I just ran DP.EXE to restore a corrupt boot sector, on a NTFS Volume.

My problems match the "How can you tell" symptoms on page 34 in the user guide exactly. So I followed the instructions for "NTFS Type Volumes" on page 41, and restored the boot sector with the one form the NTFS file system.

It didn't work, an my partition table is now very weird.

It's got the following partitions on my 120 GB Disk:
39 MB FAT Dell Utility Partition (working)
20 GB NTFS Primary Partition (working... primary OS)
20 GB NTFS Primary Partition (hidden) (working, secondary OS)

The last 80 GB used to be a primary partition for data store. I tried using Partition Magic to convert this to a Logical partition (in a extended partition). This was where it all went wrong. Partition Magic did the conversion in 1 second, but after that I could not access the drive (I got all the symptoms described in your user guide).

After backing up and restoring sector 82011825. I now have the same 3 primary partition and on extended partition, which is ~ 1185 GB!! This extended partition has got the following logical partitions:

80,42 GB Free space (this is hopefully where my data are)
23,59 GB Free space (for some reason these two free space "partition" is not merged)
811,57 GB Logical drive (Healthy Unknown Partition)
259,39 GB Logical drive (Healthy Unknown Partition)

Can you help me... I'm desperate to get my data back.

I have the backup.dat with the original corrupt boot sector... but bringing it back will at best help me get the corrupted partition table back.

Any suggestions... should I delete the extended partition and try to recover it. So fare nothing has been written to the corrupted disk, except the partition table (as fare as I can tell).

Product you are using: ,

Operating system / Service Pack: DiskPatch

I'm thinking about buying a new disk, and do a sector copy of the disk, and try recovering on the new disk.

Should the new disk be identical to the one I'm having problem with?

Would the fact that the harddisk is now 1214GB give me a problem?

Product you are using: ,

Operating system / Service Pack: DiskPatch

Hello,

Can you please download partinfo from the support page. This is a DOS program that will allow us to have a look at the partition tables.

partinfo syntax:
partinfo>filename.txt [enter], please copy and paste the contents of the filename into forum message.

>>The last 80 GB used to be a primary partition for data store. I tried using Partition Magic to convert this to a Logical partition (in a extended partition). This was where it all went wrong. Partition Magic did the conversion in 1 second, but after that I could not access the drive (I got all the symptoms described in your user guide).<<

I'd really like to see what PartitionMagic did. In one second it can't have done that much. Was there already an extended right AFTER PM finished? And if so, was there also a logical NTFS partition present?

>>After backing up and restoring sector 82011825. I now have the same 3 primary partition and on extended partition, which is ~ 1185 GB!! This extended partition has got the following logical partitions:<<

This is very strange .... If the option ran, then the partition tables suggested the partition was at least present in the partition tables. DiskPatch will use information in the partition table to locate the backup boot sector. If then the first and the last sector of the partition (the boot and the backup boot sector) do not match, then you'll be notified and the backup boot sector is copied to a file. DiskPatch will only copy this sector to a file if it is indeed an NTFS boot sector (in case of partition table damage it could any sector).

This does NOT change the partition table, so I can't explain why the partition table is a mess right now.

Please, sent the partinfo and we'll take it from there.

--
Kind regards,
Joep

Product you are using: ,

First... thanks for helping. You are doing an excelent job supporting.

The dump from partinfo is inserted at the end of this message.

Yes... after running Partition Magic there was an Extended and logical partition. I didn't do anything else except trying to access the disk an viewing it form Disk Manager and Partition Magic.

When I used DiskPath the program reported that the backup and current bootsector was not the same. That is DiskPath did find the backup sector.

Best. regards.
Thomas


Partition Information Program
Sep 16 2002 - DOS32 Version
Copyright (c) 1994-2002, PowerQuest Corporation
Permission is granted for this utility to be freely copied so long
as it is not modified in any way. All other rights are reserved.

PowerQuest, makers of PartitionMagic(r), Drive Image(tm) and DriveCopy(tm), can be reached at
Voice: 801-226-6834 Web site: http://www.powerquest.com/support/
Fax: 801-226-8941 Email: help@powerquest.com
BiosExtensions: 0x2100 Subsets (0x00000005): Access EDD
EGeo 0x0001 16383 16 63 234441648 0 512


============================================================================

Disk 0: 14593 Cylinders, 255 Heads, 63 Sectors/Track.

BiosExtensions: 0x2100 Subsets (0x00000005): Access EDD
The BIOS supports INT 13h extensions for this drive.

============================ Partition Tables ==============================

Partition -----Begin---- ------End----- Start Num

Sector # Boot Cyl Head Sect FS Cyl Head Sect Sect Sects

---------- - ---- ---- ---- ---- -- ---- ---- ---- ---------- ----------

0 0 00 0 1 1 DE 4 254 63 63 80262

0 1 80 5 0 1 07 [1023 254 63] 80325 40965750 [Large Drive Placeholders]

5 0 1 2554 254 63 Actual Values

0 2 00 [1023 0 1] 17 [1023 254 63] 41046075 40965750 [Large Drive Placeholders]

2555 0 1 5104 254 63 Actual Values

0 3 00 [1023 0 1] 0F [1023 253 63] 82011825 152424657 [Large Drive Placeholders]

5105 0 1 14592 253 63 Actual Values

Info: Partition didn't end on cylinder boundary.

ucEndHead expected to be 254, not 253.

