Solved

Accidental Partition Table Change-- How to recover data?

Posted on 2003-12-12
20
10,703 Views
Last Modified: 2007-12-19
hello... the history of my problem is recorded here...

http://www.spinzone.org/forums/index.php?showtopic=5560

basically, i ruined my partition table ( i think ) and now i must find software to help me un-do what bootMagic did to it.

please see PartitionMagic screen shot here.
http://www.e-nationmusic.com/pics/PM8_screen.jpg
the NTFS drive (drive E in the pic) should only be one partition. there is 87.xx gigs of data that. it is crucial that i recover this data.
A nice program called Virtual Lab is able to see all of my directories and files, just the way i left them, but i do not have the $535 that it will cost to proceed w/ their recovery process.

does anyone have advice on how i might manually recover my partition table?

i have several data recovery/ system utilities. any suggestion is appreciated.
thanks!

--js
0
Comment
Question by:jsabarese
  • 6
  • 5
  • 3
  • +3
20 Comments
 
LVL 24

Expert Comment

by:shivsa
ID: 9926679
u can have free recovery tools from CrazyOne list.
http://oldlook.experts-exchange.com/Operating_Systems/Win2000/Q_20441684.html

0
 
LVL 24

Expert Comment

by:shivsa
ID: 9926691
Also do u have someother disk.

1. remove this disk from this system.
2. get a other disk and install XP on that disk.
3. bring this disk back to the system and see if u can see this disk from new installed OS and all the files.

trying to get some idea, may not work.
-----------------
0
 

Author Comment

by:jsabarese
ID: 9926740
please understand, trying to save time, and a dupe message... if you read here, http://www.spinzone.org/forums/index.php?showtopic=5560 you'll see that i currently have the data lost drive running as a slave, so that i can run diagnostics...

thank you for your prompt reply in an effort to help.

(my apologies for directing you to another forum, but it's in the name of time conservation)

0
 
LVL 3

Expert Comment

by:raybass
ID: 9926799
It's easy to reconstruct a new partition table without damaging your data.  In fact, I do this all the time in my computer shop when a customer screws up their computer or a virus attacks the partition tables or something.

I don't want to make this sound scary or anything, but it's easiest to use Linux's fdisk to fix your problem.  For example, a bootable knoppix (www.knoppix.org) CD does the trick for me.  It's worth the download for you if you want to follow my instructions.

There is one catch, you need to know exactly how your partition was set up beforehand!

You'd better try this, 'cuz I'm writing it out step by step.

Okay, we boot with the knoppix CD.  At the first prompt, type "knoppix 2" (enter) -- this will give us a plain root command prompt, with full access to the whole machine.

You want to load up fdisk for your hard drive.  The command to run depends on where you have your hard drive plugged in on the IDE chain.  Primary Master is "hda", primary slave is "hdb", secondary master is "hdc" and secondary slave is "hdd"

For example purposes, we'll say your hard drive is on secondary master.

At the prompt, I type "fdisk /dev/hdc" (enter)  This loads fdisk, and gives us the initial warnings and stuff, and possibly a message about how messed up your partition table is.  you can type the letter "m" for help, but I'm going to give you all the commands to type, so don't worry so much about everything else unless you feel like exploring.

First, type "p" (enter) to print your current partition table.  You might have anywhere between 1 and 6 partitions (your screenshot indicates 4).  You need to "d" delete these all by number, there might be partition 1, 2, 5, or any combination of any number.  Typically 1-4 are primary partitions and 5-whatever are extended with logical drives.  Okay, so you've just deleted every partition on the drive, so if you type "p" again and it doesn't list any partitions, good.

Now we need to re-create our one partition.  Type "n" for new, it will ask us what partition number do we want to use?  Here we select "1" because it is the first and only partition that we are putting back on the drive.  Next it asks us what physical cylinder on the drive do we want to begin the partition on.  Since you only had one, we will start at the default "1" (just hit enter for the default).  Following that it will ask how big you want the partition to be.  Again, we just want to hit enter for the default, which is the maximum size.

We now need to change the partition type to NTFS.  Issue the "t" command, which will allow us to change the partition's ID bit, which is set at Linux by default.  Now, if you had a basic disk before (which you most likely did) type the number 7, which is HPFS/NTFS.  If you had a dynamic disk before (which you most likely did not) type the number 42, which is SFS, which means absolutely nothing.

