| View previous topic :: View next topic |
| Author |
Message |
noup
l33t
Joined: 21 Mar 2003
Posts: 917
|
 Posted: Thu Mar 10, 2005 12:08 am Post subject: |
 |
|
| NeddySeagoon wrote: | noup,
I meant, the partition type byte 0x82 for linux, 0x83 for linux swap etc.
There is no need to recreate the entire partition table. |
Hi, i just did this (changed the types to the same types they already had) and then wrote the partition, but the problem remains.
Btw, it's 82 for linux swap and 83 for linux. 
Btw2, my current partition table is:
| Code: |
Device Boot Start End Blocks Id System
/dev/hda1 1 1275 10241406 c W95 FAT32 (LBA)
/dev/hda2 1276 5981 37800945 c W95 FAT32 (LBA)
/dev/hda3 5982 18174 97940272+ 83 Linux
/dev/hda4 18175 19457 10305697+ f W95 Ext'd (LBA)
/dev/hda5 18175 18179 40131 83 Linux
/dev/hda6 18180 18302 987966 82 Linux swap / Solaris
/dev/hda7 18303 19457 9277506 83 Linux
|
In parted, it shows:
| Code: |
Disk geometry for /dev/hda: 0.000-152627,835 megabytes
Disk label type: msdos
Minor Start End Type Filesystem Flags
1 0,031 10001,403 primary lba
2 10001,404 46916,389 primary fat32 lba
3 46916,389 142561,186 primary reiserfs
4 142561,187 152625,344 extended lba
5 142561,217 142600,407 logical ext3
6 142600,438 143565,249 logical linux-swap
7 143565,280 152625,344 logical reiserfs
|
I can see that parted shows the same point for partition2 end and partition3 start. Could this be it? It's strange, since fdisk doesn't show it like this.
_________________
noup. |
|
| Back to top |
|
 |
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 55292
Location: 56N 3W
|
| Posted: Thu Mar 10, 2005 6:44 pm Post subject: |
|
|
noup,
run fdisk, press x to go into eXpert mode then d to print the raw partition table.
Post what that produces. Now press q to quit without saving.
Use m at any time to see the commands.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
noup
l33t
Joined: 21 Mar 2003
Posts: 917
|
| Posted: Thu Mar 10, 2005 10:23 pm Post subject: |
|
|
| NeddySeagoon wrote: | noup,
run fdisk, press x to go into eXpert mode then d to print the raw partition table.
Post what that produces. Now press q to quit without saving.
Use m at any time to see the commands. |
Here is the output:
| Code: |
Device: /dev/hda
0x000: EB 48 90 D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C
0x010: BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04
0x020: 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5
0x030: 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 03 02
0x040: FF 00 00 20 01 00 00 00 00 02 FA 80 CA 80 EA 53
0x050: 7C 00 00 31 C0 8E D8 8E D0 BC 00 20 FB A0 40 7C
0x060: 3C FF 74 02 88 C2 52 BE 79 7D E8 34 01 F6 C2 80
0x070: 74 54 B4 41 BB AA 55 CD 13 5A 52 72 49 81 FB 55
0x080: AA 75 43 A0 41 7C 84 C0 75 05 83 E1 01 74 37 66
0x090: 8B 4C 10 BE 05 7C C6 44 FF 01 66 8B 1E 44 7C C7
0x0A0: 04 10 00 C7 44 02 01 00 66 89 5C 08 C7 44 06 00
0x0B0: 70 66 31 C0 89 44 04 66 89 44 0C B4 42 CD 13 72
0x0C0: 05 BB 00 70 EB 7D B4 08 CD 13 73 0A F6 C2 80 0F
0x0D0: 84 F0 00 E9 8D 00 BE 05 7C C6 44 FF 00 66 31 C0
0x0E0: 88 F0 40 66 89 44 04 31 D2 88 CA C1 E2 02 88 E8
0x0F0: 88 F4 40 89 44 08 31 C0 88 D0 C0 E8 02 66 89 04
0x100: 66 A1 44 7C 66 31 D2 66 F7 34 88 54 0A 66 31 D2
0x110: 66 F7 74 04 88 54 0B 89 44 0C 3B 44 08 7D 3C 8A
0x120: 54 0D C0 E2 06 8A 4C 0A FE C1 08 D1 8A 6C 0C 5A
0x130: 8A 74 0B BB 00 70 8E C3 31 DB B8 01 02 CD 13 72
0x140: 2A 8C C3 8E 06 48 7C 60 1E B9 00 01 8E DB 31 F6
0x150: 31 FF FC F3 A5 1F 61 FF 26 42 7C BE 7F 7D E8 40
0x160: 00 EB 0E BE 84 7D E8 38 00 EB 06 BE 8E 7D E8 30
0x170: 00 BE 93 7D E8 2A 00 EB FE 47 52 55 42 20 00 47
0x180: 65 6F 6D 00 48 61 72 64 20 44 69 73 6B 00 52 65
0x190: 61 64 00 20 45 72 72 6F 72 00 BB 01 00 B4 0E CD
0x1A0: 10 AC 3C 00 75 F4 C3 00 00 00 00 00 00 00 00 00
0x1B0: 00 00 00 00 00 00 00 00 55 B4 55 B4 00 00 00 01
0x1C0: 01 00 0C FE FF FF 3F 00 00 00 FC 8A 38 01 00 FE
0x1D0: FF FF 0C FE FF FF 3B 8B 38 01 E2 97 81 04 00 FE
0x1E0: FF FF 83 FE FF FF 1D 23 BA 05 61 E6 AC 0B 00 FE
0x1F0: FF FF 0F FE FF FF 7E 09 67 11 43 81 3A 01 55 AA
0x000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE
0x1C0: FF FF 83 FE FF FF 3F 00 00 00 86 39 01 00 00 FE
0x1D0: FF FF 05 FE FF FF C5 39 01 00 7E 47 39 01 00 00
0x1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
0x000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE
0x1C0: FF FF 82 FE FF FF 3F 00 00 00 7C 26 1E 00 00 FE
0x1D0: FF FF 05 FE FF FF 80 60 1F 00 C3 20 1B 01 00 00
0x1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
0x000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE
0x1C0: FF FF 83 FE FF FF 3F 00 00 00 84 20 1B 01 00 00
0x1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
|
Thanks again, NeddySeagoon.
