Welcome, Guest. Please login or register.
Did you miss your activation email?
March 26, 2019, 11:22:15 AM
Home Help Search Login Register
News:

+  DIY DataRecovery.nl Support forum
|-+  Support
| |-+  DiskPatch (Moderators: Tom, Joep)
| | |-+  Deleted or lost partition - HELP !
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] Go Down Print
Author Topic: Deleted or lost partition - HELP !  (Read 4930 times)
tony427
member

Posts: 1


« on: May 22, 2008, 05:07:22 PM »

Hello,
I was recovering a floppy disk file using a program called Data Rescue and it created an image on my C: (Boot) drive. In doing that, though, it created a new partition and it wiped out the old one with the operating system etc. Using some utilities, I can see that my folders and data seem to still be there although the whole WINNT system folder (and all is subdirectories) is gone and the drive cannot be accessed or booted from.

My sytem: Pentium 3, running Windows 2000 SP4. Before I purchase your
DiskPatch, I would appreciated your feedback on what the chances are I can recover my old partition and the data.

Here is the DP.Log file generated using the Trial DiskPatch:

Code:
.../000:03/LOG> ### LOG START ###
.../000:03/LOG> DISKPATCH 3.4.100
.../000:03/LOG> (C) 2000-2008 DIY DataRecovery
.../000:03/LOG> Contact info: HTTP://www.DIYDataRecovery.nl
.../000:03/LOG> MemFree: 76Kb
.../000:03/LOG> CommandLineParms: /sup
.../000:03/LOG> LogDate: 05-22-2008
.../000:03/CFG> FilePath="1/.\DPFILES\"
.../000:03/CFG> LogFilename="DP.LOG"
.../000:03/CFG> ReadRetries="32"
.../000:03/CFG> WriteRetries="32"
.../000:03/CFG> MaxReadErrors="32"
.../000:03/CFG> MaxWriteErrors="1"
.../000:03/CFG> ReadDelay="0"
.../000:03/CFG> VfyFixedBadSect="1"
.../000:03/CFG> CleanAfterDOD="1"
.../000:03/CFG> DiskReset="1"
.../000:03/CFG> SectorSkip="1024"
.../000:03/CFG> AutoSaveState="1"
.../000:03/CFG> DumpFoundSectors="0"
.../000:03/CFG> FixFats="1"
.../000:03/CFG> MaxFatScan="51200"
.../000:03/CFG> MaxDataColEntries="256"
.../000:03/CFG> IgnoreF8FF="0"
.../000:03/CFG> DownSizeExt="1"
.../000:03/CFG> ScanSignature="55AA"
.../000:03/CFG> Rebuild="00"
.../000:03/13H> Ext13H installed test requested
.../000:03/13H> Disk found at 128
.../000:03/13H> Ext13H version: 2.1 / EDD-1.1
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:03/13H> Drive Interface Info :
.../000:03/13H> Disk 128 X13H data : 16383/16/63 156301488/512
.../000:03/13H> Disk found at 129
.../000:03/13H> Ext13H version: 2.1 / EDD-1.1
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:03/13H> Drive Interface Info :
.../000:03/13H> Disk 129 X13H data : 16383/16/63 60036480/512
.../000:03/13H> Disk found at 130
.../000:03/13H> Ext13H version: 2.1 / EDD-1.1
.../000:03/13H> Ext13H Support: Extended disk access functions
.../000:03/13H> Ext13H Support: Enhanced disk drive functions
.../000:03/13H> Ext13H Flags: DMA boundary errors handled transparently
.../000:03/13H> Drive Interface Info :
.../000:03/13H> Disk 130 X13H data : 16383/16/63 59772900/512
.../000:03/13H> Ext13H tested ok
.../000:03/FDL> DiskList requested
.../000:03/FDL> Disk found at 128
.../000:03/FDL> Disk found at 129
.../000:03/FDL> Disk found at 130
### DISKLIST.ARRAY ###
__D_|________LBA_|___H_|__S_|__GB
128 | .156301488 | 255 | 63 | .74
129 | ..60036480 | 255 | 63 | .28
130 | ..59772900 | 255 | 63 | .28
..0 | .........0 | ..0 | .0 | ..0
.../000:03/IAS> AdmiSector found on disk 0 (128)
.../000:03/IAS> AdmiSector found on disk 1 (129)
.../000:03/IAS> AdmiSector found on disk 2 (130)
.../000:04/EXE> Read/Write pattern test for disk 0 (128) successful
.../000:04/EXE> Read/Write pattern test for disk 1 (129) successful
.../000:05/EXE> Read/Write pattern test for disk 2 (130) successful
.../000:05/WAS> AdmiSectors in use : 0+ 1+ 2+
.../000:05/KEY> DEMO/1
.../000:05/PFC> UDMA driver active
.../000:05/PFC> PQstuff signature not detected on disk 0 (128)
.../000:05/PFC> PQstuff signature not detected on disk 1 (129)
.../000:05/PFC> PQstuff signature not detected on disk 2 (130)
