EFI BIOS GUID Partition Type - Continuing May Corrupt Disk Structures

[ckent1]

Tom, here are the four Disk Editor sector dumps done under forensic mode after removing the DiskPatch admi sector, RESERVEDBYDIYDDR:



.../000:01/LOG> ### LOG START ###
.../000:01/LOG> DISKPATCH 4.0.200
.../000:01/LOG> (C) 2000-2013 DIY DataRecovery
.../000:01/LOG> Contact info: www.DIYDataRecovery.nl
.../000:01/LOG> MemFree: 62Kb
.../000:01/LOG> CommandLineParms: /for
.../000:01/LOG> LogDate: 10-31-2013
.../000:01/CFG> FilePath="C:DPFILES\"
.../000:01/CFG> ReadRetries="32"
.../000:01/CFG> WriteRetries="32"
.../000:01/CFG> MaxReadErrors="32"
.../000:01/CFG> MaxWriteErrors="1"
.../000:01/CFG> ReadDelay="0"
.../000:01/CFG> LogEachReadError="1"
.../000:01/CFG> WriteAfterReadError="1"
.../000:01/CFG> VfyFixedBadSect="1"
.../000:01/CFG> CleanAfterDOD="1"
.../000:01/CFG> DiskReset="1"
.../000:01/CFG> SectorSkip="1024"
.../000:01/CFG> AutoSaveState="1"
.../000:01/CFG> DumpFoundSectors="0"
.../000:01/CFG> FixFats="1"
.../000:01/CFG> MaxFatScan="51200"
.../000:01/CFG> MaxDataColEntries="256"
.../000:01/CFG> IgnoreF8FF="0"
.../000:01/CFG> DownSizeExt="1"
.../000:01/CFG> ScanSignature="55AA"
.../000:01/CFG> Rebuild="00"
.../000:01/13H> Ext13H installed test requested
.../000:01/13H> Disk found at 128
.../000:01/13H> Ext13H version: EDD-3.0
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Ext13H Support: Enhanced disk drive functions
.../000:01/13H> Ext13H Flags: Cylinder/head/sector info is valid
.../000:01/13H> Drive Interface Info:
.../000:01/13H> Disk 128 X13H data : 2001/16/63 2017280/512
.../000:01/13H> Disk found at 129
.../000:01/13H> Ext13H version: EDD-3.0
.../000:01/13H> Ext13H Support: Extended disk access functions
.../000:01/13H> Drive Interface Info:
.../000:01/13H> Disk 129 X13H data : 16383/16/63 1953525168/512
.../000:01/13H> Ext13H tested ok
.../000:01/FDL> DiskList requested
.../000:01/FDL> Disk found at 128
.../000:01/FDL> Disk found at 129
### DISKLIST ###
__D_|________LBA_|___H_|__S_|___GB_|__GEO_|___SS_
128 | ...2017280 | .16 | 63 | ...0 | BIOS | .512
129 | 1953525168 | 255 | 63 | .931 | BIOS | .512
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0
..0 | .........0 | ..0 | .0 | ...0 | BIOS | ...0
.../000:01/EXE> !- EFI BIOS / GUID partition type found on disk 1 (129)
.../000:06/IAS> Forensic mode; no AdmiSectors used
.../000:06/IAS> Forensic mode; no AdmiSectors used
.../000:06/WAS> AdmiSectors in use : 0- 1-
.../000:17/KEY> DEMO/1
.../000:27/PRD> Disk 1 (129) locked
.../000:30/PFC> PQstuff signature not detected on disk 0 (128)
.../000:30/PFC> PQstuff signature not detected on disk 1 (129)
.../000:30/PFC> Disk health not checked
.../000:32/PFC> Partition State backup not found on disk 0 (128)
.../000:32/PFC> Partition State backup not found on disk 1 (129)
.../000:32/PFC> No Repair date found on disk 0 (128)
.../000:32/PFC> No Repair date found on disk 1 (129)
.../000:40/MNU> - Main, Select Disk
.../000:41/USD> No source / disk selected
.../000:42/USD> Select disk completed
.../000:43/MNU> - Main, Options
.../001:06/MNU> - Main, Options
.../003:55/MNU> - Main, Select Disk
.../004:07/CSD> Start CheckDisk for disk 1 (129)
.../004:07/CSD> 0 (0 0 1)
.../004:07/CSD> 16064 (0 254 63)
.../004:07/CSD> 1953520065 (121601 0 1)
.../004:07/CSD> 1953525167 (121601 80 63)
.../004:07/CSD> CheckDisk complete, ReadErrors 0
.../004:07/USD> Disk 1 (129) selected
.../004:07/GSC> AdmiSector not in use
.../004:07/GSC> AdmiSector not in use
129/004:07/USD> MBR for disk 1 (129)
129/004:07/LOG> SectorDump requested at 0 (0 0 1)
###
000   33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00  |  3ÀŽÐ¼.|ŽÀŽØ¾.|¿.
016   06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00  |  .¹..üó¤Ph..Ëû¹..
032   BD BE 07 80 7E 00 00 7C 0B 0F 85 0E 01 83 C5 10  |  ½¾.€~..|..…..ƒÅ.
048   E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00  |  âñÍ.ˆV.UÆF..ÆF..
064   B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09  |  ´A»ªUÍ.]r.�ûUªu.
080   F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74  |  ÷Á..t.þF.f`€~..t
096   26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00  |  &fh....f.v.h..h.
112   7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13  |  |h..h..´BŠV.‹ôÍ.
128   9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00  |  ŸƒÄ.žë.¸..».|ŠV.
144   8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1C FE  |  Šv.ŠN.Šn.Í.fas.þ
160   4E 11 75 0C 80 7E 00 80 0F 84 8A 00 B2 80 EB 84  |  N.u.€~.€.„Š.²€ë„
176   55 32 E4 8A 56 00 CD 13 5D EB 9E 81 3E FE 7D 55  |  U2äŠV.Í.]ëž�>þ}U
192   AA 75 6E FF 76 00 E8 8D 00 75 17 FA B0 D1 E6 64  |  ªun.v.è�.u.ú°Ñæd
208   E8 83 00 B0 DF E6 60 E8 7C 00 B0 FF E6 64 E8 75  |  èƒ.°ßæ`è|.°.ædèu
224   00 FB B8 00 BB CD 1A 66 23 C0 75 3B 66 81 FB 54  |  .û¸.»Í.f#Àu;f�ûT
240   43 50 41 75 32 81 F9 02 01 72 2C 66 68 07 BB 00  |  CPAu2�ù..r,fh.».
256   00 66 68 00 02 00 00 66 68 08 00 00 00 66 53 66  |  .fh....fh....fSf
272   53 66 55 66 68 00 00 00 00 66 68 00 7C 00 00 66  |  SfUfh....fh.|..f
288   61 68 00 00 07 CD 1A 5A 32 F6 EA 00 7C 00 00 CD  |  ah...Í.Z2öê.|..Í
