Help! MBR wiped out

Toggle sidebar Toggle sidebar
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Hello
While working other day on my PC, I accidentally typed this command
dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
have been
hdb3 which is my linux boot partition.
As probably you know , this has completely wiped my MBR.

On my friend's PC, the drive shows the status as RAW partition.
I think I can save my data by entering correct partition table in MBR
and I want
you to help me.
Firstly my partition table looked like this:

1 FAT32(primary) 7 GB
2 /boot(primary) 200 Mb
3 ntfs 10 gb (logical)
4 ntfs 10 gb (logical)
5 ntfs 10 gb (logical)
6 / 5 gb
7 /swap 500 mb


I think I can build the exact partition table by looking the disc
sectors in hex and identifying the location of starting boot sector of
each partition.
The problem is that I cant view my disc sectors as hex, since it shows
my disc as RAW.

Is there any utility which can scan the hard disc and tries to build
the partition table. Or do i have to do it manually.

Any help would be appreciated.

--
Madhur Ahuja
 
J

joeP

Distinguished
Dec 31, 2007
264
0
18,780
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Madhur Ahuja" <madhur_ahuja@spymac.com> wrote in message
news:b1d88ab.0410102302.271d2d76@posting.google.com...
> Hello
> While working other day on my PC, I accidentally typed this command
> dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
> have been
> hdb3 which is my linux boot partition.
> As probably you know , this has completely wiped my MBR.
>
> On my friend's PC, the drive shows the status as RAW partition.

Normally you'd expect NO partitions if the MBR was wiped, not a RAW
partition.

> I think I can save my data by entering correct partition table in MBR
> and I want
> you to help me.
> Firstly my partition table looked like this:
>
> 1 FAT32(primary) 7 GB
> 2 /boot(primary) 200 Mb
> 3 ntfs 10 gb (logical)
> 4 ntfs 10 gb (logical)
> 5 ntfs 10 gb (logical)
> 6 / 5 gb
> 7 /swap 500 mb
>

That isn't accurate enough.

>
> I think I can build the exact partition table by looking the disc
> sectors in hex and identifying the location of starting boot sector of
> each partition.
> The problem is that I cant view my disc sectors as hex, since it shows
> my disc as RAW.

Even a RAW disk can be viewed when you access the physical disk.

>
> Is there any utility which can scan the hard disc and tries to build
> the partition table.

Our tool DiskPatch can do that.

--
Joep

D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.
CHK-Mate - automated CHK file analysis & recovery
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On 11 Oct 2004 00:02:41 -0700, madhur_ahuja@spymac.com (Madhur Ahuja)
wrote:

>Hello
> While working other day on my PC, I accidentally typed this command
>dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
>have been
>hdb3 which is my linux boot partition.
>As probably you know , this has completely wiped my MBR.

That Linux dd command would not wipe the MBR, but write a file boot.b.
--
Svend Olaf
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Hello

This is the output of findpart v 4.45 on my hard disk. I have
been able to recover my c: partition.
As I told, my structure of partition is as follows:

1 FAT32(primary) 7 GB
2 /boot(primary) 200 Mb
3 ntfs 10 gb (logical)
4 ntfs 10 gb (logical)
5 ntfs 10 gb (logical)
6 / 5 gb
7 /swap 500 mb

I am currently know trying to locate my extended partition boot
sector and trying to read further tables.
If anyone can help me with the findpart output, I will be very
grateful.


Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.1.2600

Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0B 63 15454466 7546 0 1 1 961 254 62 B OK
962 2 05 0 23069340 11264 988 0 1 2423*254 63 988 OK
962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
Lilo sector 962 1 1
988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 988 OK
Lilo sector 988 0 1
0 - 07 15872283 23069277 11264 988 1 1 2423 254 63 B OK
2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 988 OK
0 - 07 38941623 19374327 9460 2424 1 1 3629 254 63 B OK
3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 988 OK
0 - 07 58316013 9446157 4612 3630 1 1 4217 254 63 B OK
4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 988 OK
4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK
Fdisk F6 sector 4806 1 1

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 15063 4 2 15063 0 0 0 000102 5667

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 15520002 7578 0 1 1 961 254 63 NB NB
0 1 1 966 20 15 Actual
0 2?83 63 417628 203 962 1 1 988 254 63 NB NB
0 1 1 26 0 1 Actual
0 3 0F 9847845 68388705 33392 613 0 1 4869*254 63 OK

No signature CHS: 613 0 1
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Mon, 11 Oct 2004 23:29:40 +0530, "madhur" wrote:

>Hello
>
>This is the output of findpart v 4.45 on my hard disk. I have
>been able to recover my c: partition.
>As I told, my structure of partition is as follows:
>
>1 FAT32(primary) 7 GB
>2 /boot(primary) 200 Mb
>3 ntfs 10 gb (logical)
>4 ntfs 10 gb (logical)
>5 ntfs 10 gb (logical)
>6 / 5 gb
>7 /swap 500 mb

That is more than the disk size.

>I am currently know trying to locate my extended partition boot
>sector and trying to read further tables.
>If anyone can help me with the findpart output, I will be very
>grateful.
>
>
>Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
>Copyright Svend Olaf Mikkelsen, 1999-2004.
>
>OS: Windows 5.1.2600
>
>Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 - 0B 63 15454466 7546 0 1 1 961 254 62 B OK
> 962 2 05 0 23069340 11264 988 0 1 2423*254 63 988 OK
> 962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
> Lilo sector 962 1 1
> 988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
> 988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 988 OK
> Lilo sector 988 0 1
> 0 - 07 15872283 23069277 11264 988 1 1 2423 254 63 B OK
> 2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
> 2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 988 OK
> 0 - 07 38941623 19374327 9460 2424 1 1 3629 254 63 B OK
> 3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
> 3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 988 OK
> 0 - 07 58316013 9446157 4612 3630 1 1 4217 254 63 B OK
> 4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
> 4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 988 OK
> 4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK
> Fdisk F6 sector 4806 1 1
>
>-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
> 0 1 33 15063 4 2 15063 0 0 0 000102 5667
>
>Partitions according to partition tables on second harddisk:
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0B 63 15520002 7578 0 1 1 961 254 63 NB NB
> 0 1 1 966 20 15 Actual
> 0 2?83 63 417628 203 962 1 1 988 254 63 NB NB
> 0 1 1 26 0 1 Actual
> 0 3 0F 9847845 68388705 33392 613 0 1 4869*254 63 OK
>
> No signature CHS: 613 0 1

The extended partition seems to be at cylinder 988 numbered from 0. If
you edit the entry, I suggest you initially make the entry type 85
(Linux extended) in stead of 0F so you can verify that the extended
partition tables are correct without confusing Windows in the case
that they are wrong.

The entry for the FAT32 partition (N 1) is wrong, since the number of
sectors is too large. The entry for the partition should end at a
cylinder boundary, so the entry should define a partition 1 sector
larger than the actual partition.

The entry for the ext2 partition (N 2) is wrong too. It currently
defines a partition at the same location as the FAT32 partition, since
the relative entry is too small. Also the active byte is not zero.

You should not use other persons email addresses.
--
Svend Olaf
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Svend Olaf Mikkelsen" <svolaf@partitionsupport.com> wrote in message
news:416a631a.2783279@dtext.news.tele.dk...
> On 11 Oct 2004 00:02:41 -0700, madhur_ahuja@spymac.com (Madhur Ahuja)
> wrote:
>
> >Hello
> > While working other day on my PC, I accidentally typed this command
> >dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
> >have been
> >hdb3 which is my linux boot partition.
> >As probably you know , this has completely wiped my MBR.
>
> That Linux dd command would not wipe the MBR, but write a file boot.b.

Sorry that was reverse.


> --
> Svend Olaf
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Svend Olaf Mikkelsen" <svolaf@partitionsupport.com> wrote in message
news:416af35d.39724197@dtext.news.tele.dk...
>[...]

