Most of the time you can use standard registry editing tools on a Windows computer that cannot boot into Windows.

Using chntpw as a Windows registry editor

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

For this post we will be looking at Windows NTFS filesystems.

How files are deleted

Deleted files are not removed from the hard drive until the space that they occupy is needed by a new file.

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn’t fragmented and the clusters haven’t been reused, you should have a great chance of getting it back.

Recovery is often done by looking at the raw data on the disk for data in areas that are marked as being available for use, then determine the file type and directory structure, copy them and save them elsewhere.

NTFS and the MFT

In an NTFS file system deleted data is found by looking at the hidden $BitMap file for areas of the disk marked as available for use. The $BitMap file is a special file within the NTFS file system. This file keeps track of all of the used and unused clusters on an NTFS volume. If data is found in an area of the disk that is marked as ‘unused’ in the $BitMap file then it is probably deleted data.

Next the location of the data can be used to check for an existing entry in the MFT. Each file and folder on an NTFS volume is represented by a record in a special file called the master file table (MFT). That record contains the location of the clusters on the disk that hold the file’s data. The MFT record for the deleted file will stay there until something else is written to that location of the disk and overwrites the deleted files data (making it unrecoverable).

Enough talk, lets look at a real example.

Delete and recover a file

Our OS is Windows XP Pro SP3 We have a hard drive with two NTFS partitions that Windows sees as a C: drive and an E: drive.

A deleted file’s data is overwritten

Now lets copy a bunch of random files to our E: drive and see what happens. Note that our record #132 in the MFT is now replaced with a new file that is occupying some of the space that our deleted file was in. The deleted file is now unrecoverable.

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How it usually starts

Often as a hard drive begins to go ‘bad’ you start to get strange errors in programs and your computer occassionally shuts down with a blue screen error. You may also start to notice sounds from the hard drive that you have not heard before. In many cases, the computer will not boot to Windows at all and none of the repair options will seem to work. Disk diagnostics programs either crash, show errors on the disk or don’t run at all.

At this point the user realizes that they need to completely re-install Windows (and hopefully, but not always, understand that they need to replace the hard drive). How do they get their data from a crashing or unbootable drive?

How to Recover the Data

A broken hard drive isn’t just ‘broken’ it is almost always still in the process of ‘breaking’ and everything we do to it is going to make it worse. That means we have to be as efficient as possible in our recovery efforts.

In this example we are going to show a recovery ‘in the field’ by connecting a good USB external drive and externally connecting the ‘bad’ drive via a USB adapter to a Compaq Presario 2200 laptop named Buster.

Preferably, this kind of job should be done on a dedicated recovery machine where the ‘good’ and ‘bad’ drives are connected directly to the motherboard and every thing about the machine is perfect except the ‘bad’ hard drive that we are trying to recover. (This particular ‘bad’ drive was already successfully recovered once using just such a computer.) Most people don’t have access to a machine like that but have a laptop in addition to their desktop so this example shows how to use the resources commonly on hand. The external drive used is a 1.5TB Western Digital external drive that costs about $100 and the USB to IDE drive connector used on the bad drive is a JMicron USB to ATA/ATAPI Bridge that can be found for about $20. If the laptop has enough free space on its internal drive (this one does not), you don’t need the external drive.

We’ll try to use the program ddrescue to recover the data.
It is included on the Parted Magic boot CD, here’s the manual…
http://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html
ddrescue helps you make a copy of a disk with errors while minimizing further damage to the disk. It does this by skipping every bad sector it comes across, noting where it exists and then coming back to it only after all of the good sectors have been copied. As long as you allow it to make a log file, you can repeatedly come back to the bad disk and try to recover the bad sectors. It also allows you to resume a copy from where it left off if there is a crash or a power failure.

ddrescue tries to make an exact copy of the disk. That way, you can recover deleted files and partitions from the copy just like you can recover them from the original.

This runs ddrescue
-r 3 tells ddrescue to retry rescuing each bad sector 3 times before giving up on it.
/dev/sdc is the ‘bad’ drive that we are copying.
/media/sdb1/image.dd is the image file that we want to copy the ‘bad’ drive to.
/media/sda1/rescuelog.log is where we want to save our logfile which is in the root of Buster’s C: drive.

After over 15 hours it completed and recovered the whole drive.
As a comparison, a healthy 40GB IDE drive containing over 30GB of data on the same setup finished in under two hours (maybe sooner as I left it and returned two hours later to find it completed).