304   18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07 32 E4  |  . ·.ë. ¶.ë. µ.2ä
320   05 00 07 8B F0 AC 3C 00 74 09 BB 07 00 B4 0E CD  |  ...‹ð¬<.t.»..´.Í
336   10 EB F2 F4 EB FD 2B C9 E4 64 EB 00 24 02 E0 F8  |  .ëòôëý+Éädë.$.àø
352   24 02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69  |  $.ÃInvalid parti
368   74 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72  |  tion table.Error
384   20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69  |   loading operati
400   6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E  |  ng system.Missin
416   67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  |  g operating syst
432   65 6D 00 00 00 63 7B 9A D5 0B EB 0D 00 00 00 00  |  em...c{šÕ.ë.....
448   02 00 EE FF FF FF 01 00 00 00 FF FF FF FF 00 00  |  ..î.............
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............Uª
###
129/004:07/VEC> Start Verify EPBR Chain for disk 1 (129)
129/004:07/VEC> Listing current partitions on disk:
129/004:07/VEC>  UNKNOWN (P)        (Err)           1  4294967295    (2048 Gb)
129/004:07/VEC> Partition Table info for sector 0 (0 0 1)
129/004:07/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 ...0 | ..EE | ....0...0...2 | .1023.255..63 | .........1 | 4294967295
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
129/004:07/VEC> 55AA sig Ok
129/004:07/LOG> Boot sector dump requested at 1 (0 0 2)
### BootSectorDump for BStype FAT16
...........Jump Code (hex): 454649
............OEM Name (txt): PART...
....Bytes per Sector (dec): 23552
.Sectors per Cluster (dec): 0
....Reserved Sectors (dec): 0
...........FAT count (dec): 227
....Root Entry Count (dec): 4294944297
..Total Sectors (16) (dec): 206
....Media Descriptor (hex): 00
.......FAT Size (16) (dec): 0
...Sectors per Track (dec): 1
.....Heads per Track (dec): 0
......Hidden Sectors (dec): 0
..Total Sectors (32) (dec): 1953525167
........Drive Number (hex): 00
............Reserved (hex): 00
......Boot Signature (hex): 00
...........Volume ID (hex): 00002200
........Volume Label (txt): Žmpt
..Filesystem Type ID (txt):   !¢€Ñ)ñ
....Sector Signature (hex): 0000
1st FAT not found at      : 1 (0 0 2)
2nd FAT not found at      : 1 (0 0 2)
129/004:07/CF8> FAT sectors are equal
129/004:07/LOG> SectorDump requested at 1 (0 0 2)
###
     EFI PART... ¯mpt....".. žŽ=çýÇ" °mp ...........
     ........... ........... ........... ...........
     ........... ........... ........... ...........
     ........... ........... ........... ...........
###
129/004:07/VEC> Verify EPBR Chain completed
129/004:08/USD> Select disk completed
129/004:39/MNU> - Main, Utilities
129/004:41/MNU> - Tools, DiskEditor
129/007:07/UND> New Undo archive created for disk 1 (129)
129/007:07/LOG> Undo settings: GL(+) DE(+) FAT(+)
129/007:07/DED> Start DiskEditor, ScanReady 0
129/008:40/DED> Dump sector requested by user
129/008:40/LOG> SectorDump requested at 1 (0 0 2)
###
000   45 46 49 20 50 41 52 54 00 00 01 00 5C 00 00 00  |  EFI PART....\...
016   E3 29 A6 CE 00 00 00 00 01 00 00 00 00 00 00 00  |  ã)¦Î............
032   AF 6D 70 74 00 00 00 00 22 00 00 00 00 00 00 00  |  ¯mpt....".......
048   8E 6D 70 74 00 00 00 00 21 A2 80 D1 29 F1 CB 4C  |  Žmpt....!¢€Ñ)ñËL
064   9E 8E 3D E7 FD C7 22 20 B0 6D 70 74 00 00 00 00  |  žŽ=çýÇ" °mpt....
080   80 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00  |  €...€...........
096   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
112   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
128   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
144   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
176   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
192   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
208   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
224   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
240   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
256   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
272   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
288   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
304   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
320   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
336   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
352   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
448   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
###
129/010:37/DED> Dump sector requested by user
129/010:37/LOG> SectorDump requested at 2 (0 0 3)
###
000   A4 BB 94 DE D1 06 40 4D A1 6A BF D5 01 79 D6 AC  |  ¤»”ÞÑ.@M¡j¿Õ.yÖ¬
016   65 96 C7 4C A4 F7 79 4D 8F 29 7C FE 72 59 B3 31  |  e–ÇL¤÷yM�)|þrY³1
032   00 08 00 00 00 00 00 00 FF 67 09 00 00 00 00 00  |  .........g......
048   01 00 00 00 00 00 00 80 42 00 61 00 73 00 69 00  |  .......€B.a.s.i.
064   63 00 20 00 64 00 61 00 74 00 61 00 20 00 70 00  |  c. .d.a.t.a. .p.
080   61 00 72 00 74 00 69 00 74 00 69 00 6F 00 6E 00  |  a.r.t.i.t.i.o.n.
096   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
112   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