After you've done that, print "p" the partition table again to make sure it looks good.  Hell, type "a" just for fun to set it active and give it the bootable flag (if it doesn't have it already).

When that all looks good, type "w" to write all your changes to disk (if you dare!!).  It will exit back to the command prompt.  If you're unix/linux savvy, you can now mount your drive to a directory to see if your data is there, but it's probably easier to type "reboot" and see if you can see it in windows now.

Assuming your data is not corrupted and you were able to rewrite your partition table exactly how it was before, you should see everything just fine on the drive.  If not, you're no worse off than you were before.  You can always boot back up in Knoppix and modify numbers around if you don't think you did it right the first time.

Out of that CrazyOne recovery tools list I recommend R-STUDIO from www.r-tt.com.  The demo is a free download where you can scan the hard drive and see if your files are there, and it will even let you recover files up to 64K for free.  Above that, the program is only $90 for a version that supports NTFS, if I remember correctly.

Good luck, and be sure to post here with what you've tried.

p.s. if you don't have the bandwidth or the patience to download knoppix, there are several single-floppy distributions that should give you the same fdisk and the same functionality, but I don't have links to any of them.  Google is your friend.  LRP might work, but they killed support over a year ago, so it might be a lost cause.
0
 

Author Comment

by:jsabarese
ID: 9926855
i don't have on any of my drives, nor do i know how to use Linux... i'm assuming that this renders your extremly thoughtful tips (thank you!) useless for me? or can i do this through DOS on my XP Pro SP1 system?

thanks

AIM = skellerpalooza
0
 
LVL 14

Expert Comment

by:kronostm
ID: 9928665
Raymond ... I see you're new around here and from your posts till now you seem skilled.
I personally see no way that your solution will work, since recreating the partition will not recreate the filesystem. Indeed, the data will still be phisically there, but no file entry to point to the bits written on the data zone. I'm dead curious if this will work though, I recommend jsabarese to try it, especially that you gave him very detailed directions on how to use fdisk. Indeed, it can't harm.

Here you can find some boot images: http://www.linuxlinks.com/Distributions/Floppy/

listening ....
0
 
LVL 3

Expert Comment

by:raybass
ID: 9929390
Thanks kronstm!

The reason I think this would work is because his filesystem shouldn't have been damaged by that boot manager software.  I believe the NTFS superblock resides somewhere closer to the middle of the partition, and it wouldn't be erased unless he "formatted".  The partition lies in the first 512 bytes of the hard disk, and if he is able to reconstruct that to how it was before identically, windows shouldn't notice.  I know for a fact this works with fat32, and I have seen it work with ntfs, but I haven't done it enough with XP hard drives to guarantee the method.

If the drive was to boot again, he might need to clear the MBR along with the partition table first, which could be done with this command, though he would have to still recreate his partition table somehow after he did this:

dd if=/dev/zero of=/dev/hda bs=512 count=1

That linux command is very dangerous, because you get into writing zeros to the hard drive.  If you mess up and accidently hit enter before you type the bs or count parts, bye bye data.
0
 
LVL 24

Expert Comment

by:shivsa
ID: 9933538
Could u check this article from MS.
http://support.microsoft.com/?kbid=282793
0
 
LVL 24

Expert Comment

by:shivsa
ID: 9933558
Also check this.
 DiskProbe

DiskProbe is a sector editor tool for Windows XP Professional that allows users who are members of the Administrators group to directly edit, save, and copy data on a physical hard disk. With careful use of DiskProbe, you can replace the master boot record (MBR), repair damaged partition table information, and repair or replace damaged boot sectors or other file system data. You can also use DiskProbe to save MBRs and boot sectors as backup binary files in case the original sectors become damaged by viruses, human error, hardware problems, power outages, or similar events. Unless you are familiar with using DiskProbe, try other troubleshooting tools, such as Recovery Console, before using DiskProbe.

Caution
    * Be cautious when making any changes to the structures of your hard disk. Because DiskProbe does not validate the proposed changes to records, incorrect values in key data structures can render the hard disk inaccessible or prevent the operating system from starting. If you cannot correct the changes you entered, you must re-create and reformat all volumes on the disk.

DiskProbe can change the values of individual bytes in any sector on a dynamic disk, but it cannot navigate the structure of a dynamic disk. Therefore, it is recommended that you use DiskProbe only on basic disks. You can, however, use DiskProbe to back up and restore the boot sector and MBR of dynamic disks.

