Monday, August 20, 2012

Sucessfully restored backup made with Samsung Recovery Solution 4 using SRS 5

Samsung netbooks usally ship with Samsung Recovery Solution, which is a branded version of Clonix WinClon. It only works on Samsung netbooks with a special recovery partition present. I have used this software once to create a backup of the windows partition of a netbook, which I had to return for repair. Since I just got my money back, I needed to decide between the same model (which was even more expensive than before, as I remember correctly) or a newer and better one. So I have chosen to buy the newer one. Although I did not know if my backed up Windows would work smoothly or even boot on this completely different system, I still wanted to recover the partition to copy the interesting files manually. However, the new netbook came with Recovery Solution 5 and did not recognize my backup files.

After some unsuccessful attempts, including trying to install SRS4 in a virtual machine (Admin Tool did not complete installing recovery environment, which may depend on special Samsung system functions), I created a backup with SRS5 and compared the files with my old backup. It seems, that there are only two bytes in user1.wcl, which are necessary for version matching. They are at 0x28 and 0x29. The backup from SRS4 is filled with zeroes at this position, while the backups from SRS5 contain the bytes ACh and 98h. So I replaced the zeroes with ACh and 98h in my old user1.wcl and replaced the SamsungRecovery folder on my external HDD with my old (but patched) backup. SRS5 now listed my old backup instead of the new one and was able to restore it. It all worked very well and Windows was even bootable (despite missing some drivers). This enabled me to copy the files (although the files left where less interesting than I believed - but at least I can now delete the backup files and free up some space).

Finally I rolled back a sector-by-sector copy of the hard disk (not made with SRS) to restore the actual state of this netbook. NOTE: remember to format (not just quick format) your disk before recovering with any backup software to avoid troubles with the file system (would have saved me some time, if I had not missed it).

Conclusion: SRS/WinClon performs very well and fast, but gets tricky if you change or mess up the system. It should be more flexible.



14 comments:

  1. Hello, my laptop was stolen and i made a backup with SRS 4 (.woo,.wcl,*.w01....). I buy a new samsung laptop, but SRS 5 is installed. The only difference is that bytes ?

    ReplyDelete
    Replies
    1. I do the same as you, but i have more different bytes between the two files....
      I copy the header, the wcl is recognized. But i have an error when trying to open the first w01 file....

      Delete
    2. I could only find differences by version at 0x16 and 0x17 as well as 0x28 and 0x29. It was sufficient to patch only at 0x28 and 0x29. Alle other bytes were either always different or always constant. Which byte sequences do you have at these positions in your SRS4 and SRS5 backup files (user1.wcl)? For my comparison I have created several backups with SRS5 and also extracted init.wcl from the recovery partition. However, I only had one SRS4 backup. If you cannot figure it out, I could provide you with more data or you just send me your header(s) so I can look into it. Hope this helps.

      Delete
    3. Thanks for your answer.

      My SRS4 backup was made on an external hard disk, and i make a SRS5 backup on laptop hard disk. Maybe thats the reason (path to the files are not good in wcl file) ?

      But it's strange, when i succeed to see SRS4 backup in SRS5, it hangs to restore on a file open box : cannot find user.w01 file (path is laptop recovery partition), i try to change to the hard disk drive SRS4/user.w01. But it don't works. After that MBR was corrupted.....

      Delete
    4. user_1_SRS4_Header.wcl :
      9D A0 00 00 1A FC 00 00 50 5F 30 31 5F 30 30 00 00 00 00 00 01 00 01 04 00 00 10 0A 00 09 00 00 00 EC DC CC BC 00 00 00 00 00 00 00 00 32 37 2F 30 37 2F 32 30 31 32 7C 32 37 2F 30 37 2F 32 30 31 32 7C 4E 52 35 32 30 7C 45 6E 74 72 65 72 20 75 6E 65 20 64 65 73 63 72 69 70 74 69 6F 6E 2E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 C0 8E D8 8E C0 8E D0 BC 00 7C 8B F4 BF 00 06 B9 00 01 FC F3 A5 EA 1B 00 60 00 0E 1F 06 E8 95 00 07 80 3E 97 01 01 74 75 80 3E 97 01 02 74 00 C6 06 94 01 00 E8 04 01 BE BE 01 B3 04 F6 04 80 75 0F 83 C6 10 FE CB 75 F4 CD 18 BE 5D 01 E8 FC 00 BB 00 7C 06 53 50 55 8B EC C7 46 02 00 00 5D 50 55 8B EC C7 46 02 00 00 5D FF 74 0A FF 74 08 06 53 50 55 8B EC C7 46 02 01 00 5D 50 55 8B EC C7 46 02 10 00 5D 16 1F 8B F4 B4 42 CD 13 83 C4 10 EB 00 CB C6 06 95 01 00 E8 A0 00 EB 00 BB 00 7C 06 53 B8 01 02 B5 00 B1 05 B6 00 B2 80 CD 13 C6 06 94 01 01 CB B8 00 F0 8E C0 33 C0 8B F0 BB FF FF 26 81 3C 53 77 74 08 83 C6 01 4B 75 F3 EB 1A 26 81 7C 02 53 6D 74 02 EB EE 26 81 7C 04 69 40 74 02 EB E4 83 C6 06 E8 01 00 C3 1E 57 26 8B 14 26 8A 44 03 EE 26 8B 44 07 8E D8 26 8B 44 05 8B F8 C7 05 43 58 C7 45 02 5C 00 26 8A 44 02 EE B1 02 8A 65 05 80 FC FF 74 13 80 FC 80 76 0E C7 45 02 5D 00 80 EC 80 88 65 05 EE B1 01 26 8B 14 26 8A 44 04 EE 5F 1F 88 0E 97 01 C3 BB 00 06 B8 01 03 B5 00 B1 01 B6 00 B2 80 CD 13 C3 AC 3C 00 74 0A B4

      Delete
    5. user_1_SRS5_Header.wcl:
      BE A0 00 00 A7 DC 00 00 50 5F 30 31 5F 30 30 00 00 00 00 00 01 00 01 05 00 00 10 05 00 04 00 00 00 C9 39 78 7C EC 8C AC AC 98 00 00 00 32 00 39 00 2F 00 30 00 38 00 2F 00 32 00 30 00 31 00 32 00 7C 00 32 00 39 00 2F 00 30 00 38 00 2F 00 32 00 30 00 31 00 32 00 7C 00 4E 00 33 00 30 00 30 00 45 00 34 00 41 00 7C 00 45 00 6E 00 74 00 72 00 65 00 72 00 20 00 75 00 6E 00 65 00 20 00 64 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 2E 00 00 00 0A 00 00 00 40 92 AF 01 B0 04 02 00 01 00 00 00 35 00 00 00 50 00 72 00 E9 00 70 00 61 00 72 00 61 00 74 00 69 00 6F 00 6E 00 20 00 64 00 65 00 20 00 6C 00 61 00 20 00 72 00 65 00 73 00 74 00 61 00 75 00 72 00 61 00 74 00 69 00 6F 00 6E 00 20 00 64 00 75 00 20 00 6C 00 6F 00 67 00 69 00 63 00 69 00 65 00 6C 00 20 00 73 00 79 00 73 00 74 00 E8 00 6D 00 65 00 2E 00 2E 00 2E 00 00 00 00 00 00 00 40 92 AF 01 B0 04 02 00 01 00 00 00 35 00 00 00 33 C0 8E D8 8E C0 8E D0 BC 00 7C 8B F4 BF 00 06 B9 00 01 FC F3 A5 EA 1B 00 60 00 0E 1F 06 E8 95 00 07 80 3E 97 01 01 74 75 80 3E 97 01 02 74 00 C6 06 94 01 00 E8 04 01 BE BE 01 B3 04 F6 04 80 75 0F 83 C6 10 FE CB 75 F4 CD 18 BE 5D 01 E8 FC 00 BB 00 7C 06 53 50 55 8B EC C7 46 02 00 00 5D 50 55 8B EC C7 46 02 00 00 5D FF 74 0A FF 74 08 06 53 50 55 8B EC C7 46 02 01 00 5D 50 55 8B EC C7 46 02 10 00 5D 16 1F 8B F4 B4 42 CD 13 83 C4 10 EB 00 CB C6 06 95 01 00 E8 A0 00 EB 00 BB 00 7C 06 53 B8 01 02 B5 00 B1 05 B6 00 B2 80 CD 13 C6 06 94 01 01 CB B8 00 F0 8E C0 33 C0 8B F0 BB FF FF 26 81 3C 53 77 74 08 83 C6 01 4B 75 F3 EB 1A 26 81 7C 02 53 6D 74 02 EB EE 26 81 7C 04 69 40 74 02 EB E4 83 C6 06 E8 01 00 C3 1E 57 26 8B 14 26 8A 44 03 EE 26 8B 44 07 8E D8 26 8B 44 05 8B F8 C7 05 43 58 C7 45 02 5C 00 26 8A 44 02 EE B1 02 8A 65 05 80 FC FF 74 13 80 FC 80 76 0E C7 45 02 5D 00 80 EC 80 88 65 05 EE B1 01 26 8B 14 26 8A 44 04 EE 5F 1F 88 0E 97 01 C3 BB 00 06 B8 01 03 B5 00 B1 01 B6 00 B2 80 CD 13 C3 AC 3C 00 74 0A B4

      Delete
    6. I have analyzed your headers and think your version of SRS4 was somehow different to mine. Still, the file structure seems to be the same and the only differences are a few more bytes prior to 0x28. You should try to replace the bytes from 0x21 to 0x29 with the following sequence: C9 39 78 7C EC 8C AC AC 98. Leave everything else untouched.
      With the bytes replaced I can get your file recognized by SRS5.

      Concerning your file paths:
      If you create a backup with SRS5 you can select your external HDD as storage path. Then just rename the new SamsungRecovery folder to something else and copy or create a SamsungRecovery folder with your SRS4 backup files. SRS5 will recognize your old backup instead of the new one. All related files must be within the same folder.

      Please keep me updated on your progress.

      Delete
    7. Thanks for your answer, i was on holydays. I'll try your solution as soon as possible.

      Delete
    8. I finally succeed to install SRS4 and get my files. It took a couple of hours.

      Thanks Again

      Delete
  2. Can i restore the files on an external hard drive ?

    ReplyDelete
    Replies
    1. No, SRS always restores to the first hard drive in the system. Make sure you create a backup if you need the data.

      Delete
  3. Hi, I have a problem with my samsung notebook, it became with windows 8, but as i didnt like it, i decided to downgrade to windows 7, before that i made a backup in a external drive, the files that were saved are: preview, init.w01, init.w02, init.03, init.wlc, init.woo and wincloninit.srs. I deleted all recovery partitions, now i want to come back to win8, but when i boot the external drive its says that there is any recovery partition and nothing happens. Could you please help me with this. Thanks! sorry for my bad english

    ReplyDelete