[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1058
  • Last Modified:

Deleted Partition and MBRWork is hung

After accidentally deleting a 40 GB FAT 32 partition on a 200 GB removeable hard drive while installing XP, I attempted to recover by running MBRWork. It's hard to find step-by-step instructions to use, but it seems that the sequence of things to do is
1) back up Track 1
2) Zero out the MBR
3) Zero out the EMBR
4) Recover MS Dos Partitions
5) Install standard partition code

After doing the first three steps, I started step 4 at 9:00 PM last night and as of 9:24 AM it is still running. This is the same thing that happened when I tried to run gpart - a linux tool. It is hard to believe it is taking that long to find the first partition.

Anyway, the first question is: how do I stop MBRWork from running without losing the MBR? it is now all zeros. And then the next question is: what to do from there?

Using the linux fdisk tool showed that the parttition starts at cylinder 1 and goes through cylinder 5099. Is this enough information to recover the partition? There was a second partition on the removeable drive, but the data it contains is unimportant. It wouldn't matter if it is overwritten.

When the partition is deleted by the XP installation procedure, does that mean that the FATs in the partition are gone too? Since I don't care about the anything after the first partition can I just resize it to something longer than 40 GB just to make sure that the linux fdisk tool and what Windows sees are the same thing?

Anyway, I need my data back. I will definitely give an A grade to anyone who can help me recover.

Thanks
0
parkhensley
Asked:
parkhensley
  • 9
  • 6
  • 2
2 Solutions
 
CallandorCommented:
Consider attaching this drive as a slave in another XP system.  Then use GetDataBack from www.runtime.org to analyze the drive and see if it can detect your files.  If it can, you will have to pay a small fee to purchase it so that you can save files, but it is one of the best data recovery programs available.
0
 
parkhensleyAuthor Commented:
Thanks. It's a removeable, why do I have to make it a slave in some other computer and I'm not sure that I can take any other computers offline soon enough. Also, I need to know how to stop MBRWork without making things worse. I would really like the answers to the other questions.
0
 
CallandorCommented:
I suggested setting it up as a slave in another computer so that the USB-to-IDE drive electronics are taken out of the picture.  In data recovery, you need the simplest interface possible to increase the chances of recovery.

I have never heard of MBRWork until now; it's not one of the better-known utilities for manipulating partitions (which should always be done with great care).  Parition Magic and Ranish are more well-known.
0
New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

 
parkhensleyAuthor Commented:
Partition Magic won't recognize the partition and the undelete option is grayed out. People also have a lot of problems with it. I agree with taking great care and that's why I need someone who knows something about MBRWork (so that if they know a way to stop it more safely than just turning off the machine) and can answer the other questions. I appreciate your response and have downloaded the program you mention, but am not going to do anything until someone responds about how to handle MBRWork as safely as possible.

Thanks,
0
 
garycaseCommented:
Are you sure MBRWork is still running?   The Terabyte utilities are good at what they do; but many do not work well with external USB drives.  (for example, my favorite utility -- Boot-It NG -- only works with USB v2.0;  I have to use Image for DOS if I'm working with a USB v1.1 device)

In any event, it's safe to simply hit the reset switch (or hold the power button until the system powers off).   Remember what your first 3 steps already did:  zeroed out the MBR/EMBR.   So there's no MBR to lose at this point.

While you've already gone a bit beyond it, you should remember the 1st (& 2nd, & 3rd, ...) rule of data recovery:  STOP !!    Do not do anything that writes to the drive.   There are many good utilities that will analyze the drive without writing to it; and will recover data to ANOTHER drive.  Callandor has already suggested what I consider the best:  GetDataBack from www.runtime.org

In addition, listen to what Callandor said about connecting the drive directly to an IDE controller (or SATA channel, depending on what kind of drive it is).   The external drive interface electronics can definitely interfere with the ability to recover your data.   Won't hurt to just try GetDataBack with the external enclosure (it won't write anything to the drive); but the probability of success is better with a direct connection.

To answer your question r.e. "... When the partition is deleted by the XP installation procedure, does that mean that the FATs in the partition are gone too? " ==>  It depends on how far into the XP install procedure you went.   If you simply deleted the partition, it would only write out the new MBR descriptors.   If you continued and created a new partition, then the formatting process for that partition would wipe out all of the current allocation tables.
0
 
parkhensleyAuthor Commented:
After 16 hours of running, MBRWork has finally returned to my control - it does have information for the partition 0:
0 15 63 1022 f 15 63 1022 67103505 10233405. Does this look right for what is the first partition on the drive. My understanding for modern drives is that they use LBA and that the last two numbers are the beginning sector and the number of sectors of the partition. Is that right? If these are hex numbers then that would mean the partition begins 4 times beyond the end of my physical hard drive and extends for another 140 GB.

Please tell me I am wrong in my interpretation of these numbers.

Anyway, since control has returned, I have the option of restoring the first track or accepting this result and installing the standard mbr code.

Again, since control has returned to me, I want to know what to do before exiting MBRWork.

Thanks
0
 
garycaseCommented:
They're not hex numbers.   Your 200GB hard drive has approximately 390,625,000 blocks, so a partition that starts at block number 67,103,505 is reasonable.   And 10,233,405 blocks is just over 5GB -- so it's nowhere near extending beyond the end of the drive.

However, the numbers are not correct for a 40GB partition.   They MAY correctly reflect what data was found with a FAT32 allocation structure, however.   Interestingly, the partition "starts" about 34GB into the disk -- the sum of this plus the indicated size (5GB) is about the 40GB you said it should be.   Makes me wonder if the XP install overwrote a good bit of the partition.

My thought on this is as follows:   You can always rerun MBRWork and get the same results (yes, it would take 16 more hours; but you could do this overnight).   So ... since the results do not match a 40GB partition, I'd restore Track 1 to its original state and either run GetDataBack OR (better) hook the drive to an internal controller and run GetDataBack.  Note there are two versions of GetDataBack - one for FAT and one for NTFS (you need the FAT version of course).    How much data was there on the partition you deleted?  (any chance the 5GB or so that MBRWork found is actually correct for your actual data?)    If GetDataBack does not find your data, then I'd re-run MBRWork and go ahead and accept the 5GB partition it found -- especially if that sounds about right for the actual amount of data you need to recover.
0
 
parkhensleyAuthor Commented:
We're getting close. The first track as restored by MBRWork now starts:

0  1  1  0  7 254  63  1023  63  81915372

and that last number is about 40 GB if I use the GB/Block ration given by garycase. Can these be the right values? It does seem more logical to me that the partition would start at that small a value. If they are, do I still need a paid recovery tool (which I am willing to do), or can something simple like fdisk just write these values to the mbr? And everything's hunky-dory.

Thanks
0
 
garycaseCommented:
There's nothing magic about computing the size -- each allocation block is simply one sector (512 bytes); so you simply multiply the number of allocation blocks times 512 to get the size of the partition.

Those numbers do look good -- what does the disk "look like" in XP??   Go to Disk Management and see what it shows for the current partition structure.   But DON'T change anything.

I have not tried this, but others have said it works pretty well -- and especially since your disk does not have any physical issues, it may be worth a try:  http://www.pcinspector.de/file_recovery/uk/faq.htm
It's (a) free, and (b) does not write to the disk you're recovering from, so it should be safe to try.

Alternatively, you COULD simply write those numbers to the MBR.   I would suggest that if you do this, you first backup the current MBR so you can restore it if necessary.   If the XP install did not do anything else except delete the MBR entries, this will - as you noted - simply make everything "hunky-dory."


0
 
parkhensleyAuthor Commented:
Disk management now reports - this is not what it showed previously - a healthy 4.88 GB partition starting 39 GB into the disk drive (what you were talking about previously) and it even gave it a drive letter, which it didn't do before. I still don't trust it. I like the numbers from MBRWork better. I can read from it, but there are only a couple of unimportant files in there. What do you suggest? How do I back up the MBR?
0
 
garycaseCommented:
There are several freeware utilities that will let you save and restore the current MBR.

I've used this to save copies of the MBR for my systems:  http://www.diydatarecovery.nl/mbrtool.htm
(fortunately, except for testing, I've never had to actually restore one)

I've not used the editing features - but I'm sure they work.   You could (a) Save the current MBR; then (b) carefully modify the MBR to add the partition parameters from MBRWork; and (c) if that doesn't work restore the MBR.   CAVEAT:  I do not know if this tool works with USB external drives.   As I noted before, if possible it would be much better to have this drive connected directly to an internal controller.

0
 
parkhensleyAuthor Commented:
Thanks, I have downloaded the tool, but it's going to take a while to read the manual. I'll respond after trying it out.
0
 
parkhensleyAuthor Commented:
It seems that I won't be able to back up the mbr to file and I'm not sure that I want to do it to sector. All drives are  formatted as NTFS 5 and when booting in real mode, they will not be available. Unless you have a work-around.
0
 
parkhensleyAuthor Commented:
All the internal drive partitions are ntfs, that is. How big is the backup? If not too big, could it be written to file on the boot floppy?
0
 
garycaseCommented:
The backup is just a sector -- it will easily fit on a floppy.
0
 
parkhensleyAuthor Commented:
I downloaded  http://www.pcinspector.de/file_recovery/uk/faq.htm. As far as I can see it only retrieves media files, pictures and so on. It requires you to enter a media format (jpg, gif, etc.). I don't see how to make it work on my drive. It's not pictures I want, but Excel spreadsheets, docs, email and other sorts of data.
0
 
garycaseCommented:
Well, as I noted, I had not used it.   Guess it's not much use here.  I would download GetDataBack and run it against your drive to see what it can recover.   IF it "sees" all of the files you want, the simplest and safest thing to do here is just buy a license for it.  http://www.runtime.org/products.htm
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

  • 9
  • 6
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now