UNIX for Advanced & Expert Users

Did you format the hard drive or just overwrite the partition table? That seems to be the first question to answer clearly. Based on what I've read so far, seems that you did not format the drive, but only changed the partition table.

This implies that you can recover the disk by rebuilding the partition table and master boot record, right?

After we identify the exact situation.... we can consider tools like:

http://www.dtidata.com/products_bundle_01.asp

http://www.r-studio.ca/?GW09

The trick is NOT TO PANIC and NOT TO OVERWRITE THIS DISK, OK?

http://download.cnet.com/downloads/0...y&cn=&ca=10001

http://www.diydatarecovery.nl/

The partition table is really quite simple, as long as the partition ID is OK, info on tracks and sectors are intact (all that can be done with Linix fdisk) then should there be some more data needed, that may be gotten off an alternative partition table.

This will be reall yinteresting, I like these things actually

AtleRamsli,

Are you saying that he must take his broken XP hard disk and install it on a Linux system... and run fdisk ?

How does this work? Fdisk will try to read the partition table and the partition table is wiped out, right?

I am not sure that this will work......... and can't recommend using fdisk based on what I've read so far.

Souldier,

Recommend you read this first....

http://www.diydatarecovery.nl/

Very good info there and it seems like what you need based on what I've read so far.



This links (below) is more technical reading ... and might help.... but seems to mathematical for most people ....

http://www.datarescue.com/laboratory/

Neo!

Maybe I didn't explain this well enough: The problem is really simple:
As a result of an operation, some bytes on the disk have been reset, and they must be set back.

The tool used for that is really irrelevant, as long as the bytes get set back to their original values, disk structure, partition structure and type.
My suggestion was to start with the simplest, compare one partition table with another using fdisk's binary dump facility, and take it from there.


Of course it is not sure to work, if the more than these few bytes have been altered, then there is really no way to fix it, because there is no telling what those bytes were.

But, as for the ones that are part of the table:
Linux fdisk has a couple of options that let you make a binary dump of the partition table
You will start by m, to list th eoptions,
then x to list the advance options, and there are:
options to change info on cylingers, heads, sector/track
in most cases, the partition table is simply marked as 'unused' - this is what happened to me, so I could just put it back to 'used by linux '=83

But, of course, that is all it can do!

I found this info about the Microsoft boot sector layout

Field Offset Length
----- ------ ------
Bytes Per Sector 11 2
Sectors Per Cluster 13 1
Reserved Sectors 14 2
FATs 16 1
Root Entries 17 2
Small Sectors 19 2
Media Descriptor 21 1
Sectors Per FAT 22 2
Sectors Per Track 24 2
Heads 26 2
Hidden Sectors 28 4
Large Sectors 32 4

MBR-Rescue sounds an aweful lot like the command "fdisk \MBR" on a DOS or Windows machine.

Also, the way I took AtleRamsli's post was an example of how he could do it - in that case, grab a Linux boot disk (for example, one of my favorite is tomsrtbt) that can get an x86 off the ground, then to use the tools within to get to fixing the hard disk setting...

I somewhat like that idea, since you don't have to sync anything to the disk prior to the change (like you would if you booted up Windows).

It also helps a LOT if have something to compare the dump to, it is often the case that you can restore the whole thing by comparing the different versions of MBR (in case more than just the type is overwritten)

In any case: Law nr.1: Stay k00l

I think I forgot to mention the most obvious advantage:

If it works, which, as it has been pointed out, you can not be sure of, you have fixed the whol problem in about 10 keystrokes or so ... this probably my main argument for giving it a shot before taking the more drastic measures ...