Lost my partition!

I checked again and confirmed that it definitely starts with F0 and not F8 in answer to question 2.

There is also data starting at offset 8A00. The readable part of it is "External FAT32. Non-system disk. Press any key to reboot "

I didnt find any data using page down 12 to 24 pages as you suggested.

There is alot of data scattered throughout but much further down.

Next?

 

Next ? That is a good question ! and not sure at this point.

If the volume boot record (offset 7E00) and its backup ( 8A00) are both with out the BPB (Bios Parameter Block) it will be very hard to rebuild the data. I have done it but takes some time to correct the guesses, unless one can get the data from the same size partition and type from a different hdd. The hardest part is to figure out the "Sectors per FAT" and "Sectors per cluster ".


Is the hdd about 149 g and did it have only 1 partiton ? Do you know how frigmented the hdd might be ? (Have you added and removed files alot)

If you want to spend $50 to try and get the data back ( it might not be possibe) , it will depend on just what XP did to the drive.

Will have to get back to you later.

 

with some research found out that on the removabe drive the F0 is correct, F8 is for non removable drives. Your hdd being connected via USB is removable.
The rebuilding of the boot sector data will not be to hard.

You will need to do one more thing to get need data. Use the Search to find the root directory again. press Page Up key till the data has a different display type (hope you understand) , the data will likely turn to all 0's. Must find the begaining sector of the directory. When it is found look at bottom right corner for the Sector number , be sure the cursor is in the directory ( use arrow key to move). What sector is displayed ?

with luck the only things need done to get drive data back is to change the drive type (NTFS to Fat32) and rebuild the boot sector data. If you buy winhex the changes should be made is short time.

 

This is a new drive. Less than one month old. The files should not be very fragmented at all. I have only used about 20 or so GB of this drive and the capacity is around 150 GB. I have not done very much deleting of files. Just mostly storing.

"You will need to do one more thing to get need data. Use the Search to find the root directory again. press Page Up key till the data has a different display type (hope you understand) , the data will likely turn to all 0's. Must find the begaining sector of the directory. When it is found look at bottom right corner for the Sector number , be sure the cursor is in the directory ( use arrow key to move). What sector is displayed ? "

I dont understand what you are saying in the paragraph above. Can you explain a little more plainly?

I will be purchasing winhex probably tomorrow since it sounds like we may be able to recover from this. I would like to retrieve the files but mostly I want to be able to restore the partition and format. Is all of this possible? I did a small experiment with a flash drive I have. It is the one I told you about earlier. I used a program called Stellar Phoenix and was able to retrieve the files from it but this program was not able to restore the partition or format. I did find out that it was FAT 16 though.

Do you know of a basic simple article or paper that explains all of this you are trying to teach me? Things like how you know where the boot sector starts and how you knew that a removable disk is F0 and not F8 and what all the FF's mean anyway.

Again I thank you very much for your time and help~

Scott M

 

If you want is to repartition and format that can all be done in XP, if you want it NTFS.

What I need is the sector # for the very first Root Directory entry. When you previosly used the text search for a file or folder in thr root directory, you may not have been at the very begaining of directory just use the page up KEY to get there ,just be sure the cursor is in the directory. If you go up into the fat you will notice a different data partern. The sector # is shown at right bottom of screen.

hdd makeup MBR,VBR,FAT1,FAT2,Root directory,data

http://www.pcguide.com/ref/hdd/file/structMBR-c.html
http://thestarman.pcministry.com/index.html
http://www.kzin.com/cgi-bin/page.cgi?/bootsec/booting

some site to read and links there.

 

ok, Ive got a full version of winhex now. Ready to go for it!!

254CA00. That is the offset of where the data/text seems to start in the root directory. What I did was to call up a known folder in the root directory and then did pg up until the data in the main box all changed to 00's. The sector in the lower right corner says 76389

 

**DO note #1 below first**
Likely best to print infomation below, I hope a typo was not made with the data and my instructions are not to confuseing.

When you open the template and enter the data, then close template it will ask if you want to save changes, say yes. If at any time you did not , or not sure if you changed data, say no if it ask to save to hdd. Just remember if it ask to save to hdd and you say yes , it will not give you a second time to say no.


