erased boot sector -> can knoppix help?

[ryblah]

Hi All,

I did a stupid thing and let my laptop reboot with a diskwipe boot disk in the floppy. I caught it before the progress even hit 1 percent so I am pretty sure the only thing that is erased is the boot sector. The laptop had 2 partitions -> 500 meg for Ghost and roughly 59 gig for winxp pro.

Anyway I can use knoppix to retrieve any data? I tried booting in to knoppix and reading the HD but I get an error -> mount: I could not determine the filesystem type and none was specified.

Ugh....I have a lot of data that is worth saving and I would appreciate any suggestions before I ship the hd to a data recovery company.

Thanks!
ry

[Harry Kuhman]

You can try gpart, but 1% is a lot more than just the MBR.

Gpart, by the way, might get back one or both of the partitions, but it will not restore the rest of the boot code, you would need to use something else for that, or just use Knoppix to back up the data if the partitions can be recovered and then start over with the hard disk.

[TopFarmer]

you can try "TESTDISK" it will rewrite the Partition Table in the MBR if it can find the partitions. If the volume boot records were deleted , not sure if it will work.
http://www.cgsecurity.org/index.html?testdisk.html It might not put the ghost partition type correct.

If the Partition Table is rewritten correctly , you will then need to use XP cd and get into the recovery console and run FIXMBR and FIXBOOT.

[rcook]

If the partition is damaged, you can do a forensic type copy to a USB drive or over a network. Then there are windows tools for less than $100 that can recover, files and directories from damaged partitions. Most of the free file recovery programs recovered files as file0001.jpg, file0002.jpg, etc.

I had a brain fade and tanked the front of my Windows partition. I copied my notebook hard drive over my network to a partition on another machine where I recovered nearly all of the files. Most I didn't want. The software recovered entire subdirectories and major portions of my root (C:)directory. The forensic copy is the first order of business, if the partition is partially overwritten.

You can search my posts on this forum.