Thank you very much svend!. Problem solved and data recovered.
I am grateful to you since you have helped me a lot in this
troublesome situation.

I made just one correction in primary table and all the drives
were instantly available. I think this is because I messed up
only primary partition table.

However there is small problem with my linux /boot partition.
Computer management shows 3 gb of unallocated space outside of
extended partition.

Here is the final output of find part:

Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 4.10.2222

Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0B 63 15454466 7546 0 1 1 961 254 62 B OK
962 2 05 0 23069340 11264 988 0 1 2423*254 63 988 OK
962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK
Lilo sector 962 1 1
988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 988 OK
Lilo sector 988 0 1
0 - 07 15872283 23069277 11264 988 1 1 2423 254 63 B OK
2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 988 OK
0 - 07 38941623 19374327 9460 2424 1 1 3629 254 63 B OK
3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 988 OK
0 - 07 58316013 9446157 4612 3630 1 1 4217 254 63 B OK
4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 988 OK
4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK
Fdisk F6 sector 4806 1 1

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 15063 4 2 15063 0 0 0 000102 5667

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 15454467 7546 0 1 1 961 254 63 NB OK
0 2 0F 15872220 62364330 30451 988 0 1 4869*254 63 OK
0 3 83 9163136 417627 203 962 1 1 987 254 63 NB NB
570 96 39 596 95 38 Actual

988 1 07 63 23069277 11264 988 1 1 2423*254 63 R0 OK
988 2 05 23069340 19374390 9460 2424* 0 1 3629*254 63 OK

2424 1 07 63 19374327 9460 2424* 1 1 3629*254 63 R0 OK
2424 2 05 42443730 9446220 4612 3630* 0 1 4217*254 63 OK

3630 1 07 63 9446157 4612 3630* 1 1 4217*254 63 R0 OK
3630 2 05 51889950 9446220 4612 4218* 0 1 4805*254 63 OK

4218 1 83 63 9446157 4612 4218* 1 1 4805*254 63 OK 3 OK
4218 2 05 61336170 1028160 502 4806* 0 1 4869*254 63 OK

4806 1 82 63 1028097 502 4806* 1 1 4869*254 63 OK

and my partition table is this:

00000000h: 80 01 01 00 0B FE FF C1 3F 00 00 00 03 D1 EB 00
00000010h: 00 00 C1 DC 0F FE FF FF DC 30 F2 00 AA 9A B7 03
00000020h: 00 01 C1 C2 83 FE FF DB 80 D1 8B 00 5B 5F 06 00
00000030h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


>
> You should not use other persons email addresses.

What email address are you talking about! or is this your signature.

> --
> Svend Olaf
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On Tue, 12 Oct 2004 04:51:24 +0530, "madhur" <billgates@microsoft.com>
wrote:

>Findpart, version 4.45 - for Windows 95/98/ME/NT/2000/XP.
>Copyright Svend Olaf Mikkelsen, 1999-2004.
>
>OS: Windows 4.10.2222
>
>Disk: 2 Cylinders: 4870 Heads: 255 Sectors: 63 MB: 38201
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS

> 962 - 83 63 417627 203 962 1 1 987 254 63 B5 3 OK

>Partitions according to partition tables on second harddisk:
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0B 63 15454467 7546 0 1 1 961 254 63 NB OK
> 0 2 0F 15872220 62364330 30451 988 0 1 4869*254 63 OK
> 0 3 83 9163136 417627 203 962 1 1 987 254 63 NB NB
> 570 96 39 596 95 38 Actual

The entry for the Linux partition still is wrong here. If you now
afterwards have an OK in the "BS" and the "CHS" field for the Linux
partition, the entry should be correct.

The "NB" for the FAT32 partition is OK, since the actual partition
space is 1 sector smaller.

>> You should not use other persons email addresses.
>
>What email address are you talking about! or is this your signature.

You will have to look at the from field in all your messages in this
thread to figure out.

