deleted mbr,boot sector

poster · May 22, 2009

so the primary HDD FAT partition cannot be found(appears unallocated)
any more
(lost &found recovery software used to copy the files,said: master
partition and boot sectors deleted)
Rebuilt MBR and partition table in Partition table doctor software but
still same (actually now it reports first partition free)
Active partition recovery,Norton Disc doctor- no help so undid their
changes
Any ideas please?

poster · May 25, 2009

As mentioned by another poster, see if the recovery software has an option
to restore directories. Directories in FAT and FAT32 partitions are stored
in a fashion similar to files and sometimes can be recovered intact, evenif
the root directory entry is missing.

Ben

No none of sotwares restore dirs although they find them because fat
is probably ok
After rebuilding partition table in PTD software I got first still
unallocated but now the second partition became visible in dos
however it is marked with c: which is wrong!
I cant create again the first partition because that will destroy its
data so I need to just put a 100% correct entry for it in the
partition table + maybe boot sector code( mbr code should be there
because I did MBR repair) -how do you do that in Disk editor or can
one try SPFdisk 2000/MBR repair?

poster · May 26, 2009

If directories are being found, the right software might be able to
restore them.

http://www.google.com/search?hl=en&q=dos+directory+recovery&aq=f&oq=&...

Try using Fdisk to make sure the first partition is set to "Active".
If it isn't, change it.

If DOS is assigning a drive letter to the partition, you might try using "sys.com"
to restore the boot sector, for example "sys d:".

Ben

it is- however it assigned c: to what was previously d:
(but it is an idea make that one bootable install win in it and use
some more powerful win based software(instead of the one from bootable
cd)to recover the previous c:

)

thanatoid · May 26, 2009

oups.com:

<SNIP>

Sorry, I'm too lazy to read the whole thread and I don't know
that much about boot sectors, but if you need to recover
partitions and directories which seem to have disappeared,
testdisk is amazing. Google.

poster · Jun 1, 2009

as mentioned deleted mbr and part table
on hdd with part1-fat32 and partition2-fat16

so part1 not visible in dos any more

To make it visible and bootable using Norton Disk editor,confirm
please?

-need to input first entry in part table of the physical hard disk
with start/end head.sector.cyl and partition1 size which should
be=size_in_KB*2 ,

(counting in some reserved sectors is not necessary even though
part1 is primary)

-need to input appropriate info in boot sector of part1(sector 0 only):
8 sect per cluster, file sys id=Bh...

-need to refresh mbr and boot sector code for part1

poster · Jun 2, 2009

as mentioned deletedmbrand part table
on hdd with part1-fat32 and partition2-fat16

so part1 not visible in dos any more

To make it visible and bootable using Norton Disk editor,confirm
please?

-need to input first entry in part table of the physical hard disk
with start/end head.sector.cyl and partition1 size which should
be=size_in_KB*2 ,

(counting in some reserved sectors is not necessary even though
part1 is primary)

-need to input appropriate info in boot sector of part1(sector 0 only):
8 sect per cluster, file sys id=Bh...

-need to refreshmbrand boot sector code for part1

ndd usually makes more damage than good
update:

did said but for physical hdd advanced recovery when input- start
side.sector.cyl=1.0.1 and end s.s.c=part2start-1 ,with sectors/
cluster=32 you get fat32 as it should be but then virtual disk button
does not display data but message-inconsistent sec/cluster given 16
derived 8, however when you change the value to 8 still no
data.Inputting sec/cluster=64 gives fat16but then virtual button takes
you to sector 263 with no data in it.Perhaps Boot sector info and
partition table need to be repaired before using advaced recovery and
disk virtualisation??

(however backup boot record in sector 6 is gone as well)

Maxim S. Shatskih · Jun 2, 2009

I would scan the whole disk using some tool (dd+grep in Linux or such) to find some signature of the boot sector - "FAT" or "NTFS" or "MSDOS" (forgot what one is actually used).

Then look at the found sector in NDD to determine whether this is a valid boot sector. Then you know the position of the boot sector (volume start) and volume size, and you can create the MBR entry manually based on this data.

CHS values in MBR entries are _not_ used by modern OSes - Windows and Linux at least - since early 2000ies at least. They are properly written by the partitioning tools though, and are used by MS DOS.

poster · Jun 3, 2009

On many disks, the start address for the first partition is cylinder 0, head 1,
sector 1. Also, zero is not a valid entry for the sector field and DOScan't
handle a partition which starts on something other than sector 1.

See if this is helpful.

http://support.microsoft.com/kb/192322

See if the software you are using has an option to search for boot sectors,
since it's possible that the partition starts at a non-standard address.

Ben

actually first problem is making a partition visible in ne

poster · Jun 4, 2009

actually first problem is making a partition visible in ne

played with numbers a bit and voila partition data showed up
now how do you go about copying it to another place- when you edit/
mark the folder it copies just the list of files in it?(NDE clipboard
is only 4KB)

poster · Jun 4, 2009

actually first problem is making a partition visible in ne

played with numbers a bit in nde and voila partition data showed up
now how do you go about copying it to another place- when you edit/
mark the folder it copies just the list of files in it?(NortonDisk
Editor clipboard is only 4KB)

poster · Jun 13, 2009

If you are referring to a Norton Disk Editor feature, you probably should
start a new thread or post in a Norton forum.

http://community.norton.com/norton/board?board.id=other

If not, I suggest you back up the existing partition table, then write the
new data to it, restart the computer and see if you have access to the
missing files and folders.

Ben

ok but
does anyone know how does norton d.e. access files with advanced
recoverz mode-is it using fat tables?Also confirm please-boot sector
info that needs to be input in sector 63 is for the first partition
and not for the hard disk as a whole

Pennywise · Jun 17, 2009

poster said:
ok but
does anyone know how does norton d.e. access files with advanced
recoverz mode-is it using fat tables?Also confirm please-boot sector
info that needs to be input in sector 63 is for the first partition
and not for the hard disk as a whole

I'm very fimilar with Norton Disk Edit, it defaults to read only you
have to turn editing on (it's a safety feature).

Your boot sector or MBR is on the first sector of the hard drive and
holds all of your partition information not just the first one.
http://en.wikipedia.org/wiki/Master_boot_record

Haven't followed the entire thread, but play around with Disk Edit,
you can't do any harm, until you change it's config to allow edits.
It's how I learned how to use it. - I recovered one of my hard drives
with it a long time ago and swear by it now - but it took a lot of
playing around to find the problem.

Jurjen Oskam · Jun 17, 2009

Your boot sector or MBR is on the first sector of the hard drive and
holds all of your partition information not just the first one.
http://en.wikipedia.org/wiki/Master_boot_record

The MBR doesn't hold all of the partition information. There's only room
for four partition table entries in the MBR. To be able to create more
partitions, a partition table entry in the main MBR can be set to type
"Extended" and point to a section of the disk where *another* MBR is
located. That other MBR has one partition table entry describing a
partition (called an "extended partition" by the OS) and optionally
another partition table entry of type "Extended" pointing to yet
another MBR, and so on.

In short: almost all information about any extended partitions *isn't*
stored in the main MBR.

Pennywise · Jun 17, 2009

The MBR doesn't hold all of the partition information. There's only room
for four partition table entries in the MBR. To be able to create more
partitions, a partition table entry in the main MBR can be set to type
"Extended" and point to a section of the disk where *another* MBR is
located. That other MBR has one partition table entry describing a
partition (called an "extended partition" by the OS) and optionally
another partition table entry of type "Extended" pointing to yet
another MBR, and so on.

In short: almost all information about any extended partitions *isn't*
stored in the main MBR.

Wow, news to me, never heard of the EBR before, but in my defense it's
still located on the first sector

http://en.wikipedia.org/wiki/Extended_boot_record
(good info at this link)

As for recovering my hard drive I should mention that I had run
DISKMAP.EXE from the NT resource kit, something I do just in case.

So I had the numbers to rebuild my partitions (extended as well), The
OP is going to have a bit more math to do than I did, Disk Edit will
help on this but it's a rough ride.

deleted mbr,boot sector

poster

poster

poster

thanatoid

poster

poster

Maxim S. Shatskih

poster

poster

poster

poster

Pennywise

Jurjen Oskam

Pennywise