_________________
noup. |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 55292
Location: 56N 3W
|
| Posted: Fri Mar 11, 2005 7:06 pm Post subject: |
|
|
noup,
Here is the raw form of your primary partition table
| Code: | 0x1B0: 00 01
0x1C0: 01 00 0C FE FF FF 3F 00 00 00 FC 8A 38 01 00 FE
0x1D0: FF FF 0C FE FF FF 3B 8B 38 01 E2 97 81 04 00 FE
0x1E0: FF FF 83 FE FF FF 1D 23 BA 05 61 E6 AC 0B 00 FE
0x1F0: FF FF 0F FE FF FF 7E 09 67 11 43 81 3A 01 |
Here is what it means
Partition 1
| Code: | 0x1BE byte - bootable flag 0x00 or 0x80 - not bootable
0x1BF byte- starting head of partition in C/H/S format - Head 1
0x1C0 16 bits Starting Cylinder 10 bits and Sector 6 bits
0x1C2 byte System indicator = 0x0C =W95 FAT32 (LBA)
0x1C3 byte ending head (CHS) =0xFE =254
0x1C4 16 bits Endibf Cylinder/Sector
0x1C6 4 bytes Sectors before partiton (LBA) 00 00 00 00 3F (low byte first)
0x1CA 4 bytes Sectors this partition (LBA) 01 38 8A FC (low byte first) |
Partition 2
| Code: | 0x1BE byte - bootable flag 0x00 or 0x80 - not bootable
0x1CF byte- starting head of partition in C/H/S format - FE Head 254 - thats strange
0x1D0 16 bits Starting Cylinder 10 bits and Sector 6 bits FF FF - thats strange too
0x1D2 byte System indicator = 0x0C =W95 FAT32 (LBA)
0x1D3 byte ending head (CHS) =0xFE =254
0x1D4 16 bits Endibf Cylinder/Sector = FF FF
0x1D6 4 bytes Sectors before partiton (LBA) 01 38 8B 3B (low byte first)
0x1DA 4 bytes Sectors this partition (LBA) 04 91 07 E2 (low byte first) |
The first sector is larger than 8.4Gb, which is why the CHS numbers are a bit odd.
Partition 3
| Code: | 0x1DE byte - bootable flag 0x00 or 0x80 - not bootable
0x1E2 byte System indicator = 0x83 =Linux
0x1E6 4 bytes Sectors before partiton (LBA) 05 BA 23 1D (low byte first)
0x1EA 4 bytes Sectors this partition (LBA) 0B AC E6 61 (low byte first) |
Partition 4 is your extended partition the other secors contain a single partition table each
Now, your partition table contains dummy CHS entries but Linux fdisk doesn't create them. It leaves the CHS entries at zero.
You could try manually editing the CHS entries to zero. Thats the 3 bytes starting at 1BF and 1C3, 1CF and 1D3, 1DF and 1E3 and 1EF and 1F3.
thats all in sector 0 of the drive.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
noup
l33t
Joined: 21 Mar 2003
Posts: 917
|
| Posted: Fri Mar 11, 2005 10:32 pm Post subject: |
|
|
| NeddySeagoon wrote: |
Partition 4 is your extended partition the other secors contain a single partition table each
Now, your partition table contains dummy CHS entries but Linux fdisk doesn't create them. It leaves the CHS entries at zero.
You could try manually editing the CHS entries to zero. Thats the 3 bytes starting at 1BF and 1C3, 1CF and 1D3, 1DF and 1E3 and 1EF and 1F3.
thats all in sector 0 of the drive. |
Thank you so much for this long and extremely useful information! I find it pretty interesting to analise the disk in raw. 
