8c  8e 25 9b fa 32 26 6b 6a  |..Pn.60..%..2&kj|
00000070  04 02 72 61 c0 a9 f3 65  a1 b4 b5 55 0c d4 e7 c7  |..ra...e...U....|
00000080  f1 52 3b f2 46 b3 e8 69  00 00 00 00 00 00 00 00  |.R;.F..i........|
00000090  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0  00 f4 a9 2b 00 00 00 00  00 10 00 00 03 00 00 00  |...+............|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200

Aug 14 '18 01:08 themaddoctor

@themaddoctor - Received a notification of you saying something about my key sector being incomplete. Just to follow up with that and the previous notifications, that's what happens each time I run the commands as provided. My theory is that because the drive was connected to Windows after being removed from the enclosure may have partially corrupted that information.

Aug 21 '18 23:08 klturi421

@klturi421 I removed that comment. The problem was at my end. Sorry. The keyblock is complete.

Aug 21 '18 23:08 themaddoctor

randomroh.zip

Here's a new INIC keyblock and 2MB dump. The MBR and GPT table were overwritten by Windows, but the NTFS headers are still encrypted.

Dec 26 '18 03:12 themaddoctor

soulbrix.zip

Keyblock from a JMS538S 2TB drive.

Dec 26 '18 04:12 themaddoctor

nganton.zip

Keyblock and dump of first 2MB from a Symwave 2TB.

Dec 26 '18 04:12 themaddoctor

kalshebikalim.zip

Keyblock and 2MB dump from a JMS538S drive, size forgotten.

Dec 26 '18 04:12 themaddoctor

rosinx-JMS538S-2TB.zip

JMS538S 2TB MyBook, including a copy of sector 0

Dec 31 '18 01:12 themaddoctor

Here are rosinx's sectors 2048 and 2049, both before and after decryption:

00000000  af 1e b3 dd 23 52 39 08  8f 2c f1 38 cf 9c f6 ee  |....#R9..,.8....|
00000010  e5 b3 51 b0 55 aa 67 e8  a0 45 0e 2f 2c 46 10 95  |..Q.U.g..E./,F..|
00000020  95 e0 f3 f6 f9 5e bb 5d  53 b3 33 70 4e b2 fa 53  |.....^.]S.3pN..S|
00000030  dd 09 f9 59 56 17 65 a5  ab 11 13 7d 12 a8 68 d6  |...YV.e....}..h.|
00000040  47 f9 e8 7d ea e8 78 b5  05 6a 9f 49 9c 7e 6b 59  |G..}..x..j.I.~kY|
00000050  e2 3b f8 50 fb 52 d6 87  dd 33 be 23 cb db 2b 78  |.;.P.R...3.#..+x|
00000060  39 37 91 c7 ed 59 81 89  78 7d 6f 92 a6 c4 05 6d  |97...Y..x}o....m|
00000070  8e 28 b1 85 72 a9 9e f7  16 74 37 9c dc 37 e9 84  |.(..r....t7..7..|
00000080  eb 1a 99 fd 1c 65 cf 21  a4 85 dd 4c d5 68 ae 0a  |.....e.!...L.h..|
00000090  32 43 a9 61 a7 f6 9f e1  d2 9d 61 84 85 08 ef 9c  |2C.a......a.....|
000000a0  3f d2 40 86 05 17 1e b6  2b 6b 88 22 91 4c db 8a  |?.@.....+k.".L..|
000000b0  7f b1 3b 4d 26 4f 43 dc  b2 cd d8 a0 31 10 6a b3  |..;M&OC.....1.j.|
000000c0  45 67 33 90 4c 2d 5d d4  7e 30 8a 49 6e 36 5d d2  |Eg3.L-].~0.In6].|
000000d0  1b f5 ee 56 9d e0 8f 5e  1a 63 70 8f 2d 1c e1 99  |...V...^.cp.-...|
000000e0  db 7c 60 58 c9 a1 8c 31  93 bb 3d 54 71 c1 a0 71  |.|`X...1..=Tq..q|
000000f0  1a 8f 24 4c de 53 22 15  cd 2d e2 89 f3 53 63 82  |..$L.S"..-...Sc.|
00000100  8c e6 ca 5e a2 3e b0 68  b5 9b 32 a5 39 02 a6 7a  |...^.>.h..2.9..z|
00000110  c2 bb 59 74 c3 02 07 80  f6 fc c0 6b e5 9b c9 aa  |..Yt.......k....|
00000120  0d 39 b2 a5 f6 3d 5f 50  b8 69 e9 96 80 35 71 75  |.9...=_P.i...5qu|
00000130  3e c3 f3 21 00 54 4e 3c  c1 66 c7 6d 35 90 7c 76  |>..!.TN<.f.m5.|v|
00000140  21 8d 3d e3 8c e7 4e 58  2d 34 3c 19 f8 bf ce 21  |!.=...NX-4<....!|
00000150  a8 70 5c 89 b4 79 2b ed  19 75 10 e3 a7 9d 47 29  |.p\..y+..u....G)|
00000160  95 7a bb 4b bf c3 a5 b4  89 50 77 73 af 7d a9 28  |.z.K.....Pws.}.(|
00000170  0e 4d a6 19 be 60 1f 46  a9 64 ee 5f a6 33 9b 53  |.M...`.F.d._.3.S|
00000180  7e 05 88 f7 d0 e2 9e 5a  23 d0 ad 9e 45 12 e0 fd  |~......Z#...E...|
00000190  cb 65 8e a4 de 11 cf 7a  0c 36 34 93 55 87 43 35  |.e.....z.64.U.C5|
000001a0  ca 13 12 5c 6c 51 88 1e  6e 9f 3a b3 a6 08 a3 3f  |...\lQ..n.:....?|
000001b0  5b ca 97 7f f5 d0 67 ad  d8 ea a8 18 ac 3a f0 4d  |[.....g......:.M|
000001c0  48 c1 99 80 50 3f cc 90  07 3c 57 dd ba 90 9b 09  |H...P?...<W.....|
000001d0  d0 6c 8d f3 50 a3 d3 47  e1 02 79 59 60 dd 6c 95  |.l..P..G..yY`.l.|
000001e0  db a4 14 a2 c9 5e c6 84  66 5e c3 2e 56 e0 4b 3a  |.....^..f^..V.K:|
000001f0  13 70 1a ea 7e 75 0c d8  f6 6d 59 11 1f 4f 73 93  |.p..~u...mY..Os.|
00000200  1f 21 d8 a9 84 49 8d c2  30 45 0d 87 b8 a6 be dd  |.!...I..0E......|
00000210  87 a8 11 61 b8 8b 9a 03  f0 7f 8d 41 38 c8 46 a7  |...a.......A8.F.|
00000220  46 43 d9 da e8 1d 9b 3a  d8 88 8f 91 47 4f d3 5a  |FC.....:....GO.Z|
00000230  46 43 d9 da e8 1d 9b 3a  d8 88 8f 91 47 4f d3 5a  |FC.....:....GO.Z|
00000240  46 43 d9 da e8 1d 9b 3a  d8 88 8f 91 47 4f d3 5a  |FC.....:....GO.Z|
00000250  a8 26 f2 55 5f 91 f0 97  d7 d1 97 35 32 c4 6f 78  |.&.U_......52.ox|
00000260  c0 71 9f 50 9b 38 6c 02  70 34 72 fb 50 8c de 15  |.q.P.8l.p4r.P...|
00000270  28 95 06 33 37 67 23 a7  a3 2d cd 1d 74 47 a0 b8  |(..37g#..-..tG..|
00000280  65 c2 07 ca 34 45 99 d1  9a d8 15 52 30 db 0e 5d  |e...4E.....R0..]|
00000290  af d6 67 02 d5 e7 13 0f  84 58 54 8d 57 97 07 11  |..g......XT.W...|
000002a0  dd 34 82 d1 0d 75 0f d4  3a a3 66 dd 7e 83 1a 90  |.4...u..:.f.~...|
000002b0  14 93 77 26 d7 08 8d 05  d9 5b 3f 01 00 86 b0 79  |..w&.....[?....y|
000002c0  65 bb 8e 89 a0 25 90 a9  54 15 60 4f aa be f1 ea  |e....%..T.`O....|
000002d0  b2 02 b2 50 c0 f2 3c 9b  a8 87 3d 21 29 4e 50 98  |...P..<...=!)NP.|
000002e0  1b 56 04 17 a4 29 73 53  a5 9a ac e5 f7 be 3f 8d  |.V...)sS......?.|
000002f0  31 69 a4 3a aa dd 8a af  8d 53 b7 19 26 23 7a f5  |1i.:.....S..&#z.|
00000300  1c 36 51 4c 57 10 c0 f6  dc 05 0a ea 13 a0 fc 4a  |.6QLW..........J|
00000310  50 8c 32 41 a2 f0 a8 11  40 c6 e6 a1 80 87 1d 48  |[email protected]|
00000320  00 bd 46 93 a3 20 a3 38  56 c4 05 82 a5 44 dd eb  |..F.. .8V....D..|
00000330  28 ba b1 bd f4 ad cf e0  a7 06 31 8f 50 12 d1 6d  |(.........1.P..m|
00000340  8c 92 db 46 f9 83 a6 df  f3 c5 8d cc 02 db c8 fd  |...F............|
00000350  45 26 13 82 54 0d 67 26  20 8f d4 9f 64 90 f3 0b  |E&..T.g& ...d...|
00000360  02 28 34 f8 6a 83 10 fc  63 97 05 4d b1 da e7 86  |.(4.j...c..M....|
00000370  b7 b4 69 7d 6b f6 93 4c  71 74 71 18 68 ff 19 f5  |..i}k..Lqtq.h...|
00000380  ca c4 39 72 93 a2 b6 16  d9 cc e8 77 f5 c3 52 a3  |..9r.......w..R.|
00000390  f0 8c 67 dc 6d 1c 8d b6  98 2b 2a 5f 2f 3c e5 2a  |..g.m....+*_/<.*|
000003a0  78 38 89 99 0e 26 4f d1  b4 d9 8d ae 97 fd 1d 49  |x8...&O........I|
000003b0  57 f3 1e 2b 4c c7 f4 ca  74 89 d9 55 d6 7d ff d1  |W..+L...t..U.}..|
000003c0  98 6f 2e 2b da ba d8 70  ea 0d ef 89 3a dc bb f3  |.o.+...p....:...|
000003d0  50 d0 39 5c bc da f9 87  3f 46 3b 1a 29 e7 67 7e  |P.9\....?F;.).g~|
000003e0  c6 ae f9 89 1a 80 1a 46  ba 49 45 27 6c e7 c3 f7  |.......F.IE'l...|
000003f0  3e 18 59 21 56 0c ff 1b  b1 46 c9 68 97 bb 2a fe  |>.Y!V....F.h..*.|

