MBR may be erased from HDD.

Toggle sidebar Toggle sidebar
A

Ash Goh

Honorable
Oct 7, 2013
8
0
10,510
Hi there, I hope someone could help me out here.

Recently my WD 1.5TB HDD works perfectly well with my LG47 TV, however I was fiddling with the remote and the TV 'Initiate' the HDD. Now the HDD can't be read on my TV and PC, only the Device Manager can read it.

I suspect it's the TV that erased the Master Boot Record (MBR) or the file structure system from the HDD. I'm thinking of recovering the HDD with use of Windows recovery disk to find back the boot record.

Can someone please advise me if I'm doing the right thing?

Thanks a million!
 
Solution
F
Sector 63 is blank which suggests that the TV did not write anything to the beginning of the 1.5TB partition.

Sector 2048 is an NTFS boot sector. Its BIOS Parameter block is telling us that the partition begins at sector 2048 (= 0x0800) and has a size of 0xAEA867FF + 1 sectors.

That corresponds to 1.5TB (1 500 299 395 072 bytes):

http://www.google.com/search?q=%280xAEA867FF++%2B+1%29+x+512+in+decimal

The boot code looks like a Vista boot sector:
http://thestarman.pcministry.com/asm/mbr/VistaVBR.htm

The TV's 1.5TB partition is slightly smaller than your original 1.5TB partition, which means that the TV's small 49MB partition is located at the end of your original data area. Hopefully the TV hasn't touched this area. If it has, then...
Sort by date Sort by votes
dextermat

dextermat

Splendid
Sep 21, 2007
4,957
0
24,960
Hi,

I doubt the tv could erase the mbr. How old is the HD and did you get any power outage lately.
Did you try plugging it in a computer and try to repair it. (chkdsk to scan for errors?)
If the computer has a bad time detecting the hard drive, it could be defective.
 
Upvote 0 Downvote
popatim

popatim

Titan
Moderator
Dec 2, 2009
38,904
980
135,890
He probably meant 'Initialize the disk" not initiate, which means the tv formatted the drive and depending on the tv it could be in an ext2 format which windows can't read.

If you have copies of whatever was on the drive it might be easier for you to just let windows format the drive and then you can copy it back in.

If you dont have copies of the files then you will need to recover the partition or run a deep scan with data recovery software.

Try Easus unformat tool here:
http://www.easeus.com/data-recovery/format-recovery-software/free-unformat-windows-7-hard-disk-drive.htm
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
Use a disc editor such as DMDE to show us the contents of sector 0 (select Mode -> Hexadecimal). That's where the MBR and partition table is located. Then we can determine what the TV has done to your drive.

DMDE - DM Disk Editor and Data Recovery Software:
http://dmde.com/
 
Upvote 0 Downvote
A

Ash Goh

Honorable
Oct 7, 2013
8
0
10,510
Yes i meant "Initialize". I have just re-checked the TV - yes I have used the Time Machine in the TV to Initialize the HDD, thus rendering it useless to Window/Mac. I don't have any backup on HDD, so I guess I have to use a disk recovery software to dig all the data. It's 1.5TB!! So that's going to be a nightmare!!

Is there any way I could 'recover' the file structure/format of the HDD so I could immediately read it like previously, and without having to go through the deep dig recovery process?

Here're four screenshot:
- https://docs.google.com/file/d/0BwDvR0eT0y7BUTg3dEhhY2xTSnc/edit?usp=sharing
- https://docs.google.com/file/d/0BwDvR0eT0y7BWVRsaWVXOTVxMVk/edit?usp=sharing
- https://docs.google.com/file/d/0BwDvR0eT0y7BVDNGQjBUd3Rrczg/edit?usp=sharing
- https://docs.google.com/file/d/0BwDvR0eT0y7BaXcyb0g3WERQMnc/edit?usp=sharing

Thank you guys for your kind help! I must say it's really intimidating to lose your data! Great job peeps!
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
The TV has created two partitions of type 0x42.

The following resource suggests that this partition ID is used to denote an old Linux swap partition, or a Windows dynamic partition, or an SFS partition:

http://www.win.tue.nl/~aeb/partitions/partition_types-1.html

There is no MBR code, so there is no clue as to the file system. It could be that this partition ID has been redefined by the TV for its own proprietary purposes.

Whatever it is, the first partition (1.5TB) appears to be reserved for data, while the second partition (49MB) looks like it might have some code or data that is used by the TV for file "management" purposes.

Your first screenshot appears to be suggesting that DMDE has found your old 1.5TB NTFS boot sector at sector 2048. This in turn suggests that most of your data may still be intact. With any luck, you could use the information in sector 2048 to reconstruct the partition table in sector 0.

Could you show us the hexadecimal contents of sectors 63 and 2048?

BTW, here are direct links to your screenshots:

https://lh5.googleusercontent.com/7fmnMMVslZ4duNg9-d3ogAFZE-vITgK1_CePKBAM5iUhsbnYoe9LQzAnpM42C_Iv5s0g1ZK-1-W_Eow
https://lh6.googleusercontent.com/1zZsFUFPoUzDaOo2dQ9fcVgbCGr8QsWrKHUWp2ersXM3Pe8o_goV8sqXQI8I_5c2E1DAiEKqIhTeqYs
https://lh4.googleusercontent.com/SWIUlO7Uup7JdduuBLg6nVglX5NFr--lBCz3w9IyZ8TNQ6HVNA47GG9jDL-55BGYXxJVtT5EN6JNknI
https://lh5.googleusercontent.com/eA8uIOVi0hexzuWCX17KfgqRzVRHPeEcaE9Q_k8OeJk5dsJMZbRDYFVqfSu8Ncc1edlr9DBAZoBUPqs

EDIT: The two TV partitions were type A2, not 42.

A2 is not listed in the abovementioned database of partition IDs, so it must indeed be a proprietary type.
 
Upvote 0 Downvote
A

Ash Goh

Honorable
Oct 7, 2013
8
0
10,510
fzabkar - thank you so much for your kind help. I can't say how important this is to me.

On this - I hope I'm not sounding stupid, where do i get to Sector 63 or 2048? Is that the LBA or the Block? So sorry for sounding so stupid :??:

Thanks a lot!



 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
Launch DMDE.

Select the desired Physical Device.

Uncheck the "Show Partitions" box and click OK.

You should see sector 0 in hexadecimal mode.

Go to Tools -> Copy Sectors

Click Device in the Source tab. First Sector should be 63. Change Number of Sectors to 1. The Last Sector should adjust itself automatically.

Choose File in the Destination tab. DMDE will select a filename of "sec_63_1.ima". Click OK.

The file should be 512 bytes in size. Could you please upload it?

Repeat the above procedure for sector 2048.
 
Upvote 0 Downvote
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
Sector 63 is blank which suggests that the TV did not write anything to the beginning of the 1.5TB partition.

Sector 2048 is an NTFS boot sector. Its BIOS Parameter block is telling us that the partition begins at sector 2048 (= 0x0800) and has a size of 0xAEA867FF + 1 sectors.

That corresponds to 1.5TB (1 500 299 395 072 bytes):

http://www.google.com/search?q=%280xAEA867FF++%2B+1%29+x+512+in+decimal

The boot code looks like a Vista boot sector:
http://thestarman.pcministry.com/asm/mbr/VistaVBR.htm

The TV's 1.5TB partition is slightly smaller than your original 1.5TB partition, which means that the TV's small 49MB partition is located at the end of your original data area. Hopefully the TV hasn't touched this area. If it has, then we would hope that there were no data in this area. In any case, you wouldn't lose much.

My approach would be to edit sector 0. Normally I would do this by hand, but DMDE seems to be reasonably safe in this regard.

Launch DMDE.

Tick the Show Partitions box.

Select your Physical Drive and click OK.

R-click each of the "Unknown (A2)" partitions and select Remove Partition.

R-click the "found NTFS" partition and select Insert the Partition (Undelete).

You may need to select Edit -> Edit Mode before doing the above. (I don't have an expendable drive to verify this procedure)

You should eject the USB device and reinsert it to ensure that Windows reexamines the file system.

One final thing you might like to do would be to save the 49MB partition plus the remaining sectors at the end of the drive to an image file, and then examine this image file for any evidence that the TV has written to this area. Let us know if you would like to do that, and be aware that your data may be included in this image.
 
Upvote 0 Downvote
Solution
F

fzabkar

Judicious
Sep 22, 2010
9,302
702
36,390
Congratulations.

BTW, I just realised that I made a mistake, but it was of no consequence. I initially stated that the TV created two partitions of type 42. In fact they were type A2 partitions. This ID is not associated with any known standard partition type and must indeed be a proprietary ID used by the TV.
 
Upvote 0 Downvote
A

Ash Goh

Honorable
Oct 7, 2013
8
0
10,510
No worries about it. I'm glad that the HDD can be saved. All thanks to your kind help.

Take care ya!



 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom