problem restoring .qic backup file catalog empty

Whenever you experience data loss due to accidental erase or corruption immediately STOP using the USB flash drive. Try to retrieve the data is through recovery software, such as Image Rescue 2 or Image Recall 2, which are available at computer retail stores.

http://www.shareup.com/Image_Recall-download-26284.html
http://www.lexar.com/software/image_rescue.html

I am sorry you may have lost all your data, but you did use the worst backup software available... Windows backup..?

Free recovery software listed here https://www.experts-exchange.com/questions/20827883/Help-Accidently-erase-my-hard-drive-by-Norton-anything-I-could-do-toretrive-any-data.html.

Zee

>>   I checked to make sure the file was on the drive  <<  how big was it? if it was 1 k or 0 k, it can be a pointer, instead of the real file

...and you're not the only one :    http://www.d-a-l.com/help/archive/index.php/t-977.html

>>  When I tried to restore it the next day, the file had mysteriously vanished, apparently it was deleted   << i suppose you installed the win98 driver for the flash drive?

>>  I was able to undelete the file to my hard drive   <<  what os was this ? XP

It sounds to me as though you MAY have disconnected the flash drive before all data had been written to it.  As you'll probably be aware, Windows ME, 2000, and XP all show an icon in the system tray that allows you to "safely disconnect" a device like that.  Windows 98/98se does not provide this, and you are taking a chance when you remove a usb flash drive.

There can often be a substantial delay in showing the file copy animated dialog when copying or "sending to" a usb flash drive, and sometimes you are left wondering if the process is complete or has even started.  On some occasions, you can actually see what seems to be the file (with the expected file size) on the destination drive before it copies there, or while it is still doing so.

To this end, although it isn't fully intended for usb drives (it was designed for Firewire peripherals), Microsoft issued an update that provides the resources for this "safely remove" dialog, and helps to address the "unexpected removal" of such devices.

http://support.microsoft.com/default.aspx?kbid=242975

It is clear, from what you have said about having "undeleted" the file to the hard drive, that you created the *.qic file on the hard drive and THEN copied it to the flash drive.  It sounds like you lost it somewhere during that file copy stage.

Make an immediate copy of that *.QIC file as it is all you have. You can then have a look at a copy to verify if it has the correct file header information.

Download http://members.ping.at/mlubich/peek11.zip.
Unzip it, Right-Click on PEEK.INF, and choose "Install".
You now have a new right-click menu for all file types that will extract as much textual content of the file as it can, and display it in Notepad without affecting the actual file.

Right at the top of a .QIC file, you should see "VTBL".  This is the header information that identifies it as a Windows 98 qic file.  There should also be other lines that look like:
MDIDMediumID4882929283527452108°VR0100°CSAEE2°
°UL03092005.
°DT43C3A650°

MDID     = VTBL tag
MediumID = Unique 19 decimal digits for identification
VR       = Version?? Always seems to be 0100
CS       = ??? Followed by 4 hex bytes
UL       = "User Label" - The file name saved as
DT       = Date/Time Created (as 8 hex bytes)
You shouldn't see FT in there, because this only seems to be applied (Format Type???) to backups made to Tape.

If it is corrupt, or wasn't written/copied properly, it may not have these headers.  You SHOULD also see some textual content that you would recognise as being the folder/file names chosen to include in the backup, and even some of the content of the files.

Unfortunately peek won't allow you to restore or fix any files, it is just a viewer through which you can first of all determine if this is a real qic file.

Is there a possibility that the system previously had one of the Windows 98 unofficial service packs installed?  I am wondering if the version of MSBACKUP.EXE on the system when the backup was created was different.  Some of these unofficial updates replace Windows 98 file versions with Windows ME versions that work.  A Win98 MSBACKUP may not recognise a QIC file created by Windows ME, because of possible differences with the file headers.

