Recreate partitons

[DRUG]

Hey guys,

I received a hdd that is fisically fine, but it's seen as raw.

It's a Windows XP hdd that needs to be working.

Retrieving the files is not enough.

I noticed upon creating an image that the sector 0 of the hdd is full of 00's instead of showing the NTFS info.

Any ideas?

[Arch Stanton]

I'd try DMDE then. See if it picks up partitions. Sometimes it's enough to repair partition table + boot sector. Free version will let you do this. Basically right click 'found' partition and select 'insert to partition table' and 'restore boot sector from copy' (latter only if needed).

Last edited by Arch Stanton on March 31st, 2021, 9:09, edited 1 time in total.

[DRUG]

I'd try DMDE then. See if it picks up partitions. Sometimes it's enough to repair partition table + boot sector. Free version will let you do this.

Oh god, right. I'll report back.

[pepe]

sector 0 of the hdd is full of 00's instead of showing the NTFS info

Lba0 doesn't typically contain NTFS boot sector, it contains the MBR instead. So if only this sector was erased, you can easily rebuild the partition table in a hex editor. Never used DMDE, so cannot comment if it can do it.

pepe

[fzabkar]

sector 0 of the hdd is full of 00's instead of showing the NTFS info

Lba0 doesn't typically contain NTFS boot sector, it contains the MBR instead. So if only this sector was erased, you can easily rebuild the partition table in a hex editor. Never used DMDE, so cannot comment if it can do it.

pepe

DMDE can do it in a few clicks. I used to laboriously rebuild the partitions by hand, but I now trust DMDE to do it for me.

[Arch Stanton]

In this case pt-table is actually ok. Or, no: there is a partition table but may be wrong. Anyway LBA 0 can be largely zeros, just one entry and 55 AA signature is very well possible. Pt points to LBA 63 but is is not NTFS boot sector, LBA 64 is. Backup boot suggests partition needs to start at LBA 64 (file system + 1). We need to check BS in relation to MFT (offset to MFT in clusters) to see which location is correct.