Recoverying lost Partition of a hard drive

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Hi,

I am new to this and am seeking some guidance in what to do next. There was
three primary partitions on the drive, fat32, linux fs and linux swap. I'm
only interested in recovering the fat32. Attempting access the drive, it
shows only a single partition and that it seems the root directory can't be
located.

I think given then output below, that I have located the root directory, but
am unsure what to do next to restore the partition and especially the root
directory for that partition.

Any assistance or pointers to information would be most helpful,

Thanks,

Nik


Below is the output for findpart for the drive in question:

Findpart, version 4.42.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: DOS 7.10

Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 20003697 9767 0 1 1 1322 239 63 B OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 Second FAT not found.

-----FAT CHS ------LBA Confidence Distance Type Sig
0 1 51 113 3729 32 OK
0 96 7 6054 3729 5941 32 OK
0 156 26 9853 28 3799 32 NB

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0C 63 20003697 9767 0 1 1 1322*239 63 OK OK


This is the output of findfat:


Findfat, version FP 4.42.
Copyright Svend Olaf Mikkelsen, 2004.

Searches for FAT's and gives an estimate of the condition.
Only some types of errors are detected. FAT size in sectors.
'Cl' is cluster KB. 'Root' is size in entries for FAT16 and
root cluster for FAT32. 'Rep.' is probably repairable. 'Bad'
can be not easy repairable FAT sectors. DataMB is an estimate.

OS: DOS 7.10

Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 Second FAT not found.

-----FAT CHS ------LBA Confidence Distance Type Sig
0 1 51 113 3729 32 OK
0 96 7 6054 3729 5941 32 OK
0 156 26 9853 28 3799 32 NB



This is part of the output of findpart finddir which shows the possible root
cluster/directory:

0 201 21 12683 0 190 26 11995 8 040415
0 201 37 12699 0 190 26 11995 8 040415
0 201 53 12715 0 190 26 11995 8 040415
0 218 6 13739 0 190 26 11995 8 040413
0 218 54 13787 0 190 26 11995 8 040413
0 226 62 14299 0 190 26 11995 8 040412
1 72 20 19675 possible root
1 139 7 23883 269 020101
1 206 10 28107 1009 020101
1 206 26 28123 0 190 26 11995 8 020101
1 207 27 28187 0 190 26 11995 8 020101
1 207 43 28203 0 190 26 11995 8 020101
1 207 59 28219 0 190 26 11995 8 020101
1 208 12 28235 0 190 26 11995 8 020101
1 208 28 28251 0 190 26 11995 8 011230
1 208 44 28267 0 190 26 11995 8 020101
1 208 60 28283 0 190 26 11995 8 020908

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Mon, 19 Apr 2004 22:06:06 +1000, Nickolas Kwiatkowski
<nik_in_peru@hotmail.com> wrote:

>Findpart, version 4.42.
>Copyright Svend Olaf Mikkelsen, 1999-2004.
>
>OS: DOS 7.10
>
>Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 - 0C 63 20003697 9767 0 1 1 1322 239 63 B OK
>
>-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
> 0 1 33 Second FAT not found.
>
>-----FAT CHS ------LBA Confidence Distance Type Sig
> 0 1 51 113 3729 32 OK
> 0 96 7 6054 3729 5941 32 OK
> 0 156 26 9853 28 3799 32 NB
>
>Partitions according to partition tables on first harddisk:
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0C 63 20003697 9767 0 1 1 1322*239 63 OK OK

The fact that the other mentioned partitions were not located, may
indicate that the disk geometry originally was 255 heads, 63 sectors.

>This is part of the output of findpart finddir which shows the possible root
>cluster/directory:
>
> 0 201 21 12683 0 190 26 11995 8 040415
> 0 201 37 12699 0 190 26 11995 8 040415
> 0 201 53 12715 0 190 26 11995 8 040415
> 0 218 6 13739 0 190 26 11995 8 040413
> 0 218 54 13787 0 190 26 11995 8 040413
> 0 226 62 14299 0 190 26 11995 8 040412
> 1 72 20 19675 possible root
> 1 139 7 23883 269 020101
> 1 206 10 28107 1009 020101

It can be seen that the FAT located matches the directories, since the

cluster 2 location calculated from the FAT findings, LBA 6054 + 5941 =
11995 matches the cluster 2 location calculated from the directories.
(nik cut the heading).

The partition size calculated from the FAT size 5941 sectors and
cluster size 8 KB is 5946 MB, meaning that the boot sector showing
9767 MB is wrong.

