FUBAR Drive - Any ideas?

PDD

Hi Guys,

I am in a desperate situation here. I have a 160Gb Maxtor drive that I have some business files on that I need to get access to but the thing is FUBAR and Im lost as to what to do. I "aquired" a copy of Acronis True Image and tried to install it but something went wrong during the install and now I cant access anything on the drive. I installed True Image no problems and then it said I had to restart the machine for changes to take effect. I restarted the machine. When it restarted it then went through some process of inspecting/indexing the partitons and during this process it stalled/crashed on one of the partitions. It said it could not read it and gave me the options of retry,ignore,ignore all. I tried all options but nothing happened so I had to softboot the machine. When it booted up again it seemed to boot into Win2K no problems, the splash screen came up and underneath it the progress bar showed it at about half way. It stays like this for about 15/20mins and then it goes blue screen with the error inaccesible_boot_device and some instructions. Now I know there is documented causes for this error on ars forums and on the MS site but I dont seem to be able to get access to the drive at all.

• My machine wont boot a 98 CD to give me a DOS prompt, it simply hangs
• It wont boot a SE boot disk, it simply hangs
• An attempt at doing a repair install of 2K simply leaves the machine chugging over for about 20mins then it restarts but wil display no change in boot behaviour at all.
• I tried an old 98 boot disk that I have and it gave me an NTLDR is missing error.
• I also tried booting into Partition Expert 2003 but it would try to read the partitions but just hung.
• I was able to book a K-Ubuntu Live CD but I could see 60odd partitions containing the same information (all my emails) but the HDD origionally had about 12 partitions on it.
• Ive tried putting it into an external housing and hooking it up to an XP machine but it didnt pick up any of the partitions.
• Ive tried hooking it up to another machine internally and it displayed the same boot behaviour.

Have the partitions and the files been physically overwritten and are gone or is it a case of the partitons and files are there just the refferences to them are screwed up? Can anyone provide any kind of insight into whats going on here coz Im at a complete loss.

Ive been quoted rediculous amounts of money from data recovery companies but Im not sure the files are worth that much.

niallb

Your partition table is trashed. Nice one Acronis.
Do as little as possible wth the drive.
Everything you try can make it less likely you'll get anything back.
Your files should still be there unless the windows reinstall wrecked them. What kind of files are they?

There is a tool called gpart, which attempts to rebuild a partition
table by analyzing the whole disk. It can need a little handholding,
but in general it does a great job.

Its installed on Knoppix, which would be a far more capable rescue
disk than kubuntu.

Take a read through these - they should help you get a feel for what's happened.

• True Stories of Knoppix Rescues
• Partition Rescue Howto

Good luck with it.

NiallB

PDD

Hey Niallb,

Cheers for the info man, so am I right in saying that the data's there but my because the partition table is trashed it has no idea where partitions are etc?

I will try that too man, thanks a million.

PDD

niallb

That should be right. The data's there until
the sectors are reused.

This is why you need to be careful with the drive.
Without the partition information, the OS has no
idea of what bits of the drive it shouldn't overwrite.

gpart can take some time, but it's the closest thing
to an automated fix to your problem you'll find.

Don't say yes to any questions you're not absolutely certain of,
and post here if you're anyway unsure.

You said there were about 12 partitions on the drive.
Any chance you have a list of them anywhere?
Do you remember how you set them up?
Write down as much detail as you can recall,
so that you can feel when gpart is on the right track.

Write down partial contents of your most important files.
If they are text based (and uncompressed), you can pull them back from
the raw disk is many cases. jpeg data is also easy to retrieve.

Best of luck,
NiallB

PDD

Ok I think Ive made some progress, I booted Knoppix Live CD and ran gpart, the results are as follows:

** Error: more than 128 logical partitions encountered.

Begin scan...
Possible partition(Linux ext2), size(5122mb), offset(0mb)
Possible extended partition at offset(5122mb)
Possible partition(Linux ext2), size(5122mb), offset(15366mb)
End scan.

Checking partitions...