00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 00 08 00 00  |........?.......|
00000020  00 00 00 00 80 00 80 00  ff 7f df e8 00 00 00 00  |................|
00000030  00 00 0c 00 00 00 00 00  02 00 00 00 00 00 00 00  |................|
00000040  f6 00 00 00 01 00 00 00  c5 11 e6 e0 50 e6 e0 3a  |............P..:|
00000050  00 00 00 00 fa 33 c0 8e  d0 bc 00 7c fb 68 c0 07  |.....3.....|.h..|
00000060  1f 1e 68 66 00 cb 88 16  0e 00 66 81 3e 03 00 4e  |..hf......f.>..N|
00000070  54 46 53 75 15 b4 41 bb  aa 55 cd 13 72 0c 81 fb  |TFSu..A..U..r...|
00000080  55 aa 75 06 f7 c1 01 00  75 03 e9 dd 00 1e 83 ec  |U.u.....u.......|
00000090  18 68 1a 00 b4 48 8a 16  0e 00 8b f4 16 1f cd 13  |.h...H..........|
000000a0  9f 83 c4 18 9e 58 1f 72  e1 3b 06 0b 00 75 db a3  |.....X.r.;...u..|
000000b0  0f 00 c1 2e 0f 00 04 1e  5a 33 db b9 00 20 2b c8  |........Z3... +.|
000000c0  66 ff 06 11 00 03 16 0f  00 8e c2 ff 06 16 00 e8  |f...............|
000000d0  4b 00 2b c8 77 ef b8 00  bb cd 1a 66 23 c0 75 2d  |K.+.w......f#.u-|
000000e0  66 81 fb 54 43 50 41 75  24 81 f9 02 01 72 1e 16  |f..TCPAu$....r..|
000000f0  68 07 bb 16 68 70 0e 16  68 09 00 66 53 66 53 66  |h...hp..h..fSfSf|
00000100  55 16 16 16 68 b8 01 66  61 0e 07 cd 1a 33 c0 bf  |U...h..fa....3..|
00000110  28 10 b9 d8 0f fc f3 aa  e9 5f 01 90 90 66 60 1e  |(........_...f`.|
00000120  06 66 a1 11 00 66 03 06  1c 00 1e 66 68 00 00 00  |.f...f.....fh...|
00000130  00 66 50 06 53 68 01 00  68 10 00 b4 42 8a 16 0e  |.fP.Sh..h...B...|
00000140  00 16 1f 8b f4 cd 13 66  59 5b 5a 66 59 66 59 1f  |.......fY[ZfYfY.|
00000150  0f 82 16 00 66 ff 06 11  00 03 16 0f 00 8e c2 ff  |....f...........|
00000160  0e 16 00 75 bc 07 1f 66  61 c3 a0 f8 01 e8 09 00  |...u...fa.......|
00000170  a0 fb 01 e8 03 00 f4 eb  fd b4 01 8b f0 ac 3c 00  |..............<.|
00000180  74 09 b4 0e bb 07 00 cd  10 eb f2 c3 0d 0a 41 20  |t.............A |
00000190  64 69 73 6b 20 72 65 61  64 20 65 72 72 6f 72 20  |disk read error |
000001a0  6f 63 63 75 72 72 65 64  00 0d 0a 42 4f 4f 54 4d  |occurred...BOOTM|
000001b0  47 52 20 69 73 20 6d 69  73 73 69 6e 67 00 0d 0a  |GR is missing...|
000001c0  42 4f 4f 54 4d 47 52 20  69 73 20 63 6f 6d 70 72  |BOOTMGR is compr|
000001d0  65 73 73 65 64 00 0d 0a  50 72 65 73 73 20 43 74  |essed...Press Ct|
000001e0  72 6c 2b 41 6c 74 2b 44  65 6c 20 74 6f 20 72 65  |rl+Alt+Del to re|
000001f0  73 74 61 72 74 0d 0a 00  8c a9 be d6 00 00 55 aa  |start.........U.|
00000200  07 00 42 00 4f 00 4f 00  54 00 4d 00 47 00 52 00  |..B.O.O.T.M.G.R.|
00000210  04 00 24 00 49 00 33 00  30 00 00 d4 00 00 00 24  |..$.I.3.0......$|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000230  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000250  00 00 00 00 00 00 eb 22  90 90 05 00 4e 00 54 00  |......."....N.T.|
00000260  4c 00 44 00 52 00 00 00  00 00 00 00 00 00 00 00  |L.D.R...........|
00000270  00 00 00 00 00 00 00 00  00 00 66 0f b7 06 0b 00  |..........f.....|
00000280  66 0f b6 1e 0d 00 66 f7  e3 66 a3 52 02 66 8b 0e  |f.....f..f.R.f..|
00000290  40 00 80 f9 00 0f 8f 0e  00 f6 d9 66 b8 01 00 00  |@..........f....|
000002a0  00 66 d3 e0 eb 08 90 66  a1 52 02 66 f7 e1 66 a3  |.f.....f.R.f..f.|
000002b0  66 02 66 0f b7 1e 0b 00  66 33 d2 66 f7 f3 66 a3  |f.f.....f3.f..f.|
000002c0  56 02 e8 95 04 66 8b 0e  4e 02 66 89 0e 26 02 66  |V....f..N.f..&.f|
000002d0  03 0e 66 02 66 89 0e 2a  02 66 03 0e 66 02 66 89  |..f.f..*.f..f.f.|
000002e0  0e 2e 02 66 03 0e 66 02  66 89 0e 3e 02 66 03 0e  |...f..f.f..>.f..|
000002f0  66 02 66 89 0e 46 02 66  b8 90 00 00 00 66 8b 0e  |f.f..F.f.....f..|
00000300  26 02 e8 83 09 66 0b c0  0f 84 5e fe 66 a3 32 02  |&....f....^.f.2.|
00000310  66 b8 a0 00 00 00 66 8b  0e 2a 02 e8 6a 09 66 a3  |f.....f..*..j.f.|
00000320  36 02 66 b8 b0 00 00 00  66 8b 0e 2e 02 e8 58 09  |6.f.....f.....X.|
00000330  66 a3 3a 02 66 a1 32 02  66 0b c0 0f 84 2b fe 67  |f.:.f.2.f....+.g|
00000340  80 78 08 00 0f 85 22 fe  67 66 8d 50 10 67 03 42  |.x....".gf.P.g.B|
00000350  04 67 66 0f b6 48 0c 66  89 0e 72 02 67 66 8b 48  |.gf..H.f..r.gf.H|
00000360  08 66 89 0e 6e 02 66 a1  6e 02 66 0f b7 0e 0b 00  |.f..n.f.n.f.....|
00000370  66 33 d2 66 f7 f1 66 a3  76 02 66 a1 46 02 66 03  |f3.f..f.v.f.F.f.|
00000380  06 6e 02 66 a3 4a 02 66  83 3e 36 02 00 0f 84 1d  |.n.f.J.f.>6.....|
00000390  00 66 83 3e 3a 02 00 0f  84 cf fd 66 8b 1e 3a 02  |.f.>:......f..:.|
000003a0  1e 07 66 8b 3e 4a 02 66  a1 2e 02 e8 e0 01 66 0f  |..f.>J.f......f.|
000003b0  b7 0e 00 02 66 b8 02 02  00 00 e8 22 08 66 0b c0  |....f......".f..|
000003c0  0f 85 16 00 66 0f b7 0e  5a 02 66 b8 5c 02 00 00  |....f...Z.f.\...|
000003d0  e8 0c 08 66 0b c0 0f 84  42 0c 67 66 8b 00 1e 07  |...f....B.gf....|
000003e0  66 8b 3e 3e 02 e8 3f 06  66 a1 3e 02 66 bb 20 00  |f.>>..?.f.>.f. .|
000003f0  00 00 66 b9 00 00 00 00  66 ba 00 00 00 00 e8 e4  |..f.....f.......|

Dec 31 '18 19:12 themaddoctor

ersanr.zip

From a 2TB JMS538S disk that was corrupted by Windows (no NTFS signatures remain, MBR overwritten).

Jan 16 '19 17:01 themaddoctor