Results 1 to 8 of 8

Thread: Lost MBR for hdb

  1. #1
    Junior Member
    Join Date
    Jan 2009
    Posts
    4

    Lost MBR for hdb

    Bet you've never seen this one before:

    Running Win2K and have got a copy of PGP that's a couple of years old and was doing some "spring cleaning" -- so ...

    HD0 = 80Gb partitioned to 8Gb (C:/) for OS and remainder (D:/) for data.

    HD1 = 200Gb partitioned to 30Gb (E:/) for backup files and 160Gb (F:/) for larger storage, video, audio, large images and stuff

    Ran chkdsk and defragmented all drives, then began wiping drive free space using PGP. All went OK for the smaller partitions on HD0, but began a wipe on the 160Gb partition and ... oops, now I can't read the data. Hardware is all recognized (I'm pretty sure there is no hardware problem), but when I run Knoppix TESTDISK I'm having difficulty navigating to the problematic drive.

    On bootup the hardware and partitions are recognized as hda and hdb -- how do I navigate to the hdb drive to reconstruct the MBR that was no doubt eaten by PGP in the wipe process? This version of PGP probably does not read the large partition and scrambled or deleted the NTFS MBR.

    EDIT: Correction
    Knoppix reads the drive as [hdb1] and [hdb2], but when I click on the recognized partitions I am told that the device could not be mounted; that "I could not determine the filesystem type, and none was specified."

    I tried right clicking on the device and clicked the "mount" option which tells me, again "I could not mount the device"

  2. #2
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441

    Re: Lost MBR for hdb

    Quote Originally Posted by lwalper
    ...EDIT: Correction
    Knoppix reads the drive as [hdb1] and [hdb2], but when I click on the recognized partitions I am told that the device could not be mounted; that "I could not determine the filesystem type, and none was specified."
    No, hdb1 and hdb2 are partitions on drive hdb, not drives. Your other drive is elsewhere, likely hda, but it really depends on the type of interface it is on (IDE for hda and hdb) and which interface connector and master/slave/cable select settings.

    See man testdisk and/or man gpart for info on recovering a MBR. But if the NTFS partition has been wiped or rewritten then your data is now extremely "secure".

  3. #3
    Junior Member
    Join Date
    Jan 2009
    Posts
    4
    Well, by running PGP security IS what I was looking for. It's sort of "sick" but you did make me chuckle. Thanks! One of those "You idiot! Why did you run that without doing a FULL backup!!" kind of moments.

    Back to the point -- I understand about logical partitions and physical drives -- there are both partitions hda1 and hda2 (drive 0) and partitions hdb1 and hdb2 (drive 1) displayed. I just can't mount the "b" drive partitions. I'll read the manual and see what gives.

    Would something like Norton utilities be able to recover the data? I'm pretty certain the data is still there (maybe not?? -- PGP may have done it's job as instructed). The data may truly be "secure."

  4. #4
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    Quote Originally Posted by lwalper
    Back to the point -- I understand about logical partitions and physical drives -- there are both partitions hda1 and hda2 (drive 0) and partitions hdb1 and hdb2 (drive 1) displayed. I just can't mount the "b" drive partitions. I'll read the manual and see what gives.

    Would something like Norton utilities be able to recover the data? I'm pretty certain the data is still there (maybe not?? -- PGP may have done it's job as instructed). The data may truly be "secure."
    hda1 is the first physical partition on the first hard drive. First partition is a bit of stretch since not all MS OSs treat the MBR partition table entries in the same order, but this is generally the "C" prtition in Windows speak.

    hda2 is a little untypical. Normally with Windows a second partition is created as a logical drive in an extended partition. This would show up as hda5 under Linux. hda2 implies that this really is a physical partition, not a logical partition. Sometimes a vendor does create a physical partition out there and hide it to hold recovery software, but most official Windows tools insist on creating additional partitions as logical drives in an extended partition. With a good formatting tool like Ranish you can get past this and have up to 4 physical DOS/Windows partitions (or 3 if you want logical drives in an extended partition also).

    Your B dirve partitions might be hdb1 and hdb2, but I would look for hdb5 also just in case.

    I can't say that Norton will not find your data, but I don't expect it. I have a few disks that Windows has roached (not PGP), and so far nothing seems to be able to access the data. There are a few people on the web who want to sell you something that might get the data back at a very steep price (money up front), but I'm not that desperate for it. Steve Gibson makes a good error recovery program called SpinRite, but this isn't a data error recovery issue, so I have absolutely no expectation that SpinRite (also expensive) would be of any help in this case at all.

  5. #5
    Member registered user
    Join Date
    Nov 2005
    Location
    Idaho
    Posts
    59
    when I run Knoppix TESTDISK I'm having difficulty navigating to the problematic drive
    Explain. Any error messages ?
    You may need to post the MBR raw data and that of the VBR's. I do not use linux much and normally get the command dd wrong, so will not post how yet, till I verify later. You could get the info useing XP's Diskprobe.exe ,downloaded from MS site.

