Look for filename in drive without valid MBR

[Rod Speed]

Rod Speed wrote in news:[email protected]

Rod Speed wrote in Rod Speed wrote

I had three partitions on a drive that had a hardware
failure and now can't be read by Windows. The only files I
really care about are *.tax. What utility will let me
search for them and copy to a working drive? [snip]
Thanks! While I understand the advice to work from a copy of the
damaged drive, I am almost overwhelmed by the urge to do
something right now. Would I be likely to make things worse by
pressing the "Reconstruct current partitions" button on the
Partition analysis screen?

Very likely.

Such confidence in the duff guys sof(t)ware.

Nothing to do with the software, everything to do with the state of
the drive.

Makes a lot more sense to clone it first before attempting to do
anything else.

Right, much better killing it for sure by trying to get all that you
don't really need in a very trying process than trying to get the
few bits that you really need in a jiffy by repairing the minimum.

Reconstructing current partitions is nothing like repairing the
minimum.

Of course it is.
Pathetic.

And who said anything about "Reconstructing current partitions".

The poster, ****wit.

Just reconstructing the MBR.

Wasnt what was being discusssed, ****wit.

If the partition boot records are still in tact, then that's
dead easy and minimal effort and strain on the drive.

Pity that wasnt what was being discusssed, ****wit.

 

[Bob Simon]

Operating the drive before imaging it is a very bad idea,
since it may suffer additional damage. Waif for the new drive,
imagie the old one. And then start messing around. Not before.

Arno

I'm the OP and I'm back after having installed a new drive, imaged the
bad drive and then removing power from the bad drive. Now I'm ready
to try to reconstruct whatever I can from the image and am looking for
some pointers.

For tools, I have UBCD plus the program that Michael wrote,
cnwrecovery. I compared the current partition map with an old
printout from Ranish Partition Manager and they match. Here's a
section from RPM:
2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
3 Pri 2 Extended LBA 255 0 1 15770 254 63
4 A Log Windows NT NTFS 255 1 1 15770 254 63
5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63

Why is partition 4 listed as A Log? I'm pretty sure this is where the
data is that I really want to find.

 

[WarOfMars]

You can try Stellar Phoenix Windows Data Recovery Software. It is a
partition recovery utility which recovers lost data from FAT 16, FAT
32, NTFS, NTFS5 file system. Stellar Phoenix is helpful in recovering
data from formatted hard drive or data lost due to software
malfunction, viruses or even sabotage.
Demo version can be downloaded from: http://www.stellarinfo.com/partition-recovery.htm

 

[Arno Wagner]

On 6 Jan 2008 08:21:19 GMT, Arno Wagner <[email protected]> wrote:

I'm the OP and I'm back after having installed a new drive, imaged the
bad drive and then removing power from the bad drive. Now I'm ready
to try to reconstruct whatever I can from the image and am looking for
some pointers.

For tools, I have UBCD plus the program that Michael wrote,
cnwrecovery. I compared the current partition map with an old
printout from Ranish Partition Manager and they match. Here's a
section from RPM:
2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
3 Pri 2 Extended LBA 255 0 1 15770 254 63
4 A Log Windows NT NTFS 255 1 1 15770 254 63
5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63

Why is partition 4 listed as A Log? I'm pretty sure this is where the
data is that I really want to find.

"Log" very likely means "Logical Partition".

The above would be primaries 1,3 and a logical contained in
primary 2, which is an extended patition,. i.e. a container
for logical partitions.

Arno

 

[mscotgrove]

"Log" very likely means "Logical Partition".

The above would be primaries 1,3 and a logical contained in
primary 2, which is an extended patition,. i.e. a container
for logical partitions.

Arno

The partition function in my program will give the size of each
partition, and the starting location. If it needs to be
reconstructed, thye reconstruction routine will scan the drive looking
for possible starts, and where possible using values from pointer
blocks.

A lot of commercial PCs, such as Dell and Sony start a disk with a
short - often FAT - hidden partition that is used for recovery. The
data is then on the second logical partition.

Once a partition has been selected for recovery, for logical recovery
my NTFS function does require valid values for cluster size and the
start of the MFT. There are helper functions for each of these.
(Analyse disk...)

As you now have an image, you can make as many mistakes as you like,
and will not lose more data. For a partially damaged drive, the most
successful function to use with NTFS recovery is 'Recover from file
entries' This will read each MFT in sequence, rather than trying to
read with the logical directory tree. Thus, if a critical part of the
directory tree has failed, files will still be found with valid
names. If the MFT structure is damaged, the whole disk can be scanned
for MFTs.

On the NTFS screen is a function for file filter - this can be use to
select just your .tax files.

Function key F1 will give contect sensitive help on every screen

Michael

 

[bobneworleans]

"Log" very likely means "Logical Partition".

The above would be primaries 1,3 and a logical contained in
primary 2, which is an extended patition,. i.e. a container
for logical partitions.

Arno

Does this mean that when I attempt to recover a file in the logical
NTFS partition, whatever software I'm using will automatically
rebuild the container first? Or is this typically a two-step process
where I must first re-create the extended partition, then the NTFS
partition?

 

[mscotgrove]

Does this mean that when I attempt to recover a file in the logical
NTFS partition, whatever software I'm using will automatically
rebuild the container first?  Or is this typically a two-step process
where I must first re-create the extended partition, then the NTFS
partition?- Hide quoted text -

- Show quoted text -

I can only speak for my own software but as far as I understand it,
the container is just a way to have more than 4 partitions. On the
boot sector, there is space for 4 records, ( starting at 0x1be) each
defining a partition. By using one of those records to point to an
extended partition, another 4 partitions may be added. The extended
partition overhead is typically 64 sectors.

For recovery, the only important thing is the start of the real
partition. Therefore recovery of the extended partition on it's own
is not required.

Michael

 

[Folkert Rienstra]

The partition function in my program will give the size of each partition,
and the starting location. If it needs to be reconstructed, thye recon-
struction routine will scan the drive looking for possible starts, and
where possible using values from pointer blocks.

A lot of commercial PCs, such as Dell and Sony start a disk with a
short - often FAT - hidden partition that is used for recovery.
The data is then on the second logical partition.

Once a partition has been selected for recovery, for logical recovery
my NTFS function does require valid values for cluster size and the
start of the MFT. There are helper functions for each of these.
(Analyse disk...)

As you now have an image, you can make as many mistakes as you like,
and will not lose more data.

More nonsense.
After 'your' socalled 'mistake' you have to re-image again.
The only way to make mistakes without loosing data is to
keep yet another copy of the image as a backup or not to
allow any changes to the image and use it as a source only.

 

[Folkert Rienstra]

I can only speak for my own software but as far

 

[Folkert Rienstra]

Rod Speed wrote in news:[email protected]

Rod Speed wrote in news:[email protected]

Rod Speed wrote in Rod Speed wrote

I had three partitions on a drive that had a hardware
failure and now can't be read by Windows. The only
files I really care about are *.tax. What utility will
let me search for them and copy to a working drive? [snip]
Thanks! While I understand the advice to work from a copy of the
damaged drive, I am almost overwhelmed by the urge to do
something right now. Would I be likely to make things worse by
pressing the "Reconstruct current partitions" button on the
Partition analysis screen?

Very likely.

Such confidence in the duff guys sof(t)ware.

Nothing to do with the software, everything to do with the state of
the drive.

Makes a lot more sense to clone it first before attempting to do
anything else.

Right, much better killing it for sure by trying to get all that you
don't really need in a very trying process than trying to get the
few bits that you really need in a jiffy by repairing the minimum.

Reconstructing current partitions is nothing like repairing the
minimum.

Of course it is.
Pathetic.

And who said anything about "Reconstructing current partitions".

The poster, ****wit.

Just reconstructing the MBR.

Wasnt what was being discusssed, ****wit.

But obviously was what he meant, whitness subject title, dimwit.
And "Reconstructing current partitions" -plural- is obviously
not what it may look at first glance: reconstructing volumes.
It's just re-establishing simple pointers to relatively simple
partition tables.

Pity that wasnt what was being discusssed, ****wit.

Pity that is all he want's, whatever it's called, dimwit.

