HDD GURU FORUMS

Data recovery and HDD repair discussions
It is currently September 2nd, 2010, 13:27

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 13 posts ] 
Author Message
 Post subject: SQL MDF recovery in RAW mode
PostPosted: June 30th, 2009, 1:32 
Offline

Joined: July 15th, 2008, 1:50
Posts: 76
Hi friends
I am recovering data from a overwritten disk ( partition formatted & OS (xp) reinstalled. Both easyrecovery & winhex dont have signatures for sql .Is there any good program other than these two?


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 2nd, 2009, 2:29 
Offline

Joined: July 15th, 2008, 1:50
Posts: 76
Strange enough , No one has encountered SQL recovery so far? I have calculated it myself is it- 01 0F 00 00 08 00 00 00 ?
It will be great help for me if some one confirms it


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 2nd, 2009, 6:34 
Offline

Joined: May 16th, 2009, 9:32
Posts: 131
Location: UNited Kingdom
Well I dont know how those scan tools work, presumably they just look for a signature at the start of the sector (or rather cluster if a ntfs volume)

But the start of a SQL MDF datbase does indeed start
01 0F 00 00
mine then continues 08 02 00 00


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 2nd, 2009, 9:36 
Offline

Joined: October 23rd, 2006, 8:56
Posts: 803
It has already been covered in this forum. Use search function and check in the software section.


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 2nd, 2009, 9:52 
Offline

Joined: July 15th, 2008, 1:50
Posts: 76
different softwares needs different signatures. winhex needs it in another way. To add trouble every version of sql has its own signature.I have taken first 8 bits.


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 2nd, 2009, 10:16 
Offline

Joined: October 23rd, 2006, 8:56
Posts: 803
Oh, I was thinking of a damaged SQL database.

What file system was on the disk?


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 2nd, 2009, 10:19 
Offline

Joined: October 23rd, 2006, 8:56
Posts: 803
I see, (xp) so then why don't you recover the parition first? Instead of trying to do a raw recovery on an mdf file?


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 3rd, 2009, 1:16 
Offline

Joined: July 15th, 2008, 1:50
Posts: 76
Hello quasimodo
thanks . disk was formatted by user & winxp (approx 8gb) reinstalled. now they want sql mdf / ldf files. so raw recovery is the only option.


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 3rd, 2009, 8:11 
Offline

Joined: May 16th, 2009, 9:32
Posts: 131
Location: UNited Kingdom
Lets hope the drive (or rather volume) orgininally had lots of space in- use before they created the database, such that it will tend to have been using clusters further into the volume

Probably would have been if they also orginally had installed SQL on the drive, and havent reinstalled it since the format and OS reinstall

But your going to need to get lucky

I'd search for a left over MFT entry (File Record entry) for the mdf file first
and if that hasnt been reused, it will show the original cluster used
for the data, and you can see if any have been reused and if they still contain the mdf data

NB Is it NTFS or FAT32 ?


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 4th, 2009, 1:54 
Offline

Joined: July 15th, 2008, 1:50
Posts: 76
tons of thanks xsoliman
disk volume was 20gb NTFS but customer has copied similar named ldf / mdf files & occupied file size is 8gb. got few files from winhex and easyrecovery.


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 6th, 2009, 11:08 
Offline

Joined: May 16th, 2009, 9:32
Posts: 131
Location: UNited Kingdom
This is getting more complicated and much less chances of success

So sounds like they have put another database with the same mdf name onto the drive
(presumably an older backup copy)

Formatting it was a mistake
Reinstalling the OS on it was a mistake
But putting another copy of the large database on it makes recovery very unlikely


How big is the new mdf (and the lost mdf)? Sounds like both were about 4GB
and drive now has 8GB's worth of data on it and 12GB of space

And they are hoping that the orginal MDF file is in the spare space ...


Very unlikey that you can find the MFT entry for the original mdf file entry
(and need to make sure you dont get distracted by the new MFT entry for the new copy of the file with the same name)

Search every other sector (as MFT entries are 1K long) extensive search, for any that contain the filename.mdf (in unicode), and that start 'FILE*' (in ascii)
This will give you the unimportant MFT entry for the new copy of the file, and if you are lucky will also bring back an older, left-over, MFT entry for the previous one


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 6th, 2009, 15:37 
Offline

Joined: October 23rd, 2006, 8:56
Posts: 803
I agree, your chances therefore are alot slimmer. Make sure you know exactly what version of SQL the customer was running, then re-create a sql database or two with the same version of SQL. Check and confirm not only the header, but also the footer of the MDF and LDF files. Perform a search for both header and footer in winhex. Also check for fragmentation of the database files. Although this can be a very big pane in the @$$ to try to patch a fragmented database back together.

Good luck :D


Top
 Profile  
 
 Post subject: Re: SQL MDF recovery in RAW mode
PostPosted: July 7th, 2009, 0:15 
Offline

Joined: July 15th, 2008, 1:50
Posts: 76
thanks xsoliman & quasimodo
database created using same version was on another partition but both ldf /mdf files have same signature. only one file of 1.37gb was copied from old backup.Both easyrecovery & winhex have recovered lot of files.
It seems method you have suggested is only right & will give it a try.
thank you so much


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 13 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Alexii and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group