--
Svend Olaf
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Previously Madhur Ahuja <madhur_ahuja@spymac.com> wrote:
> Hello
> While working other day on my PC, I accidentally typed this command
> dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
> have been
> hdb3 which is my linux boot partition.
> As probably you know , this has completely wiped my MBR.

Huh? This overwrites the file /boot/boot.b with the first 512 bytes
of /dev/hdb! It does not have any effect on the MBR.

Do you mean the same command with the parameters to 'if' and 'of'
exchanged?

Arno
--
For email address: lastname AT tik DOT ee DOT ethz DOT ch
GnuPG: ID:1E25338F FP:0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
"The more corrupt the state, the more numerous the laws" - Tacitus
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Arno Wagner <me@privacy.net> wrote:
> Previously Madhur Ahuja <madhur_ahuja@spymac.com> wrote:
>> Hello
>> While working other day on my PC, I accidentally typed this command
>> dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
>> have been
>> hdb3 which is my linux boot partition.
>> As probably you know , this has completely wiped my MBR.
>
> Huh? This overwrites the file /boot/boot.b with the first 512 bytes
> of /dev/hdb! It does not have any effect on the MBR.
>
> Do you mean the same command with the parameters to 'if' and 'of'
> exchanged?
>
> Arno

Yes Arno! I have pointed this earlier in the thread.
But the issue is resolved now. I have posted the solution in the thread.

--
Madhur Ahuja [madhur<underscore>ahuja<at>yahoo<dot>com]

Homepage
http://madhur.netfirms.com
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Svend Olaf Mikkelsen <svolaf@partitionsupport.com> wrote:
>>> You should not use other persons email addresses.
>>
>> What email address are you talking about! or is this your signature.
>
> You will have to look at the from field in all your messages in this
> thread to figure out.

They both are my email ids. Although ef@df.com is just a spoof one to
avoid spam.

--
Madhur Ahuja [madhur<underscore>ahuja<at>yahoo<dot>com]

Homepage
http://madhur.netfirms.com
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Previously Madhur Ahuja <ef@df.com> wrote:
> Arno Wagner <me@privacy.net> wrote:
>> Previously Madhur Ahuja <madhur_ahuja@spymac.com> wrote:
>>> Hello
>>> While working other day on my PC, I accidentally typed this command
>>> dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
>>> have been
>>> hdb3 which is my linux boot partition.
>>> As probably you know , this has completely wiped my MBR.
>>
>> Huh? This overwrites the file /boot/boot.b with the first 512 bytes
>> of /dev/hdb! It does not have any effect on the MBR.
>>
>> Do you mean the same command with the parameters to 'if' and 'of'
>> exchanged?
>>
>> Arno

> Yes Arno! I have pointed this earlier in the thread.
> But the issue is resolved now. I have posted the solution in the thread.

Sorry, did not see it in time.

Arno
--
For email address: lastname AT tik DOT ee DOT ethz DOT ch
GnuPG: ID:1E25338F FP:0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
"The more corrupt the state, the more numerous the laws" - Tacitus
 
G

Guest

Guest
Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"Madhur Ahuja" <ef@df.com> wrote in message news:2t2jkpF1pmd60U1@uni-berlin.de
> Arno Wagner <me@privacy.net> wrote:
> > Previously Madhur Ahuja <madhur_ahuja@spymac.com> wrote:
> > > Hello
> > > While working other day on my PC, I accidentally typed this command
> > > dd if=/dev/hdb of=/boot/boot.b count=1 . Instead of hdb there should
> > > have been hdb3 which is my linux boot partition.
> > > As probably you know , this has completely wiped my MBR.
> >
> > Huh? This overwrites the file /boot/boot.b with the first 512 bytes
> > of /dev/hdb! It does not have any effect on the MBR.
> >
> > Do you mean the same command with the parameters to 'if' and 'of'
> > exchanged?
> >
> > Arno
>
> Yes Arno! I have pointed this earlier in the thread.

It must have been quite a drinkfest for our Arnie.

> But the issue is resolved now. I have posted the solution in the thread.
 
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom