help: hard drive lost ntfs partition

  • Thread starter Thread starter Mad Scientist Jr
  • Start date Start date
Mad Scientist Jr said:
Other than turning it on for a minute to get the chipset/driver I have
not touched the drive since the crash. Do any of you know how to use
the FindNTFS or similar utility to recover the partition? NTFS stores
backups of partition tables, right? I don't trust Norton to fix this.
Click to expand...

NTFS doesn't store a backup of the partition table (actually the MBR and
extended partition *sectors*) but it's relatively simple to rebuild the table
from scratch if you know how to assess the partitions geometry. There are
several tools for the purpose, most of them are free (including RESQ, for this
purpose).

NTFS stores a backup of the boot sector, though, as the last sector of the
partition, respectively.

Regards
 
Would TestDisk (http://www.cgsecurity.org) rebuild the partition table?


The problem I am having with FindNTFS is I have it output a list of
folders and files, but it is incomplete. For instance, "findpart all"
listed cylinder/head/sector 0, 1, 7, so I did
findntfs 5 0 1 7 file5017.txt files

which created a file that lists certain folders/files:

2005-02-27 23:50:58 <DIR> 10000000 myfolder1
2005-02-28 14:02:31 <DIR> 10000000 myfolder2
2005-03-07 23:50:18 <DIR> 10000000 myfolder3
2005-02-28 11:45:30 <DIR> 10000000 myfolder4
2005-02-28 12:44:19 <DIR> 10000000 myfolder5
2005-03-02 22:46:43 <DIR> 10000000 myfolder6
2005-02-28 13:37:47 <DIR> 10000000 myfolder7
2005-03-07 23:41:44 <DIR> 10000000 myfolder8

97691 mydata\myfolder1\
2004-11-22 20:47:50 8368128 00000020 file1.doc
2004-11-22 20:47:50 8368128 00000020 file2.doc
2004-11-22 20:48:22 8368128 00000020 file3.avi
2004-11-22 20:48:22 8368128 00000020 file4.doc

97685 mydata\myfolder2\
2004-12-05 00:41:09 28344 00000020 file5.doc
2002-11-10 11:14:44 14483456 00000020 file6.doc
2002-11-10 11:14:44 14483456 00000020 file7.doc
2002-11-10 11:14:44 14483456 00000020 file8.doc
2002-11-10 11:14:44 14483456 00000020 file9.doc

97680 mydata\myfolder7\
2004-11-22 19:55:37 8687616 00000020 file10.avi
2004-11-22 19:55:37 8687616 00000020 file11.wav
2004-11-22 19:55:59 8687616 00000020 file12.wav
2004-11-22 19:55:59 8687616 00000020 file13.wav

etc.

But while myfolder4, myfolder5 and myfolder6 appear in the list above,
they do not appear below broken out with files. And if I try generating
a dir list with

findntfs 5 0 1 7 dirs5017.txt dirs

those folders don't appear at all.

I tried searching sector 1 instead
findntfs 5 0 1 1 file5011.txt files
findntfs 5 0 1 1 dirs 5011.txt dirs

and the output files are about 1/2 the size of the sector 7 ones, and
are also missing the folders.

Also, when I try to do findpart copy, for some of the folders it
doesn't restore all the files, and for some it restores none,
outputting "no info":

Searching ... .

------Date ----Time -------Size ---Flags Name

61732 mydata\myfolder9\
2005-02-19 09:09:22 2498604 00000020 myfile14.wav No info
2005-02-19 09:11:30 2762796 00000020 myfile15.wav No info
2005-02-19 09:13:58 3203116 00000020 myfile16.avi No info
2005-02-19 09:19:00 2555948 00000020 myfile17.wav No info
2005-03-01 00:37:38 1552428 00000020 myfile18.aif No info
2005-03-03 15:01:52 1651756 00000020 myfile19.wav No info

Directories: 7650
Files: 134380
Trees: 25
Exe/dll files: 1963
Exe/dll files signature: 1952
Copied files: 0
Cluster KB: 4
MFT record used: None
Listed files MB: 102530

So it seems the folders I am trying to recover only exist in the files
list of sector 7. They are listed, so hopefully I am using findntfs
wrong or another tool can recover them. Maybe there is more information
stored elsewhere that can locate the particular directories.

Any more detailed help appreciated.
 
Back
Top