Recoverying lost Partition of a hard drive

  • Thread starter Thread starter Nickolas Kwiatkowski
  • Start date Start date
N

Nickolas Kwiatkowski

Hi,

I am new to this and am seeking some guidance in what to do next. There was
three primary partitions on the drive, fat32, linux fs and linux swap. I'm
only interested in recovering the fat32. Attempting access the drive, it
shows only a single partition and that it seems the root directory can't be
located.

I think given then output below, that I have located the root directory, but
am unsure what to do next to restore the partition and especially the root
directory for that partition.

Any assistance or pointers to information would be most helpful,

Thanks,

Nik


Below is the output for findpart for the drive in question:

Findpart, version 4.42.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: DOS 7.10

Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 20003697 9767 0 1 1 1322 239 63 B OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 Second FAT not found.

-----FAT CHS ------LBA Confidence Distance Type Sig
0 1 51 113 3729 32 OK
0 96 7 6054 3729 5941 32 OK
0 156 26 9853 28 3799 32 NB

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0C 63 20003697 9767 0 1 1 1322*239 63 OK OK


This is the output of findfat:


Findfat, version FP 4.42.
Copyright Svend Olaf Mikkelsen, 2004.

Searches for FAT's and gives an estimate of the condition.
Only some types of errors are detected. FAT size in sectors.
'Cl' is cluster KB. 'Root' is size in entries for FAT16 and
root cluster for FAT32. 'Rep.' is probably repairable. 'Bad'
can be not easy repairable FAT sectors. DataMB is an estimate.

OS: DOS 7.10

Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 Second FAT not found.

-----FAT CHS ------LBA Confidence Distance Type Sig
0 1 51 113 3729 32 OK
0 96 7 6054 3729 5941 32 OK
0 156 26 9853 28 3799 32 NB



This is part of the output of findpart finddir which shows the possible root
cluster/directory:

0 201 21 12683 0 190 26 11995 8 040415
0 201 37 12699 0 190 26 11995 8 040415
0 201 53 12715 0 190 26 11995 8 040415
0 218 6 13739 0 190 26 11995 8 040413
0 218 54 13787 0 190 26 11995 8 040413
0 226 62 14299 0 190 26 11995 8 040412
1 72 20 19675 possible root
1 139 7 23883 269 020101
1 206 10 28107 1009 020101
1 206 26 28123 0 190 26 11995 8 020101
1 207 27 28187 0 190 26 11995 8 020101
1 207 43 28203 0 190 26 11995 8 020101
1 207 59 28219 0 190 26 11995 8 020101
1 208 12 28235 0 190 26 11995 8 020101
1 208 28 28251 0 190 26 11995 8 011230
1 208 44 28267 0 190 26 11995 8 020101
1 208 60 28283 0 190 26 11995 8 020908
 
Findpart, version 4.42.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: DOS 7.10

Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 20003697 9767 0 1 1 1322 239 63 B OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 Second FAT not found.

-----FAT CHS ------LBA Confidence Distance Type Sig
0 1 51 113 3729 32 OK
0 96 7 6054 3729 5941 32 OK
0 156 26 9853 28 3799 32 NB

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0C 63 20003697 9767 0 1 1 1322*239 63 OK OK
Click to expand...

The fact that the other mentioned partitions were not located, may
indicate that the disk geometry originally was 255 heads, 63 sectors.
This is part of the output of findpart finddir which shows the possible root
cluster/directory:

0 201 21 12683 0 190 26 11995 8 040415
0 201 37 12699 0 190 26 11995 8 040415
0 201 53 12715 0 190 26 11995 8 040415
0 218 6 13739 0 190 26 11995 8 040413
0 218 54 13787 0 190 26 11995 8 040413
0 226 62 14299 0 190 26 11995 8 040412
1 72 20 19675 possible root
1 139 7 23883 269 020101
1 206 10 28107 1009 020101
Click to expand...

It can be seen that the FAT located matches the directories, since the

cluster 2 location calculated from the FAT findings, LBA 6054 + 5941 =
11995 matches the cluster 2 location calculated from the directories.
(nik cut the heading).

The partition size calculated from the FAT size 5941 sectors and
cluster size 8 KB is 5946 MB, meaning that the boot sector showing
9767 MB is wrong.

The possible root cluster number is (19675-11995) / 16 + 2 = 482. The
16 is the number of sectors in a cluster, and the 2 is the number of
the first cluster.

chsdir 1 0 1 51 5941 8 482 summary fp-a.txt

may show the content, if the root directory number is correct.

The disk should not be inserted in a Windows system, unless the
partition in the partition tables is effectively hidden, to prevent
further damage.
 
Svend said:
The fact that the other mentioned partitions were not located, may
indicate that the disk geometry originally was 255 heads, 63 sectors.


It can be seen that the FAT located matches the directories, since the

cluster 2 location calculated from the FAT findings, LBA 6054 + 5941 =
11995 matches the cluster 2 location calculated from the directories.
(nik cut the heading).