.../000:06/PFC> Partition State backup not found on disk 0 (128)
.../000:06/PFC> Partition State backup not found on disk 1 (129)
.../000:06/PFC> Partition State backup not found on disk 2 (130)
.../000:06/PFC> No Repair date found on disk 0 (128)
.../000:06/PFC> No Repair date found on disk 1 (129)
.../000:06/PFC> No Repair date found on disk 2 (130)
.../000:17/CSD> Start CheckDisk for disk 0 (128)
.../000:17/CSD> CheckDisk complete, ReadErrors 0
.../000:17/USD> Disk 0 (128) selected
.../000:17/GSC> No geo change detected for disk 0 (128)
.../000:17/WAS> AdmiSectors in use : 0+ 1+ 2+
.../000:17/GSC> Geo for disk 0 (128) saved as 0156301488255063
128/000:17/USD> MBR for disk 0 (128)
128/000:17/LOG> SectorDump requested at 0 (0 0 1)
###
000   90 E9 7D 01 FA 33 C0 8E D0 8E C0 8E D8 BC 00 7C  |  ??}.?3??????.|
016   8B F4 FB BF 00 06 B9 00 01 F3 A5 BB 20 06 FF E3  |  ????..?..??? ..?
032   90 90 BE 7D 07 81 3C AA 55 75 11 E8 58 00 73 0C  |  ???}.?<?Uu.?X.s.
048   E8 65 00 72 07 E8 B1 00 72 3B EB 2C BE 7D 07 C7  |  ?e.r.??.r;?,?}.?
064   04 00 00 BA 80 00 BE BE 07 B9 04 00 F6 04 80 75  |  ...??.??.?..?.?u
080   07 83 C6 10 E2 F6 EB 1D 8A 74 01 8B 4C 02 BB 00  |  .??.???.?t.?L.?.
096   7C B8 01 02 CD 13 72 0D 81 3E FE 7D 55 AA 75 05  |  |?..?.r.?>?}U?u.
112   EA 00 7C 00 00 BE 6A 07 AC 0A C0 74 FE BB 07 00  |  ?.|..?j.?.?t??..
128   B4 0E CD 10 EB F2 BB 00 7E C6 07 13 C6 47 01 00  |  ?.?.???.~?..?G..
144   B2 80 B8 00 E0 CD 13 C3 BF 00 7E BA F0 01 B3 A0  |  ???.??..~??.? 
160   E8 84 00 72 0C B1 01 E8 48 00 72 05 E8 19 00 73  |  ??.r.?.?H.r.?..s
176   16 F6 C3 10 75 05 80 CB 10 EB E5 81 FA 70 01 74  |  .??.u.??.????p.t
192   05 BA 70 01 EB D8 F9 C3 81 BD FE 01 55 AA 75 17  |  .?p.?????.U?u.
208   8B 75 02 81 FE BE 01 77 0E 03 F7 81 3C AA 55 75  |  ?u.???.w..??<?Uu
224   06 F6 44 02 01 75 01 F9 C3 BF 00 7C B1 0A E8 01  |  .?D..u.?.|?.?.
240   00 C3 52 57 83 C2 02 B0 01 EE 42 8A C1 EE 42 32  |  .?RW??.?.?B???B2
256   C0 EE 42 EE 42 8A C3 EE 42 B0 20 EE E8 33 00 EC  |  ??B?B???B? ??3.?
272   24 FD 3C 58 75 0D 83 EA 07 B9 00 01 FA F3 6D FB  |  $?<Xu.??.?..??m?
288   F8 EB 01 F9 5F 5A C3 52 83 C2 07 EC A8 80 75 0F  |  ??.?_Z?R??.?u.
304   4A 8A C3 EE 42 EC 24 D0 3C 50 75 03 F8 EB 01 F9  |  J???B?$?<Pu.??.?
320   5A C3 51 8B 0E 6C 04 83 C1 12 81 C2 FF 01 EC 8A  |  Z?Q?.l.??.??..??
336   E0 80 E4 D8 80 FC 58 74 06 3B 0E 6C 04 75 EF 81  |  ?????Xt.;.l.u??
352   EA FF 01 B9 00 20 E2 FE 59 C3 0D 0A 45 72 72 6F  |  ?..?. ??Y?..Erro
368   72 20 4C 6F 61 64 69 6E 67 20 4F 53 00 AA 55 00  |  r Loading OS.?U.
384   00 E9 80 FE 00 00 00 00 00 00 00 00 00 00 00 00  |  .???............
400   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
416   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
432   00 00 00 00 00 00 00 00 0B 02 0C 02 00 00 80 01  |  ..............?.
448   01 00 07 FE BF 00 3F 00 00 00 82 E4 50 09 00 00  |  ...??.?...??P...
464   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
480   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |  ................
496   00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  |  ..............U?
###
128/000:19/VEC> Start Verify EPBR Chain for disk 0 (128)
128/000:19/VEC> Listing current partitions on disk:
128/000:19/VEC>     NTFS (P)      NO NAME          63   156296322      (75 Gb)
128/000:19/VEC> Partition Table info for sector 0 (0 0 1)
128/000:19/LOG> PartListDump requested at 0 (0 0 1)
### _ACT_|_TYPE_|__START--C/H/S_|__END----C/H/S_|__LBA-start_|_LBA-length
..1 .128 | ..07 | ....0...1...1 | ..512.254..63 | ........63 | .156296322
..2 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..3 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
..4 ...0 | ..00 | ....0...0...0 | ....0...0...0 | .........0 | .........0
128/000:19/VEC> 55AA sig Ok
128/000:19/LOG> Boot sector dump requested at 63 (0 1 1)
### BootSectorDump for BStype NTFS
...........Jump Code (hex): EB3C90
............OEM Name (txt): ,E&]XIHC
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 1
....Reserved Sectors (dec): 1
..............Unused (hex): 0B4000E002
....Media Descriptor (hex): F0
..............Unused (hex): 0009
...Sectors per Track (dec): 18
.....Heads per Track (dec): 2
......Hidden Sectors (dec): 0
..............Unused (hex): 00000000
.............Unknown (hex): 63290000
.......Total Sectors (dec): 1322283241
........MFT Location (dec): 538985805
.MFT Mirror Location (dec): 540160340
....Clusters per FRS (dec): 4038906254
.Clusters/Indx Block (dec): 3101265531
...........Volume ID (hex): 7C00BDFCC08E2000
........Volume Label (txt): NO NAME
............Checksum (hex): 7D244E38
....Sector Signature (hex): AA55
128/000:20/VEC> BS and BBS not equal, dump follows;
128/000:20/LOG> Boot sector dump requested at 156296384 (9728 254 63)
### BootSectorDump for BStype NTFS (B)
...........Jump Code (hex): EB5290
............OEM Name (txt): NTFS
....Bytes per Sector (dec): 512
.Sectors per Cluster (dec): 8
....Reserved Sectors (dec): 0
..............Unused (hex): 0000000000
....Media Descriptor (hex): F8
..............Unused (hex): 0000
...Sectors per Track (dec): 63
.....Heads per Track (dec): 255
......Hidden Sectors (dec): 63
..............Unused (hex): 00000000
.............Unknown (hex): 00800080
.......Total Sectors (dec): 156296321
........MFT Location (dec): 4
.MFT Mirror Location (dec): 9768520
....Clusters per FRS (dec): 246
.Clusters/Indx Block (dec): 1
...........Volume ID (hex): 01C7C74F7BDD6840
........Volume Label (txt): (Err)
............Checksum (hex): 00000000
....Sector Signature (hex): AA55
128/000:20/VEC> Verify EPBR Chain completed
128/000:21/USD> Select disk completed
128/000:34/SCN> DiskScan requested, ScanType is 3
128/000:34/SCN> from 0 (0 0 1) to 156301487 (9729 80 63), 156301488 sectors
128/000:34/SCN> Starting QuickScan (pre-vista) at 63 (0 1 1)
128/000:35/SCN> Next QuickScan location at 2943 (0 46 46)
128/000:36/SCN> Next QuickScan location at 0 (0 0 1)
128/000:36/SCN> QuickScan finished
128/000:36/SCN> Starting SmartScan (pre-vista) at 0 (0 0 1) (JMP=16065, RNG=63)
128/004:26/SCN> SmartScan finished
128/004:26/SCN> DiskScan completed
128/004:26/SCN> ReadErrors for disk 0 (128): 0
128/007:44/LOG> DataCollection items found: 6 / 2
### DATACOLLECTION.ARRAY, FULL ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL_|_F
001 | 128 | ........63 | ..FAT12 | ..BS | ........63 | ......2880 | PRI | .
002 | 128 | .........0 | ...NTFS | PTE1 | ........63 | .156296322 | PRI | .
003 | 128 | .........8 | ...NTFS | PTE1 | ........71 | .156296322 | LOG | I
004 | 128 | ........63 | ..FAT12 | ..BS | ........63 | ......2880 | PRI | I
005 | 128 | .156280319 | ...NTFS | .BBS | ........63 | .156280257 | PRI | .
006 | 128 | .156296384 | ...NTFS | .BBS | ........63 | .156296322 | PRI | .
128/007:45/LOG> DataCollection items found: 6 / 2
### DATACOLLECTION.ARRAY, CLEANED ###
SEQ_|___D_|________LOC_|____TYPE_|__COM_|______START_|_____LENGTH_|__PL
001 | 128 | ........63 | ..FAT12 | ..BS | ........63 | ......2880 | PRI
002 | 128 | .........0 | ...NTFS | PTE1 | ........63 | .156296322 | PRI
005 | 128 | .156280319 | ...NTFS | .BBS | ........63 | .156280257 | PRI
006 | 128 | .156296384 | ...NTFS | .BBS | ........63 | .156296322 | PRI
128/007:45/LOG> PartList items created: 3
### PARTLIST.ARRAY ###
SEQ_|____TYPE_|_PTE_|__BS_|_BBS_|F8FF_|___S_|___L_|__PL_|_C_|___R
001 | ...NTFS | ..2 | ... | ..6 | --- | ..2 | ..2 | ..2 | 2 | ..B
002 | ..FAT12 | ... | ..1 | --- | ... | ..1 | ..1 | ..1 | 1 | ...
003 | ...NTFS | ... | ... | ..5 | --- | ..5 | ..5 | ..5 | 1 | ..B
### PARTLIST.ARRAY.INTERPRETED ###
SEQ_|____TYPE_|______START_|_____LENGTH_|________END_|__PL_|___R
001 | ...NTFS | ........63 | .156296322 | .156296384 | PRI | ..B
002 | ..FAT12 | ........63 | ......2880 | ......2942 | PRI | ...
003 | ...NTFS | ........63 | .156280257 | .156280319 | PRI | ..B
128/007:45/SST> SaveState requested for disk 0 (128)
128/007:51/WAS> AdmiSectors in use : 0+ 1+ 2+
128/007:52/SST> SaveState completed for disk 0 (128)
128/007:52/EXE> Analysis complete
128/007:59/LOG> RunTime: 007:59
128/007:59/LOG> ### CLOSE LOG ###


