Forum: Geek Forum
Topic: Data Recovery
started by: Observer
Posted by Observer on Oct. 22 2001,15:08
Ok, so I was stupid and in the course of trying to copy one drive to another, wiped the wrong drive. Partition Magic has a "Partition Undelete" feature, but doing that has given me some memory access violation errors. I also tried the trial version of Norton Utilities, but the tool I needed was not there.

Anyway, is there a tool I can use to re-write the partition table with what should be there? The drive had (should have) one primary FAT32 partition.

------------------
When 1337 hax0rs start impaling each other with swords and typing code with a hook on one hand, then they can modify the term "pirate."

Posted by just_dave on Oct. 22 2001,16:46
maxtor makes a program called max blast.. available on their site that copys total partitions it like formats the new drive then copys everything from the other drive... sorta like drive imaging if that helps.

This message has been edited by just_dave on October 23, 2001 at 11:49 AM

Posted by Beldurin on Oct. 22 2001,18:02
Yeah, but I don't think MaxBlast is a data recovery program.

------------------
Give me ambiguity or give me something else...

Posted by damien_s_lucifer on Oct. 22 2001,18:06
Norton Utilities has a sector editor stashed somewhere. If you can find your way around hex codes, you can use it to rebuild your partition table manually.
Posted by EvilGenius on Oct. 22 2001,20:23
beat the computer sensless with a stick, and scream obscenities at it until you pass out... it's what i do.. albeit it doesn't work to well.
Posted by Observer on Oct. 22 2001,20:53
Now all I would need is where to put what values.

------------------
When 1337 hax0rs start impaling each other with swords and typing code with a hook on one hand, then they can modify the term "pirate."

Posted by damien_s_lucifer on Oct. 23 2001,04:42
I only dug this up because, er, anyone who is willing to use a sector editor to fix a busted MBR deserves it.

code:

                 Disk Partition Table (Fixed disk boot record)
       Offset       Represents:  (see format below)
        01BE        Partition 1 data table  (16 bytes)
        01CE        Partition 2 data table  (16 bytes)
        01DE        Partition 3 data table  (16 bytes)
        01EE        Partition 4 data table  (16 bytes)
        01FE        Signature  (hex 55 AA, 2 bytes)
        Offset from beginning of partition data shown above:
      Offset Size               Description
        00   byte   boot indicator
        01   byte   beginning sector head number
        02   byte   beginning sector (2 high bits of cylinder #)
        03   byte   beginning cylinder# (low order bits of cylinder #)
        04   byte   system indicator
        05   byte   ending sector head number
        06   byte   ending sector (2 high bits of cylinder #)
        07   byte   ending cylinder# (low order bits of cylinder #)
        08   dword  number of sectors preceding the partition
        0B   dword  number of sectors in the partition

        Boot indicator (BYTE)
        00  - non-bootable partition
        80  - bootable partition (one partition only)

        System Indicator (BYTE)
        00 - unknown operating system
        01 - DOS with 12 bit FAT, 16 bit sector number
        02 - XENIX
        04 - DOS with 16 bit FAT, 16 bit sector number
        05 - DOS Extended partition (DOS 3.3+)
        06 - DOS 4.0 (Compaq 3.31), 32 bit sector number
        51 - Ontrack extended partition
        64 - Novell
        75 - PCIX
        DB - CP/M
        FF - BBT

        Signature
        Hex 55AA marks the end of valid boot sector.     This is also
        required in each of the partition boot records.

        Sector/Cylinder
        2 bytes are combined to a word similar to INT 13:
        „ 7„ 6„ 5„ 4„ 3„ 2„ 1„ 0„  1st byte  (sector)
         „  „  „¤„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„Ÿ Sector offset within cylinder
         „¤„Ÿ„¨„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ High order bits of cylinder #
        „ 7„ 6„ 5„ 4„ 3„ 2„ 1„ 0„  2nd byte  (cylinder)
         „¤„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„¨„Ÿ„Ÿ„Ÿ„Ÿ„Ÿ Low order bits of cylinder #

        - all partitions begin on sector 1 head 0, except the first
          partition which follows the disk's master boot record and begins
          in sector 2
        - some of this information may vary with some variants of DOS 3.2
          and DOS 3.3 that use their own sectoring scheme for large disks
        - see  INT 21 subfunction 32;  Disk Partition Table

The partition type for FAT32 is hex 0C.

AFAIK, DOS / Windows completely ignore the beginning and ending track (they call it a "cylinder") / head / sector information and only use the starting sector and partition length in sectors. Look in CMOS for the number of sectors per track; that *should* be the value for "# of sectors preceding the partition." If you paritioned the entire drive, the length in sectors should be total * of sectors (CMOS Tracks * CMOS Heads * CMOS Sectors per Track).

I hope you didn't use fdisk to try and re-create the partition... if so, you'll have to write out a new boot sector as well. I don't have anything on FAT32 boot sectors.

Posted by Observer on Oct. 23 2001,14:21
Nope, just deleted the partition by accident, nothing further written to the drive. Thanks for the info. Hopefully I'll be able to put it to some use.

------------------
When 1337 hax0rs start impaling each other with swords and typing code with a hook on one hand, then they can modify the term "pirate."

Posted by just_dave on Oct. 24 2001,05:22
Sorry for my stupidty, I read his post quickly, I didn't realize the part where he said "WRONG" drive ... hehe my bad..

sorry
/me hangs his head in shame

Posted by Observer on Oct. 24 2001,11:10
Update: I believe that I have found a viable alternative to sitting down with a large cup of coffee and a sector editor. Apparently the Linux fdisk utility is able to modify the MBR without touching the actual partitions. Found a nice "Linux on a floppy" < here > for just that purpose.

------------------
When 1337 hax0rs start impaling each other with swords and typing code with a hook on one hand, then they can modify the term "pirate."

Posted by askheaves on Oct. 24 2001,13:18
Are you sure the 2K recovery mode doesn't have an MBR repair? Don't know how useful it would be since I've never roasted the wrong drive before, but still.
Posted by Observer on Oct. 26 2001,03:53
Win2k's recovery console can repair a damaged mbr signature. Mine was undamaged, just empty.

Anyway, Linux fdisk worked for me. Just had to redefine the partition and write the mbr back to the disk. The difference between this one and the DOS fdisk is that the DOS version wipes the first block of the partition (so that Format works properly) when creating a new one.

And an OS on a floppy is just cool.

------------------
When 1337 hax0rs start impaling each other with swords and typing code with a hook on one hand, then they can modify the term "pirate."

Powered by Ikonboard 3.1.4 © 2006 Ikonboard