Disappearing .bkf file

[Robert Copcutt]

To help a friend transfer to a new computer and change from Windows XP pro
to Linux I did 4 backups. 3 failed for 1 reason or another! The problem
backup I am targeting now was done onto an external USB hard drive
(Seagate). I used Windows backup to create a .bkf file and later went to
restore it onto another Win XP computer. The trouble was that I was
rushing with a new install and forgot to install service pack 2. That
meant that the external drive was restricted to USB 1 and the restore was
taking far too long. I eventually had to abort it by turning the power
off. Later, after installing SP2, the .bkf file had disappeared from the
external drive. It is as if Windows makes .bkf files invisible while it
does the restore. Stopping the restore before it was finished has made it
stay invisible to every program I can get my hands on. Can anyone
recommend a way to finish the restore?

 

[Flasherly]

To help a friend transfer to a new computer and change from Windows XP pro
to Linux I did 4 backups. 3 failed for 1 reason or another! The problem
backup I am targeting now was done onto an external USB hard drive
(Seagate). I used Windows backup to create a .bkf file and later went to
restore it onto another Win XP computer. The trouble was that I was
rushing with a new install and forgot to install service pack 2. That
meant that the external drive was restricted to USB 1 and the restore was
taking far too long. I eventually had to abort it by turning the power
off. Later, after installing SP2, the .bkf file had disappeared from the
external drive. It is as if Windows makes .bkf files invisible while it
does the restore. Stopping the restore before it was finished has made it
stay invisible to every program I can get my hands on. Can anyone
recommend a way to finish the restore?

Try a good restoration, deleted file and/or drive (mbr) restoration
utility. Kid gloves with the USB device, I'd imagine perhaps with
several such utilities - with Easeus, I've had some luck with potshot
craps when playing XP's house game on their table, at best.

Anything along that line, btw, I go elsewhere. Boot arbitrator for
another partition entirely apart W-x, for running ghost images across
partitions. ...I'd feel like a bat in some primeval dark cave w/out
it.

Yep: Lived, been there done that, & learn, that's my credo.

 

[Paul]

To help a friend transfer to a new computer and change from Windows XP pro
to Linux I did 4 backups. 3 failed for 1 reason or another! The problem
backup I am targeting now was done onto an external USB hard drive
(Seagate). I used Windows backup to create a .bkf file and later went to
restore it onto another Win XP computer. The trouble was that I was
rushing with a new install and forgot to install service pack 2. That
meant that the external drive was restricted to USB 1 and the restore was
taking far too long. I eventually had to abort it by turning the power
off. Later, after installing SP2, the .bkf file had disappeared from the
external drive. It is as if Windows makes .bkf files invisible while it
does the restore. Stopping the restore before it was finished has made it
stay invisible to every program I can get my hands on. Can anyone
recommend a way to finish the restore?

There are people in this world, who would use your scenario
to spam their "BKF recovery software" I hope you're not one
of those people.

For future reference, you can get Macrium Reflect Free (for free).
It's a backup/restore and clone utility. Pretty nice for a freebie.
Not like some, where all sorts of stuff is greyed out and just
about anything you need, doesn't work. This one is actually
worth having.

(Download button - bottom left corner. Use the WAIK-based emergency
boot disk option, make yourself a CD, for future reference. You
can even do backups without Windows running, by using the CD.
I generally make an ISO9660 file first, then use whatever
CD burning software i have sitting here - Nero or Imgburn.)

http://www.macrium.com/reflectfree.aspx

In addition to that one, when you buy a hard drive
(like your external), both Seagate and Western Digital
have copies of re-branded Acronis TIH available. It's offered
to customers of those brands of disk drives, so they can clone
or backup, to their new hard drive purchase. I think the
Seagate one is called DiscWizard, while the WDC one still
mentions Acronis in the name. The product also comes
with a manual on the download page, so you can read up
on all the options. The utility checks that the
drive in question, is one of theirs. Install the
Seagate utility, if your external is a Seagate. Etc.

There's no pressing need to torture yourself with NTBackup
any more. I was impressed with NTBackup, in that it uses
VSS and can copy the C: OS partition while the OS is running.
But 90% of the other utilities out there, like the freebies,
are also doing that now. There aren't too many utilities that
do the old-style file by file method as such (like an XCOPY).
Continue to use NTBackup, only if you want to court
one of those BKF recovery spammer-dudes.