For our example, we’ll recover just the main partition’s files straight from TestDisk to illustrate that we could recover this to a disk from our repaired image. In a real life recovery, we would get a new disk large enough to hold the image and then use dd or ddrescue with the image file as our input and the new drive as our output.

In TestDisk from the partition list of our image file we select our partition then we press ‘p’ to view files and folders on the partition then we press ‘a’ to select all of them then we press ‘C’ to copy selected files then we choose the location to send them to.

Here we sent them to an empty partition that we made that Windows calls the H: drive. Here are all the files. There were about a dozen corrupted files in this recovery but they were not in any system files.

This drive was dead and inaccessible from Windows. When I originally rescued it I did the ddrescue, recovered the partitions to a new internal drive and after we put the new drive into the computer that the bad drive was in, it booted up fine and everything was there. That was over a year ago and it is still running with that drive and OS.

Even though the user had repeatedly run various disk repair tools which all crashed after several hours, we were able to recover this drive’s data and they were very happy.

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How partitions are deleted

From personal experience, there are three ways that I have seen partitions accidentally deleted.

Deleted Partition Recovery with TestDisk

We’ll do this in Windows XP Professional Service Pack 3

TestDisk does an excellent job of recovering deleted partitions.

Deleted Boot Partition Recovery with TestDisk

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

Data recovery from hard drives has not changed much in decades. However, the effectiveness and ease of use of free tools has increased greatly. Also, the fact that CD’s, DVD’s, flash drives, SD cards and USB keys are made to behave like hard drives makes them candidates for recovery using the same tools. SSD’s provide some new challenges due to techniques they use to extend their life expectancy but for the most part are recoverable in the same manner as platter based drives.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How files are deleted

Deleted files are not removed from the hard drive until the space that they occupy is needed by a new file.

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn’t fragmented and the clusters haven’t been reused, you should have a great chance of getting it back.

Recovery is often done by looking at the raw data on the disk for unreferenced data, then determine the file type and directory structure, rebuild them and save them elsewhere.

Simple Recovery with Testdisk and PhotoRec

We’ll do this in Windows XP Professional Service Pack 3

TestDisk is a program that does lots of things that we will talk about later in this series but for this post we are looking at its file undelete capabilities. It also comes with the program PhotoRec which has some advantages for recovering specific file types like pictures or Outlook mailboxes (currently over 200 file types).

When to use TestDisk or PhotoRec for Deleted File Recovery

Recuva is great for recovering files when you are working in a Windows environment (See Part 1 of this series). It also has better directory structure recovery than TestDisk and is very easy to use. However, when you are trying to recover files from a broken Windows machine using a Linux bootdisk TestDisk and PhotoRec are your best choice. For this example we will be running it from within a Windows environment but it looks exactly the same as when you run it from a Linux Live environment like Puppy Linux. Use TestDisk to recover everything deleted on a partition and use PhotoRec to recover specific filetypes from a partition (all the .jpg picture files for example).

What Happens When You Overwrite Some of the Deleted Data ?

This illustrates why it is important to attempt recovery before anything else is written on the disk and potentially overwrites the data that you need to recover.

Using PhotoRec for file recovery

Since PhotoRec focuses on specific filetypes, it is incredibly powerful. It uses techniques such as file carving to try to get as complete a recovery as possible without a human actually analyzing the data stored on the drive.

DISCLAIMER: These examples use techniques that I actually employ in the real world to deal with real problems. They might be wrong or dangerous. They might be inefficient. If you try them yourself, it might cause damage or irreparable loss. I take no responsibility for anything you do based on my examples or the information that I provide here.

Data recovery from hard drives has not changed much in decades. However, the effectiveness and ease of use of free tools has increased greatly. Also, the fact that CD’s, DVD’s, flash drives, SD cards and USB keys are made to behave like hard drives makes them candidates for recovery using the same tools. SSD’s provide some new challenges due to techniques they use to extend their life expectancy but for the most part are recoverable in the same manner as platter based drives.

In this series we’ll look at some real world examples of disastrous situations salvaged and made better again.

We will be looking at Windows (FAT and NTFS) filesystems.

How files are deleted

Deleted files are not removed from the hard drive until the space that they occupy is needed by a new file.

When a file is deleted, the list of disk clusters occupied by the file is erased, marking those sectors available for use by other files created or modified thereafter. If the file wasn’t fragmented and the clusters haven’t been reused, you should have a great chance of getting it back.

Recovery is often done by looking at the raw data on the disk for unreferenced data, then determine the file type and directory structure, rebuild them and save them elsewhere.