Note: all 0=zero not letter o
access box\partition\
1) Partition table template

Partition type indicator (hex) 0C


********************

2) Boot Sector template


OEM MSWIN4.1


BIOS Parameter Block
Bytes per sector 512
Sectors per cluster 64
Reserved sectors 32
Number of FATs 2
Root entries (unused) 0
Sectors (on small volume 0
Media descriptor (hex) F0
Sectors per FAT (small v 0
Sectors per track 63
Heads 255
Hidden sectors 63
Sectors (on large volume 312560577

FAT32 Section
Sectors per FAT see Note #1
Root dir 1st cluster 2
FSInfo sector 1
Backup boot sector 6


BIOS drive (hex, HD=8x) 80
Ext. boot signature (29h) 29
Volume serial number (decim 813440255 **
Volume serial number (hex) ff1c7c30 **
File system FAT32

Signature (55 AA) should be 55 AA


** = should work ok it's from my hdd

Note #1 (data not yet given to me see post #25) but have a better way to get needed data.
1) select Access box\partition\Boot sector.
2) top menu- Search\Find Hex value
in new box type in -- F0FFFF0F press enter
press (F3) till you see (bottom left) sector # 95 {begaining of FAT1}
press (F3) once more- record sector # (bottom left) {begaining of FAT2}
FAT2 sector # minus FAT1 sector # (95) = {Sectors per FAT} data to enter above.

Once the data is saved to hdd , need to verify some items.
You may have to close Winhex first but don't think so.
1) Access box\partition\open
2)access box\ now you should have FAT1, FAT2 and directory listed.
by alterently going between FAT1 and FAT2 do they look the same ?

IF not we have more work to do.
IF the FAT's look the same , it is time to reboot comp.
DO NOT let WIN do an auto check on this hdd (chkdisk) !
do a manual chkdisk by going to hdd icon right click\propertios\tools\
be sure auto fix is not checked. If any errors will need to try to fix manual, depending on error. You can also try to copy data from hdd to a different one.
Pls report back if all went good or bad.

 

Im afraid Im lost again. My earlier note to you #26 did give you the sector number that was at the start of the root directory. I told you that I did a search for the name of one of the folders in the root directory, then I scrolled up (paged up) until there was no more data. That section where the data changed to all zeros was #76388. Therefore the number of the sector where the root directory data started was #76389.

I started to follow your last post, starting with your note#1. I entered F0FFFF0F and pressing F3 did take me to sector #95. Pressing F3 once more took me to sector #38242. 38242-95=38147. I dont see where to enter this number though.

Next I went to the start of your note and did as you said: access box/partition/partition table template. This opened up a window called "Master Boot Record, Base Offset:0 ".

In this new window are 4 subheadings. These are Partition table entry#1, Partition table entry #2, Partition table entry #3, and Partition table entry #4.

The only one that has any values other than zero is Partition table entry #1.

The listing below Partition table entry #1 is:
446 80=active partition 00
447 Start head 1
448 Start sector 1
448 Start cylinder 0
450 Parti type indic. 07
451 End head 254
452 End sector 63
452 End cylinder 1023
454 sectors preceding partition 1 63
458 sectors in partition 1 312560577


Then all of the above is repeated with Partition table entry #2, but as I said all values are zero in table #2. Same with tables 3 and 4.

I am unsure where to enter 0C as your note indicated. Should I edit the value above? (offset 450 which now currently has the value 07).

Next, your item number 2) starts with OEM MSWIN4.1. I dont see this anywhere on my winhex program. I also dont know where to edit the values you have listed. BIOS Parameter Block etc.

Do you want me to go back to Access\partition 1\Boot sector template??

When I do that, I dont see anything that looks at all like what you have listed. What I see is a window that opens up that is titled "Template manager" and below that are listed:

Boot Sector FAT BIOS Parameter block BPB and more
Boot Sector FAT32 Bios parameter block bpb and more
Boot Sector NTFS boot sector of an NTFS partition
FAT directory Entry Normal short entry format
FAT directory Entry Long entry format
POS file format Structure of a Winhex position file.

Please advise me where to find and edit all these parameters you have listed. Thanks

 

Ok, Im playing around with it a bit more now and see that if you double click one of the entries in the Template manager window, it will bring up a table that looks like what you have listed, starting with OEM. The trouble is, which entry do I double click on? Do I double click on Boot sector FAT, or Boot sector FAT 32, or Boot sector NTFS? Also, when I select Boot sector template from the access box, a window pops up and says "the data at offset 32256 does not meet the templates requirements. Continue anyway?" Should I say yes?

Im thinking that it might be much easier to do this via emailing each other. That way we could attach screen captures and not have to type everything out the long way. I understand the value of having this discussion public in that others may also benefit but where screen captures are needed we could email them to one another. What do you think?