*******

Based on your description, it sounds like the MBR partition
table is not damaged, and the backup partition is still present.
That will save some time.

The TestDisk utility can scan a disk and attempt to build a
fresh MBR, but we don't need that yet.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The same site, also features Photorec, a tool for
scavenging missing files from a disk. BKF happens
to be one of the 440 different file formats it
recognizes. Before you get your hopes up though,
a utility like this can't work magic if the FAT
(file allocation table) or MFT (master file table)
is damaged. If a disk was freshly defragmented, just
before it was damaged, the results could be fairly good.
A fragmented disk would be a disaster area. I've tested
this, by copying a photo to a small partition, deleting
it, then running PhotoRec, and it did recover my test
photo. What I can't be sure of though, is how much
damage to the disk there can be, before the program
makes a bad job of the recovery. If there's enough
damage to the file system, and "chunks" of the file
aren't next to one another, proper recovery would be
impossible. (Only if the file had a great deal of
redundancy inside it, could you recover it in that
case. If a file format is designed for this style of
recovery, your chances would be a lot better.)

http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

There are lots of $39.95 partition recovery
softwares, which will offer to scan a disk and
list the files. And then, based on that "trial info",
you pay them $39.95 for the license, and the program
attempts to live up to its promises.

*******

With that much out of the way, we'll take your
theory at face value.

The "attrib" command can change the attributes of
a file.

attrib -h -s somefile.ext
attrib +h +s somefile.ext

Those are examples of turning off and turning on,
the hidden and system attribute bits. You can
operate the bits independently of one another.
Doing this, should print out the current
attributes.

attrib somefile.ext

(Other utilities of minor interest
are "takeown" and "icacls", but again, I have
no evidence we need a thing like that. Attrib
sounds like enough fun for now.)

In terms of attempting to list the files on a partition,
you could try Sysinternals "contig", from the year 2006.
The modern version turned off the ability to scan an
entire partition, but the earlier versions will do the
whole partition for you, listing practically every
file on there. (A few files that give "Access Denied"
errors to just about every other utility, will also fail
to be listed by "contig".)

contig_2006 -v -a -s C: > c_listing.txt

There is a download link on this page. This is how
I find older versions of the utilities. Microsoft
bought Sysinternals, which is why the file was
on a Microsoft site.

https://web.archive.org/web/2008020...icrosoft.com/en-us/sysinternals/bb897428.aspx

If you don't want to read the previous page, this link is the download.
I renamed the executable "contig_2006.exe" so I can tell
it apart from the other versions I have here.

https://web.archive.org/web/20080204085459/http://download.sysinternals.com/Files/Contig.zip

Now, if that didn't work, there is nfi for NTFS partitions.
You'll have to dig around in the ZIP download, to find
the tiny nfi.exe utility. The nfi utility doesn't work
on FAT32 partitions. I use this when "nosing around"
an NTFS partition.

http://support.microsoft.com/kb/253066

http://download.microsoft.com/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip

nfi C: > list_of_C.txt

So those are a few toys you can play with.

*******

I don't understand why the restoration utility would
need to use the hidden bit. That seems like a not-so-clever
overkill. It would be sufficient to open a lock file,
as a means of marking a restore is in progress. There's
absolutely no reason for the program to make any
modifications to the file. Doing so, could change
the dates on it, and that doesn't sound very good
to me.

I hope it's not something more serious. And if
so, I hope the drive is not fragmented. As,
depending on the damage, recovery could
be messy.

And then, we really will need one of those
spammer-dudes, to come in and advertise their
magic BKF recovery programs I know the
spammer-dude is checking his watch now, to see
if it's time to spring his trap.

Paul

 

[Robert Copcutt]

For future reference, you can get Macrium Reflect Free (for free).
It's a backup/restore and clone utility. Pretty nice for a freebie.

Wow Paul I was not expecting a whole book on the subject! Thanks for the
Macrium tip. Could be useful for next time.

http://www.macrium.com/reflectfree.aspx

In addition to that one, when you buy a hard drive (like your external),
both Seagate and Western Digital have copies of re-branded Acronis TIH
available. It's offered to customers of those brands of disk drives, so
they can clone or backup, to their new hard drive purchase. I think the
Seagate one is called DiscWizard, while the WDC one still mentions
Acronis in the name.

Yes, I was looking at DiscWizard, but it does not seem to solve my
immediate problem.

Based on your description, it sounds like the MBR partition table is not
damaged, and the backup partition is still present.