=================================

The DPSTATE.128 log file follows:
"3.4.100   255       63        156301488 F360E74F7EE61295    6         3         0         "
"128","63","FAT12","BS","63","2880","PRI","I"
"128","0","NTFS","PTE1","63","156296322","PRI","I"
"128","8","NTFS","PTE1","71","156296322","LOG","I"
"128","63","FAT12","BS","63","2880","PRI","I"
"128","156280319","NTFS","BBS","63","156280257","PRI","I"
"128","156296384","NTFS","BBS","63","156296322","PRI","I"
"NTFS","2","","6","---","2","2","2","2","B","","",""
"FAT12","","1","---","","1","1","1","1","","","",""
"NTFS","","","5","---","5","5","5","1","B","","",""

==========================

What can you make of it? Any hope I can recover / undelete the old partition and recover the data with DiskPatch?

Thank you so much for your attention

Tony





 
Logged
Joep
Developer and Support Tech
Administrator
member
*****
Posts: 1475



WWW
« Reply #1 on: May 23, 2008, 08:22:02 AM »

Hello,

Data Rescue, or Data Rescue's PhotoRescue? Anyway, yes instead of writing the diskette image to a file, it overwrote the start of you NTFS drive. That means the boot sector was overwritten, and worse, since your MFT starts (started) in cluster 4, it overwrote the begin of that as well. The latter will not be fixed by DiskPatch. The boot sector it can repair.

I am not sure if restoring the MFT mirror would give you access to the bulk of your data again, we could do that manually using the DiskPatch disk editor. Doing that will only restore the first few records of the MFT as the MFT mirror is far from what it is suggesting, it is not a complete mirror of the MFT. Since the outcome is uncertain I advise against it, however if you want to give that a try, go ahead and purchase a license. If it does not work we will refund.

Again, I would not advise to do so, instead the best approach would be to salvage user data from the NTFS drive (using iUndelete or iRecover) and then reformat and reinstall whatever was on the drive (Windows I presume).

Quote
Using some utilities, I can see that my folders and data seem to still be there although the whole WINNT system folder (and all is subdirectories)

Yes, showing the file/folder data and even copying it out of there is something else than fixing it. Under almost all circumstances data recovery utilities will be able to show the files as long as the administrative info on those files has not been overwritten.

Logged

--
Kind regards,
Joep - My blog @: www.disktuna.com - Try my JPEG Repair Tool: https://www.youtube.com/watch?v=pyn0AVXv4iE
Pages: [1] Go Up Print 
« previous next »
Jump to:  


Login with username, password and session length

Powered by MySQL Powered by PHP Powered by SMF 1.1.20 | SMF © 2013, Simple Machines Valid XHTML 1.0! Valid CSS!