DiskProbe is part of Windows Support Tools. For more information about DiskProbe, click Tools in Help and Support Center, and then click Windows Support Tools.
more info:
0
Google Storage: Standard vs. Nearline vs. Coldline

Google Cloud Storage has a number of classes to choose from. Although there are a lot in common, they vary in price and usage terms. This post explains Google Cloud Storage classes and helps to understand which  one to choose.

 

Expert Comment

by:TIMFOX123
ID: 9933899
Just a thought.  You may want to at least try to do a "ghost" of this drive before you start messing with the partion table.  I do not know if Ghost will back it up but it is worth a shot.
0
 

Author Comment

by:jsabarese
ID: 9938623
btw, i haven't yet used FIMMBR from the recovery console... seems a simple answer, but is it possible that that would put my data into greater jeopardy?

0
 
LVL 24

Expert Comment

by:shivsa
ID: 9938631
did u try disk probe, it also fixes the MDR but with cautions.
0
 

Author Comment

by:jsabarese
ID: 9938673
no, i did not. is this a tool in the recovery console?
0
 
LVL 24

Expert Comment

by:shivsa
ID: 9938687
DiskProbe is part of Windows Support Tools. For more information about DiskProbe, click Tools in Help and Support Center, and then click Windows Support Tools.
0
 
LVL 3

Expert Comment

by:raybass
ID: 9939061
I experimented.  FIXMBR doesn't alter the partition table, just the MBR.  It leaves the partition table intact.  FIXMBR will not alter the readability of your data or your partition information

Here's a 60gig winxp hard drive's first sector.  I have no idea if the pre tag works or not on this website, I'll try it. apologizes if the spacing is all screwey..

<pre>
00000000  33 c0 8e d0 bc 00 7c fb  50 07 50 1f fc be 1b 7c  |3.....|.P.P....||     <--boot block begins
00000010  bf 1b 06 50 57 b9 e5 01  f3 a4 cb bd be 07 b1 04  |...PW...........|
00000020  38 6e 00 7c 09 75 13 83  c5 10 e2 f4 cd 18 8b f5  |8n.|.u..........|
00000030  83 c6 10 49 74 19 38 2c  74 f6 a0 b5 07 b4 07 8b  |...It.8,t.......|
00000040  f0 ac 3c 00 74 fc bb 07  00 b4 0e cd 10 eb f2 88  |..<.t...........|
00000050  4e 10 e8 46 00 73 2a fe  46 10 80 7e 04 0b 74 0b  |N..F.s*.F..~..t.|
00000060  80 7e 04 0c 74 05 a0 b6  07 75 d2 80 46 02 06 83  |.~..t....u..F...|
00000070  46 08 06 83 56 0a 00 e8  21 00 73 05 a0 b6 07 eb  |F...V...!.s.....|
00000080  bc 81 3e fe 7d 55 aa 74  0b 80 7e 10 00 74 c8 a0  |..>.}U.t..~..t..|
00000090  b7 07 eb a9 8b fc 1e 57  8b f5 cb bf 05 00 8a 56  |.......W.......V|
000000a0  00 b4 08 cd 13 72 23 8a  c1 24 3f 98 8a de 8a fc  |.....r#..$?.....|
000000b0  43 f7 e3 8b d1 86 d6 b1  06 d2 ee 42 f7 e2 39 56  |C..........B..9V|
000000c0  0a 77 23 72 05 39 46 08  73 1c b8 01 02 bb 00 7c  |.w#r.9F.s......||
000000d0  8b 4e 02 8b 56 00 cd 13  73 51 4f 74 4e 32 e4 8a  |.N..V...sQOtN2..|
000000e0  56 00 cd 13 eb e4 8a 56  00 60 bb aa 55 b4 41 cd  |V......V.`..U.A.|
000000f0  13 72 36 81 fb 55 aa 75  30 f6 c1 01 74 2b 61 60  |.r6..U.u0...t+a`|
00000100  6a 00 6a 00 ff 76 0a ff  76 08 6a 00 68 00 7c 6a  |j.j..v..v.j.h.|j|
00000110  01 6a 10 b4 42 8b f4 cd  13 61 61 73 0e 4f 74 0b  |.j..B....aas.Ot.|
00000120  32 e4 8a 56 00 cd 13 eb  d6 61 f9 c3 49 6e 76 61  |2..V.....a..Inva|
00000130  6c 69 64 20 70 61 72 74  69 74 69 6f 6e 20 74 61  |lid partition ta|
00000140  62 6c 65 00 45 72 72 6f  72 20 6c 6f 61 64 69 6e  |ble.Error loadin|
00000150  67 20 6f 70 65 72 61 74  69 6e 67 20 73 79 73 74  |g operating syst|
00000160  65 6d 00 4d 69 73 73 69  6e 67 20 6f 70 65 72 61  |em.Missing opera|
00000170  74 69 6e 67 20 73 79 73  74 65 6d 00 00 00 00 00  |ting system.....|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 2c 44 63  1a 76 05 31 cf c9 80 01  |.....,Dc.v.1....|    <-- boot block ends, partition table begins
000001c0  01 00 07 fe ff ff 3f 00  00 00 41 7c fc 06 00 00  |......?...A|....|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200
</pre>