I see what you mean, but how do you recomend me to do this, with dd perhaps? I'll only have a chance to try it on sunday, when i come back from weekend, but i'll check out how to do it in advance.
_________________
noup. |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 55292
Location: 56N 3W
|
| Posted: Fri Mar 11, 2005 10:47 pm Post subject: |
|
|
noup,
emerge hexedit
Use dd to make a backup of the partition table in case you don't get it quite right.
Make several backups, edit one, then copy it into position with dd.
If its not right, you will need a copy on another disk to be able to restore it. If you trash the partition table, you won't have any access to this disk, so be careful
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
noup
l33t
Joined: 21 Mar 2003
Posts: 917
|
| Posted: Tue Mar 15, 2005 11:43 pm Post subject: |
|
|
Hi NeddySeagoon,
Finally i got back to my computer and, luckily, i tried a cd containing windows xp with service pack 2 from a friend of mine, which detected all the partitions successfuly. So, i think i'll just leave the partitions the way they are, right now.
Thanks again for all your help, i surely appreciate it.
_________________
noup. |
|
| Back to top |
|
|
nick-brown
n00b
Joined: 23 Feb 2005
Posts: 12
|
| Posted: Wed Mar 16, 2005 4:00 pm Post subject: |
|
|
Just a final note on this - is your HD a Maxtor ? There was an issue with Windows only detecting the first 130Gb of 160Gb Maxtor disks that was fixed in a patch - this may explain why SP2 fixed it.
N |
|
| Back to top |
|
|
noup
l33t
Joined: 21 Mar 2003
Posts: 917
|
| Posted: Wed Mar 16, 2005 11:30 pm Post subject: |
|
|
| nick-brown wrote: | Just a final note on this - is your HD a Maxtor ? There was an issue with Windows only detecting the first 130Gb of 160Gb Maxtor disks that was fixed in a patch - this may explain why SP2 fixed it.
N |
Nope, it's a Seagate. But i think that can explain part of it. I mean, i already had windows installed before, so i could install xp (base version, no SP's) before. But perhaps now, since my partition table was written with a linux prog, perhaps it can't read it well (or couldn't). And so, perhaps it had the problem of only detecting 130GB and since no partitions were detected, then 130GB appeared.
This would be a strange thing, if it weren't related to the M company software.
_________________
noup. |
|
| Back to top |
|
|
romhelfen
n00b
Joined: 21 Nov 2004
Posts: 10
Location: Germany
|
| Posted: Wed Mar 23, 2005 3:24 pm Post subject: recovery of data in a windows-formated partion |
|
|
Hello,
I was in the same situation as noup (Windows-XP destroyed the partition-table ...) but thanks to testdisk I could recover all my data.
But now I have an additional problem (question):
Is it possible to recreate the data in a partition after formating it (i.e. in Windows/Explorer by rightclicking on it and then choosing format ...)?
That means, the partition-table is the same, only one partiton was formated. I' ve been trying to recover the data with testdisk for serveral times, but always with the same result: The related partion is found, but no data in it!
Afaik the "old" data should still remain in the partition, as I didn't execute a "low-level-formating" and performed no write-action so far. So is it possible to
recover/recreate the "old" data? |
|
| Back to top |
|
|
NeddySeagoon
Administrator
Joined: 05 Jul 2003
Posts: 55292
Location: 56N 3W
|
| Posted: Wed Mar 23, 2005 9:50 pm Post subject: |
|
|
romhelfen,
Data recovery after format depends on the filesystem in use. Format does not actually write vey much to the disk, just the root directory structure and updates the free space tracking mechanism to show everything free.
If the partition was NTFS, you may well be out of luck because small files are stored within the Master File Table itself, which has been rewritten. If it was FAT of some sort, then its not too difficult to recreate the root directory entries with a sector editior.
The free space map is still showing everything free, so you must not write to the filesystem.
Linux filesystems have similar challenges and ease of data recovery differs there too.
_________________
Regards,
NeddySeagoon
Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail. |
|
| Back to top |
|
|
romhelfen
n00b
Joined: 21 Nov 2004
Posts: 10
Location: Germany
|
| Posted: Fri Mar 25, 2005 11:14 am Post subject: (windows-) tool iRecover |
|
|
Hi there,
I found the windows-tool iRecover (http://www.diydatarecovery.nl/), which can be used to recover data on (among others) FAT/NTFS-partitions after (intentionally/carelessly) formating.
This tool doesn' t make any changes to partition-tables/sectors but recovers the data and provides the possibiliy to copy it to another location/partition.
In the trial-version the features are restricted to save only one directory. I have tried it and it works fine. So this might be a solution for all who don' t have the knowledge/skills to work with sector-editors as advised by NeddySeagoon.
Kind regards
romhelfen |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Other Things Gentoo
