please help save my partition using findpart editpart

  • Thread starter Thread starter perltcl
  • Start date Start date
P

perltcl

hi

please help save my partition using findpart and editpart.
after reinstall window xp (twice) my second partition is gone.
it seem some people can use findpart and editpart to save their
partition.
please help.


Findpart, version 4.71 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.1.2600 Service Pack 2 All

Disk: 1 Cylinders: 2584 Heads: 240 Sectors: 63 MB: 19077

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63 20638737 10077 0 1 1 1364 239 63 B OK
678 - 07 63 10236177 4998 678 1 1 1354 239 63 BU OK
1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK
1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK
0 - 0C 38102400 967680 472 2520 0 1 2583 239 63 B OK
677 - 07 63 28833777 14078 677 1 1 2583 239 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
2520 0 33 944 4 2 944 0 0 0 000908 362

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63 20638737 10077 0 1 1 1364*239 63 OK OK
0 2 0F 20638800 18431280 8999 1365* 0 1 2583*239 63 OK

1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK

I can't remember what is the format for the second partion nor it's
size.
it's a long time ago.
please help, I have lots of pictures on second partition.
Thanks.
 
hi

please help save my partition using findpart and editpart.
after reinstall window xp (twice) my second partition is gone.
it seem some people can use findpart and editpart to save their
partition.
please help.


Findpart, version 4.71 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.1.2600 Service Pack 2 All

Disk: 1 Cylinders: 2584 Heads: 240 Sectors: 63 MB: 19077

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63 20638737 10077 0 1 1 1364 239 63 B OK
678 - 07 63 10236177 4998 678 1 1 1354 239 63 BU OK
1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK
1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK
0 - 0C 38102400 967680 472 2520 0 1 2583 239 63 B OK
677 - 07 63 28833777 14078 677 1 1 2583 239 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
2520 0 33 944 4 2 944 0 0 0 000908 362

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63 20638737 10077 0 1 1 1364*239 63 OK OK
0 2 0F 20638800 18431280 8999 1365* 0 1 2583*239 63 OK

1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK

I can't remember what is the format for the second partion nor it's
size.
it's a long time ago.
please help, I have lots of pictures on second partition.
Thanks.
Click to expand...


If data are lost on this disk, the disk should be inserted as second
disk in a working system for examination, and the current 10077 MB
NTFS partition should not be accessed.

The explanation is that partitions may be overlapping, so lost data
can be damaged if data are written to the current partition.

There is a 9073 MB NTFS partition at cylinder 1355, which may be the
lost partition. That is inside the current primary partition.


Other methods, such as copying to an external disk or a network drive
letter using Findpart would be possible, as long as nothing is written
to the current partition.
 
please help save my partition using findpart and editpart.
Click to expand...

Some might disagree, but I've had too many hard-drive-related problems
with Windows to trust this OS for such a recovery.

Also, trying to repair a partition table while running an OS on the
same hard disk, is definitely a bad idea.

I'd recommend booting on a Linux CD-ROM and using gpart.
You can either ask gpart to completely recover the partition table, or
just ask it to detect the second partition and use fdisk.

Documentation: <http://www.stud.uni-hannover.de/user/76201/gpart/>

A boot disk that contains gpart: Recovery Is Possible. This disk has
been really helpful to me for lots of hard drive problems.
<http://www.tux.org/pub/people/kent-robotti/looplinux/rip/>
 
Svend said:
If data are lost on this disk, the disk should be inserted as second
disk in a working system for examination, and the current 10077 MB
NTFS partition should not be accessed.

The explanation is that partitions may be overlapping, so lost data
can be damaged if data are written to the current partition.

There is a 9073 MB NTFS partition at cylinder 1355, which may be the
lost partition. That is inside the current primary partition.


Other methods, such as copying to an external disk or a network drive
letter using Findpart would be possible, as long as nothing is written
to the current partition.
Click to expand...

This is a IBM notebook, it has floppy drive though.
I try chsdir.exe 1 2520 0 3, but it won't let me run in XP.
I do'nt have any DOS disks anymore.
I could try to find one on the net though.
I have 2 Knoppix CDs though.
I just started using Knoppix recently.
I try to mount the second partition but it failed.
What would you suggest? get a dos disk and run chsdir?
You seem to have helped a few people on the net.
Please help.
 
This is a IBM notebook, it has floppy drive though.
I try chsdir.exe 1 2520 0 3, but it won't let me run in XP.
I do'nt have any DOS disks anymore.
I could try to find one on the net though.
I have 2 Knoppix CDs though.
I just started using Knoppix recently.
I try to mount the second partition but it failed.
What would you suggest? get a dos disk and run chsdir?
You seem to have helped a few people on the net.
Please help.
Click to expand...

