MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 28 posts ]  Go to page Previous  1, 2
Author Message
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 13th, 2010, 7:00 
Offline

Joined: July 9th, 2010, 17:47
Posts: 14
Location: Canada
fzabkar wrote:
The partition table is corrupt. Did you attempt to fix your MBR with Microsoft's FIXMBR? If so, then that will explain the damage.

The partition table is reporting a single partition consisting of 66055248 sectors, ie about 32GB. Its type is 04 which is FAT16 (NTFS has a type of 07). The partition [incorrectly] begins at LBA 0 instead of the usual LBA 63 (the boot sector). That's why the boot parameter block contains nonsensical data.

The simplest solution to repair your logical file system corruption is to manually rebuild the partition table (16 bytes) using the information in the boot parameter block at sector 63. Hopefully the original boot sector is still intact.


This seems to be the case. The sector 63 I posted is the MSWIN4.1 bootsector (http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm). With this boot sector the DWORD located at 20h contains the total number of sectors in the partition. Unlike NTFS partitions there is no need to subtract 1 from this number, since it does not exclude backup copies of the bootsector. The total partition size is 0x04908BA0 (76581792). This number seems a bit off to me. The drive has 78156225 sectors total, minus 63 sectors prior to the start of the partition, leaves 78156162 sectors for the partition. That's a difference of 1574370 sectors, or ~768MB. Seems like there is too much room at the end of the drive. Would the HPA account for this space?

Anyway, moving on... in the partition table (sector 0) at 1BEh I have bytes 80 00 01 00 04 FE FF FF 00 00 00 00 50 EC EF 03. Which is:

Boot active - true - 80h
Staring CHS - CHS (0,1,0)
Partition type - 04
Ending CHS - CHS (1023, 254, 63)
Starting Sector - 0
Partition Size in sectors - 66055248h

Instead, this should be:
Boot active - true - 80h
Starting CHS - CHS (0,1,1)
Partition type - 0Bh
Ending CHS -CHS (1023, 254, 63)
Starting Sector - 63
Partition Size in sectors - 04908BA0h

Bytes:
80 01 01 00 0B FE FF FF 3F 00 00 00 A0 8B 90 04

Does that all look correct?


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 13th, 2010, 7:00 
Offline

Joined: July 9th, 2010, 17:47
Posts: 14
Location: Canada
fzabkar wrote:
The partition table is corrupt. Did you attempt to fix your MBR with Microsoft's FIXMBR? If so, then that will explain the damage.

The partition table is reporting a single partition consisting of 66055248 sectors, ie about 32GB. Its type is 04 which is FAT16 (NTFS has a type of 07). The partition [incorrectly] begins at LBA 0 instead of the usual LBA 63 (the boot sector). That's why the boot parameter block contains nonsensical data.

The simplest solution to repair your logical file system corruption is to manually rebuild the partition table (16 bytes) using the information in the boot parameter block at sector 63. Hopefully the original boot sector is still intact.


This seems to be the case. The sector 63 I posted is the MSWIN4.1 bootsector. With this boot sector the DWORD located at 20h contains the total number of sectors in the partition. Unlike NTFS partitions there is no need to subtract 1 from this number, since it does not exclude backup copies of the bootsector. The total partition size is 0x04908BA0 (76581792). This number seems a bit off to me. The drive has 78156225 sectors total, minus 63 sectors prior to the start of the partition, leaves 78156162 sectors for the partition. That's a difference of 1574370 sectors, or ~768MB. Seems like there is too much room at the end of the drive. Would the HPA account for this space?