82011825 0 63 [ 368 111 45] 72 [ 371 101 51] 300141334 1701990410 [Large Drive Placeholders]

18682 238 11 59090 238 60 Actual ValuesWarning: Partition boot flag expected to be 0x00 or 0x80,

not 0x63. This should not be a problem.


Error #107: Partition begins after end of disk.

ucBeginCylinder (18682) must be less than 14593.

Info: Partition didn't begin on head boundary.

ucBeginHead expected to be 0 or 1, not 238.

Info: Partition didn't begin on head boundary.

ucBeginSector expected to be 1, not 11.

Error #109: Partition ends after end of disk.

ucEndCylinder (59090) must be less than 14593.

Info: Partition didn't end on cylinder boundary.

ucEndHead expected to be 254, not 238.

Info: Partition didn't end on cylinder boundary.

ucEndSector expected to be 63, not 60.

Error #110: Number of sectors in partition is inconsistent.

ucSectors = 1701990410
end - begin = 649154570
82011825 1 73 [ 67 115 32] 74 [ 299 114 44] 811062002 543974724 [Large Drive Placeholders]

50486 70 3 18811 34 29 Actual ValuesWarning: Partition boot flag expected to be 0x00 or 0x80,

not 0x73. This should not be a problem.


Error #107: Partition begins after end of disk.

ucBeginCylinder (50486) must be less than 14593.

Info: Partition didn't begin on head boundary.

ucBeginHead expected to be 0 or 1, not 70.

Info: Partition didn't begin on head boundary.

ucBeginSector expected to be 1, not 3.

Error #109: Partition ends after end of disk.

ucEndCylinder (18811) must be less than 14593.

Info: Partition didn't end on cylinder boundary.

ucEndHead expected to be 254, not 34.

Info: Partition didn't end on cylinder boundary.

ucEndSector expected to be 63, not 29.

Error #110: Number of sectors in partition is inconsistent.

ucSectors = 543974724
end - begin = 3786106180
82011825 2 74 [ 114 111 32] 65 [ 353 115 52] 250665763 0 [Large Drive Placeholders]

15603 56 41 15603 56 40 Actual ValuesWarning: Partition boot flag expected to be 0x00 or 0x80,

not 0x74. This should not be a problem.


Error #107: Partition begins after end of disk.

ucBeginCylinder (15603) must be less than 14593.

Info: Partition didn't begin on head boundary.

ucBeginHead expected to be 0 or 1, not 56.

Info: Partition didn't begin on head boundary.

ucBeginSector expected to be 1, not 41.

Error #109: Partition ends after end of disk.

ucEndCylinder (15603) must be less than 14593.

Info: Partition didn't end on cylinder boundary.

ucEndHead expected to be 254, not 56.

Info: Partition didn't end on cylinder boundary.

ucEndSector expected to be 63, not 40.

Info: This partition unexpectedly contains no sectors.


Disk[0], Part[82011825]: Warning #113: EPBR partition starting at 82011825 overlaps extended partition.


Disk[0], Part[250665763]: Error #113: Logic starting at 250665763 overlaps extended partition.


Disk[0], Part[250665763]: Info: Logical starting at 250665763 is not one head away from EPBR.


Disk[0], Part[300141334]: Error #113: Logic starting at 300141334 overlaps extended partition.


Disk[0], Part[300141334]: Info: Logical starting at 300141334 is not one head away from EPBR.


Disk[0], Part[811062002]: Error #113: Logic starting at 811062002 overlaps extended partition.


Disk[0], Part[811062002]: Info: Logical starting at 811062002 is not one head away from EPBR.




==================================================================================

Disk 0: 114471.0 Megabytes

============================= Partition Information ==============================

Volume Partition Partition Start Total

Letter:Label Type Status Size MB Sector # Sector Sectors

------------- --------------- -------- -------- ---------- - ---------- ----------

