Welcome, Guest. Please login or register.
Did you miss your activation email?
June 20, 2019, 07:29:40 AM
Home Help Search Login Register
News:

+  DIY DataRecovery.nl Support forum
|-+  Support
| |-+  DiskPatch (Moderators: Tom, Joep)
| | |-+  Recovering a partition encrypted using BitLocker
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: 1 [2] Go Down Print
Author Topic: Recovering a partition encrypted using BitLocker  (Read 74861 times)
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #15 on: February 06, 2013, 07:53:00 AM »

I very much doubt deleting the partition will help you. How did that number get there, in the partition table (381897117)? What was the disk partitioned with?

Anyway, the real number that the file system uses is the one in the boot sector (381896001).
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
spyder_pk
member

Posts: 14


« Reply #16 on: February 06, 2013, 05:54:25 PM »

Thanks Joep!

I cannot believe I missed that!  Huh

Should I then edit the MBR to number 381896001 as total sectors in the first drive instead of 381897117 it is showing now?! Will that fix it? I backed up all data from the first partition in case I plan to go ahead with any repairs.
Logged
spyder_pk
member

Posts: 14


« Reply #17 on: February 06, 2013, 08:16:42 PM »

Hi Joep!

I found out the problem.. it is as you said!

After reading your post.. I did some calculations and it was there right in front of us all along! I decided to check what the boot sector dump at sector 63 (start sector for the NTFS drive that is working) showed.

I was shocked to see I missed that the boot sector dump of at sector 63 showed the total sectors in the partition to be 381896001 AND NOT 381897117 as shown in MBR!

So I decided to do the calculations with 381896001 as total sectors and here it is:
381896001 + 63(Start of partition 0) = 381896064 - END OF Partition 0 (Location of Backup BS??)
Start of Lost partition is 381896704
So.. 381896704-381896064= 640 - NO OVERLAPPING FOR 640 SECTORS!!!

It is now CONFIRMED! Total Sectors count for Partition 0 in MBR is false!

Confirmation is the Backup Boot Sector Dump for sector 63 is found at sector 381896064 (63+381896001) from the partition's boot sector and NOT at sector 381897180 (63+381897117) from the MBR.

DUMP at sector 381896064:
Offset(h)   00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
2D868B0000  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  R.NTFS    .....
2D868B0010  00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00  .......?..?...
2D868B0020  00 00 00 00 80 00 80 00 41 45 C3 16 00 00 00 00  ......AE.....
2D868B0030  02 00 00 00 00 00 00 00 54 C4 D1 01 00 00 00 00  ........T.....
2D868B0040  F6 00 00 00 01 00 00 00 4E 9B 9C 78 A9 9C 78 04  .......Nxx.
2D868B0050  00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07  ....3м.|.
2D868B0060  8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00  ....3...
2D868B0070  10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4  .S.h..hj.ˊ.$.
2D868B0080  08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66  ..s.f.@f
2D868B0090  0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F  .р?.Af.
2D868B00A0  B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A  ff .ôAU
2D868B00B0  16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01  .$..r..Uu..
2D868B00C0  74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66  t....f`..f..f
2D868B00D0  03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A  ....f;. ..:..fj
2D868B00E0  00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00  .fP.Sfh....>...
2D868B00F0  0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00  ...>....a.
2D868B0100  B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07  B.$....fX[.
2D868B0110  66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00  fXfX.-f3f....
2D868B0120  66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36  fŠff.6
2D868B0130  1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8  ..֊.$...̸
2D868B0140  01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66  ....... .f
2D868B0150  FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61  .......o..fa
2D868B0160  C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE  ... ...
2D868B0170  B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10  .<.t.....
2D868B0180  EB F2 C3 0D 0A 41 20 64 69 73 6B 20 72 65 61 64  ..A disk read
2D868B0190  20 65 72 72 6F 72 20 6F 63 63 75 72 72 65 64 00   error occurred.
2D868B01A0  0D 0A 4E 54 4C 44 52 20 69 73 20 6D 69 73 73 69  ..NTLDR is missi
2D868B01B0  6E 67 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F  ng...NTLDR is co
2D868B01C0  6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73 73  mpressed...Press
2D868B01D0  20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F   Ctrl+Alt+Del to
2D868B01E0  20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00   restart........
2D868B01F0  00 00 00 00 00 00 00 00 83 A0 B3 C9 00 00 55 AA  ........ ..U

So we edit the MBR!!!