 

For some reason I keep on overlooking part of your posts.

"Partition table entry #1 "
replace '450 Parti type indic. (07 =NTFS)' with (0C=fat32)

when you close the template window (I think, have not bought the program) it will ask if you want to save data to hdd, say yes.
Close WInhex and restart Winhex, it will now see the drive as FAT32 and things should work better. In any case if a choise is given , choise FAT32.

when you go access\partiton #1\ you should now see boot sector template.

"Sectors per FAT see Note #1" will be (38147)

I will post back with more in case boot sector template is not shown as above, but but go at this time.

 

I input all the data you have listed starting with OEM MSWIN4.1
All seem to go ok until I got down to the last entry: Signature (55 AA) It would not let me input this value so it remained at 00 00 I dont know what this will cause. After I input I saved it all to hdd. then I access/partition/open but do not see FAT1 or FAT2 listed. It looks the same as before. A new window opens up over the top of the original hard disk 2 offsets window. this new window is labeled "hard disk 2, partition 1 ". also in this window...at the top of it is listed all of the folders in my root directory. This looks very promising as I can now see all the folders. However when I exit winhex and try to open the drive from windows, I get a message "drive not formatted. Do you want to format now ". Is this good progress or has something gone wrong. I wait for your next information.

 

Seems like my last replly got lost. Anyway, I input all data that you had listed...Starting with OEM MSWIN4.1. Everything was ok except for the last entry. It would not let me input 55 AA. That one (Signature) remains at 00.

I saved all this to hdd and exited. Reloaded winhex and access/boot sector template. The template that shows up now matches all the data you have listed in your earlier message (except the last one..Signature). The only thing that concerns me is that when I access boot sector template, a message box pops up that says "The data at offset 322258 does not meet the templates requirements. Continue anyway?" I tell it yes and then another box pops up that says "The data at offset 32766 does not meet the templates requirements. Continue anyway?" I say yes to this and then the boot sector template opens as I have described above.

Also, when I select Access\Partition 1\Open...the Hard disk 2 partition 1 window opens and now...at the top of the window is listed all of the folders that were in my root directory! This seems like progress. When I double click on them however, the files are mostly listed but not in an accessable format. Double clicking on any of the files in these folders opens up a new offset window for that file. I suppose this is normal and I shouldnt expect the actual document or program to open from within Winhex.

I also exited Winhex and then tried to access the drive. Windows reported that the drive was not formatted and asked me if I wanted to format it now. I said No. What's next?

 

When you goto "access/boot sector template" the main window should be going to sector 63 (bottom right), does it ? If not STOP, The data you enter is at the wrong sector. Do not know why the error message with template.

close template, (you should be at offset 7EFx) use arrow keys go to "offset 7EFE" , type in 55 AA and save. ( the last 2 bytes of sector 63).
Till the "Signature (55 AA)" is correct the OS will not see a valid boot sector, ie. not formated.

 

When I Access/partion 1/boot sector template...a box opens that says "invalid file: user.txt Do not proceed. I can either click ok or just close the window. Which? I can see that the offset window that opens up is indeed sector 63 so that part is ok.

The last 2 bytes of sector 63 are 00 00. The last 2 bytes of sector 64 are 55 AA. and also the offset is completely different than what you said it was. the offset for the last 2 bytes of sector 63 is 3275214 and 3275215. THe offset for the last 2 bytes if sectir 64 ( the ones that are 55 AA) are 3326414 and 3326415

Should I change the last 2 bytes of 63 to read 55 AA? Should I change the last 2 bytes of 64 to read 00 00? If so, can I make the change in the same offset window or do I need to go elsewhere?


later..... I just tried to change the last 2 bytes of 63 to 55AA and the last 2 bytes of 64 to 00 00 but winhex would not save changes because the "invalid file: user.txt" message popped up again. The boot sector reverted back to 00 00 as the last 2 bytes.

still later.... I realize now that the offset numbers were in decimal and not in hex. I have switched them to hex. Now I see that the last two bytes of sector 63 have offset of 7FFE and 7FFF and NOT 7EFE as you wrote. Was it a typo error on your part or is there a problem.

 

"Now I see that the last two bytes of sector 63 have offset of 7FFE and 7FFF and NOT 7EFE as you wrote. Was it a typo error on your part or is there a problem. " Yes it was a typo .