DellUtility Dell Pri 39.2 0 0 63 80262

NTFS Pri,Boot 20002.8 0 1 80325 40965750

Hidden NTFS Pri 20002.8 0 2 41046075 40965750

ExtendedX Pri 74426.1 0 3 82011825 152424657

EPBR Log 82350.6 None - 82011825 168653938

NetWare Log,Boot 0.0 82011825 2 250665763 0

Type 72 Log,Boot 831050.0 82011825 0 300141334 1701990410

Type 74 Log,Boot 265612.7 82011825 1 811062002 543974724






========================================================================

Boot Sector for drive *: Drive 1, Starting Sector: 63, Type: FAT

========================================================================

1. Jump: EB 46 90

2. OEM Name: Dell 4.1

3. Bytes Per Sector: 512

4. Sectors Per Cluster: 4

5. Reserved Sectors: 1

6. Number of FAT's: 2

7. Root Dir Entries: 512

8. Total Sectors: 0 (0x0)

9. Media Descriptor: 0xF8

10. Sectors Per FAT: 79

11. Sectors Per Track: 63 (0x3F)

12. Number of Heads: 255 (0xFF)

13. Hidden Sectors: 63 (0x3F)

14. Big Total Sectors: 80262 (0x13986)

15. Drive ID: 0x80

16. Dirty Flag: 0x00

17. Extended Boot Sig: 0x29 BS_FAT

18. Serial Number: 0x07D30306

19. Volume Name: DellUtility

20. File System Type: FAT16

21. Boot Signature: 0xAA55





========================================================================

Boot Sector for drive *: Drive 1, Starting Sector: 80325, Type: NTFS

========================================================================

1. Jump: EB 52 90

2. OEM Name: NTFS

3. Bytes Per Sector: 512

4. Sectors Per Cluster: 8

5. Reserved Sectors: 0

6. Number of FAT's: 0

7. Root Dir Entries: 0

8. Total Sectors: 0 (0x0)

9. Media Descriptor: 0xF8

10. Sectors Per FAT: 0

11. Sectors Per Track: 63 (0x3F)

12. Number of Heads: 255 (0xFF)

13. Hidden Sectors: 80325 (0x139C5)

14. Big Total Sectors: 0 (0x0)

15. Unused: 0x80 00 80 00

16. Total NTFS Sectors: 40965749 (0x2711675)

17. MFT Start Cluster: 1706906 (0x1A0B9A)

18. MFT Mirror Start Clust: 2675051 (0x28D16B)

19. Clusters per FRS: 246

20. Size per Index Buffer: 1

21. Serial Number: 0xCC58441558440126

22. Checksum: 0x00000000

23. Boot Signature: 0xAA55





========================================================================

Boot Sector for drive *: Drive 1, Starting Sector: 41046075, Type: NTFS

========================================================================

1. Jump: EB 52 90

2. OEM Name: NTFS

3. Bytes Per Sector: 512

4. Sectors Per Cluster: 8

5. Reserved Sectors: 0

6. Number of FAT's: 0

7. Root Dir Entries: 0

8. Total Sectors: 0 (0x0)

9. Media Descriptor: 0xF8

10. Sectors Per FAT: 0

11. Sectors Per Track: 63 (0x3F)

12. Number of Heads: 255 (0xFF)

13. Hidden Sectors: 41046075 (0x272503B)

14. Big Total Sectors: 0 (0x0)

15. Unused: 0x80 00 80 00

16. Total NTFS Sectors: 40965749 (0x2711675)

17. MFT Start Cluster: 786432 (0xC0000)

18. MFT Mirror Start Clust: 2560359 (0x271167)

19. Clusters per FRS: 246

20. Size per Index Buffer: 1

21. Serial Number: 0xE47C58DF7C58AE54

22. Checksum: 0x00000000

23. Boot Signature: 0xAA55

Product you are using: ,

Operating system / Service Pack: DiskPath

Hello,

Well, that partition table mess is only caused by the extended partition. We could remove the 'noise' that this causes, but we can also do that later.

The extended partition itself seems valid, however the contents of it's first sector (a partition table) does not contain valid information. This bogus information is interpreted as if it were partition table information while it is not, this causes the huge partition(s).

Please use DiskPatch and do the following, goal is to determine if we can find the start of the lost partition:

Repair MBR > FixMBR tables > select *SKIP* for *ALL* partitions found, and do *NOT* write to disk after the scan finishes. Once that's done, quit DiskPatch and sent me the logfile (dskpatch.log), either by email or by pasting it's contents here.

--
Kind regards,
Joep

Product you are using: ,

Again. Thanks for helping... and for the very Quick Answer.

I send the requested log file by mail.

Best. regards.
Thomas

Product you are using: ,

Operating system / Service Pack: DiskPath

Hello,

I think I see what happened. PM didn't (of course how could it in a second) finish correctly. It DID create an extended partition, and by doing so it overwrote the boot sector of the NTFS partition (which is now back in place, after you have copied it with DiskPatch).

However, the partition table still points to this sector as if it were an extended partition. We can easily fix this by manually editing the partition table:

Repair MBR > Edit > any key to close the hexdump and the instruction ...

Select entry 4 > just press enter for start cylinder, head and sector > change type from 15 to 7 > for all following values just press enter (to leave them as they are) > select save > Quit DiskPatch and check if the partition can be accessed.

--
Joep

Product you are using: ,

In addition to Edit > ... accept the default value for sector (0 - zero).

--
Joep

Product you are using: ,

IT WORKED :-))))))))))))))


Which planet do you come from?

I'm so happy... I can't thank you enough.

You are a pro... I mean... support with answers within minutes. And the confident and insight you deliver. This is the best 35 bucks I ever spend... where can I pay more? If you want... you can have the extra 1014GB that I had a few minutes ago ;-)

If fact my children and wife is even more happy... all our digital pictures is back... and I have already started making a backup.

Good night and thanks a million.

Product you are using: ,

Operating system / Service Pack: DiskPath

IT WORKED :-))))))))))))))

That's what we want to hear ;-)

--
Kind regards,
Joep

Product you are using: ,