The possible root cluster number is (19675-11995) / 16 + 2 = 482. The
16 is the number of sectors in a cluster, and the 2 is the number of
the first cluster.

chsdir 1 0 1 51 5941 8 482 summary fp-a.txt

may show the content, if the root directory number is correct.

The disk should not be inserted in a Windows system, unless the
partition in the partition tables is effectively hidden, to prevent
further damage.
--
Svend Olaf
http://www.partitionsupport.com/utilities.htm

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Svend Olaf Mikkelsen wrote:

> On Mon, 19 Apr 2004 22:06:06 +1000, Nickolas Kwiatkowski
> <nik_in_peru@hotmail.com> wrote:
>
>>Findpart, version 4.42.
>>Copyright Svend Olaf Mikkelsen, 1999-2004.
>>
>>OS: DOS 7.10
>>
>>Disk: 1 Cylinders: 1323 Heads: 240 Sectors: 63 MB: 9767
>>
>>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
>> 0 - 0C 63 20003697 9767 0 1 1 1322 239 63 B OK
>>
>>-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
>> 0 1 33 Second FAT not found.
>>
>>-----FAT CHS ------LBA Confidence Distance Type Sig
>> 0 1 51 113 3729 32 OK
>> 0 96 7 6054 3729 5941 32 OK
>> 0 156 26 9853 28 3799 32 NB
>>
>>Partitions according to partition tables on first harddisk:
>>
>>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
>> 0 1*0C 63 20003697 9767 0 1 1 1322*239 63 OK OK
>
> The fact that the other mentioned partitions were not located, may
> indicate that the disk geometry originally was 255 heads, 63 sectors.
>
>>This is part of the output of findpart finddir which shows the possible
>>root cluster/directory:
>>
>> 0 201 21 12683 0 190 26 11995 8 040415
>> 0 201 37 12699 0 190 26 11995 8 040415
>> 0 201 53 12715 0 190 26 11995 8 040415
>> 0 218 6 13739 0 190 26 11995 8 040413
>> 0 218 54 13787 0 190 26 11995 8 040413
>> 0 226 62 14299 0 190 26 11995 8 040412
>> 1 72 20 19675 possible root
>> 1 139 7 23883 269 020101
>> 1 206 10 28107 1009 020101
>
> It can be seen that the FAT located matches the directories, since the
>
> cluster 2 location calculated from the FAT findings, LBA 6054 + 5941 =
> 11995 matches the cluster 2 location calculated from the directories.
> (nik cut the heading).
>
> The partition size calculated from the FAT size 5941 sectors and
> cluster size 8 KB is 5946 MB, meaning that the boot sector showing
> 9767 MB is wrong.

Yes, indeed 5946 MB was the correct size of the partition.
>
> The possible root cluster number is (19675-11995) / 16 + 2 = 482. The
> 16 is the number of sectors in a cluster, and the 2 is the number of
> the first cluster.
>
> chsdir 1 0 1 51 5941 8 482 summary fp-a.txt
>
> may show the content, if the root directory number is correct.
>

This is the output of that command:

Chsdir, version 2.6.

Disk 1 CHS: 1323/240/63 FAT Location: 0/1/51

Total clusters: 760446 Cluster KB: 8
Last used cluster: 723941 Reserved: 50
FAT sectors: 5941 Root cluster: 482
FAT used clusters: 555154 FAT entries: 87694
Used clusters: 555159 Entries: 87697
Directories: 2438 Directories MB: 23
Files: 85259 Files MB: 3886
Partition MB: 5946 Free MB: 1603

Used clusters do not match the FAT.
NB files: 3

The detailed listing of the content of the partition is correct and shows
the files that were originally on the partition.

> The disk should not be inserted in a Windows system, unless the
> partition in the partition tables is effectively hidden, to prevent
> further damage.

Understood. Give the above, was is the best course of action to restore the
drive.

Thanks,

Nik

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Tue, 20 Apr 2004 09:12:12 +1000, Nickolas Kwiatkowski
<nik_in_peru@hotmail.com> wrote:

>Yes, indeed 5946 MB was the correct size of the partition.

>This is the output of that command:
>
>Chsdir, version 2.6.
>
>Disk 1 CHS: 1323/240/63 FAT Location: 0/1/51
>
>Total clusters: 760446 Cluster KB: 8
>Last used cluster: 723941 Reserved: 50
>FAT sectors: 5941 Root cluster: 482
>FAT used clusters: 555154 FAT entries: 87694
>Used clusters: 555159 Entries: 87697
>Directories: 2438 Directories MB: 23
>Files: 85259 Files MB: 3886
>Partition MB: 5946 Free MB: 1603
>
>Used clusters do not match the FAT.
>NB files: 3
>
>The detailed listing of the content of the partition is correct and shows
>the files that were originally on the partition.