Simple Recovery with Recuva

What Happens When You Overwrite Some of the Deleted Data ?

This illustrates why it is important to attempt recovery before anything else is written on the disk and potentially overwrite the data that you need to recover.

var isPrerendering = false;

function handleVisibilityChange(evt) {
if (!isPrerendering) return;
countView();
isPrerendering = false;
}

function countView(){
document.write('<img src="http://PIWIK WEBHOST/piwik/
   piwik.php?idsite=[ID OF NORMAL SITE]&rec=1" />');
}

/*
* We can count the view right now if the document isn't being prerendered.
* Browsers that don't support the API will return undefined for
* webkitVisibilityState.
*/
if (document.webkitVisibilityState != "prerender") {
countView();
} else {
//We'll need to count the pageview later
isPrerendering = true;
document.write('<img src="http://PIWIK WEBHOST/piwik/
   piwik.php?idsite=[ID OF PRERENDER TRACKING SITE]&rec=1" />');
document.addEventListener("webkitvisibilitychange", 
   handleVisibilityChange, false);
}

Summary of Operation

1. It checks the field on the MySQL server at litten.com that represents the state of the lamp once per second.
2. It sends an X10 command through the X10 PC interface to the lamp, setting it to that state.

fig. I

MySQL Database

Create new mySQL db

Add a table

Add new restricted users

ON/ OFF Button

<iframe id="frame1" src="http://litten.com/switch.php"  height="50"
width="100" frameborder="0" scrolling="no"></iframe>

<?php
$db_host = 'localhost';
$db_user = 'x10user';
$db_pwd = 'mypassword';
$database = 'x10';
$table = 'x10state';

if (!mysql_connect($db_host, $db_user, $db_pwd))
die("Can't connect to database");

if (!mysql_select_db($database))
die("Can't select database");

$result = mysql_query("SELECT * FROM {$table}
 WHERE device = 'lamp'");
if (!$result) {
die("failed");
}

$row = mysql_fetch_row($result);
$state = $row[1];

$lampstate = "OFF";
if ($state == 1) {
$lampstate = "ON";
}
?>

<form method=POST action="http://litten.com/changestate.php">
<input type="submit" name="switch"
 value= "<?php echo $lampstate ?>">
</form>
 

<?php
$db_host = 'localhost';
$db_user = 'x10user';
$db_pwd = 'mypassword';
$database = 'x10';
$table = 'x10state';

if (!mysql_connect($db_host, $db_user, $db_pwd))
die("Can't connect to database");

if (!mysql_select_db($database))
die("Can't select database");

$result1 = mysql_query("SELECT * FROM {$table}
 WHERE device = 'lamp'");
if (!$result1) {
die("failed");
}

$row = mysql_fetch_row($result1);
$state = $row[1];

$onoff = 1;
if ($state == 1) {
$onoff = 0;
}

$result2 = mysql_query("UPDATE {$table}
 SET state = {$onoff} WHERE device = 'lamp'");
if (!$result2) {
die("failed2");
}

$lampstate = "ON";
if ($state == 1) {
$lampstate = "OFF";
}
?>

<form method=POST action="http://litten.com/changestate.php">
<input type="submit" name="switch"
 value= "<?php echo $lampstate ?>">
</form>
 

Video Streaming

Web Server on Home PC

X10 PC Interface via a PHP page

• A lamp. I am using a nice Himalayan Salt lamp from Amazon.com.
• An X10 3-pin Appliance Module (AM466). To plug the lamp into. Then it is plugged into an outlet.
• An ActiveHome Professional Computer Interface (CM15A). That is plugged into an outlet and attached to your PC via USB cable.
• The ActiveHome Scripting SDK
• A copy of msvcp71.dll and msvcr71.dll (be careful, this site tries to trick you to click on ads)

<META HTTP-EQUIV=Refresh CONTENT='1; URL=refresher.php'>
<?php
$db_host = 'litten.com';
$db_user = 'x10user';
$db_pwd = 'mypassword';
$database = 'x10';
$table = 'x10state';

if (!mysql_connect($db_host, $db_user, $db_pwd))
die("Can't connect to database");

if (!mysql_select_db($database))
die("Can't select database");

$result = mysql_query("SELECT * FROM {$table} WHERE device = 'lamp'");
if (!$result) {
die("failed");
}
$row = mysql_fetch_row($result);
$state = $row[1];
echo $state;

$cmd = 'on';
if ($state == 0){
$cmd = 'off';
}

$cmdstring = "A1 ".$cmd;
echo $cmdstring;
exec("ahcmd.exe sendplc $cmdstring");
?>

exec("ahcmd.exe sendplc $cmdstring");

\lib\armeabi\libCore.so

Ahh, the Adobe AIR runtime kind of runs beside the Dalvik virtual machine rather than completely inside of it.