Guide me Smiley
Logged
Tom
Developer and Support Tech
Administrator
member
*****
Posts: 1476


WWW
« Reply #18 on: February 07, 2013, 10:08:48 PM »

You could edit the MBR to 'adjust' the incorrect value for that first volume. Simply use DiskPatch's disk editor and go to the MBR (which is displayed by default when starting the disk editor). Start the partition table editor and correct the value (so LBA length for the first volume should be 381896002).
You will be doing this at your own risk, we here don't believe it is going to make a difference, but it's up to you. I suppose there's no harm in doing this, but make sure the undo feature is active so you can roll back the changes if needed.
Logged

spyder_pk
member

Posts: 14


« Reply #19 on: February 08, 2013, 04:53:29 AM »

Hi Joep,

Why 381896002? Why not 381896001 as in the boot sector?

The BS mirror is at 381896064 and partition starts at 63, so 381896001+63=381896064

If I enter 381896002 then BBS will not be found again? Or am I missing something? Also will I need to make any changes to the end CHS for partition 0 in the MBR?

Thanks
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #20 on: February 08, 2013, 08:27:39 AM »

Hello,

381896001 is the size of the file system. The backup boot is not part of the file system but is directly following, so 381896001 + 1. Leave CHS as they are, they're obsolete and ignored by Windows anyway.

Now, we have just found numbers that don't exactly match. No way of telling if fixing this value in the partition table will fix things. I doubt it to be honest.
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
spyder_pk
member

Posts: 14


« Reply #21 on: February 09, 2013, 06:26:09 AM »

Hi,

Well then you would be wrong!!  Grin

Because that is what fixed it! And I have all my data back!






But I was afraid to edit HEX data manually so I downloaded a software called Partition Guru Pro from: http://www.partitionguru.com/download.php

When I ran it it said there were 2 problems in my HDD:
1) No active partitions - didn't need it
2) Space conflict between partitions - the culprit!

So I just chose to let it fix the problems. Nothing happened initially after I reconnected the drive via USB except it making my first partition active! I was very disappointed at that point.. so I went into Diskpart and marked it inactive and  disconnected/reconnected the drive and voil!! Windows said the drive was bitlocked and asked for a password.. accepted the password and showed me the data!  Cheesy

Thank you for pointing out the end sector in BS was different than that in the MBR. That really pinpointed the error. Also without your log files I could not have made out what was happening really quickly.

Also "The Starman" from http://thestarman.pcministry.com/ helped/guided me A LOT! throughout!

I have learnt my lesson now and backed up the encrypted data on another drive the moment I got it back!

You can close this thread now! Everything is fixed!

Final LOG file:

