Thanks Joakim.
After I had the problem, I immediately created an image with Easeus Todo Backup, but later I found that this is not a true image. The information is not a raw copy of the original disk.
In fact, it looks totally different under a drive editor.
The affected drive was online for several months, but I didn't write anything to the disk, so maybe the $Log file still contains the data.
I have a real raw image (done with dmde), but I created this one much later.
I don't have much time now, but I will try your parser.
↧