The libCore.so file is a shared object file using JNI. Java Native Interface(JNI) http://en.wikipedia.org/wiki/JNI code written in C or C++ allows you to access platform specific features and ‘touch the metal’ with your code.

Android provides the Android NDK so you can use native code.
http://developer.android.com/sdk/ndk/index.html

Some words of wisdom from the Android developer page

The NDK will not benefit most applications. As a developer, you need 
to balance its benefits against its drawbacks; notably, using native 
code does not result in an automatic performance increase, but 
always increases application complexity. In general, you should 
only use native code if it is essential to your application, not just 
because you prefer to program in C/C++.

I wanted to try compiling and running some native code on my phone (Android 2.2) so that I have that tool in my toolbox when I need it. I found a great example at Qualcomm.
https://ar.qualcomm.com/qdevnet/sdk

The sample application that comes with the SDK allows you to detect and track image targets in 3D using your phone’s camera and then it puts a floating teapot (http://www.sjbaker.org/wiki/index.php?title=The_History_of_The_Teapot) over your target. The NDK is required to compile the native C++ code which uses OpenGL ES http://en.wikipedia.org/wiki/OpenGL_ES. It has step by step instructions that will show you how to build the native C++ source files with the NDK package of the Android SDK and then use Eclipse to build the Java sources and create the APK package that can be deployed to the phone.

This is very much like the augmented reality on the new Nintendo 3DS
http://www.siliconera.com/2011/03/04/lose-your-nintendo-3ds-ar-cards-just-print-out-new-ones/

If you are having a hard time with the NDK, try the sample that comes with it in \samples\hello-jni along with the tutorial at http://www.pocketmagic.net/?p=1332 for a very basic example that will help you understand the proper procedure.

I have some broken antique clocks around the house so I made image targets out of their faces and now have a teapot floating in front of them. Next time I get a little break in the action, I’ll change that teapot to a semi-transparent digital clock so my clocks will no longer be broken provided, I run the program on my phone and point the camera at the clocks

The NDK combined with current hardware capabilities certainly seem to be enough to make sophisticated and engaging toolkits and engines for game developers and artists.

Anyway, enjoy playing with the code as that is how you learn.

AIR stands for Adobe Integrated Runtime and was originally for

...building rich Internet applications using Adobe Flash, Adobe Flex,
Adobe Dreamweaver (HTML or Ajax), AIR SDK, that can be run as 
desktop applications.

But now seems to be headed toward becoming an easy way to quickly develop powerful applications for smartphones, TV’s, car dashboards, tablets, big computers, tiny computers and everything in between.
http://www.adobe.com/products/air/

Setting up your development environment

1. Get Flash CS5 (you can get a 30 day free trial at http://www.adobe.com/downloads)

2. Install Flash extension for AIR http://labs.adobe.com/technologies/flashpro_extensionforair/

3. Install AIR SDK http://www.adobe.com/products/air/

4. Install Android SDK http://developer.android.com/sdk/index.html

Step by step video instructions

Setting up your development environment with Flash CS5 and AIR for Android
http://www.gotoandlearn.com/play.php?id=123

More instructions for setting up.

Getting started with Adobe AIR for Android
http://www.adobe.com/newsletters/edge/august2010/articles/article1/index.html

Some AIR for Android examples

Build a GPS Speedometer
http://mobile.tutsplus.com/tutorials/android/build-a-gps-speedometer-getting-into-air-for-android/

AIR for Android MazeFM Application
http://www.flashandmath.com/mobile/mazefm/index.html

Air for Android: Geolocation
http://www.unitedmindset.com/jonbcampos/2010/08/30/air-for-android-geolocation/

Simple camera application with Flash CS5 and AIR for Android
http://www.gotoandlearn.com/play.php?id=124

Publishing AIR for Android Applications to the App Store
http://www.gotoandlearn.com/play.php?id=131

The .apk file that is created for AIR for Android has the .swf file in the assets folder and an application.xml file in the assets/META-INF/AIR folder which works with the main AndroidManifest.xml file to set the programs application properties and how it should start (run the swf file).

Now it’s easy to move your Flash apps and games to the mobile market. Enjoy.