MBR Partition Table Unknown

Hey there, Brenton88!

Really sorry to hear about your issues with the WD TV. Can you tell me what's the model please?
I'd suggest to try to update the firmware first maybe.
But I'm going to need more details about the product though.

Or you can simply contact our tech support for assistance, I'm sure they will more than willing to help you resolve the problem.
Here are the contacts: http://products.wdc.com/support/kb.ashx?id=9leWl8

Keep me posted and good luck!
SuperSoph_WD
 

Brenton88

Reputable
Dec 10, 2014
8
0
4,510
Theres no problem with the WDTV just the operator/hard drive attached. Accidentally initialise the drive again has lead to a new partition being made I think. Anyone knowledgeable with MBR would be able to tell me?
 


How did this accidental initializing happen?
I'm not sure if you will be able to recover what was on the partition, but I guess you can try some sort of a third-party software. Check this thread: http://www.tomshardware.co.uk/forum/258456-32-data-erase-initialize-hard-drive

What may have happened is that your MBR was overwritten or corrupted.
Another way to try to restore it is using Linux LiveCD or Test Disk. Here are some tutorials that might help you with that: http://www.dedoimedo.com/computers/linux-data-recovery.html
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

If you have a backup of the data on the partition, you can try to get the drive recognized by re-formatting it yourself using Disk Management in Windows: http://products.wdc.com/support/kb.ashx?id=m9yBGn

Hope this helped!
SuperSoph_WD
 
@Brenton88, sorry, I can't access your Google image. :-(

However, it sounds like restoring your partitions could be as simple as a few clicks with DMDE. I wouldn't bother with any data recovery software just yet. If you would like me to help you, please upload your DMDE screenshot to Postimg or some other file sharing site.

 
ISTR that the two "Primary Unknown" partitions look like the kinds of partitions that are normally created when the drive is formatted by an LG TV. Is this what happened?

I can't be certain which of the "found" partitions is your original one. If you double-click the GODBOX2 or $Volume02 partitions, can you see your files and folders?
 

Brenton88

Reputable
Dec 10, 2014
8
0
4,510
It was accidentally reformmated (re-initiliased) using a WDTV.
The volume was originally called GODBOX and I can open that up in DMDE and see all my files.
I'm currently doing a NTFS scan on the $Volume02 partition now with no results so far. GODBOX volume is FAT and $Volume2 is NTFS. If GODBOX works maybe $Volume2 shouldnt exist?
 
ISTM that all we need to do is to remove the new partitions and reinstate the GODBOX2 partition.

R-click each of the "Primary unknown" partitions and select Remove the Partition.

Then r-click the GODBOX2 partition and select Insert the Partition (Undelete). You may need to select Edit -> Edit Mode beforehand.

Then select Drive -> Apply Changes.

Reboot in order for the changes to take effect and to ensure that the OS re-examines the file system.
 

Brenton88

Reputable
Dec 10, 2014
8
0
4,510
I've done that and windows still won't detect the drive. This is what it currently looks like in DMDE

http://postimg.com/image/182000/partition-table-ext-hdd-after-delete-unknown-181311.jpg

EDIT: Actually after a restart windows detected it and I can see all my folders again! Thanks, but a lot of folders I get "The file or directory is corrupted and unreadable"
How do you think I could fix this? Windows chckdsk /f? or anything else?
 
Let me first say that all we have done is to repair the partition table in sector 0. We have not touched your data. Working with live data is dangerous, so the safest approach would be to clone your drive, sector by sector, and then work on the clone.

IME Windows disc tools are potentially dangerous. Even the simplest utilities (eg FIXBOOT) have caused me a lot of grief. CHKDSK is especially dangerous, particularly if the drive has numerous bad sectors. I would run it in readonly mode, ie without the "/f" modifier.

The GODBOX2 FAT32 partition begins at sector 2 and spans the entire drive. The first new "unknown" partition begins at sector 63. This places it within the first copy of the FAT of the GODBOX2 partition. If sector 63 has been overwritten, then your file structure will have been corrupted.

Here is the typical layout for a FAT32 file system:

sector 2 - FAT32 boot sector
sector 8 - copy of FAT32 boot sector
sector 34 - first copy of FAT
sector ? - second copy of FAT
sector ? - root directory

My next step would be to examine the first 2048 sectors in readonly mode. Do not write anything to your drive.

