Originally posted by: ZL1
Hi
guys I need help bad, last night I lost a partition and the funny thing was all I did is open a directory while it was in use, it started to list files then it hanged then no more partition
Sounds like the drive overheated or had the boot sector (actually, in this case, filesystem boot-sector, nevermind) suddenly go bad. Windows' is constantly re-writing that sector on the drive (updating a filesystem timestamp and/or flags). I know that WD drives tend to "lose sectors" when they overheat. (Other mfg's drives often do much worse things, as well as lose sectors.)
Alternatively, possibly something got corrupted (flaky RAM perhaps? Unstable PCI/system bus/CPU cache?), and a disk write got shuttled off to LBA sector zero, when it shouldn't have been, and overwrote the MBR/partition table with garbage. (Had that happen once when I overclocked my AMD 5x86-133 system, or rather, attempted to, to 160Mhz on a Biostar UUD866x mobo.)
Originally posted by: ZL1
now using some file recovery stuff I am able to see that the files are all there and I was wondering if there is a recovery soft that could rebuild the partition table ?
please advise
Thank you
Dan
Hmm. Well, yes and no. I'm sure that there probably is, I'm just not familiar with it. I don't really trust automatic utilities to make those kinds of decisions, since you don't actually know what the exact failure-mode is until you look at it yourself manually. I usually use Norton Diskedit for DOS (actually, the one included in Systemworks 2002 or 2003, whatever the most recent one is, that properly handles LBA drives), and then I switch to "partition table view", and manually patch things back up. That may or may not seem like a viable route to take for you. I've been doing it for years, it's not too hard when you understand the partition-table format and have a calculator handy, but it's not for the novice or faint-of-heart.
One other feature that Norton Diskedit has, is that it can actually scan through the HD's sectors, looking for the filesystem bootsectors. Assuming that you manually discard any obsolete/duplicated entries (created by deleting/re-creating or resizing partitions and then formatting them, then you can find out the starting sectors of all of the filesystems on the HD. (Likewise the extended partition table sectors too.) From those, you can re-create the partition-table chain by hand.
If you had some automatic recovery software find the filesystems (and they are intact), then if you find out the start/end sectors then you can use that info to rebuild the partition tables.
One other possibility is to use a bootable Linux "recovery CD" (I haven't kept up with the state-of-the-art in this area, perhaps someone can fill in which is the latest-and-greatest distro version to use), and then use, I think it is 'cfdisk', to also fill in the partition-table values.
Whatever you do, DO NOT use a bootable Win98se floppy with FDISK.EXE. FDISK is evil, if you create partitions, not only does it create the partition-table entry, it also OVERWRITES the filesystem's bootsector, and marks it as "unformatted". Generally a very bad idea when attempting data-recovery.
Also, Win98se, when booting in DOS mode off of a boot disk, also writes to the HD during booting. That is another no-no when attempting data-recovery, try to stick to an MS-DOS 6.22-formatted bootable floppy. Just don't manipulate anything that requires LFNs in that case.
PS. Symantec has a downloadable "trial version" of Systemworks, or did. It installs the "VBox installer", which is a DRM-like try-before-you-buy sort of system that cannot be un-installed (not easily, not without reformatting, so use a 'dummy' system to do this), and the trial is time-limited to a month (I think), but during the installation, it decompresses the files, and you can copy the necessary DOS-based Diskedit files out of the directory to make a boot disk with Diskedit on it.
Edit:
1) Do NOT run "FIXMBR". That re-writes the code in the MBR for booting, but doesn't somehow magically re-create the partition tables from the locations of the filesystem bootrecords on the HD. For one thing, it would take a long time to scan for them, and another, it doesn't know which are valid and which are obsolete, not easily.
2) Do NOT run "CHKDISK". That wouldn't help anyways, since it requires a visible and valid filesystem, which pre-supposes that the MBR/partition table is both intact and correct. If it is partially bad, it could cause the drive to get even more corrupted in unfixable ways.
Btw, if this data is important to you, before you run any recovery utils, you can use a bootable Ghost 2003 floppy (if you own it, OEM copies are floating around on the internet for as low as $5, also included free with Ghost 9), and create a "forensic" sector-by-sector image backup onto another HD as a bunch of files. That will take up a *lot* of space though, as much as the size of the original HD. Not the normal Ghost image-backup mode, that does a file-by-file backup only.
You can also use the '-fro' switch, I think it is, to cause Ghost to skip over sectors on the HD that have gone physically bad and are unreadable, if your HD is actually failing or has bad sectors, this can be a good thing. You can restore the image backup to another HD of identical or larger size, sector-by-sector, and then perform the data-recovery on the copy instead. Much safer.
Facebook
Twitter