128   28 73 2A C1 1F F8 D2 11 BA 4B 00 A0 C9 3E C9 3B  |  (s*Á.øÒ.ºK. É>É;
144   4E BC 6B C7 4F 8D 21 44 90 DC F0 5D 2D 2B 5D E4  |  N¼kÇO�!D�Üð]-+]ä
160   00 68 09 00 00 00 00 00 FF 7F 0C 00 00 00 00 00  |  .h.............
176   00 00 00 00 00 00 00 80 45 00 46 00 49 00 20 00  |  .......€E.F.I. .
192   73 00 79 00 73 00 74 00 65 00 6D 00 20 00 70 00  |  s.y.s.t.e.m. .p.
208   61 00 72 00 74 00 69 00 74 00 69 00 6F 00 6E 00  |  a.r.t.i.t.i.o.n.
224   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
240   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
256   16 E3 C9 E3 5C 0B B8 4D 81 7D F9 2D F0 02 15 AE  |  .ãÉã\.¸M�}ù-ð..®
272   5F 07 3C 42 67 33 36 4B AF 22 38 46 28 FF CD 78  |  _.<Bg36K¯"8F(.Íx
288   00 80 0C 00 00 00 00 00 FF 7F 10 00 00 00 00 00  |  .€.............
304   00 00 00 00 00 00 00 80 4D 00 69 00 63 00 72 00  |  .......€M.i.c.r.
320   6F 00 73 00 6F 00 66 00 74 00 20 00 72 00 65 00  |  o.s.o.f.t. .r.e.
336   73 00 65 00 72 00 76 00 65 00 64 00 20 00 70 00  |  s.e.r.v.e.d. .p.
352   61 00 72 00 74 00 69 00 74 00 69 00 6F 00 6E 00  |  a.r.t.i.t.i.o.n.
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   A2 A0 D0 EB E5 B9 33 44 87 C0 68 B6 B7 26 99 C7  |  ¢ Ðëå¹3D‡Àh¶·&™Ç
400   E7 DB A9 CF 9D 79 D9 40 89 60 B2 A8 16 2A 92 BE  |  çÛ©Ï�yÙ@‰`²¨.*’¾
416   00 80 10 00 00 00 00 00 FF 67 70 74 00 00 00 00  |  .€.......gpt....
432   00 00 00 00 00 00 00 00 42 00 61 00 73 00 69 00  |  ........B.a.s.i.
448   63 00 20 00 64 00 61 00 74 00 61 00 20 00 70 00  |  c. .d.a.t.a. .p.
464   61 00 72 00 74 00 69 00 74 00 69 00 6F 00 6E 00  |  a.r.t.i.t.i.o.n.
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
###
129/011:37/DED> Dump sector requested by user
129/011:37/LOG> SectorDump requested at 1953525167 (121601 80 63)
###
000   45 46 49 20 50 41 52 54 00 00 01 00 5C 00 00 00  |  EFI PART....\...
016   FB 44 81 D9 00 00 00 00 AF 6D 70 74 00 00 00 00  |  ûD�Ù....¯mpt....
032   01 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00  |  ........".......
048   8E 6D 70 74 00 00 00 00 21 A2 80 D1 29 F1 CB 4C  |  Žmpt....!¢€Ñ)ñËL
064   9E 8E 3D E7 FD C7 22 20 8F 6D 70 74 00 00 00 00  |  žŽ=çýÇ" �mpt....
080   80 00 00 00 80 00 00 00 E3 29 A6 CE 00 00 00 00  |  €...€...ã)¦Î....
096   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
112   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
128   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
144   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
176   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
192   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
208   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
224   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
240   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
256   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
272   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
288   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
304   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
320   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
336   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
352   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
448   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
###
129/013:21/DED> Dump sector requested by user
129/013:21/LOG> SectorDump requested at 29 (0 0 30)
###
000   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
016   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
032   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
048   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
064   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
080   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
096   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
112   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
128   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
144   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
160   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
176   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
192   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
208   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
224   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
240   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
256   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
272   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
288   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
304   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
320   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
336   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
352   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
368   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
384   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
448   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
###
129/015:27/DED> Exit DiskEditor at 2 (0 0 3)
129/015:27/UND> Undo archive discarded, no sectors saved
129/015:33/MNU> - Main, Quit
129/015:33/LOG> RunTime: 015:33
129/015:33/LOG> ### CLOSE LOG ###



Also, as mentioned, please post the detailed guide for using Gdisk.

[Tom]

Okay, the log confirms my thoughts, so here we go.

First, this:
I now have a good idea of what happened but not of how. The DiskPatch Trial version can only write to one sector on the disk (sector 29) and while that sector is a part of the GPT, it is almost always filled with null characters (DiskPatch checks to see if it is empty before using it, so the fact that DiskPatch used the sector on your disk means that it was originally empty). Putting anything in that sector has no effect on Windows but seems to affect the EFI systems. This is an oversight on my part and will be corrected as soon as possible. Having said that, returning sector 29 to its original state (deleting the DiskPatch data and nulling the sector) should correct the problem. The fact that it doesn't tells me that the EFI has more to do with this than meets the eye. This is difficult to pin down because there are many EFI types out there, but we'll have a look at this.

Here's how to fix the GPT with gdisk.

First, you need a prompt to start gdisk. You have a Linux live CD with gdisk on it, so that is something you must find out first. Find the gdisk executable and start it as follows:

gdisk /dev/sda

The parameter (/dev/sda) selects the first disk in the system. I'm basing this on the logs you posted so if nothing has changed since these logs it should be good. If not, you'll have to find out for yourself which disk is the problem disk. sda is the first disk, sdb the second, sdc the third etc. Only hard disks count.
You'll probably know when you have the correct disk because gdisk will complain about the state of the GPT.
After that you should have the gdisk prompt. You can enter ? for a list of commands, but here are the commands you need to enter:
enter r. this will send you to the Recovery menu.
enter c. this will restore the backup.
enter w. this will write changes to disk.
enter q. this will exit gdisk.
That is it. Throughout entering these commands you may receive confirmation prompts, read the text and if no alarms are raised, continue.

I have done this using the Windows version of gdisk. I'm sure that the commands are the same for all gdisk versions but it might be nice to enter ? at the menus to make sure that the commands I've given here are indeed the same for the Linux version.

[ckent1]

Thanks, Tom. In the second half of my last gdisk.txt analysis I posted on the previous page it says:
***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format.
***************************************************************


Warning! Secondary partition table overlaps the last partition by
33 blocks!
You will need to delete this partition or resize it in another utility.
Disk /dev/sdb: 247807 sectors, 121.0 MiB
Logical sector size: 512 bytes
Disk identifier (GUID): A263696A-0507-4995-B11C-09306684BF39
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 247773
Partitions will be aligned on 1-sector boundaries
Total free space is 29 sectors (14.5 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1              63          247806   121.0 MiB   0700  Microsoft basic data

Will I need another utility to fix the 'Warning! Secondary partition table overlaps the last partition by
33 blocks! You will need to delete this partition or resize it in another utility' issue before we continue as there are a total of three factory-default partitions on this disk?

[Tom]

Skip that for now, because that is another disk (disk /sdb). Probably something that comes from the bootable USB, or another disk that is messing up Gdisk's view. Safe to ignore for now.

Actually, it's probably from a RAMdisk. Many Live cds install a RAMdisk for use with some tools.

[Tom]

Any news?

[ckent1]

Thanks, Tom. Still have to create the LiveCD as I haven't found a way on accessing just the Gdisk command from the Acronis 2014 Rescue disk.

Is it as easy as just putting the Gdisk program (for Windows) on, say your Win 98 image you sent me previously or do I also have to match OS versions (eg. create a Windows 8 64-bit boot CD/USB)?

[Tom]

You'll need a Windows 32B version (XP or later) to run the Gdisk Win32 version, or a Linux Live CD to run the Gdisk Linux version. In addition, if the disk is SATA you'll need to make sure the correct drivers are included/loaded, so XP would probably not work well in that case.

The simplest thing to do would be to connect the problem disk to another PC that has a running Windows and run the Gdisk win32 version from there. Make sure to select the correct disk with Gdisk when doing that. If needed I can help with that.
Another way would be to get a Linux Live distro and get the Linux Gdisk version to run with that. You'll need to find a way to get the Gdisk program to run in the Linux distro (maybe by using a USB key).

I would expect it to be possible to get a prompt on that Acronis disk and then manually start Gdisk. I'll see if I can find out more about that. I'll post as soon as I have something.

Edit: it seems most Linux distros have Gdisk on board, that should simplify things. I'm testing now.

[Tom]

Well, this should be simple.

Download the Knoppix Linux Live distro from here:
ftp.uni-kl.de/pub/linux/knoppix-dvd/KNOPPIX_V7.2.0DVD-2013-06-16-EN.iso

Save the file, burn it to a DVD, boot the PC with it.

Once the boot is complete you'll see the Desktop.
Go to the start menu (click lower left corner) and select "Knoppix" and then "Root shell"
You'll see a command prompt.
Type "gdisk /dev/sda" without the quotes and press enter.
(the rest is the same as in my previous post, so I copy/pasted that)
The parameter (/dev/sda) selects the first disk in the system. I'm basing this on the logs you posted so if nothing has changed since these logs it should be good. If not, you'll have to find out for yourself which disk is the problem disk. sda is the first disk, sdb the second, sdc the third etc. Only hard disks count.
You'll probably know when you have the correct disk because gdisk will complain about the state of the GPT.
After that you should have the gdisk prompt. You can enter ? for a list of commands, but here are the commands you need to enter:
enter r. this will send you to the Recovery menu.
enter c. this will restore the backup.
enter w. this will write changes to disk.
enter q. this will exit gdisk.
That is it. Throughout entering these commands you may receive confirmation prompts, read the text and if no alarms are raised, continue.
Perform a normal shutdown by selecting Logout then Shutdown from the Start menu (lower left corner).

You can check the disk beforehand, to make sure you can actually see the disk and find out if it is the correct disk.
Type "gdisk -l /dev/sda" without the quotes to have gdisk print a report for disk sda. Check the output to see if that is the right disk.
Same can be done for sdb, sdc etc. ("-l" is lowercase L, for List)

[Tom]

We're curious here, how's it going?

[ckent1]

The procedure above worked but the performance of the disk gradually got worse and worse. After about a year, the SMART health failed and the HDD had to be replaced under warranty with no data lost!