Yes, I suspect so.

The TestDisk utility can scan a disk and attempt to build a fresh MBR,
but we don't need that yet.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Done, and it checks out OK.

The same site, also features Photorec, a tool for scavenging missing
files from a disk. BKF happens to be one of the 440 different file
formats it recognizes.

Another good tip, and I have it running right now. Trouble is, estimated
time to completion = 380 hours! Hmmm. Do I really want to run a program
for 16 days? That is the sort of dilemma that led to the file disappearing
in the first place.

There are lots of $39.95 partition recovery softwares, which will offer
to scan a disk and list the files.

My situation does not justify that really. I missed out a lot of details
because sometimes usenet posts drop into a black hole. I created 2 .bkf
files. The partial backup with the critical data is OK and fully restored.
I am helping a technophobic Facebook addict who does not understand
folders. I have explained that you need to look at what folder is being
suggested before pressing the save button but somehow that key idea does
not stick There were photos all over the place. The full backup (that has
disappeared) was made so that at a later date, when I had time, I could
dig through all the folders and recover any .jpgs, and the like, that were
lurking in the wrong place.

The "attrib" command can change the attributes of a file.

Tried that, but the attrib command cannot see the file so that does not
help.

(Other utilities of minor interest are "takeown" and "icacls", but
again, I have no evidence we need a thing like that.

I will look into those if Photorec turns up a blank.

https://web.archive.org/web/20080204085459/http://technet.microsoft.com/ en-us/sysinternals/bb897428.aspx

If you don't want to read the previous page, this link is the download.
I renamed the executable "contig_2006.exe" so I can tell it apart from
the other versions I have here.

Contig seems to be for defraging files. I stopped using the USB drive when
this problem arose to make sure that sort of problem did not happen. I now
want to do a thorough backup of my own computer so I need my USB drive
back.

I don't understand why the restoration utility would need to use the
hidden bit.

It is a mystery to me too, but it seems to be a lower level issue.

Robert.

 

[Paul]

Wow Paul I was not expecting a whole book on the subject! Thanks for the
Macrium tip. Could be useful for next time.


Yes, I was looking at DiscWizard, but it does not seem to solve my
immediate problem.


Yes, I suspect so.


Done, and it checks out OK.


Another good tip, and I have it running right now. Trouble is, estimated
time to completion = 380 hours! Hmmm. Do I really want to run a program
for 16 days? That is the sort of dilemma that led to the file disappearing
in the first place.


My situation does not justify that really. I missed out a lot of details
because sometimes usenet posts drop into a black hole. I created 2 .bkf
files. The partial backup with the critical data is OK and fully restored.
I am helping a technophobic Facebook addict who does not understand
folders. I have explained that you need to look at what folder is being
suggested before pressing the save button but somehow that key idea does
not stick There were photos all over the place. The full backup (that has
disappeared) was made so that at a later date, when I had time, I could
dig through all the folders and recover any .jpgs, and the like, that were
lurking in the wrong place.


Tried that, but the attrib command cannot see the file so that does not
help.



I will look into those if Photorec turns up a blank.


Contig seems to be for defraging files. I stopped using the USB drive when
this problem arose to make sure that sort of problem did not happen. I now
want to do a thorough backup of my own computer so I need my USB drive
back.


It is a mystery to me too, but it seems to be a lower level issue.

Robert.

OK, one word of warning.

Someone may suggest CHKDSK. It has the ability, on an
NTFS partition, to use the journal, locate missing files,
and put them in a place like C:\found or similar.

But, CHKDSK is also considered a "repair-in-place" utility.
In some cases, it does an unbelievable amount of damage!
This is especially the case, if a disk drive cable is
loose, as you're running CHKDSK.

Consequently, if you have a damaged partition, and you
don't know how it got damaged, you need to back up the
disk first. Macrium has options for "intelligent" sector
copy, but you would want to turn that off. When a disk has
unknown damage, you want a dumb "sector-by-sector" copy.