  6. #6
    Junior Member
    Join Date
    Jan 2009
    Posts
    4
    Ran gpart with no real success. It recognized the partitions without any problem, but without a bit more drive information my ability to effectively use the tool was limited. So ...

    Dowloaded dskprobe.exe from M$ -- first run tells me I need to enter a new "focus" (whatever that is). I tried entering drive letters [E:/; F:/] without success. Tried [hd1] , [1] -- apparently I don't have enough "focus" to enter the correct "focus."

    Does anybody know what they are telling me to do?

  7. #7
    Member registered user
    Join Date
    Nov 2005
    Location
    Idaho
    Posts
    59
    I have no idea what "focus" is. You do need to run with Administrator rights, could be the problem (?). I use XP so there could be differences with W2k. You say that you entered drive letters, or do you mean that you selected the letters from the "Drives" drop down box ? Is Dskprobe.exe 203k byte size ? What web site did you download from ?

    I have never used gpart , so can not help with it.

    If you could give a web site for PGP, so I can read just what it does might be helpful. With luck the program just made a mess with the primary Volume Boot Record but the back up is good (should be the last sector of volume). But if it wiped any thing else than data is likely lost.

  8. #8
    Junior Member
    Join Date
    Jan 2009
    Posts
    4
    Check www.pgpi.org

    I'm ben using version 7.0. The documentation bundled with the software tells me:

    NOTE: Commercial data recovery companies have been known to
    recover data that has been over written up to 9 times. PGP uses
    highly sophisticated patterns during each wipe to ensure that your
    sensitive data cannot be recovered.

    I may just admit that the data is not "mission critical" (it's not really), has been made "secure," format the partition and get back to work.

    Thanks for everybody's help!

Similar Threads

  1. Lost NTFS (Yet Again)
    By kg4wxw in forum Hardware & Booting
    Replies: 2
    Last Post: 08-02-2006, 06:28 AM
  2. hda: lost interrupt
    By rozen in forum Hardware & Booting
    Replies: 2
    Last Post: 06-13-2006, 07:07 PM
  3. lost password
    By mataemon_araki in forum General Support
    Replies: 3
    Last Post: 01-08-2006, 01:13 AM
  4. swriter lost!!!
    By babelbrennt in forum Hdd Install / Debian / Apt
    Replies: 2
    Last Post: 09-17-2005, 01:32 AM
  5. HELP?!?! Lost MBR!
    By bigkahuna in forum Hardware & Booting
    Replies: 1
    Last Post: 05-02-2005, 01:22 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


Cisco SG95-16 16-Port Gigabit Switch SG95-16-KR picture

Cisco SG95-16 16-Port Gigabit Switch SG95-16-KR

$47.00



Cisco SG95D 5 port Gigabit Desktop Switch SG95D-05-IN picture

Cisco SG95D 5 port Gigabit Desktop Switch SG95D-05-IN

$35.00



Cisco SG110 24 Port Gigabit Ethernet Switch w/ 2 x SFP SG110-24 picture

Cisco SG110 24 Port Gigabit Ethernet Switch w/ 2 x SFP SG110-24

$117.00



Cisco MS120-48FP - 52 Ports Fully Managed Ethernet Switch UNCLAIMED picture

Cisco MS120-48FP - 52 Ports Fully Managed Ethernet Switch UNCLAIMED

$449.00



Linksys SE3008 8 Ports Rack Mountable Gigabit Ethernet Switch picture

Linksys SE3008 8 Ports Rack Mountable Gigabit Ethernet Switch

$18.99



New Linksys SE3005 5-port Gigabit Ethernet Switch picture

New Linksys SE3005 5-port Gigabit Ethernet Switch

$15.99



NETGEAR 5-Port Gigabit Ethernet Unmanaged Switch (GS305) - NEW IN BOX picture

NETGEAR 5-Port Gigabit Ethernet Unmanaged Switch (GS305) - NEW IN BOX

$18.99



Cisco WS-C3750X-48T-S 48 Port 3750X Gigabit Switch - Same Day Shipping picture

Cisco WS-C3750X-48T-S 48 Port 3750X Gigabit Switch - Same Day Shipping

$49.95



*NETGEAR PROSAFE (JGS524V2) 24-Port Gigabit Ethernet Switch *NO AC* picture

*NETGEAR PROSAFE (JGS524V2) 24-Port Gigabit Ethernet Switch *NO AC*

$29.99



YuanLey 10 Port Gigabit PoE Switch With 8 Poe Unmanaged with 2 1000Mbps Uplink picture

YuanLey 10 Port Gigabit PoE Switch With 8 Poe Unmanaged with 2 1000Mbps Uplink

$20.00