If the file LOOKS valid, then you MIGHT stand a chance of recovery using recovery software.  It's worth checking out first.

recovering data from harddisk and flash drives are different...Use Image Rescue 2 or Image Recall 2 only..this will solve your problem

Interestingly, I was able to replicate this behaviour by deliberately tampering with a .qic file in a hex editor to corrupt it.  I had made the backup from a a new folder of junk files, and then deleted it after creating the backup, so restoring it to the original location didn't matter.  I ran the Restore Wizard and it predictably threw up the error message:
Current media does not contain any backup sets.  This operation will be cancelled".
When I clicked the "OK" button, and then cancelled and closed MS Backup, my test *.qic file had been deleted from my hard drive partition.

I tried again to replicate this, but I couldn't get it to do the same.  Very unpredictable to say the least, and probably accounts for your scenario.

I downloaded the necessary driver for Win98 to recognize the flash drive before I did the backup.  I restored the file using Active Undelete. I tried restoring it on WinXP and Win98 and got the same result.  The restored file shows that it is 776MB, which is about what I expected.   I downloaded the Peek application, but I'm honestly not sure which of the options I should use.  Opening it as a binary and standard file just produced a lot of unintelligible junk (to me), so I'm guessing those weren't the approaches to take.  If I'm wrong about that please correct me.  As a unicode file it produced the following info at the top. After this, was a list of the file names I expected to see. I guess this doesn't look good.  Is it likely that a different restoration program would yield a different result? I've made sure that the flash drive hasn't been used since the original backup.

"Checking file system on F:
The type of the file system is FAT32.


One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                        
Volume Serial Number is 200D-9CA3
Windows has checked the file system and found no problem.

   1039556608 bytes total disk space.
         4096 bytes in 1 hidden files.
   1039548416 bytes available on disk.

         4096 bytes in each allocation unit.
       253798 total allocation units on disk.
       253796 allocation units available on disk.

TAX01


TAX99

WINDOWS

SAFECA~
DILLA
BD6FD000.DAT
C
DILLA
SafeCast Product Licences
e Worl
rlife.
me to
nely.
e Worl
rlife.
me to
nely.
Eaaa
000 AA
TsoT
PSHi
GXQ5
PSHi
RTWA
PSHi
0Me 0
TZ3t
454Nl
4psN
At J
A3LL
nlhj
pjuz
?gOuI
jORS
jORS
5c10N

Uho
SP4C
?5
4
A4G

A4G

GA8E
sUOl
bHxL
OXy1
Tclb
Tclb
OXy9
  2Z
0uRT
AAxZ
AAxZ      
fb X?
P0C

Ajpt
COpg
A tA
jp

Lj0q
uHi
pbPp
U tB
j0c
Aj4w?
GO6S
Alf3?
bPj
b4XR
uHi
OILW
O Ov
pi m
DILLAx?
GRPHFLT"
"

try recovering it with one of these, and check if it does better :

http://www.runtime.org/                                    GetDataBack
http://www.stellarinfo.com/                                    Stellar
http://www.bitmart.net/                                    Restorer 2000
http://www.snapfiles.com/get/restoration.html                        Restoration
http://www.snapfiles.com/get/activeundelete.html                  Active undelete
http://www.pcinspector.de/file_recovery/UK/welcome.htm                  pc Inspector

Re. the PEEK utility.  I generally just use the "standard" view option.  You should really have seen the file headers I mentioned if that backup was made with Windows 98's MS Backup program.  Without a file header, the file will not be identified correctly.

To give you a couple of examples of file headers.  View the following files with the peek text extraction utility and you will see the respective file headers at the top:

1. *.CAB file (eg. from the Win98 folder of the Windows CD) - header MSCF identifies it as a "MicroSoft Cabinet File"
2. *.ZIP file created by WinZip or other PK-Zip compatible programs will have the letters "PK" appended immediately to the end of the file names shown as being packed into the archive.  The files are usually listed at the end of the file when viewed in Peek and, although they aren't really "headers" as such, without the suffixes the zip file will be seen as corrupt.
3. *.jpg image file - JFIF, *.gif image file - GIF87 or GIF89.
4. Those files you see on installer packages with an underscore in place of the last letter eg. AsycFilt.dl_  These are compressed files, and will show SZ as a file header.