" "invalid file: user.txt" " I have no idea what that error is saying. See if there is a "user.txt" in the Winhex directory, if there is change name to "1user.txt ", do this before opening winhex. That file did not come installed with program, it was made later. Some types of editing is first stored in a file then written to disk, it should have likely deleted the file after writing, check the HELP \Working with the hex editor\edit modes.

the last 2 bytes of sector 63 must be changed, leave sector 64 alone. If renameing user.txt does not fix problem try "Options\edit mode\in-place mode "
do take care, it says it will write without asking.

You will have to do the editing in the main window , not in a template. Just go to the the offset and put in the new data, then close window. ( I hope)

 

User.txt was the file that contained my registration code. I renamed it and then named it back again to user.txt and this time no error. I was able to change the last 2 bytes of sector 63 to 55 AA. I was able to change it right in the boot sector template.

Now the only error I get is when I open the boot sector template a window opens with the message: "the data at offset 7E02 does not match the template's requirements. Continue anyway?" Dont know what that means. The data at 7E02 is 00. any idea what it should be?

Also, when I select Access/partition 1/open a new offset table opens that is labeled Hard disk 2 Partition 1. (the original one underneath it is just labeled Hard disk 2). In this new window, if I scroll down to sector 63 I see that there is no data there. It is all 00's. Even 7FFE and 7FFF are 00 and not 55 FF. Is this normal or is this just a new template if I want to change partition 1 yet again?

Anyway, everything else is pretty much the same as reported earlier. Selecting Access/partition/open also has in part of it's window the list of folders in my hdd root directory. Yet still when I reboot windows, this hdd is still seen as a raw unformatted hdd of unknown capacity.

So far everything is set up as you said but I still do not have an FAT 1 and FAT2 option in the access box.

 

at offset 7E00 to 7E02 is a JUMP instruction around the template data, it is not used if the partition is non bootable, and should not be needed. But it would be (E8 58 90).

"Access\open" -then "Access\ fat1,fat2,dir" , {the sector #'s will change also}.

When you first open a drive the sector numbers are from the very first sector of disk (absolute sector 0) , but when a partition is open then the sector numbers start at the first sector of partiton (your case absolute sector 63 becomes sector 0) , not at drives first sector.

It is a bit of confusing and the user must know if he is working within a open partition or not ,other wise he might write to the wrong sector.

 

I have never totol rebuilt the Boot sector befor only make corrections. Upon doing some testing found out a little more editing is required for Windows to read the drive.

The "Boot sector" is 3 sectors long , absolute sectors 63,64,65 (if partition is opened then the sectors will be 0,1,2) with a backup at absolute sectors 69,70,71 (or if partition is open sectors 6,7,8). confused yet ?

sector 64 needs the following data:
starting at offset 8000 --52 52 61 41
starting at offset 81E4 -- 72 72 41 61 FF FF FF FF FF FF FF FF (once the OS reads the drive the FF's will be changed)
last two entries for sector 55 AA (Signature bytes)
all other entries 0's

the signature bytes (55 AA) needs to be at the end of all sectors mentioned above.

The third sector of the "Boot Sector" seems not to be needed if drive is non bootable, but still must have the Signature bytes.

 

I took a different approach last night. I opened partition one and saw that it listed all the folders that I had on the hdd. I told winhex to transfer these folders one at a time to another hdd and it worked. So now I have all the data and files copied from this disk to another drive. I no longer need anything that is on this drive. So now my question is, what is the easiest way of making this hdd useable once again? Now that we are not worried about losing data. How can I repartition and format this drive. Preferably as an NTFS drive but FAT would be ok. Just so that the drive is recognized and useable once again.

It is interesting to note that winhex apparently sees this drive as perfectly normal. it lists all the information for this drive. When I have partition 1 open it shows it as a FAT32 drive, how much disk space is used, how much free disk space remains, total disk space, and pretty much everything else associated with this partition. So why doesnt windows see it and have the ability to access it? Windows still sees it as an unformated raw drive.

Anyway, how do you suggest we proceed at this point?


later.....I have made the changes to the Boot sector that you suggested in your last post and it seemed to make no difference. After rebooting windows, the drive is still not able to be read or accessed by windows.

 

Since I no longer need the files on this disk, I tried once again to have windows format this drive as an NTFS drive. This time it worked. I am in the process of reformatting the drive. Hopefully when this finishes I should once again have a fully functional drive. When it completes I will open it up with Winhex to see what the data in these various sectors turns out to be. Tell me again which sectors I should look at...besides 63 64 65.