Printable View
i ran this command dd if=install.bin of=/dev/hda when i meant to run dd if=install.bin of=/dev/hda1 !!!!!!!!
and i have nuked my mbr i think? on my windows laptop
i am utterly confused how to fix the problem and get my windows system up and running again (as it contains come critical data!)
i think i have just destroyed the mbr but someone far better qualified on the forums can advise me
can't they!
help!!!!
You can repair the mbr (as far as windows is concerned) by running fdisk from a recovery disk with the /mbr option:Quote:
Originally Posted by hogwash
Better yet, you can get a copy of Smart Boot Manager and install that as your MBR - then you'll be able to boot from any partition, or any CD, or any floppy. (Put Lilo or Grub on the Linux partition, not the MBR when you do this.)Code:fdisk /mbr
thanks for that
from the command i have run i hope i have not wiped the hda and overwritten the entire contents with the binary i was trying to import
can someone advise as to what they think i have done with the command above.... if i have lost the data i am in deep doo doo
People can give you their opnions, but why not know for sure? - just boot Knoppix and look at the partitions and see if the data you need is still there. You could even use Knoppix to back up critical data before you go any further (since you don't seem to have any backup).Quote:
Originally Posted by hogwash
the problem i have is that i cannot mount the drive , it is "seen" as an "unidentified file system" or as un-allocated space. windows sees it as un-allocated space , knoppix simply wont let me mount it , at least in the manner i have been trying .. or failing
Thats because the partition table has been nuked also, and if the file was bigger then 512 b then part of the first partition has been nuked also, If you can remember the sizes of the partitions you can try and use fdisk to rebuild the table.Quote:
Originally Posted by hogwash
well, it was a 20mb binary! so i guess that explains that then... as for the partition sizes it is a 20gb hdd and only had one partition which was the maximum size in ntfs
where do i begin guys??
yup, I agree with firebyrd10, if you can't mount the partitions under Knoppix then more than just the MBR has been munged. There are still tools under both Linux and MS OS's that can help you recover stuff, but you've got more work to do than just replace the MBR.Quote:
Originally Posted by firebyrd10
i dony mind the work i just need a few pointers! .... i assume that if i rebuild the patition table on the max @ 20gb (original config) that would be a good place to start... then the mbr and see what is what from there?
You might start with the forensic LiveCD Helix. And I would be looking at where I was going to be putting any files I could recover (if it's a desktop, install a second hard drive with a FAT32 partition in that puppy before you do anything else, and move the files to the other hard drive as soon as you can). How large are the files you need to recover? Would they fit on a USB memory device? A CDR? Can you network to another system?Quote:
Originally Posted by hogwash
However, if anyone has other suggestions, then consider taking them over Helix; I've played with it but never really recovered data with it. And Don't forget some of the DOS/Windows live CD's or even commercial tools designed for the NTFS file system.
I'm not sure how one can get the partition back. My expectation is if you just recreate the partition it will look unformatted. If you format it you could wipe out the data. I'm hoping someone else may know how to repair the partition in a way that will leave the files in place.Quote:
Originally Posted by hogwash
yes that is what was causing me pain , even if i fdisk the partition back it will show up as unformatted space i guess.... but i know it is ntfs so presumably i can recover files using a third party ntfs recovery tool or at least try and mount it and browse it maybe ...
much work ahead ... good job for the holidays !
thanks for your tips/advice
Use gpart to rebuild the partition table. I too once nuked the MNR & the partition table using the dd command. I then freaked out that I had lost everything. I searched google and found gpart. I then noticed it was on the Knoppix CD and used it to rebuild the partition table. Check out http://www.stud.uni-hannover.de/user/76201/gpart/.
I hope this helps.
James
All files after the 20 meg mark on the drive are still intact, if you can fix the partition then you may be able to get your files back, only problem I see is the TOC of disks. That would need to be rewritten. Though I sure some tool can scan and write it.
Like said before, Helix might be the thing to try.