For this reason, renaming a file to another file type will not change the way it has been encoded originally when saved first "saved as".  Take a look at the Windows 98 logo files logo.sys, logos.sys, and logow.sys.  They are just renamed .BMP files, so renaming them back to .bmp will allow them to be opened in an image editor.

A *.qic file should be registered with MSBACKUP.EXE such that it will open that program on a double-click, but it stops there and doesn't actually read the file, or it would be a good test to see if it found a recogniseable file header.
Unfortunately, you could rename an empty *.TXT file as *.QIC and it would also open MSBackup on a double-click.  That has nothing to do with the file's integrity, because the command that is associated with *.QIC files in the registry doesn't pass it any parameters (ie. options that tell it to do something with the file once the program opened).  All it does is OPEN the program. I could just as easily associate a new conjured-up *.2z9 file to do the same, ie. open Windows Calculator or MSBackup on a double-click.

Regrettably I don't know of any utilities designed specifically to test the integrity of a *.QIC file, or even view it in a particular layout to visualise its integrity.

Without knowing the ins-and-outs of purported "recovery" utilities, my guess is that they would either extract all the data and then recompress it with the correct algorithm to apply the correct headers, tags, and labels OR that they would recover the file in place and just rewrite these headers, etc after reading the data.

There is one possible way that I can see which MIGHT rewrite the file headers and make this file valid IF this IS where the problem lies.  If you were to make a copy of the *.QIC file (by a different name would also be safer), and then run MSBackup as though you were doing an "incremental" backup.  All you would have to do is choose a new folder containing one single text file to add into the backup file and, when it gets to the "choose destination for output file", you would then choose the option to ADD files rather than overwrite the archive.  It will notify you that the destination already contains an archive and provide you with this option.

This is just a thought, because I'm not in the position to try it on my PC, but in theory it COULD reconstruct a corrupt file.  Perhaps not though.  IF the file IS corrupt, then it may refuse to update it with this new content being added to it.  You are abviously mitigating the risks to zero here by using a renamed copy of the QIC file in another folder.

Worth a try?

OH, and BTW you are about to restore what is recognised to have been a form of SpyWare back into the system.  Intuit TurboTax (up until around 2002??) deliberately installed a program without the user's knowledge, and designed it so that the program remained on your system after TaxCalc was uninstalled.

Judging by the extract from your QIC file, you would be restoring TaxCalc '99 along with the folder containing the so-called "Safecast Product Licenses".

This program was written by MacroVision, and was known as C-Dilla or SafeCast.  TaxCalc isn't the only software they managed to weasel into, there were plenty more like "Unreal Tournament 2003".  It's a similar thing to how Mattel/Broderbundt installed a tracking program named "Brodcast" with many of their titles until forced to remove it and provide a cleanup utility.

Do a search on http://www.google.com for the keywords "intuit spyware c-dilla", and you'll get your eyes opened. The essence of its "spyware" is that it is installed without the user's prior knowledge, and is designed to thwart software piracy by disabling any CD-RW Drive while copy-protected software is in the drive, hence its other  names: "SafeDisc", "SafeDisc HD" and "SafeCast Gold".  In addition to this, it was discovered that it logged other software titles being inserted, and transmitted data when the user went online.

Most AntiSpyware utilities will pick it up and remove it, but unfortunately C-Dilla is integrated into TurboTax as part of the registration process, and the application may not work without it.  MacroVision seem to still be proud of that one (http://www.macrovision.com/products/legacy_products_OLD/safecast/index.shtml) and I wonder if C-Dilla's founder Peter Newman was involved in the latest Sony copy-protection ploy?: http://reviews.cnet.com/4520-3513_7-6388181-1.html

i hpe u tried it in win 98...u cant do it in winxp
foe xp read this http://xphelpandsupport.mvps.org/how_do_i_open_qic_backup_files_i.htm
hre u mentioned "downloaded peak application" ..wht is that?

I missed a bit that I meant to say.

"The VTBL header is the unique identifying character that will tell MS Backup for Windows 98 that the file is a valid one in a recognised compressed or uncompressed format.  Without that identifier, the file will be seen by the program as an "empty catalog"..........

------> Hence my suggestion of Using MSBackup again and trying to add a new file to A COPY OF the QIC file as an incremental backup to see if it is able to "repair" the required header data that appears to be missing.

Thanks for all the info!  I'm going to try the suggestions and see what happens. I'll keep you posted. It might take a couple of days.

I found Sonic's Europe version of Backup MyPC to open the .qic file, but it said the file "could not be read or is not properly formatted." I tried restoring the file with multiple programs, including GetDataBack, Restorer 2000 and PC inspector.  They all restored the same amount of data, and all ended up giving me the same error when I tried to open with Backup MyPC.  I also tried to do an incremental backup using the file, but that didn't work either.  The suggestions were great, but it looks like the file is a loss.  

Oh dear, it does look as though the file is missing something that would normally make it complete and usable, or something has corrupted it and messed up the expected format.

Out of curiosity, when you say that the recovery programs "restored the same amount of data", did it restore some files and folders from the QIC file back into their original state, but not all of them?  I've never used one of those utilities on a QIC file, so I wouldn't know the results to expect.

I've been looking at possible ways that you might be able to add some file headers into the qic file, but something like this would have to be done in a hex editor so that it wouldn't screw up the file format.  Trying to do something like that in Notepad, and then saving the file, would most certainly mess up the format.  I've manipulated data within .exe and other file types using DOS Edit, but that was only to change things that were already present, and not to add or remove any of the content.  I didn't have any success with a test qic file when I deliberately removed the headers in a hex editor, saved it, and then tried to add them again.

One thing I DO notice, and IS VERY significant, is that the original name of the QIC file and the name of the backup "job" are stored within the file in the header area.

I created a simple test backup file from a copy of a folder containing mixed files, and then deleted that folder.  I then renamed the QIC file and attempted to have MS backup restore it to the "original location".  This would be a good simulation, because why else would you need to restore a backup if the original contents were still there and intact.

On opening the Restore tab, and browsing to the new renamed QIC file, it initially tells me that "The catalog is empty for selected device".  HOWEVER, when I then click on the "View > Refresh" Menu, it asks me "Would you like to refresh the current view?".
Saying Yes to this seems to scan the qic file  and come back with the name of the backup "job", and the date and time of creation in a "Select Backup Sets" dialog and with the familiar green checkmark against that job.

When you accept that as the chosen backup set, it then shows the "What to restore" folder-tree layout which allows you to do a partial or total restore.  The folder-tree layout is most certainly stored with the original paths in the qic file.

It all looks fine so far, and the renamed QIC file is still showing as the file from which the backup will be restored, but when I click the Start button to restore it to the original location, it shows a "Media Required" dialog telling me "the following media is required to complete this operation", and lists the original filename given to the qic file at the time the backup was created.

OK, so I no longer have the named "media" available (ie. the original file name), because I renamed the qic file.  Nevertheless, I clicked OK and it came back with a success message and it successfully restored the backup to the original location.

So, going back to that initial "The catalog is empty for selected device" message.  Try it again, and this time click "View > Refresh" to see if it is able to scan the file and load it.

I doubt this will work, seeing as "Backup MyPC" failed to recognise the format of the qic file, but is is always possible that the version of Backup MyPC might only be compatible with eg. a Windows 95, or Windows NT backup and may not recognise the Win98 one you have.

It's worth trying, and it's the only other last-ditch suggestion I can make.

Bill

I wasn't able to get MSbackup to recognize it.  I downloaded a hext editor just to fool with a copy of the file.  I created a new backup file, then basically copied the header info into the new file.  I tried it several different times with slight alterations in the header (like actually substituting the proper file name :-) )  I think the final error that I got says "an error occurred while retrieving the backup directory. An unformatted region was detected on the media."  I may have messed up something at some point in the alteration.  I admit that after saving the 800MB file a few times I started to lose patience.  I think that I'm going to try it again with a fresh copy today and see how it goes.  If you have any suggestions on it please let me know. I honestly have only a limited clue on the hex editing.
Oh, my header ended up looking like this:

VTBL
MDIDMediumID4884
927727515337182
VR0100 CSC4D FM
2 ULtest backup.qic
DT43CABFE3

I created a new backup file, copied the header to the old file and tried to restore it.  The message I now get is "data read from the backuo device was damaged (CRC failure). You may be able to repair this file by using...chkdisk." I tried fixing errors with chkdsk with no luck.  If I click on "continue anyway", it gives me the same message over and over.   I'm wondering if someone with programmer's knowledge could use a hex editor to fix it.  I contacted a couple of data recoverty companies, but they just basically restore the original file.  One suggested contacting Microsoft, but I'm not sure if MS techical help line would be able to help or if I'd have to spend $35 to find out they don't handle this kind of problem.

amprod

I have a feeling you have done just about as much as possible, and certainly gone to the limit of my own technical knowledge.  Perhaps a question in the programming section might prompt some suggestions for those with in-depth knowledge on manipulating file structure.  It's worth asking, I suppose.  The problem with hex-editing is that one dot or space may appear to be the same as the next, but actually is something entirely different.  Inserting the wrong hex value will no doubt cause the "unformatted region was detected on the media" error.

I think I can anticipate Microsoft's answer to this.  Windows 98 is now an old dead operating system, and therefore the program files and the data files generated by them are something I doubt they will even begin to consider.  I agree, if there was a way that you could spend $3 on a phone call to find out IF they might be able to help, then OK, but I think you would get the runaround and $35 will probably end up an under estimate.

Sorry I can't help any more with suggestions, but it's just beyond my scope of knowledge.  It's all very well making educated guesses up to a point, but as you say you have an 800 MB file there, and it is very time consuming for you trying out different things that are really untested theories with vague chances of success.

I hope you do get some useful and successful advice in the programming topic area if you do ask this question there, but if I think of anything else to try I will certainly post back here with details.

Regards
Bill

While I am here, there is one utility that MAY be useful at some point in the future, and possibly in connection with your qic file.

I discovered a web site dedicated to forensic examination of computer data, and amongst the downloads was a boot floppy intended to assist in forensic data acquisition without losing essential evidence.

http://www.disclosedigital.com/eabd.html
http://www.disclosedigital.com/scripts/eadb.zip

Amongst the files in that zip file is one named XChange.exe.  To create the boot floppy, you run FBD.BAT.  This calls XChange.exe to modify IO.SYS and COMMAND.COM on the boot floppy in such a way that they can safely be used without losing evidence on the hard drive.

I'm not suggesting the boot floppy as a useful tool in itself, but just that XChange.exe program file and the OChange.exe program that overwrites files into exactly the same place as the file being overwritten.  It can be used from DOS, with the appropriate options and syntax, to find and replace strings in binary files.  For instance, if you try and open Command.com or IO.Sys in Notepad, it's all gobbledegook.  The PEEK text extraction tool is just a viewer, and you can't use it to make changes to the file from which it extracted the strings.  Using a hex editor is, as you have found, quite easy to make a mistake with.

Perhaps XChange.exe and OChange.exe might make it easier to REPLACE data in a file such as the qic file, but the stumbling block is ADDING data into it that wasn't there before.  This program won't help with that aspect.

As an example, I created a quick batch file to modify the IO.SYS file on a Win98se boot floppy so that the menu header changed from:
"Win 98 Second Edition Boot Menu :"
to
"Microsuck Windows 98 Screwup Menu"

@echo off
attrib -h -r -s io.sys
xcopy io.sys io.fbd
Xchange io.FBD "  Microsoft Windows 98 Startup Menu" "  Microsuck Windows 98 Screwup Menu"
ocopy io.FBD io.sys
attrib +r +s +h io.sys
if exist io.FBD del io.FBD
EXIT

That simply replaces an ascii string, but it can be used to find and change non-ascii characters also.  Easier than hex editing IF you know exactly what you need to replace.

Whooops, sorry amprod.  I didn't see that you had actually accepted my comment.  I was drilling down through the emailed notifications and hadn't reached the "Good Answer!" one yet.

Thank you for that, even though my comments haven't yielded any success in the end.  It's appreciated.