The drive did not get formatted, it accidentally got partitioned using fdisk. It is my understand that the data is still there until it is overwritten by something else, this hasn't been. So is it possible to cheaply recover the data off the drive?
Is it possible to recover data off of a hard drive that was fdisk'd?
- Thread starter coolred
- Start date
It is my understanding too that the data is still there and retrievable, I believe you can use Norton Utilities boot disk and you have the option to rebuild the partition. There are probably many ways and I would guess that if something simple like rhis didn't work then it would just depend on how bad you wanted that data back amd how much $$ you would be willing to spend, I know the data recovery companies like Ontrack charge a bundle to do this though.
The data is not worth enough to me, to pay to have it recovered. Thats why I am hoping i can do it easily, like the way you mentioned, but I am not sure if what you say will work, can anyone else give me more info on the process?
<< The data is not worth enough to me, to pay to have it recovered. Thats why I am hoping i can do it easily, like the way you mentioned, but I am not sure if what you say will work, can anyone else give me more info on the process? >>
You have norton utilities or system works? Ya can get it for like 25$. Pricewatch it. And you can boot from the cd to do virus scans and stuff like that. Rebuild the partition.....
I have Norton System Works 2001 and Norton System works Pro 2002. So you are saying if I boot off of one of those CD's it will have an option to rebuild a partition? I will give that a try
I just booted off the 2002 Pro CD and was given 3 options
1. Norton antivirus
2. Normal Startup
3. I don't remember the third one, but it didn't sound like anything i needed anyway, so how do i do this?
1. Norton antivirus
2. Normal Startup
3. I don't remember the third one, but it didn't sound like anything i needed anyway, so how do i do this?
Assuming the filesystem was FAT32 (common case), search for software called Tiramisu FAT32. There are flavors for other filesystems as well.
This software no longer exists; the technology was bought by Ontrack and rolled into their Executive Disk Recovery Pro (or something like that).
I've tried Tiramisu FAT32 a long time ago (it worked), and Ontrack's product not two years ago (didn't work).
The way it works is that the software goes over your hard disk bit by bit, analyzing it for any trace of filesystems. If all you did was hose the partition table (and not the partitions), I'd say it's quite likely Tiramisu FAT32 will do the trick.
This software no longer exists; the technology was bought by Ontrack and rolled into their Executive Disk Recovery Pro (or something like that).
I've tried Tiramisu FAT32 a long time ago (it worked), and Ontrack's product not two years ago (didn't work).
The way it works is that the software goes over your hard disk bit by bit, analyzing it for any trace of filesystems. If all you did was hose the partition table (and not the partitions), I'd say it's quite likely Tiramisu FAT32 will do the trick.
I am searching for that file now, in the mean time does anyone have any more info on using norton to fix this?
<< Too bad you don't work for the FBI, cuz they can do it with thier eyes closed
>>It's actually not all that difficult. But it does take lots of time sometimes, and it's not something I can lead someone through in this forum.
Yes, the data is still on the drive. You just need to rebuild the partition table manually. In my case, I would put the drive in a W2K system and use dskprobe from the Resource Kit to do the dirty work. You need to read in sector 0, edit the appropriate fields, and write it back out to sector 0. Knowing what values to put where is the hard part. Q114841 is your ticket out of this mess.
Let me know the following and I'll see if I can help:
1) whether the partition was primary or extended
2) the filesystem of the partition
3) the size (make/model if possible) of hard drive
You're going to need a sector editor to get the data back, but it can be done.
-Noggin
sctor editor, man the other people made it sound easy.
1. I don't remember if it was primary or extended
2. Fat32
3. Maxtor 5t030h3 30gig
1. I don't remember if it was primary or extended
2. Fat32
3. Maxtor 5t030h3 30gig
Well... I'll do my best.
First off, if it was in an extended partition, I quit right here and now. No desire to walk the partition table when we don't even know where it is.
Now that that's out of the way, fire up your favorite sector editor. Load up sector 0 of this hard drive.
Hopefully, you'll see text in there like "Invalid Partition Table" that indicates most of the MBR is intact.
Now, you need to create an entry in the partition table for this partition. The partition table starts at byte 0x01BE.
At byte 0x01BE, if this is a bootable partition, set the value to 0x80.
At byte 0x01BF, put in value 0x01.
At bytes 0x1C0 to 0x1C1, put in 01 00.
At byte 0x1C2, put in value 0x0B. This is the FAT32 filesystem indicator.
You've just defined the boot flag, the starting side, cylinder, and sector, and filesystem indicator. That's the easy part.
The ending side, cynlider, and sector is not so easy. These are the next three bytes. If your partition is > 7.8GB, try setting these to 0xFE 0xFF 0xFF.
Now at location 0x1C6, we need to set the relative sectors. This is almost always 0x3F 0x00 0x00 0x00 for the first partition on the drive. You can check this by looking for a FAT32 bootsector at sector 63 on the drive.
At location 0x1CA we need to indicate the total number of sectors for the partition. This is the tricky part. This is a four byte value. If you're using dskprobe, find the FAT32 bootsector (usually sector 63) and view this as a FAT bootsector and get the total sectors. Put this in the MBR.
Of course, back up any sectors before writing to them.
Again, this CAN be done, and I've done it enough times that it doesn't phase me. If you're willing to put in the work, chances are excellent that you can get your data back.
First off, if it was in an extended partition, I quit right here and now. No desire to walk the partition table when we don't even know where it is.
Now that that's out of the way, fire up your favorite sector editor. Load up sector 0 of this hard drive.
Hopefully, you'll see text in there like "Invalid Partition Table" that indicates most of the MBR is intact.
Now, you need to create an entry in the partition table for this partition. The partition table starts at byte 0x01BE.
At byte 0x01BE, if this is a bootable partition, set the value to 0x80.
At byte 0x01BF, put in value 0x01.
At bytes 0x1C0 to 0x1C1, put in 01 00.
At byte 0x1C2, put in value 0x0B. This is the FAT32 filesystem indicator.
You've just defined the boot flag, the starting side, cylinder, and sector, and filesystem indicator. That's the easy part.
The ending side, cynlider, and sector is not so easy. These are the next three bytes. If your partition is > 7.8GB, try setting these to 0xFE 0xFF 0xFF.
Now at location 0x1C6, we need to set the relative sectors. This is almost always 0x3F 0x00 0x00 0x00 for the first partition on the drive. You can check this by looking for a FAT32 bootsector at sector 63 on the drive.
At location 0x1CA we need to indicate the total number of sectors for the partition. This is the tricky part. This is a four byte value. If you're using dskprobe, find the FAT32 bootsector (usually sector 63) and view this as a FAT bootsector and get the total sectors. Put this in the MBR.
Of course, back up any sectors before writing to them.
Again, this CAN be done, and I've done it enough times that it doesn't phase me. If you're willing to put in the work, chances are excellent that you can get your data back.
I am pretty sure it was a primary, I just don't fully remember. my next problem is that I don't have nor do I know what asector editor is.
Is there any software I can use to do this a little more easily. I mean a few people mentioned norton, but then never elaborated on it. I also downloaded Lost and found a while ago when powerquest was giving it away free(unfortunately i don't think i got the product key or serial number or whatever you need to start it). is there an easier way. If not, LMK where to get a sector editor.
I'd give Tiramisu FAT32 a try if at all possible.
It's non-destructive, requiring a separate disk or floppy to write recovered data to. It is a bit time consuming to examine the raw disk, and recover data, but that's to be expected from a DOS utility.
It's non-destructive, requiring a separate disk or floppy to write recovered data to. It is a bit time consuming to examine the raw disk, and recover data, but that's to be expected from a DOS utility.
I've rebuilt partitions by hand, it's not that hard, it just takes some time and patience.
I used unix tools to do this (i.e. hexedit, dump, vi, etc) but you can do it with the equivalent from norton. I don't quite remember the name but it came with norton utilities. The idea is to edit the hard drive directly.
At the beggining of the disk you''ll find the partition table. The format is not too complex. You can look at the documentation around the web to see how it looks, I don't recall any specific info source right now to show you.
Each entry in the partition table has some fields. NogginBoink pointed out some of the values for those fields.
Extended partitons are a list of partitions, you'll need to "walk" through them.
hmm ....
Ok, maybe it's not as simple as I was trying to make it.
All I can say is, next time, keep a copy of the first 1K of your HD. (or a specific dump of your partition table)
cl
I guess I wasn't too helpful.
I used unix tools to do this (i.e. hexedit, dump, vi, etc) but you can do it with the equivalent from norton. I don't quite remember the name but it came with norton utilities. The idea is to edit the hard drive directly.
At the beggining of the disk you''ll find the partition table. The format is not too complex. You can look at the documentation around the web to see how it looks, I don't recall any specific info source right now to show you.
Each entry in the partition table has some fields. NogginBoink pointed out some of the values for those fields.
Extended partitons are a list of partitions, you'll need to "walk" through them.
hmm ....
Ok, maybe it's not as simple as I was trying to make it.
All I can say is, next time, keep a copy of the first 1K of your HD. (or a specific dump of your partition table)
cl
I guess I wasn't too helpful.
Search for a program called GetDataBack, they have a FAT and NTFS version. It will scan your drive and present you with a list of partitions, files and directorys it found and allow you to copy them anywhere.
I had to use it after I booted from a old DOS disk with the Monkey Boot Virus on it (wipes the partition table!!) It was able to recover every single file.
I had to use it after I booted from a old DOS disk with the Monkey Boot Virus on it (wipes the partition table!!) It was able to recover every single file.
Found that program, do I have to buy it in order to fully use it. I am downloading it, but I am not sure if it will do the whole job unless i buy it
TRENDING THREADS
-
Discussion Zen 5 Speculation (EPYC Turin and Strix Point/Granite Ridge - Ryzen 9000)- Started by DisEnchantment
- Replies: 25K
-
Discussion Intel Meteor, Arrow, Lunar & Panther Lakes + WCL Discussion Threads
- Started by Tigerick
- Replies: 23K
-
Discussion Intel current and future Lakes & Rapids thread- Started by TheF34RChannel
- Replies: 23K
-
-
Facebook
Twitter