Help! MBR wiped out

  • Thread starter Thread starter Madhur Ahuja
  • Start date Start date
M

Madhur Ahuja

Hello
While working other day on my PC, I accidentally typed this command
dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
have been
hdb3 which is my linux boot partition.
As probably you know , this has completely wiped my MBR.

On my friend's PC, the drive shows the status as RAW partition.
I think I can save my data by entering correct partition table in MBR
and I want
you to help me.
Firstly my partition table looked like this:

1 FAT32(primary) 7 GB
2 /boot(primary) 200 Mb
3 ntfs 10 gb (logical)
4 ntfs 10 gb (logical)
5 ntfs 10 gb (logical)
6 / 5 gb
7 /swap 500 mb


I think I can build the exact partition table by looking the disc
sectors in hex and identifying the location of starting boot sector of
each partition.
The problem is that I cant view my disc sectors as hex, since it shows
my disc as RAW.

Is there any utility which can scan the hard disc and tries to build
the partition table. Or do i have to do it manually.

Any help would be appreciated.
 
Madhur Ahuja said:
Hello
While working other day on my PC, I accidentally typed this command
dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
have been
hdb3 which is my linux boot partition.
As probably you know , this has completely wiped my MBR.

On my friend's PC, the drive shows the status as RAW partition.
Click to expand...

Normally you'd expect NO partitions if the MBR was wiped, not a RAW
partition.
I think I can save my data by entering correct partition table in MBR
and I want
you to help me.
Firstly my partition table looked like this:

1 FAT32(primary) 7 GB
2 /boot(primary) 200 Mb
3 ntfs 10 gb (logical)
4 ntfs 10 gb (logical)
5 ntfs 10 gb (logical)
6 / 5 gb
7 /swap 500 mb
Click to expand...

That isn't accurate enough.
I think I can build the exact partition table by looking the disc
sectors in hex and identifying the location of starting boot sector of
each partition.
The problem is that I cant view my disc sectors as hex, since it shows
my disc as RAW.
Click to expand...

Even a RAW disk can be viewed when you access the physical disk.
Is there any utility which can scan the hard disc and tries to build
the partition table.
Click to expand...

Our tool DiskPatch can do that.

--
Joep

D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.
CHK-Mate - automated CHK file analysis & recovery
 
Hello
While working other day on my PC, I accidentally typed this command
dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
have been
hdb3 which is my linux boot partition.
As probably you know , this has completely wiped my MBR.
Click to expand...

That Linux dd command would not wipe the MBR, but write a file boot.b.
 
Hello

This is the output of findpart v 4.45 on my hard disk. I have
been able to recover my c: partition.
As I told, my structure of partition is as follows:

1 FAT32(primary) 7 GB
2 /boot(primary) 200 Mb
3 ntfs 10 gb (logical)
4 ntfs 10 gb (logical)
5 ntfs 10 gb (logical)
6 / 5 gb
7 /swap 500 mb

I am currently know trying to locate my extended partition boot
sector and trying to read further tables.
If anyone can help me with the findpart output, I will be very
grateful.


Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.1.2600

Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0B 63 15454466 7546 0 1 1 961 254 62 B OK
962 2 05 0 23069340 11264 988 0 1 2423*254 63 988 OK
962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
Lilo sector 962 1 1
988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 988 OK
Lilo sector 988 0 1
0 - 07 15872283 23069277 11264 988 1 1 2423 254 63 B OK
2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 988 OK
0 - 07 38941623 19374327 9460 2424 1 1 3629 254 63 B OK
3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 988 OK
0 - 07 58316013 9446157 4612 3630 1 1 4217 254 63 B OK
4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 988 OK
4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK
Fdisk F6 sector 4806 1 1

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 15063 4 2 15063 0 0 0 000102 5667

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 15520002 7578 0 1 1 961 254 63 NB NB
0 1 1 966 20 15 Actual
0 2?83 63 417628 203 962 1 1 988 254 63 NB NB
0 1 1 26 0 1 Actual
0 3 0F 9847845 68388705 33392 613 0 1 4869*254 63 OK

No signature CHS: 613 0 1
 
Hello

This is the output of findpart v 4.45 on my hard disk. I have
been able to recover my c: partition.
As I told, my structure of partition is as follows:

1 FAT32(primary) 7 GB
2 /boot(primary) 200 Mb
3 ntfs 10 gb (logical)
4 ntfs 10 gb (logical)
5 ntfs 10 gb (logical)
6 / 5 gb
7 /swap 500 mb
Click to expand...

That is more than the disk size.
I am currently know trying to locate my extended partition boot
sector and trying to read further tables.
If anyone can help me with the findpart output, I will be very
grateful.


Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.1.2600

Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0B 63 15454466 7546 0 1 1 961 254 62 B OK
962 2 05 0 23069340 11264 988 0 1 2423*254 63 988 OK
962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
Lilo sector 962 1 1
988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 988 OK
Lilo sector 988 0 1
0 - 07 15872283 23069277 11264 988 1 1 2423 254 63 B OK
2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 988 OK
0 - 07 38941623 19374327 9460 2424 1 1 3629 254 63 B OK
3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 988 OK
0 - 07 58316013 9446157 4612 3630 1 1 4217 254 63 B OK
4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 988 OK
4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK
Fdisk F6 sector 4806 1 1

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 15063 4 2 15063 0 0 0 000102 5667

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 15520002 7578 0 1 1 961 254 63 NB NB
0 1 1 966 20 15 Actual
0 2?83 63 417628 203 962 1 1 988 254 63 NB NB
0 1 1 26 0 1 Actual
0 3 0F 9847845 68388705 33392 613 0 1 4869*254 63 OK

No signature CHS: 613 0 1
Click to expand...

The extended partition seems to be at cylinder 988 numbered from 0. If
you edit the entry, I suggest you initially make the entry type 85
(Linux extended) in stead of 0F so you can verify that the extended
partition tables are correct without confusing Windows in the case
that they are wrong.

The entry for the FAT32 partition (N 1) is wrong, since the number of
sectors is too large. The entry for the partition should end at a
cylinder boundary, so the entry should define a partition 1 sector
larger than the actual partition.

The entry for the ext2 partition (N 2) is wrong too. It currently
defines a partition at the same location as the FAT32 partition, since
the relative entry is too small. Also the active byte is not zero.

You should not use other persons email addresses.
 
Svend Olaf Mikkelsen said:
[...]
Click to expand...

Thank you very much svend!. Problem solved and data recovered.
I am grateful to you since you have helped me a lot in this
troublesome situation.

I made just one correction in primary table and all the drives
were instantly available. I think this is because I messed up
only primary partition table.

However there is small problem with my linux /boot partition.
Computer management shows 3 gb of unallocated space outside of
extended partition.

Here is the final output of find part:

Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 4.10.2222

Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0B 63 15454466 7546 0 1 1 961 254 62 B OK
962 2 05 0 23069340 11264 988 0 1 2423*254 63 988 OK
962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
Lilo sector 962 1 1
988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 988 OK
Lilo sector 988 0 1
0 - 07 15872283 23069277 11264 988 1 1 2423 254 63 B OK
2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 988 OK
0 - 07 38941623 19374327 9460 2424 1 1 3629 254 63 B OK
3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 988 OK
0 - 07 58316013 9446157 4612 3630 1 1 4217 254 63 B OK
4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 988 OK
4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK
Fdisk F6 sector 4806 1 1

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 15063 4 2 15063 0 0 0 000102 5667

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 15454467 7546 0 1 1 961 254 63 NB OK
0 2 0F 15872220 62364330 30451 988 0 1 4869*254 63 OK
0 3 83 9163136 417627 203 962 1 1 987 254 63 NB NB
570 96 39 596 95 38 Actual

988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 OK

2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 OK

3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 OK

4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 OK

4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK

and my partition table is this:

00000000h: 80 01 01 00 0B FE FF C1 3F 00 00 00 03 D1 EB 00
00000010h: 00 00 C1 DC 0F FE FF FF DC 30 F2 00 AA 9A B7 03
00000020h: 00 01 C1 C2 83 FE FF DB 80 D1 8B 00 5B 5F 06 00
00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

You should not use other persons email addresses.
Click to expand...

What email address are you talking about! or is this your signature.
 
Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 4.10.2222

Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
Click to expand...
962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
Click to expand...
Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 15454467 7546 0 1 1 961 254 63 NB OK
0 2 0F 15872220 62364330 30451 988 0 1 4869*254 63 OK
0 3 83 9163136 417627 203 962 1 1 987 254 63 NB NB
570 96 39 596 95 38 Actual
Click to expand...

The entry for the Linux partition still is wrong here. If you now
afterwards have an OK in the "BS" and the "CHS" field for the Linux
partition, the entry should be correct.

The "NB" for the FAT32 partition is OK, since the actual partition
space is 1 sector smaller.
What email address are you talking about! or is this your signature.
Click to expand...

You will have to look at the from field in all your messages in this
thread to figure out.
 
Previously Madhur Ahuja said:
Hello
While working other day on my PC, I accidentally typed this command
dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
have been
hdb3 which is my linux boot partition.
As probably you know , this has completely wiped my MBR.
Click to expand...

Huh? This overwrites the file /boot/boot.b with the first 512 bytes
of /dev/hdb! It does not have any effect on the MBR.

Do you mean the same command with the parameters to 'if' and 'of'
exchanged?

Arno
 
Arno Wagner said:
Huh? This overwrites the file /boot/boot.b with the first 512 bytes
of /dev/hdb! It does not have any effect on the MBR.

Do you mean the same command with the parameters to 'if' and 'of'
exchanged?

Arno
Click to expand...

Yes Arno! I have pointed this earlier in the thread.
But the issue is resolved now. I have posted the solution in the thread.
 
Svend Olaf Mikkelsen said:
You will have to look at the from field in all your messages in this
thread to figure out.
Click to expand...

They both are my email ids. Although (e-mail address removed) is just a spoof one to
avoid spam.
 
Yes Arno! I have pointed this earlier in the thread.
But the issue is resolved now. I have posted the solution in the thread.
Click to expand...

Sorry, did not see it in time.

Arno
 
Back
Top