.../000:03/LOG> ### LOG START ###
.../000:03/LOG> DISKPATCH 3.5.300
.../000:03/LOG> (C) 2000-2009 DIY DataRecovery
.../000:03/LOG> Contact info: http://HTTP://www.DIYDataRecovery.nl
.../000:03/LOG> MemFree: 62Kb
.../000:03/LOG> CommandLineParms:
.../000:03/LOG> LogDate: 02-09-2013
.../000:03/CFG> FilePath="C:DPFILES\"
.../000:03/CFG> ReadRetries="32"
.../000:03/CFG> WriteRetries="32"
.../000:03/CFG> MaxReadErrors="32"
.../000:03/CFG> MaxWriteErrors="1"
.../000:03/CFG> LogEachReadError="1"
.../000:03/CFG> ReadDelay="0"
.../000:03/CFG> VfyFixedBadSect="1"
.../000:03/CFG> CleanAfterDOD="1"
.../000:03/CFG> DiskReset="1"
.../000:03/CFG> SectorSkip="1024"
.../000:03/CFG> AutoSaveState="1"
.../000:03/CFG> DumpFoundSectors="0"
.../000:03/CFG> FixFats="1"
.../000:03/CFG> MaxFatScan="51200"
.../000:03/CFG> MaxDataColEntries="256"
.../000:03/CFG> IgnoreF8FF="0"
.../000:03/CFG> DownSizeExt="1"
.../000:03/CFG> ScanSignature="55AA"
.../000:03/CFG> Rebuild="00"
.../000:03/13H> Ext13H installed test requested
.../000:03/13H> Disk found at 128
.../000:03/13H> Ext13H version: EDD-3.0
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Removable drive controller functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:03/13H> Ext13H Flags: Cylinder/head/sector info is valid
.../000:03/13H> Drive Interface Info:
.../000:03/13H> Disk 128 X13H data : 491/255/63 7892992/512
.../000:03/13H> Disk found at 129
.../000:03/13H> Ext13H version: EDD-3.0
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Removable drive controller functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:03/13H> Drive Interface Info:
.../000:03/13H> Disk 129 X13H data : 0/0/0 488397166/512
.../000:03/13H> Disk found at 130
.../000:03/13H> Ext13H version: EDD-3.0
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:03/13H> Drive Interface Info:
.../000:03/13H> Disk 130 X13H data : 16383/16/63 234441648/512
.../000:03/13H> Ext13H tested ok
.../000:03/FDL> DiskList requested
.../000:03/FDL> Disk found at 128
.../000:03/FDL> Disk found at 129
.../000:03/FDL> Disk found at 130
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB_|__GEO
128 | ...7892992 | 255 | 63 | ..3 | BIOS
129 | .488397166 | 255 | 63 | 232 | BIOS
130 | .234441648 | 255 | 63 | 111 | BIOS
..0 | .........0 | ..0 | .0 | ..0 | BIOS
.../000:03/IAS> AdmiSector found on disk 0 (128)
.../000:03/IAS> AdmiSector found on disk 1 (129)
.../000:03/IAS> AdmiSector found on disk 2 (130)
.../000:04/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:04/EXE> Read/Write pattern test for disk 1 (129) successful
.../000:05/EXE> Read/Write pattern test for disk 2 (130) successful
.../000:05/WAS> AdmiSectors in use : 0+ 1+ 2+
.../000:05/KEY> 251OO6OO74/8
.../000:05/PFC> PQstuff signature not detected on disk 0 (128)
.../000:05/PFC> PQstuff signature not detected on disk 1 (129)
.../000:05/PFC> PQstuff signature not detected on disk 2 (130)
.../000:05/PFC> UDMA driver not loaded
.../000:05/PFC> Disk health not checked
.../000:06/PFC> Partition State backup not found on disk 0 (128)
.../000:06/PFC> Partition State backup not found on disk 1 (129)
.../000:06/PFC> Partition State backup not found on disk 2 (130)
.../000:06/PFC> No Repair date found on disk 0 (128)
.../000:06/PFC> No Repair date found on disk 1 (129)
.../000:06/PFC> No Repair date found on disk 2 (130)
.../000:11/MNU> - Main, Select Disk
.../000:17/CSD> Start CheckDisk for disk 1 (129)
.../000:17/CSD> CheckDisk complete, ReadErrors 0
.../000:17/USD> Disk 1 (129) selected
.../000:17/GSC> No geo change detected for disk 1 (129)
.../000:17/WAS> AdmiSectors in use : 0+ 1+ 2+
129/000:17/USD> MBR for disk 1 (129)
129/000:17/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C  |  3м.|P.P..|
016   BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04  |  ..PW.˽..
032   38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5  |  8n.|.u...
048   83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B  |  .It.8,t ..
064   F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88  |  <.t....
080   4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B  |  N.F.s*F.~..t.
096   80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83  |  ~..t. .uҀF..
112   46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB  |  F..V..!.s. .
128   BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0  |  >}Ut.~..t
144   B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56  |  .멋.W˿..V
160   00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC  |  ...r#$?ފ
176   43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56  |  Cцֱ.B9V