Tools -> Copy Sectors

Source
Start Sector - 0
Number of Sectors - 2048

In the Destination pane choose File. You will be offered a file name such as "dev128_lba0_2048.bin". Save it, ZIP or RAR it, and upload it. The BIN file shouldn't contain any private data, but you could examine it with a hex editor (eg HxD freeware) to allay any concerns.

 
Sector 2 is indeed a FAT32 boot sector:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000400 EB 58 90 42 53 44 20 20 34 2E 34 00 02 40 20 00 ëX.BSD 4.4..@ .
00000410 02 00 00 00 00 F8 00 00 20 00 FF 00 02 00 00 00 .....ø.. .ÿ.....
00000420 AD 88 E0 E8 90 46 07 00 00 00 00 00 02 00 00 00 ­ˆàè.F..........
00000430 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000440 80 01 29 E0 12 AE 45 47 4F 44 42 4F 58 32 20 20 €.)à.®EGODBOX2
00000450 20 20 46 41 54 33 32 20 20 20 FA 31 C0 8E D0 BC FAT32 ú1ÀŽÐ¼
00000460 00 7C FB 8E D8 E8 00 00 5E 83 C6 19 BB 07 00 FC .|ûŽØè..^ƒÆ.»..ü
00000470 AC 84 C0 74 06 B4 0E CD 10 EB F5 30 E4 CD 16 CD ¬„Àt.´.Í.ëõ0äÍ.Í
00000480 19 0D 0A 4E 6F 6E 2D 73 79 73 74 65 6D 20 64 69 ...Non-system di
00000490 73 6B 0D 0A 50 72 65 73 73 20 61 6E 79 20 6B 65 sk..Press any ke
000004A0 79 20 74 6F 20 72 65 62 6F 6F 74 0D 0A 00 00 00 y to reboot.....

Sector 34 is the first sector of the fisrt copy of the FAT:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00004400 F8 FF FF 0F FF FF FF 7F FF FF FF 0F FF FF FF 0F
00004410 FF FF FF 0F FF FF FF 0F FF FF FF 0F FF FF FF 0F
00004420 FF FF FF 0F FF FF FF 0F FF FF FF 0F FF FF FF 0F
00004430 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Unfortunately sector 63 (at offset 0x7E00) has been overwritten, as I suspected. :-(

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00007DC0 71 0E 00 00 72 0E 00 00 73 0E 00 00 74 0E 00 00
00007DD0 75 0E 00 00 76 0E 00 00 77 0E 00 00 78 0E 00 00
00007DE0 79 0E 00 00 7A 0E 00 00 7B 0E 00 00 7C 0E 00 00
00007DF0 7D 0E 00 00 7E 0E 00 00 7F 0E 00 00 80 0E 00 00
00007E00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00007E10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00007E20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Immediately prior to offset 0x7E00 we see the last sector of the uncorrupted FAT.

We now need to determine the fulle extent of the corruption. With any luck we may find that the second copy of the FAT has not been touched, in which case it could be used to reconstruct the first copy.

The boot sector is telling us that there are 476,816 (= 0x74690) sectors per FAT.

The structure of the drive is now as follows:

sector 2 - FAT32 boot sector
sector 8 - copy of FAT32 boot sector
sector 34 - first copy of FAT
sector 476850 - second copy of FAT
sector 953666 - root directory

We need to now examine the first sector of FAT #2.

select Mode -> Hexadecimal
select Editor -> Goto Offset
Sector - 476850
Sector offset - 0
From start/end
Dec

Is the target sector identical to sector 34? If so, then FAT #2 is probably OK.

Now repeat the above procedure and go to sector 953666.

Can you see the files and folders in your root directory?

If FAT #2 and the root directory are intact, then there are two ways we could proceed. The first would be to allow your data recovery software to recover your files using the second copy of the FAT, assuming the software is smart enough to do this. The second way is a little risky, but it involves copying FAT #2 over FAT #1. I would prefer to try this on a clone rather than your live data, but the choice is yours.

There is a third way, but I've never tried it. It involves switching off the first FAT and transferring control to the second one.