I use "dd", when I need to copy an entire disk the dumb way,
and preserve it forensically. It's a command line utility,
and hard to use safely, so it's not my first choice.
But, I'm used to it now, and it's been a while
since I ruined anything

http://www.chrysocome.net/dd

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

Example - back up my entire OS drive, all four partitions.
Partition0 means "start at sector 0 and keep going".

dd if=\\?\Device\Harddisk1\Partition0 of=N:\mywholedrive.dd

I have two disks, Harddisk0 and Harddisk1, and Harddisk1 corresponds
to the second disk I see in Disk Management. Partition0 is a
representation of the entire disk. Partition1..PartitionN are
identifiers to pick off individual partitions for backup or
protection for later. I may not need to back up the
entire disk, if just one small partition is damaged.

dd if=\\?\Device\Harddisk1\Partition3 of=N:\mythirdpartition.dd

The utility operates slower, if you don't specify a block size.
To specify a block size and block count for a copy, I use
a program called "factor.exe" to factor the total disk size
(500,107,862,016 bytes of my 500GB disk). From that, I
figure out a block size which is a multiple of 512 byte sectors.

500,107,862,016 = 2^13 * 3^4 * 7 * 67 * 1607
= 221184 * 2261049

221184 = 432 sectors or 432*512. Block size is "sector-sized", a multiple
of the 512 byte sectors that disk uses.

Now, my new and improved dd command becomes

dd if=\\?\Device\Harddisk1\Partition0 of=N:\mywholedrive.dd bs=221184 count=2261049

That will place a 500GB single file on my NTFS N: partition.
Later, I simply reverse the parameters, to do a restore.

Typical transfer speed, might be ~40MB/sec. Yes, it takes a while.

Not all drives respond the same way to the parameters. Some drives
"like" the 221184 sized request. Others "like" an 8192 byte
blocksize. In which case, I have to re-juggle the two numbers
so I get 500,107,862,016 bytes (for my 500GB drive). I use the
Performance plugin, to watch the transfer rate, then restart
the transfer if I want to try a different set of parameters.

Compressing the file, is typically the last thing you want
to do at a time like this. Compressing the file is good for
long term storage - but that doesn't really make much sense.
It's much better to have disks with a "clean CHKDSK", then
use Macrium with intelligent sectors turned on. You don't
really want to back up damaged partitions for any significant
period of time. You back them up, until your recovery effort
is completed.

*******

I use "contig_2006.exe" to list all the files on the partition.
I use "nfi.exe" to list all the files on the partition.
Those are attempts to see if the file name is still listed.

I use CHKDSK, only as a last resort - knowing the partition
is damaged, and there's no way to predict what a mess it'll
make.

If the CHKDSK avenue isn't working, next I'm off to
Photorec or "$39.95 utility", to try and get the file
that way. The file is there. It's just a matter
of not wrecking anything, until you get it

*******

My posts become longer, the more variables that could be at play

Paul

 

[Paul]

Paul wrote:

One other thing. A utility like "dd", doesn't use
VSS and it wouldn't make a "good copy" of C: if in
fact C: had the BKF file.

Macrium or Acronis or similar, those ones are better
at capturing a disk, no matter what. They use VSS, the
Volume Shadow Service, to make it possible to back up
a busy partition. The versions of files are frozen, for
the duration of the backup attempt.

What I neglected to mention, is I have WinXP on one disk,
Win2K on a second disk, and if the WinXP was damaged,
I boot Win2K and run "dd" from there. That's how I take care
of making sure an OS partition "is not busy". And that's how
I can successfully use "dd" to backup a whole damaged disk,
sector by sector.

A Linux LiveCD can also be used to run the Linux version of "dd".
In a similar way. So even if I had just the one OS, I could
still do it. The difference is, the disk syntax differs a bit.
The block device identifiers are different, in a Linux Terminal
session.

dd if=/dev/sda of=/media/windowsbackuppartition/mywholedisk.dd bs=8192 count=...

That would be the basic idea in Linux. You don't have to
install Linux, to use it for maintenance. You can boot a
LiveCD and use that. An example would be Linux Mint Mate Edition.

There are plenty of other maintenance environments as well - I
just don't use them often enough to remember them
I've even run NTBackup 5 plugin from a BartPE disc - you
can do a restore from there. And you can do that restore, without
a regular Windows OS to do it with. That's how you could
"bare metal restore" a BKF, if no OS was working. But BartPE
takes some getting used to. I took me about five attempts
at Bart runs, before I was getting a decent set of tools
set up in a BartPE CD. I still would recommend such a
thing, for a person with a large collection of
BKF files (a person "wedded" to NTBackup ).
I only ran it the one time, to see what functions
it listed. And it would not do a backup in there,
because BartPE would have no working VSS for the backup
step. But you can do a restore in there. Of course,
it would still be slow And you'd be tempted to hammer
the power button.

Paul