Remember: Do not write to C: until it is known that it is safe.

1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK
Click to expand...

Regarding the partition at cylinder 1355:

It can be an old obsolete partition, or it can be the lost partition.
To verify if it is the lost partition, you can make a file listing to
the screen, using this command:

findpart findntfs 1 1355 1 1

Using the mouse on the scroll bars, it may be possible to temporarily
stop the screen scrolling, so you can read the output.


To list the content of the FAT32 partition ad cylinder 2520, you can
use:


findpart chsdir 1 2520 0 1
 
Fabien said:
Some might disagree, but I've had too many hard-drive-related problems
with Windows to trust this OS for such a recovery.

Also, trying to repair a partition table while running an OS on the
same hard disk, is definitely a bad idea.

I'd recommend booting on a Linux CD-ROM and using gpart.
You can either ask gpart to completely recover the partition table, or
just ask it to detect the second partition and use fdisk.

Documentation: <http://www.stud.uni-hannover.de/user/76201/gpart/>

A boot disk that contains gpart: Recovery Is Possible. This disk has
been really helpful to me for lots of hard drive problems.
<http://www.tux.org/pub/people/kent-robotti/looplinux/rip/>
Click to expand...

well, I am not being ungratefull, but I did try and use gpart and I
only get:

gpart /dev/hda
.......
.......

Guessed primary partition table:
Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 10077mb #s(20638737) s(63-20638799)
chs: (0/1/1)-(1023/14/63)d (0/1/1)-(21839/14/63)r

Primary partition(2)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

I'm trying to save my second partition. also it doesn't seem to have
any further detail on what can be done from here....
 
Svend said:
Remember: Do not write to C: until it is known that it is safe.



Regarding the partition at cylinder 1355:

It can be an old obsolete partition, or it can be the lost partition.
To verify if it is the lost partition, you can make a file listing to
the screen, using this command:

findpart findntfs 1 1355 1 1

Using the mouse on the scroll bars, it may be possible to temporarily
stop the screen scrolling, so you can read the output.



To list the content of the FAT32 partition ad cylinder 2520, you can
use:


findpart chsdir 1 2520 0 1
Click to expand...

I just found the partition!
findpart findntfs 1 1355 1 1


Directories: 184
Files: 831
Trees: 1
Exe/dll files: 3
Exe/dll files signature: 3
Cluster KB: 4
MFT cluster no: 4
MFT size: 9755648
MFT cluster bytes: 4096
Listed files MB: 591

this kicks ass, all my pics are there! all my past homeworks.
how do I do from here?
thanks.
 
I just found the partition!
findpart findntfs 1 1355 1 1


Directories: 184
Files: 831
Trees: 1
Exe/dll files: 3
Exe/dll files signature: 3
Cluster KB: 4
MFT cluster no: 4
MFT size: 9755648
MFT cluster bytes: 4096
Listed files MB: 591

this kicks ass, all my pics are there! all my past homeworks.
how do I do from here?
thanks.
Click to expand...

OK. Realize that this partition begins inside your C: partition, and
that if you write to C: you may permanently loose access to the files.
The important Master File Table is inside the C: partition.

If we should discuss this further, you must access usenet from another
computer. Maybe you are already doing that?
 
Svend said:
OK. Realize that this partition begins inside your C: partition, and
that if you write to C: you may permanently loose access to the files.
The important Master File Table is inside the C: partition.

If we should discuss this further, you must access usenet from another
computer. Maybe you are already doing that?
Click to expand...

I do have a second computer with internet access.
considering I have already reinstalled xp twice,
also editpart and findpart etc. on c drive.
and also install several other softwares,
hell I am typing and posting on the same computer :)
but I digress, I will shut this off and use another computer.
thanks
 
Yes, you have already shown to mostly have no clue of anything in this group.
Click to expand...

Arno has blacklisted you, so you're looking for someone else to fight
with, uh?
 
Fabien LE LEZ said:
Arno has blacklisted you, so you're looking for someone else to fight
with, uh?
Click to expand...
Care to explain why gpart did not find the partition that findpart did?
 
Folkert said:
Yes, you have already shown to mostly have no clue of anything in this group.
Click to expand...

for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

slightly longer version involved: "Knoppix on notebook,
linux host with qemu windows guest,
netcat, dd if=/dev/hda conv=noerror,sync bs=512 | nc 192.168.0.1 9000"
My harddrive had "input/output error".

So, findpart save my day.

I could have just unplug the harddrive and plug it in another machine
with windows running, though that would be no fun.... netcat is just so
much fun...

I did try to mount the "netcated" diskimage with calculated offset=$((
63*512*1355*240)) or $(( 63*512*1356*240)) but no success.
maybe someone could further enlighten me...

mount -t ntfs -o loop,ro,offset=$((63*512*1355*240)) rescued.img /tmp/l
mount -t ntfs -o loop,ro,offset=$((63*512*1356*240)) rescued.img /tmp/l

dmesg | tail
NTFS-fs error (device loop2): ntfs_fill_super(): Not an NTFS volume.

If I could mount the rescued image, it would have been a better and
faster solution.....
still all thanks goes to findpart.
 
for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

slightly longer version involved: "Knoppix on notebook,
linux host with qemu windows guest,
netcat, dd if=/dev/hda conv=noerror,sync bs=512 | nc 192.168.0.1 9000"
My harddrive had "input/output error".

So, findpart save my day.

I could have just unplug the harddrive and plug it in another machine
with windows running, though that would be no fun.... netcat is just so
much fun...

I did try to mount the "netcated" diskimage with calculated offset=$((
63*512*1355*240)) or $(( 63*512*1356*240)) but no success.
maybe someone could further enlighten me...

mount -t ntfs -o loop,ro,offset=$((63*512*1355*240)) rescued.img /tmp/l
mount -t ntfs -o loop,ro,offset=$((63*512*1356*240)) rescued.img /tmp/l

dmesg | tail
NTFS-fs error (device loop2): ntfs_fill_super(): Not an NTFS volume.

If I could mount the rescued image, it would have been a better and
faster solution.....
still all thanks goes to findpart.
Click to expand...

One more detail : I have to force geometry with findpart findntfs heads
240, since qemu has strange bios that report "255" heads....
 
[email protected] said:
One more detail : I have to force geometry with findpart findntfs heads
240, since qemu has strange bios that report "255" heads....
Click to expand...

One more detail: working with linux is fun,
but working with people who use linux is no fun,
because they have no idea of "supporting your software"....
 
for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"
Click to expand...

that should be: "findpart findntfs heads 240 2 1355 1 1 showsys copy"
or was it : "findpart heads 240 findntfs 2 1355 1 1 showsys copy"
 
Eric said:
Care to explain why gpart did not find the partition that findpart did?
Click to expand...

Didn't you read my posted output from gpart,
the output shows no indication of finding the partition at CHS: 1355 1
1
while findpart finds serveral "OK" partition on first try.
not to mention findpart has support for listing and copying.
where I did I find that with gpart? or anywhere on their web site?
 
that should be: "findpart findntfs heads 240 2 1355 1 1 showsys copy"
or was it : "findpart heads 240 findntfs 2 1355 1 1 showsys copy"
Click to expand...

sorry that should be:
findpart.exe findntfs 2 1355 1 1 heads 240
 
for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

slightly longer version involved: "Knoppix on notebook,
linux host with qemu windows guest,
netcat, dd if=/dev/hda conv=noerror,sync bs=512 | nc 192.168.0.1 9000"
My harddrive had "input/output error".

So, findpart save my day.

I could have just unplug the harddrive and plug it in another machine
with windows running, though that would be no fun.... netcat is just so
much fun...

I did try to mount the "netcated" diskimage with calculated offset=$((
63*512*1355*240)) or $(( 63*512*1356*240)) but no success.
maybe someone could further enlighten me...

mount -t ntfs -o loop,ro,offset=$((63*512*1355*240)) rescued.img /tmp/l
mount -t ntfs -o loop,ro,offset=$((63*512*1356*240)) rescued.img /tmp/l

dmesg | tail
NTFS-fs error (device loop2): ntfs_fill_super(): Not an NTFS volume.

If I could mount the rescued image, it would have been a better and
faster solution.....
still all thanks goes to findpart.
Click to expand...

Nice that the problem was solved. I do not understand all the "heads"
issues, but it seems as you found a solution.

In bytes, the offset to the partition would be
Disk: 1 Cylinders: 2584 Heads: 240 Sectors: 63 MB: 19077
Click to expand...
1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK
Click to expand...


(1355 * 240 * 63 + 1 * 63 + (1 - 1)) * 512 = 10489683456


Last time I looked at the mount offset option, it would not work for
values larger than 2^31 bytes, but that may have changed.
 
Back
Top