Help! Nedd to recover files

[cbagger01]

Ok, here is what gpart says:

Ok.

Guessed Primary Partition Table:
Primary partition(1)
type: 006(0x06)(Primary 'big' DOS (>32MB))
size: 47mb #s (96327) s(63-96389)
chs: (0/1/1)-(5/254/63)d (0/1/1-(5/254/63)r

Primary partition(2)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 233609mb #s(478431760) s(96390-478528149)
chs: (6/0/1)-(1023/254/63)d (6/0/1)-(29786/254/5r

Primary partition(3)
type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT,
LBA)
size: 4753mb #s(9735390) s(478528155-488263544)
chs: (1023/254/63)-(1023/254/63)d
(29787/0/1)-(30392/254/63)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Now, where do I go from here?
Thanks again

Since it appears that your "guessed" partitions are consistent, you can now rebuild your partition table. By consistent, I mean that all of your partitions appear to be in sequential order, so you don't have a partition that spills over into a neighboring partition.

From the data, it appears like you have a small DOS partition at the beginning of the disk (probably a BIOS/utility partition), followed by your main NTFS "C:" drive partition and a small approximately 4GB FAT32 partition (maybe an "E:" drive?) at the end of your disk.

So now you can run the same command again, only this time you can use it to WRITE a new partition table for your drive.

A command like this one should get the job done. The "W" needs to be an UPPERCASE letter:

gpart -W /dev/sda /dev/sda


Then you can reboot KNOPPIX and hopefully some new drive partition icons will appear on your desktop. You should then be able to copy any important files over to a USB drive or to a network shared drive.

Assuming that you now have a good partition table on your drive, you might even be able to save your Windows installation if you own the original CDROM. You will need to boot your Windows CDROM and then go into the "Recovery Console" and type in a command like this:

fixmbr


Here is an example of someone who used gpart to solve a similar problem as yours:

http://enterprise.linux.com/article..../10/11/1911211


If you get everything back up and running, you should take his advice and make a backup copy of your Master Boot Record including the partition table and store this file somewhere else like on a thumbdrive or a floppy disk.

To make a backup, type this in:

dd if=/dev/sda of=/tmp/mbr_backup.img bs=512 count=1

and the backup file will be called "mbr_backup.img" and it will be stored inside your /tmp directory (Temporary files are commonly stored there). Then copy this file to somewhere safe.

To restore your backup, first copy it back to the /tmp directory and then type:

dd if=/tmp/mbr_backup.img of=/dev/sda bs=512 count=1

Good Luck

[kk39shadow]

I'll give it a shot! One question though. If this doesn't work, can it be tried again, or is this a one shot deal? Also, if it doesn't work, this won't permanently mess up the hard drive will it? I could still re-install Windows and have it go back to the factory settings and everything?
Thanks again for everything!!!!

[kk39shadow]

Ok, I used gpart to write the partition table. I do have more icons on the desktop: sda1, which is the Hidden Dell partition, I'm able to mount and get in to, and sda3 I'm also able to get in to. sda2, which is the one I want to mount and open, I still can't get in to. When I try to mount, I get:
Could not mount device.
The reported error was:
Failed to read last sector (478431764): Invalid argument
Perhaps the volume is a RAID/LDM but it wasn't setup yet, or the
wrong device was used, or the partition table is incorrect.
Failed to startup volume: Invalid argument
Failed to mount '/dev/sda2': Invalid argument
The device '/dev/sda2' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
Is there any thing else I can do?
Thanks

[TopFarmer]

There might be an error in the partition table for the NTFS partition.

Primary partition(2)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 233609mb #s(478431760) s(96390-478528149)
chs: (6/0/1)-(29786/254/5)r

If you look at the CHS , the last part (29786/254/5) , the 5 is not normal , it should end at 63 (sector). Look at the other partition and they do end at 63. There would be a conflict between the MBR and the VBR (Volume Boot Record).

cbagger01- if you agree , will let you tell him how to edit the table , likely with DD , read/edit/write back to MBR ? Have never done it all would not like mess the hdd up.


EDIT: cbagger01- he will also need the NTFS set Active to boot into XP, if editing the partition table works.

[kk39shadow]

Just to let you know, the 5 is actually 58. Not sure how the smiley got in there! Don't know if that changes anything. I know it's still not 63.

[Harry Kuhman]

Not sure how the smiley got in there!

It's an artifact of the way that the board's software stores and displays smileys. The 8 was next to a close paren character, and the two together get translated into a smiley. Several character combinations do this.

[cbagger01]

Ok, I used gpart to write the partition table. I do have more icons on the desktop: sda1, which is the Hidden Dell partition, I'm able to mount and get in to, and sda3 I'm also able to get in to. sda2, which is the one I want to mount and open, I still can't get in to. When I try to mount, I get:
Could not mount device.
The reported error was:
Failed to read last sector (478431764): Invalid argument
Perhaps the volume is a RAID/LDM but it wasn't setup yet, or the
wrong device was used, or the partition table is incorrect.
Failed to startup volume: Invalid argument
Failed to mount '/dev/sda2': Invalid argument
The device '/dev/sda2' doesn't have a valid NTFS.
Maybe you selected the wrong device? Or the whole disk instead of a
partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
Is there any thing else I can do?
Thanks

The problem is that your rebuilt NTFS partition is listed as the wrong size in the new partition table.
The partition table says that your size is 478431760 sectors, but the filesystem is telling Linux to read sector number 478431764 and this fails.

