i errored and am confused how to fix it!. help!!!!

[hogwash]

i ran this command dd if=install.bin of=/dev/hda when i meant to run dd if=install.bin of=/dev/hda1 !!!!!!!!

and i have nuked my mbr i think? on my windows laptop

i am utterly confused how to fix the problem and get my windows system up and running again (as it contains come critical data!)

i think i have just destroyed the mbr but someone far better qualified on the forums can advise me

can't they!


help!!!!

[Harry Kuhman]

i think i have just destroyed the mbr.....
You can repair the mbr (as far as windows is concerned) by running fdisk from a recovery disk with the /mbr option:

fdisk /mbr
Better yet, you can get a copy of Smart Boot Manager (http://btmgr.webframe.org/)and install that as your MBR - then you'll be able to boot from any partition, or any CD, or any floppy. (Put Lilo or Grub on the Linux partition, not the MBR when you do this.)

[hogwash]

thanks for that

from the command i have run i hope i have not wiped the hda and overwritten the entire contents with the binary i was trying to import
can someone advise as to what they think i have done with the command above.... if i have lost the data i am in deep doo doo

[Harry Kuhman]

.....can someone advise as to what they think i have done with the command above.... if i have lost the data i am in deep doo doo
People can give you their opnions, but why not know for sure? - just boot Knoppix and look at the partitions and see if the data you need is still there. You could even use Knoppix to back up critical data before you go any further (since you don't seem to have any backup).

[hogwash]

the problem i have is that i cannot mount the drive , it is "seen" as an "unidentified file system" or as un-allocated space. windows sees it as un-allocated space , knoppix simply wont let me mount it , at least in the manner i have been trying .. or failing

[firebyrd10]

the problem i have is that i cannot mount the drive , it is "seen" as an "unidentified file system" or as un-allocated space. windows sees it as un-allocated space , knoppix simply wont let me mount it , at least in the manner i have been trying .. or failing

Thats because the partition table has been nuked also, and if the file was bigger then 512 b then part of the first partition has been nuked also, If you can remember the sizes of the partitions you can try and use fdisk to rebuild the table.

[hogwash]

well, it was a 20mb binary! so i guess that explains that then... as for the partition sizes it is a 20gb hdd and only had one partition which was the maximum size in ntfs

where do i begin guys??

[Harry Kuhman]

Thats because the partition table has been nuked also,.....
yup, I agree with firebyrd10, if you can't mount the partitions under Knoppix then more than just the MBR has been munged. There are still tools under both Linux and MS OS's that can help you recover stuff, but you've got more work to do than just replace the MBR.

[hogwash]

i dony mind the work i just need a few pointers! .... i assume that if i rebuild the patition table on the max @ 20gb (original config) that would be a good place to start... then the mbr and see what is what from there?

[Harry Kuhman]

where do i begin guys??
You might start with the forensic LiveCD Helix (http://www.e-fense.com/helix/download.htm). And I would be looking at where I was going to be putting any files I could recover (if it's a desktop, install a second hard drive with a FAT32 partition in that puppy before you do anything else, and move the files to the other hard drive as soon as you can). How large are the files you need to recover? Would they fit on a USB memory device? A CDR? Can you network to another system?

However, if anyone has other suggestions, then consider taking them over Helix; I've played with it but never really recovered data with it. And Don't forget some of the DOS/Windows live CD's or even commercial tools designed for the NTFS file system.

[Harry Kuhman]

i dony mind the work i just need a few pointers! .... i assume that if i rebuild the patition table on the max @ 20gb (original config) that would be a good place to start... then the mbr and see what is what from there?
I'm not sure how one can get the partition back. My expectation is if you just recreate the partition it will look unformatted. If you format it you could wipe out the data. I'm hoping someone else may know how to repair the partition in a way that will leave the files in place.

[hogwash]

yes that is what was causing me pain , even if i fdisk the partition back it will show up as unformatted space i guess.... but i know it is ntfs so presumably i can recover files using a third party ntfs recovery tool or at least try and mount it and browse it maybe ...

much work ahead ... good job for the holidays !
thanks for your tips/advice

[UnderScore]

Use gpart to rebuild the partition table. I too once nuked the MNR & the partition table using the dd command. I then freaked out that I had lost everything. I searched google and found gpart. I then noticed it was on the Knoppix CD and used it to rebuild the partition table. Check out http://www.stud.uni-hannover.de/user/76201/gpart/.
I hope this helps.
James

[firebyrd10]

All files after the 20 meg mark on the drive are still intact, if you can fix the partition then you may be able to get your files back, only problem I see is the TOC of disks. That would need to be rewritten. Though I sure some tool can scan and write it.

Like said before, Helix might be the thing to try.