Thank you for so graciously acknowledging my point, Roddles.

 

[mscotgrove]

(e-mail address removed) wrote in








More nonsense.
After 'your' socalled 'mistake' you have to re-image again.
The only way to make mistakes without loosing data is to
keep yet another copy of the image as a backup or not to
allow any changes to the image and use it as a source only.







- Show quoted text -- Hide quoted text -

- Show quoted text -

It is a pity that you do not know what the software I wrote actually
does.

One important thing is that it never changes the source. If the boot
sector needs updating, it does so on a virtual boot sector, not the
real thing, thus any trial and error mistake does not change the
source.

Newsgroups are here to share information, and generally assist, not to
run others down.

Michael

 

[Rod Speed]

Rod Speed wrote in news:[email protected]

Rod Speed wrote in Rod Speed wrote in Rod Speed wrote

I had three partitions on a drive that had a hardware
failure and now can't be read by Windows. The only
files I really care about are *.tax. What utility will
let me search for them and copy to a working drive?
[snip]
Thanks! While I understand the advice to work from a copy of
the damaged drive, I am almost overwhelmed by the urge to do
something right now. Would I be likely to make things worse
by pressing the "Reconstruct current partitions" button on the
Partition analysis screen?

Very likely.

Such confidence in the duff guys sof(t)ware.

Nothing to do with the software, everything to do with the state
of the drive.

Makes a lot more sense to clone it first before attempting to do
anything else.

Right, much better killing it for sure by trying to get all that
you don't really need in a very trying process than trying to get
the few bits that you really need in a jiffy by repairing the
minimum.

Reconstructing current partitions is nothing like repairing the
minimum.

Of course it is.
Pathetic.

And who said anything about "Reconstructing current partitions".

The poster, ****wit.

Just reconstructing the MBR.

Wasnt what was being discusssed, ****wit.

But obviously was what he meant, whitness subject title, dimwit.

Wasnt the command he was asking about, ****wit.

<reams of your pathetic excuse for bullshit flushed where it belongs>

 

[Arno Wagner]

It is a pity that you do not know what the software I wrote actually
does.

One important thing is that it never changes the source. If the boot
sector needs updating, it does so on a virtual boot sector, not the
real thing, thus any trial and error mistake does not change the
source.

Sound design for software not targetted at experts (which I gather
this is). Also a nifty feature for experts. If the (prevalent?) case
that the disk is actually fine, this seems to be a valid alternative
to working on an image.

Newsgroups are here to share information, and generally assist, not to
run others down.

Something Folkert does not understand and very likely never will.
He is here to run others down.

Arno

 

[Arno Wagner]

I can only speak for my own software but as far as I understand it,
the container is just a way to have more than 4 partitions.

Basically, yes.

On the
boot sector, there is space for 4 records, ( starting at 0x1be) each
defining a partition. By using one of those records to point to an
extended partition, another 4 partitions may be added. The extended
partition overhead is typically 64 sectors.

Not quite what I found, when I traced this on sector level a long time
ago. The structure was as follows: A main partition table entry points
to a next partition sector, at the beginning of the space for the
extended partition. This then had the extended parition described in
entry 1 and a further partition sector pointed to, if I remember
correctly. From there on it was basically a linked list (there were 5
or so logical partitions), were entry 1 described the logical
partition and entry 2 pointed to an additional partition sector at the
beginning of the next logical partition.

I don't know whether this is standard, but it seems the 4 entries in
the extended partitition description(s) are not all used.

For recovery, the only important thing is the start of the real
partition. Therefore recovery of the extended partition on it's own
is not required.

True, of course.

Arno

 

[mscotgrove]

Not quite what I found, when I traced this on sector level a long time

ago. The structure was as follows: A main partition table entry points
to a next partition sector, at the beginning of the space for the
extended partition. This then had the extended parition described in
entry 1 and a further partition sector pointed to, if I remember
correctly. From there on it was basically a linked list (there were 5
or so logical partitions), were entry 1 described the logical
partition and entry 2 pointed to an additional partition sector at the
beginning of the next logical partition.

I don't know whether this is standard, but it seems the 4 entries in
the extended partitition description(s) are not all used.