>Understood. Give the above, was is the best course of action to restore the
>drive.
>
>Thanks,
>
>Nik

>> chsdir 1 0 1 51 5941 8 482 summary fp-a.txt

It seems as the condition of the partition is good enough to be
repaired by creating a new boot sector and editing the partition
tables. That however would be hand work for me, and verifying the
result with different time zones.

What about this:

You delete the partition table entry currently in the partition tables
to protect the partition from operating system access. After that do
not touch any partitioning tool, and do *not* enter the Fdisk create
partition screen. Then insert the disk as disk number 2 in a working
Windows system with room for the files, and do in an empty directory
using Findpart for Windows:

findpart chsdir 2 0 1 51 5941 8 482 copy

?

If you prefer hands on help in this case, then mail me.
--
Svend Olaf
http://www.partitionsupport.com/utilities.htm

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Svend Olaf Mikkelsen wrote:

> On Tue, 20 Apr 2004 09:12:12 +appreciateas Kwiatkowski
> <nik_in_peru@hotmail.com> wrote:
>
>>Yes, indeed 5946 MB was the correct size of the partition.
>
>exercises the output of that command:
>>
>>Chsdir, version 2.6.
>>
>>Disk 1 CHS: 1323/240/63 FAT Location: 0/1/51
>>
>>Total clusters: 760446 Cluster KB: 8
>>Last used cluster: 723941 Reserved: 50
>>FAT sectors: 5941 Root cluster: 482
>>FAT used clusters: 555154 FAT entries: 87694
>>Used clusters: 555159 Entries: 87697
>>Directories: 2438 Directories MB: 23
>>Files: 85259 Files MB: 3886
>>Partition MB: 5946 Free MB: 1603
>>
>>Used clusters do not match the FAT.
>>NB files: 3
>>
>>The detailed listing of the content of the partition is correct and shows
>>the files that were originally on the partition.
>
>>Understood. Give the above, was is the best course of action to restore
>>the drive.
>>
>>Thanks,
>>
>>Nik
>
>>> chsdir 1 0 1 51 5941 8 482 summary fp-a.txt
>
> It seems as the condition of the partition is good enough to be
> repaired by creating a new boot sector and editing the partition
> tables. That however would be hand work for me, and verifying the
> result with different time zones.
>

Agreed, I don't want to take up too much of your own time. I appreciate the
time the you have given.

> What about this:
>
> You delete the partition table entry currently in the partition tables
> to protect the partition from operating system access. After that do
> not touch any partitioning tool, and do *not* enter the Fdisk create
> partition screen. Then insert the disk as disk number 2 in a working
> Windows system with room for the files, and do in an empty directory
> using Findpart for Windows:
>
> findpart chsdir 2 0 1 51 5941 8 482 copy
>
> ?
>

Sounds like a good idea, I will do that.

> If you prefer hands on help in this case, then mail me.

Thank you for the offer, I will see how I process. Out of my own interest,
after using the above procedure, I think I would like to try to
repair/rebuild the partition myself as a learning exercise. Any suggestion
on what I should look at? I have download the MS technical doc for FAT
filesystem and am reading thru that.

Thank you very much for your assistance and the tools that you have
provided.

Nik

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Tue, 20 Apr 2004 22:27:23 +1000, Nickolas Kwiatkowski
<nik_in_peru@hotmail.com> wrote:

>Sounds like a good idea, I will do that.
>
>> If you prefer hands on help in this case, then mail me.
>
>Thank you for the offer, I will see how I process. Out of my own interest,
>after using the above procedure, I think I would like to try to
>repair/rebuild the partition myself as a learning exercise. Any suggestion
>on what I should look at? I have download the MS technical doc for FAT
>filesystem and am reading thru that.
>
>Thank you very much for your assistance and the tools that you have
>provided.
>
>Nik

Well, you will need a 512 bytes FAT32 boot sector (a wrong one is
already there in your case), and a tool to edit it.

If you do:

set findpart=edit
findpart editboot

you will see the usage for a simple command line utility to edit the
boot sector. You will have to able to calculate the number of sectors
in the partition. For partition table editing, you can see my pages.

Tools with more advanced user interface exists, but one have to make
sure that the tool is reliable.

Note that you may want to go back to a 255 heads translation. That can
be done if no partitions are in the MBR partition table.
--
Svend Olaf