The partition size calculated from the FAT size 5941 sectors and
cluster size 8 KB is 5946 MB, meaning that the boot sector showing
9767 MB is wrong.
Click to expand...

Yes, indeed 5946 MB was the correct size of the partition.
The possible root cluster number is (19675-11995) / 16 + 2 = 482. The
16 is the number of sectors in a cluster, and the 2 is the number of
the first cluster.

chsdir 1 0 1 51 5941 8 482 summary fp-a.txt

may show the content, if the root directory number is correct.
Click to expand...

This is the output of that command:

Chsdir, version 2.6.

Disk 1 CHS: 1323/240/63 FAT Location: 0/1/51

Total clusters: 760446 Cluster KB: 8
Last used cluster: 723941 Reserved: 50
FAT sectors: 5941 Root cluster: 482
FAT used clusters: 555154 FAT entries: 87694
Used clusters: 555159 Entries: 87697
Directories: 2438 Directories MB: 23
Files: 85259 Files MB: 3886
Partition MB: 5946 Free MB: 1603

Used clusters do not match the FAT.
NB files: 3

The detailed listing of the content of the partition is correct and shows
the files that were originally on the partition.
The disk should not be inserted in a Windows system, unless the
partition in the partition tables is effectively hidden, to prevent
further damage.
Click to expand...

Understood. Give the above, was is the best course of action to restore the
drive.

Thanks,

Nik
 
Yes, indeed 5946 MB was the correct size of the partition.
Click to expand...
This is the output of that command:

Chsdir, version 2.6.

Disk 1 CHS: 1323/240/63 FAT Location: 0/1/51

Total clusters: 760446 Cluster KB: 8
Last used cluster: 723941 Reserved: 50
FAT sectors: 5941 Root cluster: 482
FAT used clusters: 555154 FAT entries: 87694
Used clusters: 555159 Entries: 87697
Directories: 2438 Directories MB: 23
Files: 85259 Files MB: 3886
Partition MB: 5946 Free MB: 1603

Used clusters do not match the FAT.
NB files: 3

The detailed listing of the content of the partition is correct and shows
the files that were originally on the partition.
Click to expand...
Understood. Give the above, was is the best course of action to restore the
drive.

Thanks,

Nik
Click to expand...

It seems as the condition of the partition is good enough to be
repaired by creating a new boot sector and editing the partition
tables. That however would be hand work for me, and verifying the
result with different time zones.

What about this:

You delete the partition table entry currently in the partition tables
to protect the partition from operating system access. After that do
not touch any partitioning tool, and do *not* enter the Fdisk create
partition screen. Then insert the disk as disk number 2 in a working
Windows system with room for the files, and do in an empty directory
using Findpart for Windows:

findpart chsdir 2 0 1 51 5941 8 482 copy

?

If you prefer hands on help in this case, then mail me.
 
Svend said:
exercises the output of that command:


It seems as the condition of the partition is good enough to be
repaired by creating a new boot sector and editing the partition
tables. That however would be hand work for me, and verifying the
result with different time zones.
Click to expand...

Agreed, I don't want to take up too much of your own time. I appreciate the
time the you have given.
What about this:

You delete the partition table entry currently in the partition tables
to protect the partition from operating system access. After that do
not touch any partitioning tool, and do *not* enter the Fdisk create
partition screen. Then insert the disk as disk number 2 in a working
Windows system with room for the files, and do in an empty directory
using Findpart for Windows:

findpart chsdir 2 0 1 51 5941 8 482 copy

?
Click to expand...

Sounds like a good idea, I will do that.
If you prefer hands on help in this case, then mail me.
Click to expand...

Thank you for the offer, I will see how I process. Out of my own interest,
after using the above procedure, I think I would like to try to
repair/rebuild the partition myself as a learning exercise. Any suggestion
on what I should look at? I have download the MS technical doc for FAT
filesystem and am reading thru that.

Thank you very much for your assistance and the tools that you have
provided.

Nik
 
Sounds like a good idea, I will do that.


Thank you for the offer, I will see how I process. Out of my own interest,
after using the above procedure, I think I would like to try to
repair/rebuild the partition myself as a learning exercise. Any suggestion
on what I should look at? I have download the MS technical doc for FAT
filesystem and am reading thru that.

Thank you very much for your assistance and the tools that you have
provided.

Nik
Click to expand...

Well, you will need a 512 bytes FAT32 boot sector (a wrong one is
already there in your case), and a tool to edit it.

If you do:

set findpart=edit
findpart editboot

you will see the usage for a simple command line utility to edit the
boot sector. You will have to able to calculate the number of sectors
in the partition. For partition table editing, you can see my pages.

Tools with more advanced user interface exists, but one have to make
sure that the tool is reliable.

Note that you may want to go back to a 255 heads translation. That can
be done if no partitions are in the MBR partition table.
 
Back
Top