True, of course.

Arno- Hide quoted text -

- Show quoted text -

What you describe is what I have always seen, but I think in theory,
all 4 entries could be used. After all, the first extended pointer
is any one of the 4 pointers in the boot sector. I don't remember
seeing a pattern, but also I don't remember seeing more than one
extended pointer at a time.

Michael

 

[Arno Wagner]

What you describe is what I have always seen, but I think in theory,
all 4 entries could be used. After all, the first extended pointer
is any one of the 4 pointers in the boot sector. I don't remember
seeing a pattern, but also I don't remember seeing more than one
extended pointer at a time.

I have no idea whether this is required to be implemented fully general
(which would also aloww tree-like structures) or what the limits are.

Arno

 

[Folkert Rienstra]

It is a pity that you do not know what the software I wrote actually
does.

Apparently neither do you ...

One important thing is that it never changes the source.

.... so obviously there won't be any mistakes to make, yet that is what you wrote.

And if it doesn't change the source you have to get yet another new disk
to recover all your files to.

If the boot sector needs updating, it does so on a virtual boot sector,

What's the point if it doesn't get used by the OS, the ultimate test.

not the real thing, thus any trial and error mistake does not change the source.

There's much more than just the bootsector(s) when it comes to trial and
error. There is no excessive unused space on a drive to also keep virtual
FATs directories and what have you.

Newsgroups are here to share information, and generally assist,

They are also not meant to take commercially advantage of.
Which is exactly what you do.

I 'assist' in pointing you out.

not to run others down.

I have no problem running commercial spammers down.

 

[Folkert Rienstra]

Arno Wagner wrote in news:[email protected]

I have no idea

Indeed, babblebot.

 

[Folkert Rienstra]

Arno Wagner wrote in news:[email protected]

Basically, yes.

Not quite what I found, when I traced this on sector level a long time
ago.

Yeah, why bother to read the definition when you can do it the hard way.

The structure was as follows:

A main partition table entry

Whatever that is.
Presumably he means the Extended Partition entry in the MBR.

points to a next partition sector,

Whatever that is.
Presumably he means the address of the EPBR (Extended Partition Boot
Record) that describes both the enclosed logical partition and the re-
maining free extended partition.

at the beginning of the space for the extended partition.

This then had the extended parition

Not the extended partition but the logical partition within the extended partititon.

described in entry 1

Just like any other ordinary primary partition definition.

and a further partition sector pointed to,

the next Extended Partition Boot Record pointer and remaining free ex-
tended partition description.

if I remember correctly.

Guess not then, babblebot.

From there on it was basically a linked list (there were 5
or so logical partitions), were entry 1 described the logical
partition and entry 2 pointed to an additional partition sector
at the beginning of the next logical partition.

It's a linked list directly from the start of the MBR entry.

 

[mscotgrove]

... so obviously there won't be any mistakes to make, yet that is what youwrote.

And if it doesn't change the source you have to get yet another new disk
to recover all your files to.

This is correct - to try and recover data onto the original disk is
very dangerous. Recovery is required when something has gone wrong,
and the normal operating system will not help. To have the greatest
chance of retaining your data, copy all files to a new location. Yes,
this may mean a new disk drive, but at say $100, this gives a large
peace of mind.

What's the point if it doesn't get used by the OS, the ultimate test.

The ultimate test is correctly recovered user files. Making the
original disk work again may be a bonus, but in my opinion, not very
important.

There's much more than just the bootsector(s) when it comes to trial and
error. There is no excessive unused space on a drive to also keep virtual
FATs directories and what have you.


They are also not meant to take commercially advantage of.
Which is exactly what you do.

I 'assist' in pointing you out.


I have no problem running commercial spammers down.

I have no intention of spamming. I will try and assist other members,
as well as asking questions. If I suggest my program may be of use, I
try and make it clear that I have an interest in the program, and so
it is not impartial advice. If someone asks how to do something, and
I have a solution, I will tell them - and often other members of the
newsgroup will suggest other programs as well. It is up to readers to
make their own mind up.

Could other members of the newsgroup tell me if I am right or wrong,
or somewhere in the middle.