Anyway, moving on... in the partition table (sector 0) at 1BEh I have bytes 80 00 01 00 04 FE FF FF 00 00 00 00 50 EC EF 03. Which is:

Boot active - true - 80h
Staring CHS - CHS (0,1,0)
Partition type - 04
Ending CHS - CHS (1023, 254, 63)
Starting Sector - 0
Partition Size in sectors - 66055248h

Instead, this should be:
Boot active - true - 80h
Starting CHS - CHS (0,1,1)
Partition type - 0Bh
Ending CHS -CHS (1023, 254, 63)
Starting Sector - 63
Partition Size in sectors - 04908BA0h

Bytes:
80 01 01 00 0B FE FF FF 3F 00 00 00 A0 8B 90 04

Does that all look correct?


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 13th, 2010, 7:48 
Offline

Joined: July 9th, 2010, 17:47
Posts: 14
Location: Canada
Just an FYI, I tested that partition entry out on my working drive that had the partial image of the bad drive on it. After verifying everything looked right in fdisk I went ahead and mounted it. It mounted no problem and gave me a file listing. I only had the first so many megs of the image so I could only see the file listing for the root of the drive.

I repeated the procedure on the bad drive and was able to recover the majority of the files. There is still a problem with the heads where the drive would lock up, but after a few attempts I was able to get the complete assignment (500MB-ish) off the drive. It CRC checked just fine after I pieced it all back together.

Thanks very much for the help everyone! My friend will be very pleased.


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 13th, 2010, 22:54 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16959
Location: Australia
Congratulations, and thanks very much for the detailed feedback.

On the question of the remaining 768MB, I don't believe your drive has a HPA.

Elsewhere you mentioned that the drive sometimes reports 4865 cylinders, and sometimes 4111.

The respective capacities are ...

4865 x 255 x 63 = 78 156 225 sectors = 40 015 987 200 bytes

4111 x 255 x 63 = 66 043 215 sectors = 33 814 126 080 bytes

I suspect that the remaining space may be assigned to a "recovery" partition or "utilities" partition, such as are often used by OEMs such as Dell. These sometimes appear with non-standard partition IDs, eg DEh. Such partitions are invisible to Microsoft operating systems. The actual partition structure can be a standard type such as FAT16.

I suggest you use your disc editor (eg HxD or DMDE) to examine the first sector beyond the main partition. This sector could be a boot sector in the case of a second primary partition, or an EBR (Extended Boot Record) in the case of an extended partition.

Alternatively, you could use TestDisk or Partition Find and Mount to locate and mount the partition.

http://www.cgsecurity.org/wiki/TestDisk
http://findandmount.com/


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 14th, 2010, 18:53 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16959
Location: Australia
It could be that the drive originally had a small HPA, but that the "tech guy" restored the full native capacity while troubleshooting the 32GB capacity limitation fault.

If the drive originally had an OEM MBR, then this may have been replaced with standard Microsoft code after applying FIXMBR. Furthermore, if the OEM is Dell, then there may be additional OEM code in LBA 3.


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 15th, 2010, 18:49 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16959
Location: Australia
Demus wrote:
The total partition size is 0x04908BA0 (76581792). This number seems a bit off to me. The drive has 78156225 sectors total, minus 63 sectors prior to the start of the partition, leaves 78156162 sectors for the partition. That's a difference of 1574370 sectors, or ~768MB. Seems like there is too much room at the end of the drive. Would the HPA account for this space?

Could it be that this area is set aside for an image of system RAM to support hibernation or suspend-to-disk?

http://en.wikipedia.org/wiki/Hibernation_(computing)


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 15th, 2010, 21:20 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16959
Location: Australia
Spildit wrote:
I think the problem is not just a logic issue ...

That was confirmed several posts ago. In fact the OP did eventually recover the stubborn sectors.


Top
 Profile  
 
 Post subject: Re: Hard drive spins, detects, and reads up to first 480MB
PostPosted: July 15th, 2010, 21:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 16959
Location: Australia
Spildit wrote:
Maybe it's time for a full drive image/cloning now ?

Do you mean for practice? Or are you referring to the 768MB at the tail end? Otherwise I don't understand.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 28 posts ]  Go to page Previous  1, 2

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 25 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group