ZAR File Recovery Lock Up and Question

[bdacosta]

Greetings. I have 2 questions:

1) On the file explorer tab, what exactly does the SAVE button do? Does this save my analysis so I can go back to it?

2) When I start a a file copy, the computer locks up. Should I copy out in smaller batches?

This is on a 500GB drive.

Thanks.

[Alexey V. Gubin]

1. SAVE button saves analysis, correct. However, to return to a saved analysis, you need paid (not trial) version and to maintain exactly the same disk configuration between runs.

2. Clarify "computer locks up". Is it ZAR who locks up, or the entire system becomes unresponisve?

3. What version of ZAR you use, and what is the build number indicated on a first screen when you start ZAR?

4. What is the problem with the drive? I.e. what type, physical damage, formatted, or maybe something else?

[bdacosta]

Explorer.exe gives a GPF with a runtime error. Message displayed is cannot write to log file. ZAR runs, but Windows is unresponsive. This happens on 3 different machines with more than enough power (they are forensic investigation boxes).

Build is 8.3 29 and we have purchased the full license.

The drive's issue is that both the MFT and it's mirror are bad. NTFS is the file system.

[Alexey V. Gubin]

Could you please try http://www.z-a-recovery.com/zar-83-034.exe to see if the problem is still there?

[bdacosta]

I installed the version you suggested. The runtime error has gone away, but now halfway through a copy (6 million files total) ZAR just stops. Windows acts as if it is out of resources, but there is 1GB of memory free. I am using the disk cache defaults. CPU is at zero. 250GB free on system drive(C:).

Also, with the new version, I can no longer load a save file. it acts as if it is loading, but the GUI never refreshes on the "choose files to copy" screen.

[Alexey V. Gubin]

With six million files, maybe you can just split the copy in two parts, i.e. copy first half of the tree, then a second part.

[bdacosta]

I've found that it locks up if you try to extract more than 300,000 at a time.

When it does lock up, it always forces Windows to CHKDSK the C: drive on reboot.

The inability to load a save file is an issue now, since after lock up, I am forced to run the 3 hour parse/quick scan procedure to get back to where I was.

[bdacosta]

Also,
Since you mentioned running smaller batches, the ability to Shift-Click would be great when selecting files to extract.

[bdacosta]

Well, ZAR locked up the computer again. This time corrupting my restore drive's MFT.

I think it's time for a refund.

[Alexey V. Gubin]

You may want to start looking for a hardware problem, because source (damaged) and target (restore) drives are supposed to be independent at hardware level.

As far as refund is concerned, either post or send me with a private message the order reference number, or your full name.

[bdacosta]

Lockup happens on 4 different machines. All three drives are on their own controllers. I'll send you theorder info.

Thank you.