recover disk

[jaclaz]

okay here it is:

http://ifile.it/txnr20g

it includes the 0-100 sector dd file and the MBR/PBR of all partitions and drives

WHY?

I mean, I don't have any use for the "other" (main, boot, working) drive.

The "right" files for the drive should be only:

• image[0-51200].dd
  
• MBR_HardDisk1.dat
  
• BootSector_DriveF.dat
  
• BootSector_DriveG.dat
  
• BootSector_DriveH.dat
  

Ther is nothing actually wrong in the MBR_HardDisk1.dat (same contents of image[0-51200].dd) exception made for the extended partition marked 05 (CHS mapped) instead of 0F (LBA mapped).

I don't believe TESTdisk can have the output you posted, unless the problem is in the actual EPBR's.

First partition (what becomes "F:") is from LBA 63 for 41913522 up to 41913585

First EPBR is at LBA 41913585

Second partition (first volume inside Extended, what becomes "G:") has a "strange" sectors before of 65.

Third partition (second volume inside Extended, what becomes "H:") has "standard" sectors before of 63.

BOTH volumes inside extended have "crazy" values for $MFT and $MFT mirror placement.

Let's have a look at the actual EPBR's.

IF the data in the sectors you posted is correct you have:

the extended partition from sector LBA 41913585 for 153452880 i.e. 78,567,874,560 bytes

Inside it you should have (unless I am mistaken):

1. 63 hidden sectors for the first EPBR
   
2. 89,755,088 sectors for the G: NTFS filesystem (45,954,605,056 bytes)
   
3. 1 exceeding sector for PBR mirror
   
4. 63 hidden sectors for the second EPBR
   
5. 63,697,656 sectors for the H: NTFS filesystem (32,613,199,872 bytes)
   
6. 1 exceeding sector for PBR mirror
   

Values #2 and #5 don't make much sense as they don't respect 255/63 geometry.

Let's try with three more files - hoping we'll get the actual EPBR's and the PBR mirrors:

1. Start at sector 41,913,580 for 100 sectors
   
2. Start at sector 131,668,730 for 100 sectors
   
3. Start at sector 195,366,365 for 100 sectors
   

jaclaz

[colore]

here it is, i hope it's the right files:

http://ifile.it/z1qebhn

[jaclaz]

here it is, i hope it's the right files:

http://ifile.it/z1qebhn

The files are seemingly "right", their content unfortunately isn't.

This means that the info in the MBR is completely "nuts".

Try getting Dmde and analyze the image:

http://softdm.com/

jaclaz

[colore]

it recognizes only C: partition

I don't know what to do, I think I will just copy the files to another disk and get rid of the damaged disk :S