Line 0 through line 1bd (the 14th character on the line 1b0) is all the master boot record.  It's the actual boot code windows wrote, it displays the error messages like "missing operating system" during boot.  After that is the partition table.  Each partition (there can be four) takes up 16 byes.  The last two bytes of the sector (55 AA) identify that sector as a partition block.

In the above example, the first partition is identified by the following 16 bytes:

80 01 01 00 07 FE FF FF 3F 00 00 00 41 7C FC 06

Taken byte by byte, this is what it means:

byte 1, "80" means it's bootable (00 would mean not-bootable (active))
byte 2, is the starting head
byte 3 and 4 are the sector/cylinder starting markers
byte 5, "07" is the type, NTFS (there are tables for what is what)
byte 6 is the ending head
byte 7 and 8 are the sector/cylinder ending markers
byte 9-12 tell where the boot sector for this partition is stores
byte 13-16 tell how many sectors large the partition is

I learned all the above from experimentation and the following web pages:

http://www.edm2.com/0603/drive.html
http://www.datarescue.com/laboratory/partition.htm

What's wrong with your drive is that those partition bytes are screwed up.  FIXMBR won't fix it, FIXBOOT won't fix it.  You can use DiskProbe to fix it, if you know exactly what data to enter in.  I recommend using linux fdisk still, though, because it will create it how it's supposed to be, per my above instructions.  It doesn't matter if the MBR is screwed up, because that's for booting only.  You only care about the 64 bytes that contain the partition table, specifically the first 16 of those.

good luck again.
0
 

Author Comment

by:jsabarese
ID: 9982926
i installed the windows support tools, (no prompt about diskprobe though... ?) and upon prompted reboot, XP (before the black, splash screen) "corrected" broken links on the drive (e: apparently) and now the drive is readable from the 10 gig, but it's showing a list of files (no extensions) 4kb each, showing some of the directories from the C: drive. what happened there?

and a quick question about what norton system works will do to the drive E...

when i ran Norton System Works. it of course has found an error on the disk. the exact text from Norton is as follows:
error on hard disk = an extended partition is invalid. An extended partition has invalid parameters and is probably inaccessible. correct this situation if you are unable to access partitions on hard disk. do you wish to correct this problem? (end of text)
i've used a utility, FinalData, to scan the disk and it is able to see the files and directories as i left them before i mucked it up w/ BootMagic. my question is-- if i proceed w/ the Norton fix, might it further jeopardize my data, or will it leave it intact?
i appreciate any advice on disk Dr. thanks.

due to time restrictions, i haven't yet tried raybass's suggestion.
0
 
LVL 14

Expert Comment

by:kronostm
ID: 9996523
I recommend using Symantec's software to correct the error. However, if you say that "FinalData" found your files, why don't you do a backup of what you need and only after that let NU repair the error.
I won't be back till next year, so Good Luck and a Happy new year to all of you


Kronos
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 11093610
PAQed, with points refunded (410)

Computer101
E-E Admin
0

Featured Post

Give your grad a cloud of their own!

With up to 8TB of storage, give your favorite graduate their own personal cloud to centralize all their photos, videos and music in one safe place. They can save, sync and share all their stuff, and automatic photo backup helps free up space on their smartphone and tablet.

Join & Write a Comment

Sometimes the best way to deal with an infected computer is to boot from external media and run your tools from there.  The reason you may wish to do this really depends on the infection.  Some malware is so recalcitrant that no matter what you do i…
Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now