Jump to content

recover disk


Recommended Posts

okay here it is:

http://ifile.it/txnr20g

it includes the 0-100 sector dd file and the MBR/PBR of all partitions and drives

WHY?

I mean, I don't have any use for the "other" (main, boot, working) drive.

The "right" files for the drive should be only:

  • image[0-51200].dd
  • MBR_HardDisk1.dat
  • BootSector_DriveF.dat
  • BootSector_DriveG.dat
  • BootSector_DriveH.dat

Ther is nothing actually wrong in the MBR_HardDisk1.dat (same contents of image[0-51200].dd) exception made for the extended partition marked 05 (CHS mapped) instead of 0F (LBA mapped).

I don't believe TESTdisk can have the output you posted, unless the problem is in the actual EPBR's. :unsure:

First partition (what becomes "F:") is from LBA 63 for 41913522 up to 41913585

First EPBR is at LBA 41913585

Second partition (first volume inside Extended, what becomes "G:") has a "strange" sectors before of 65.

Third partition (second volume inside Extended, what becomes "H:") has "standard" sectors before of 63.

BOTH volumes inside extended have "crazy" values for $MFT and $MFT mirror placement. :ph34r:

Let's have a look at the actual EPBR's.

IF the data in the sectors you posted is correct you have:

the extended partition from sector LBA 41913585 for 153452880 i.e. 78,567,874,560 bytes

Inside it you should have (unless I am mistaken):

  1. 63 hidden sectors for the first EPBR
  2. 89,755,088 sectors for the G: NTFS filesystem (45,954,605,056 bytes)
  3. 1 exceeding sector for PBR mirror
  4. 63 hidden sectors for the second EPBR
  5. 63,697,656 sectors for the H: NTFS filesystem (32,613,199,872 bytes)
  6. 1 exceeding sector for PBR mirror

Values #2 and #5 don't make much sense as they don't respect 255/63 geometry.

Let's try with three more files - hoping we'll get the actual EPBR's and the PBR mirrors:

  1. Start at sector 41,913,580 for 100 sectors
  2. Start at sector 131,668,730 for 100 sectors
  3. Start at sector 195,366,365 for 100 sectors

jaclaz

Link to comment
Share on other sites


Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...