* Warning: more than one extended partition: 2.
Partition(Linux ext2 filesystem): primary
Partition(Linux ext2 filesystem): invalid

* Warning: partition(Extended DOS, LBA) ends beyond disk end.
Number of inconsistencies found: 1.

Guessed primary partition table:
Primary partition(1)
type: 131(0x83)(Linux ext2 filesystem)
size: 5122mb #s(10490376) s(63-10490438)
chs: (0/1/1)-(652/254/57)d (0/1/1)-(652/254/57)r

Primary partition(2)
type: 015(0x0F)(Extended DOS, LBA)
size: 156319mb #s(320143320) s(10490445-330633764)
chs: (653/0/1)-(1023/254/63)d (653/0/1)-(20580/254/63)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

I know I only had the one primary partition for booting windows, everything else were FAT-32 extended / logical partitions which Im guessing are all locked up in the second primary partition of 156319mb that gpart detected. Any ideas on how to find/recover the other logical partitions?

PDD

Ive also tried parted with limited success, I ran: "sudo parted /dev/hda/"

GNU Parted 1.6.9
Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003 Free Software Foundation, Inc.
This program is free software, covered by the GNU General Public License.

This program is distributed in the hope that it will be useful, but WITHOUT ANY
WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE. See the GNU General Public License for more details.

Using /dev/hda
Warning: Unable to align partition properly. This probably means that another
partitioning tool generated an incorrect partition table, because it didn't have
the correct BIOS geometry. It is safe to ignore,but ignoring may cause
(fixable) problems with some boot loaders.
Ignore/Cancel? i
Error: Unable to satisfy all constraints on the partition.
(parted) print
Error: Unable to satisfy all constraints on the partition.
(parted)

niallb

I think you have to provisionally restore the extended partition
for gpart to look inside it.
Have you ever had linux installed on that drive?
It seems strange it would have found an ext2 partition otherwise,
but if you haven't the second partition may be wrong.
It looks like possibly a partition got relabelled as linux
as the cause of your problems.
Such a relabelling of the partition type would cause
Windows to fail with an inaccessible boot device,
but still allow the bootstrapped ntldr to run.

If that's the case, and gpart manages to get your partition table
back, you'll need to run fdisk on it, and change the partition type
after recovery.

Was your Win2K partition about 5G, or is that size way off?
If it sounds right, let gpart try that confguration, and see what else you find.

Keep us posted,
NiallB

PDD

Hi Niall,

Yep there was Linux partitions at the start of the drive, I think I had two because at one stage I had planned to installe Suse and also a few other distro to try them out so I had 5Gb partitions for different OS's. Im assuming that this is the first primary partition and the rest of the drive is then the second primary partition with the fat-32 logical partitions. The sizes look about right with regard to the 5Gb. Im not exactly sure how to use GPart but from what your saying and whats in the documentation can I load a particular drive configuration to checkout partitions before writing it back to the disk/

Dave

niallb

Any time I've done it, I've backed up the MBR and (broken) partition table first
using dd if=/dev/hda of=/tmp/MBR.hda1.dd bs=512 count=1.

The if= is the input file - your drive - the of= is the output file to backup to,
and the rest means to read one block of 512 bytes.

If gpart doesn't work out, you can put it back the way it was
using dd if=/tmp/MBR.hda1.dd of=/dev/hda bs=512 count=1.
(Change hda to whatever your drive is at the moment.)

This is the most important attitude in data recovery - that you can always
go back to the way things were before your latest brainwave.
Ideally, you should make no changes to the drive at all until
you get your data off it.
If at all possible, it's better to work on an image of the drive
instead of the drive itself, but that's not really an option for you here.

If you let gpart use the partitioning it suggests, it will then continue
and show you possible partitions within the second partition,
which is an extended partition rather than a primary.
Extended partitions are containers for logical partitions,
and if you get the start block right, it's extremely likely
it just continues to the end of the drive.
You should be given a chance to back out if you don't like
what you get, but if not, the dd command above will break
it again in exactly the same way as it was.
Be VERY careful with dd!
Type exactly what is written above unless you have a
complete and confident understanding of why it should be different.

I'll keep an eye on the forum,
talk to you soon,
NiallB