192   0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C  |  .w#r.9F.s....|
208   8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A  |  N.V..sQOtN2
224   56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD  |  V..V.`UA
240   13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60  |  .r6Uu0.t+a`
256   6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A  |  j.j..v..v.j.h.|j
272   01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B  |  .j.B.aas.Ot.
288   32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61  |  2V..aInva
304   6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61  |  lid partition ta
320   62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E  |  ble.Error loadin
336   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  |  g operating syst
352   65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  |  em.Missing opera
368   74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00  |  ting system.....
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 00 73 B5 A4 00 00 00 01  |  .........s....
448   01 00 07 FE FF FF 3F 00 00 00 42 45 C3 16 00 FE  |  .....?...BE..
464   FF FF 07 FE FF FF 00 48 C3 16 00 00 59 06 00 00  |  ......H...Y...
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U
###
129/000:17/VEC> Start Verify EPBR Chain for disk 1 (129)
129/000:17/VEC> Listing current partitions on disk:
129/000:17/VEC>     NTFS (P)  FreeAgent D          63   381896002     (182 Gb)
129/000:17/VEC>     NTFS (P)      NO NAME   381896704   106496000      (51 Gb)
129/000:17/VEC> Partition Table info for sector 0 (0 0 1)
129/000:17/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..07 | ....0...1...1 | .1023.254..63 | ........63 | .381896002
..2 ...0 | ..07 | .1023.254..63 | .1023.254..63 | .381896704 | .106496000
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/000:17/VEC> 55AA sig Ok
129/000:17/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 381896001
........MFT Location (dec): 2
.MFT Mirror Location (dec): 30524500
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): 04789CA9789C9B4E
........Volume Label (txt): FreeAgent D
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
129/000:17/VEC> BS and BBS equal
129/000:17/LOG> Boot sector dump requested at 381896704 (23771 247 29)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5890
............OEM Name (txt): -FVE-FS-
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 381896704
..............Unused (hex): 00000000
.............Unknown (hex): 00001FE0
.......Total Sectors (dec): 0
........MFT Location (dec): 393217
.MFT Mirror Location (dec): 0
....Clusters per FRS (dec): 2687104
.Clusters/Indx Block (dec): 1308622848
...........Volume ID (hex): 2020454D414E204F
........Volume Label (txt): NO NAME
............Checksum (hex): 41462020
....Sector Signature (hex): AA55
129/000:17/VEC> BS and BBS not equal, dump follows;
129/000:17/LOG> Boot sector dump requested at 488392703 (30401 10 9)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): 14C02C
............OEM Name (txt): p1} +
....Bytes per Sector (dec): 17179
.Sectors per Cluster (dec): 165
....Reserved Sectors (dec): 4294951377
..............Unused (hex): 79CF7E1AFD
....Media Descriptor (hex): 71
..............Unused (hex): 4144
...Sectors per Track (dec): 4294957122
.....Heads per Track (dec): 4294962553
......Hidden Sectors (dec): 280752731
..............Unused (hex): 4C0DEC5D
.............Unknown (hex): B8A7CC09
.......Total Sectors (dec): 2633527330
........MFT Location (dec): 1942010997
.MFT Mirror Location (dec): 1784810133
....Clusters per FRS (dec): 1831991639
.Clusters/Indx Block (dec): 4224906717
...........Volume ID (hex): F9E181174FF48AEE
........Volume Label (txt): (Err)
............Checksum (hex): A7F7D126
....Sector Signature (hex): CD27
129/000:17/VEC> Verify EPBR Chain completed
129/000:18/USD> Select disk completed
129/000:26/MNU> - Main, Repairs
129/000:28/MNU> - Repair, Rebuild Boot Sectors
129/000:32/UND> Undo skipped
129/000:33/LOG> Undo settings: GL(+) DE(+) FAT(+)
129/000:36/MNU> - Main, Repairs
129/000:39/MNU> - Repair, Rebuild Boot Sectors
129/000:40/UND> New Undo archive created for disk 1 (129)
129/000:40/LOG> Undo settings: GL(+) DE(+) FAT(+)
129/000:46/BSE> Start BSedit NTFS at 381896704 (23771 247 29)
129/000:46/LOG> Boot sector dump requested at 381896704 (23771 247 29)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5890
............OEM Name (txt): -FVE-FS-
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 381896704
..............Unused (hex): 00000000
.............Unknown (hex): 00001FE0
.......Total Sectors (dec): 0
........MFT Location (dec): 393217
.MFT Mirror Location (dec): 0
....Clusters per FRS (dec): 2687104
.Clusters/Indx Block (dec): 1308622848
...........Volume ID (hex): 2020454D414E204F
........Volume Label (txt): NO NAME
............Checksum (hex): 41462020
....Sector Signature (hex): AA55
129/000:52/BSE> End BSedit NTFS at 381896704 (23771 247 29), changes discarded
129/000:55/BSE> Start BSedit NTFS at 63 (0 1 1)
129/000:55/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 381896001
........MFT Location (dec): 2
.MFT Mirror Location (dec): 30524500
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): 04789CA9789C9B4E
........Volume Label (txt): FreeAgent D
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
129/000:59/BSE> End BSedit NTFS at 63 (0 1 1), changes discarded
129/001:00/UND> Undo archive discarded, no sectors saved
129/001:04/MNU> - Main, MBR ops
129/001:09/MNU> - Main, Utilities
129/001:17/MNU> - Main, Select Disk
129/001:21/VEC> Start Verify EPBR Chain for disk 1 (129)
129/001:21/VEC> Listing current partitions on disk:
129/001:21/VEC>     NTFS (P)  FreeAgent D          63   381896002     (182 Gb)
129/001:21/VEC>     NTFS (P)      NO NAME   381896704   106496000      (51 Gb)
129/001:21/VEC> Partition Table info for sector 0 (0 0 1)
129/001:21/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..07 | ....0...1...1 | .1023.254..63 | ........63 | .381896002
..2 ...0 | ..07 | .1023.254..63 | .1023.254..63 | .381896704 | .106496000
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/001:21/VEC> 55AA sig Ok
129/001:21/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 381896001
........MFT Location (dec): 2
.MFT Mirror Location (dec): 30524500
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): 04789CA9789C9B4E
........Volume Label (txt): FreeAgent D
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
129/001:21/VEC> BS and BBS equal
129/001:21/LOG> Boot sector dump requested at 381896704 (23771 247 29)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB5890
............OEM Name (txt): -FVE-FS-
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 381896704
..............Unused (hex): 00000000
.............Unknown (hex): 00001FE0
.......Total Sectors (dec): 0
........MFT Location (dec): 393217
.MFT Mirror Location (dec): 0
....Clusters per FRS (dec): 2687104
.Clusters/Indx Block (dec): 1308622848
...........Volume ID (hex): 2020454D414E204F
........Volume Label (txt): NO NAME
............Checksum (hex): 41462020
....Sector Signature (hex): AA55
129/001:21/VEC> BS and BBS not equal, dump follows;
129/001:21/LOG> Boot sector dump requested at 488392703 (30401 10 9)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): 14C02C
............OEM Name (txt): p1} +
....Bytes per Sector (dec): 17179
.Sectors per Cluster (dec): 165
....Reserved Sectors (dec): 4294951377
..............Unused (hex): 79CF7E1AFD
....Media Descriptor (hex): 71
..............Unused (hex): 4144
...Sectors per Track (dec): 4294957122
.....Heads per Track (dec): 4294962553
......Hidden Sectors (dec): 280752731
..............Unused (hex): 4C0DEC5D
.............Unknown (hex): B8A7CC09
.......Total Sectors (dec): 2633527330
........MFT Location (dec): 1942010997
.MFT Mirror Location (dec): 1784810133
....Clusters per FRS (dec): 1831991639
.Clusters/Indx Block (dec): 4224906717
...........Volume ID (hex): F9E181174FF48AEE
........Volume Label (txt): (Err)
............Checksum (hex): A7F7D126
....Sector Signature (hex): CD27
129/001:40/VEC> Verify EPBR Chain completed
129/001:41/USD> No source / disk selected
.../001:41/USD> Select disk completed
.../001:44/MNU> - Main, Quit
.../001:44/LOG> RunTime: 001:44
.../001:44/LOG> ### CLOSE LOG ###


Thanks again!
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1476



WWW
« Reply #22 on: February 09, 2013, 10:06:44 AM »

AWSOME! Okay, I am glad I have learned something, and I am glad you have your data back .. It's just, I had never seen a case like this .. and I was indeed pessimistic but I am glad I was wrong!

Quote
But I was afraid to edit HEX data manually

Yeah, you could have entered decimal values using DiskPatch or even our freebee MBRtool.
Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://youtu.be/Ox2F8QRuU5Q
Pages: 1 [2] Go Up Print 
« previous next »
Jump to:  


Login with username, password and session length

Powered by MySQL Powered by PHP Powered by SMF 1.1.20 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!