The solution is to redefine your NTFS partition size to be 478431765 sectors, with a startpoint of 96390 and an endpoint of 478528154.

You can do this by typing:

sudo cfdisk /dev/sda

in a terminal window. Then use the menu to delete your Primary Partition #2. Then create a new Primary partition #2 and have it take up all of the available space (as stated above). Then change the partition type of your newly created partition to type #7 or "0x07". Then write your partition table and exit the program.

Then reboot and try again.

Good Luck.

[kk39shadow]

You guys are geniuses!!! Thank you soooooooooo much! It worked. I was able to access all of my files . You saved me $1600.00 that the Geek Squad wanted to charge to recover files!!! One last question. Before I had a chance to put the windows cd in, the computer re-booted. Windows started up fine, and everything appears to be here and working, except I'm able to see the Hidden Dell partition and the other partition after my C drive now. They are called local disk F and G. Since I can now boot, do I still need to boot from the Windows cd, and run the Windows recovery or fixmbr command, or is everything ok now? Again Thank you very, very much!!!!

[cbagger01]

You guys are geniuses!!! Thank you soooooooooo much! It worked. I was able to access all of my files . You saved me $1600.00 that the Geek Squad wanted to charge to recover files!!! One last question. Before I had a chance to put the windows cd in, the computer re-booted. Windows started up fine, and everything appears to be here and working, except I'm able to see the Hidden Dell partition and the other partition after my C drive now. They are called local disk F and G. Since I can now boot, do I still need to boot from the Windows cd, and run the Windows recovery or fixmbr command, or is everything ok now? Again Thank you very, very much!!!!

If you can boot normally, then you do not need to run the fixmbr command. Everything is OK now.

If you wish to make the Dell partition "hidden" again, you can go into the Windows control panel administrative tools and choose computer management. Then choose Disk Management. Then you can select your Dell partition and choose Change drive letter and paths and "Remove drive letter" from the menu. But please make sure that you are choosing the correct partition (Dell). If you pick the wrong one, bad things will happen.

[xpcomputers]

I am new here and wasn't sure on this forum's etiquette. Apologies if this is in the wrong place.

I think I have the same problem, but I didn't know whether you prefer me to post a new thread, or continue this one... if you prefer me to start my own thread, then reply saying that, and I will start a new thread for my problem instead.

My problem.
I have a SATA disk that one day stopped booting into Windows. It had three partitions. 1st is a system recovery partition installed by the manufacturer. 2nd is the Windows install. 3rd is some data. None of these partitions were showing at all. I used Acronis Disk Director to attempt a recovery of the partitions. It has found and "restored" all three, rewriting the partition table. However like the OP of this thread, my Windows partition is still unreadable. Whereas the other two are now detected and running fine again.

I have them mounted in Knoppix 5.1.1 (DVD version) as
/dev/sda1
/dev/sda2
/dev/sda5
(not sure why the odd numbering)

I have used gpart /dev/sda to find out the guessed partition points, and they have a similar "not 63" number in the CHS figures.

Begin scan...
Possible partition(DOS FAT), size(4502mb), offset(0mb)
Possible partition(Windows NT/W2K FS), size(80576mb), offset(4502mb)
Possible extended partition at offset(85078mb)
   Possible partition(Windows NT/W2K FS), size(71249mb), offset(85078mb)
End scan.

Checking partitions...
Partition(DOS or Windows 95 with 32 bit FAT, LBA): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Ok.

Guessed primary partition table:
Primary partition(1)
   type: 012(0x0C)(DOS or Windows 95 with 32 bit FAT, LBA)
   size: 4502mb #s(9221247) s(63-9221309)
   chs:  (0/1/1)-(573/254/63)d (0/1/1)-(573/254/63)r

Primary partition(2)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
   size: 80576mb #s(165019672) s(9221310-174240981)
   chs:  (574/0/1)-(1023/254/63)d (574/0/1)-(10845/254/55)r

Primary partition(3)
   type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
   size: 71249mb #s(145918328) s(174241053-320159380)
   chs:  (1023/254/63)-(1023/254/63)d (10846/1/1)-(19928/254/59)r

Primary partition(4)
   type: 000(0x00)(unused)
   size: 0mb #s(0) s(0-0)
   chs:  (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

The guessed partition locations... are these based on the partition table that Acronis Disk Director has written, or is it purely on what gpart thinks it should be?

What I need to establish is whether my partition locations are correct, and if not get them in line, so that the data on my C drive (/dev/sda2) can be recovered. In Windows (as a slave on another machine, this partition is unviewable. I can't even run chkdsk on it from Windows either.

In Knoppix, if I attempt to browse /dev/sda2 it says
"Could not mount device.
The reported error was:
Incomplete multi sector transfer detected in $MFT.
Failed to load $MFT: Input/output error
Failed to startup volume: Input/output error
Failed to mount '/dev/sda2': Input/output error
NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was
made to NTFS by this software."

Since it won't let me run chkdsk from Windows, I am hoping that gpart or TestDisk might be able to help me.

I am competent in Windows work, but have no experience of Linux & Knoppix, so am feeling my way forwards in the dark!

Mike