QBW File Repair

[Philip Shaw]

Good afternoon. I have a customer who brought me a drive from a computer he had punched. I did a head exchange and was able to find the Quickbooks backup he was looking for under QuickbooksAutoDataRecovery. There were scratches and I was able to get all but 46 sectors read successfully. I tried reading those sectors hundreds of times with no luck. When we loaded the file in his Quickbooks it went to Quickbooks Desktop File Doctor for about 25 minutes but then said it couldn't repair the file. I was surprised since the first bad sector was nowhere near the beginning of the file. Is there any program out there that can fix a bad .qbw file?

Thanks.

[t...@desertdatarecovery.com]

I presume you looked at this?

 

https://quickbooks.intuit.com/learn-support/en-us/damaged-data/recover-lost-data-with-quickbooks-auto-data-recovery/00/203436

 

Tim

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkYP%3DEf0x%2BkQ4-3by1vL1F_S3HeoLcAAPDmjiP0qHNyy%3Dw%40mail.gmail.com.

[Wilfried Welsch]

We had great experience with Mark from https://quickbooksrepair.com/data-recovery/ for repairing corrupted files or files with bad sectors.

 

Thank you

 

Wilfried Welsch

resquoo, inc.

Phone (978) 531-1022

 

Facebook | Website | Apple Consultants Network

Yelp | Google+

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/051001d540b8%24139dda90%243ad98fb0%24%40desertdatarecovery.com.

[Joe]

I've have success with the software bellow. You can try it free but you'll have to pay to actually recover and the price is per year.

https://www.stellarinfo.com/file-repair/quickbooks-recovery/quickbooks-recovery.php

[German Ballardo]

This is another good alternative i have used for Quickbooks.

https://www.thegrideon.com/quickbooks-forensics.html  

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/bc4659ed-c955-4b4c-bf4a-0dff71d69158%40googlegroups.com.

--

German A. Ballardo

[compos mentis]

Were these 46 sectors at the end of the file? What is the model of the drive?

The reason I am asking is that an Advanced Format drive has a physical sector size of 4KB, so one would expect that the count of unreadable logical sectors would be divisible by 8, assuming that the file system was properly aligned to a 4KB boundary.

[compos mentis]

It seems that nobody cares about the implications of the missing 46 sectors. 

If these sectors occur in the middle of the file, and if the drive is an AF model, then this means that there is one physical sector for which the tool was able to recover only 2 of the 8 LBAs, ie the tool or the drive threw away 6 readable LBAs. Clearly this is absurd -- either you read an entire physical sector, or you don't read it at all. This then points to a bug in the tool, or a misconfiguration by the operator, or some weird problem with the drive's caching strategy.

[Desert Data Recovery]

I think only the OP needs to care about the missing sectors :-)  I presume as it's missing 46, then these were 512b sectors. You average QBW file is about 100mb give it take, so this sort of corruption is normally salvageable with these software repair programs. 

From what the OP first described he is working with QB Auto Recovered files. I think most of the recommended programs are to repair QBW or QBB. He needs to go through this process first to recover them to the right format. 

Phil, we have all put time and effort into these recommendations. Did you have success? If so which software worked for you?

On Sat, Jul 27, 2019, 3:21 PM compos mentis <pbzcbf...@gmail.com> wrote:

It seems that nobody cares about the implications of the missing 46 sectors. 

If these sectors occur in the middle of the file, and if the drive is an AF model, then this means that there is one physical sector for which the tool was able to recover only 2 of the 8 LBAs, ie the tool or the drive threw away 6 readable LBAs. Clearly this is absurd -- either you read an entire physical sector, or you don't read it at all. This then points to a bug in the tool, or a misconfiguration by the operator, or some weird problem with the drive's caching strategy.

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/c9bfd462-d802-4904-815b-80cdf1766edb%40googlegroups.com.

[compos mentis]

The same "partial physical sector read" problem occurred here:

http://www.hddoracle.com/viewtopic.php?f=172&t=1819&start=60#p11806

[Desert Data Recovery]

I assume Phil used PC3000 as I know he uses it. When opening up a new task in DE, if it's a 4k drive, it gives you the option to use the physical or logical sector (logical is required in WD encrypted drives for example) so if the errors are not a multiple of 8, logical sector would have been used so probably not a FE drive. I have used ddrescue a lot, but not hddsuperclone so don't know its limitations or errors. 

On Sat, Jul 27, 2019, 10:18 PM compos mentis <pbzcbf...@gmail.com> wrote:

The same "partial physical sector read" problem occurred here:

http://www.hddoracle.com/viewtopic.php?f=172&t=1819&start=60#p11806

--

You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/78bb5d06-b55b-4a8b-9b0d-7974642f7835%40googlegroups.com.

[Philip Shaw]

The customer has balked at the $250 for the Stellar software so I am going to order another donor and try to get a Frankenstein file if I can read those sectors from another file with the same time stamp and size and copy them over. When I did the head exchange Head1 was getting constant errors so I imaged everything in the MFT under Head0 and then did an MFT scan and came up with enough folder structure to find the adr file and all of that was under Head0. But, alas, there were some scratches. The file was a qbw.adr which I thought was basically a copy of the customer's qbw file. I removed the adr from the end but I don't have a tlg file to go with it. I don't believe that is necessary to recover the data.

