Partition Issues - Fat 16, Known Sectors - Specialist advice

[ruperthargreaves]

Hi
I need to boot to a partition, it is FAT 16 and 20mb in size, I know the sector addresses from the start to the end, please can someone suggest how I can manually map to this, make it bootable etc. Ive tried lots of applications, the only one that can see the partition and give me all its information is Active Partition Recovery software, it works great to see it and I can even recover the contents, they are very healthy but I cant get it to boot to the partition.

The sortware does all this but it fails to restor the partition table, info and mbr. Ive tried so many software apps and bootdisks / recovery disks, ultimate bootdisk, active disk, Insert1.3.9, windows recovery disk .. etc etc etc

The partition holds some encryption keys and a log in screen for password access that once used will decrypt the rest of the drives contents, it holds another mbr and part tables (NTFS) that it lets you through to. It is called Safeboot by Mcafee. There is a file bootcode.ini so i believe it is a bootable partition.

Any help much appreciated.

Thanks Rupert.

PS - I am quite knowledgable with this kind of thing already and im specifically looking for a way to write a partition table and mbr manually or to customise one to fit the FAT16 and start sectors etc I need, perhaps some hex editing software is what i need with guidance on what to look for in the partition ive mentioned.

[drc]

How did it get broken?

The boot code you need is proprietary and lived in the boot sector that sounds like it has probably been overwritten at this point

[ruperthargreaves]

Hi DRC, thank for your response

It was broken when the machine hard disk failed, there black screen only after bios but no error messages I believed it to be the motherboard but after some tests realised it was the hdd that had corrupt.

Through using boot disk software I have got to this stage. I have the correct login password for the mcaffee software but cant get to the screen to enter it. The software is an older version and I dont get support any more from them. I dont have the install disks anymore the system was installed on the laptop from new.

Ive posted a screenshot of what i am seeing in Winhex, it is a bootable partition, I know the starting sector - Can I map it and make bootable using software like "Free Partition recovery" available from dtidata?

Thanks

Attachments

[fzabkar]

I don't know if it helps you, but here is what the boot code looks like when it has been disassembled by Debug in a Windows DOS box:

Code:

-u 100 102

12EB:0100 EB3C          JMP     013E
12EB:0102 90            NOP

-u 013e 0140

12EB:013E EB1A          JMP     015A
12EB:0140 90            NOP

-u 015a 017d

12EB:015A 33C0          XOR     AX,AX
12EB:015C FA            CLI
12EB:015D 8ED0          MOV     SS,AX
12EB:015F BC007C        MOV     SP,7C00
12EB:0162 FB            STI
12EB:0163 8ED8          MOV     DS,AX
12EB:0165 BE7E7C        MOV     SI,7C7E
12EB:0168 E80600        CALL    0171
12EB:016B 32E4          XOR     AH,AH
12EB:016D CD16          INT     16
12EB:016F CD19          INT     19
12EB:0171 B40E          MOV     AH,0E
12EB:0173 FC            CLD
12EB:0174 AC            LODSB
12EB:0175 3C00          CMP     AL,00
12EB:0177 7404          JZ      017D
12EB:0179 CD10          INT     10
12EB:017B EBF7          JMP     0174
12EB:017D C3            RET


[drc]

It was broken when the machine hard disk failed, there black screen only after bios but no error messages I believed it to be the motherboard but after some tests realised it was the hdd that had corrupt.

Through using boot disk software I have got to this stage.

What exactly have you done, changed, overwritten, etc?

Have you cloned/imaged the drive? Is it exhibiting bad sectors?

[Vulcan]

The partition holds some encryption keys and a log in screen

No, the partition (i.e. what you're saying that you have) doesn't contain that.

As drc has explained, the login code and decryption keys are actually outside the partition - specifically they're in original sectors 1-63 (along with special MBR code in sector 0 to call that code). The partition boot sector (kindly disassembled by fzabkar) clearly contains no ability (code) to be able to boot, so you're mistaken in believing that the partition is bootable - or at least it isn't bootable directly from a normal MBR, and this is deliberate, because in that case the partition would still be encrypted and hence useless.

You haven't said the exact results (e.g. specific error messages) of your attempts to create a suitable MBR (just that you "cant get it to boot to the partition"). It would be easy to create an MBR which would boot to that boot sector (and perhaps your utilities have already done that), but as seen in that boot sector code, it is actually not directly bootable, and so I expect that you're seeing a boot message starting with "Non system disk [...]".

The only 2 ways forward from this point that I know of (other than if there is any backdoor in the SafeBoot system), are (a) get the original disk's sectors 0-63 (which comes back to the questions already asked by drc, which you haven't yet answered in detail - IMHO you need to give more of the history of exactly what has happened so far and exactly what you have done with the original disk); or (b) use the SDB file and SafeTech recovery floppy disk or CD, which should have been created during the original SafeBoot initialisation (assuming this was not a corporate version, which saved the encryption keys to a central server).

In both cases, you're likely to still need more help (and I'm not volunteering to do that), but without you getting to the point of having the ability to follow (a) or (b) above, I don't see a way forwards, for you to decrypt and read that partition.