The errors are spread out in the middle of the file in a pattern which indicates missing oxide on the platter. Tim is correct, I used the logical sector option so the errors are eight times more as are the total sectors in the file for a physical drive.

Thank you for the feedback.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAOasWzv7K87Cz4Z_ntQgSGm3g5%3DU%2BXPCXvap%2Bh_My-qvjZ5bLQ%40mail.gmail.com.

[Desert Data Recovery]

Phil. If you read my first reply, it describes how to handle qbw.adr files. You cannot simply change .adr to .qbw. 

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkYo98D6nXpRZc65v7GLKEZ9gOPBf2RhT6-DJwmgBfwJRg%40mail.gmail.com.

[David - Blizzard Data Recovery]

I have never had an issue removing the trailing .ADR and opening the file as a normal QBW file. It looks like the article you referenced might allow for some "extra" data if you have a current log file. If you don't have the log file (TLG) Quickbooks creates a new one when you open the QBW file. As a matter of fact, if you drop the dot ADR so the file has the QBW extension and then open it with a newer version of QuickBooks it will prompt you to upgrade the company file, it definitely sees it as a normal QBW file.

[Desert Data Recovery]

Thanks David, I did not know that. Should have tried it in the past I guess....

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/c0c83fce-3540-4a21-9f86-def67c6a5dbd%40googlegroups.com.

[compos mentis]

On Monday, July 29, 2019 at 12:30:28 AM UTC+10, Philip Shaw wrote:

 

The errors are spread out in the middle of the file in a pattern which indicates missing oxide on the platter. Tim is correct, I used the logical sector option so the errors are eight times more as are the total sectors in the file for a physical drive.

If the drive is AF, then this means that 6 readable LBAs were discarded. 

BTW, I don't understand why AF FDE drives need the logical sector option. 

[Desert Data Recovery]

The logical sector option is always used on drives that have encryption. 

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/e7c96835-abcb-4c72-9404-76b195174e77%40googlegroups.com.

[Philip Shaw]

Good morning. I have done over 1,300 recoveries and this one ranks right up there on my list of cool ones. Just to recap, the customer had punched his keyboard because his computer was running slow (that didn't fix it) and then he took the added helpful step of opening the drive (that also didn't fix it). I ordered a set of heads and Head0 worked pretty well and Head1 was pretty weak and had a lot of scratches. I imaged the entire MFT using Head0 only and that gave me about 60% of the MFT. I then did an MFT scan and came up with a fairly robust folder structure which gave me the Auto Data Recovery folder. In that folder was a qbw.adr company file which had the correct date on it and it was all under Head0! I imaged the file and got about 100 bad sectors out of 20,000 or so and got that down to 45 by slamming the errors. I thought that would be good enough but, alas, the file wouldn't open on his computer (which prompted my original post). After all of your great feedback he didn't want to spend that much additional money for a program to fix it. I saw this as a major challenge and ordered another donor. I had noticed that there was another file in the same folder called qbw.adr.old and it had the same size as the other file but just earlier in the day. This file was all under Head1 so I went back to the 45 errors and noted where they were and read them on the .old file and pasted the 45 into the problem file. The son of a bitch worked and the customer was thrilled. I even took ten minutes to show him all that I did and he seemed interested but maybe he was just being nice. He did give me $75 more than I told him it would be which is still about 1/3 what it would have cost to send it off. 

Sorry about the wordiness but I am really happy with this recovery and I figured you guys would appreciate it a lot more than my wife.

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAOasWzvE3-eUUtvR3Yd-W_OGeyD5PVJiJPnLzh55pi%3DAoUZaoQ%40mail.gmail.com.

[YB]

Wow, that's some great work Philip. Very cool indeed. 

You received this message because you are subscribed to a topic in the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/datarecoverycertification/2c4pN19eh3Q/unsubscribe.
To unsubscribe from this group and all its topics, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkY57nUhDinvCnfifh2ETG5DChvCtom9WQ7ccGcoqvXAEA%40mail.gmail.com.

[t...@desertdatarecovery.com]

Well done Phil. Great they you stuck at it to the end 😊

 

 

From: datarecovery...@googlegroups.com <datarecovery...@googlegroups.com> On Behalf Of Philip Shaw
Sent: Friday, August 2, 2019 8:14 AM
To: DataRecoveryCertification <datarecovery...@googlegroups.com>

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkY57nUhDinvCnfifh2ETG5DChvCtom9WQ7ccGcoqvXAEA%40mail.gmail.com.

[wayne horner]

nice phil

some good creative thinking!

Alandata Data Recovery -  (949)287-3282  
"Cleanroom Data Recovery of RAID, VMware, Network Attached Storage, Linux, Tape, Disk, Forensics"

www.AlanData.com   www.AlanDataRecovery.com

To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/CAPG2QkY57nUhDinvCnfifh2ETG5DChvCtom9WQ7ccGcoqvXAEA%40mail.gmail.com.

[compos mentis]

On Saturday, August 3, 2019 at 1:14:14 AM UTC+10, Philip Shaw wrote:

I had noticed that there was another file in the same folder called qbw.adr.old and it had the same size as the other file but just earlier in the day. This file was all under Head1 so I went back to the 45 errors and noted where they were and read them on the .old file and pasted the 45 into the problem file. The son of a bitch worked and the customer was thrilled.

Were the two files actually different?  If so, were the differences at the end?

Nice work, BTW.