On Tue, 22 May 2012 13:16:50 -0700, Daniel Prince
<(E-Mail Removed)> put finger to keyboard and composed:
===========================================================================
Master Boot Record
===========================================================================
| B | FS TYPE | START | END | | |
| F | (hex) | C H S| C H S| RELATIVE | TOTAL |
===========================================================================
| * | 04 | 0 0 1|1023 254 63| 0| 488378646|
| | 00 | 0 0 0| 0 0 0| 0| 0|
| | 00 | 0 0 0| 0 0 0| 0| 0|
| | 00 | 0 0 0| 0 0 0| 0| 0|
===========================================================================
The drive is an Advanced Format model with a physical sector size of
4KB. Your partition table has a single entry with a size of 488378646
LBAs.
Windows XP is assuming that the sector size is 512 bytes, in which
case it thinks that the size of the volume is ...
488378646 x 512 = 250 049 866 752 bytes = 232.9 GiB
The actual size is ...
488378646 x 512 = 2 000 398 934 016 bytes
Furthermore, this file system is unusual in that there is an "NTFS"
signature, yet the partition ID is FAT16 (0x04).
Partition types: List of partition identifiers for PCs:
http://www.win.tue.nl/~aeb/partition...n_types-1.html
Even more unusual is the fact that the partition table points to LBA 0
as the starting sector for the logical volume, ie the boot sector and
MBR are one and the same. This is the reason that Sector Inspector's
report duplicates this sector. The usual regime places the boot sector
at LBA 63 or LBA 2048.
000 eb 52 90 4e 54 46 53 20-20 20 20 00 10 01 00 00 ?R?NTFS ....
010 00 00 00 00 00 f8 00 00-3f 00 ff 00 00 00 00 00 .....?..?.?.....
020 00 00 00 00 80 00 80 00-15 11 1c 1d 00 00 00 00 ....?.?.....
030 00 00 0c 00 00 00 00 00-02 00 00 00 00 00 00 00 ................
040 01 00 00 00 01 00 00 00-21 50 7c 68 5b 7c 68 42 ........!P|h[|hB
050 00 00 00 00 fa 33 c0 8e-d0 bc 00 7c fb 68 c0 07 ....?3????.|?h?.
060 1f 1e 68 66 00 cb 88 16-0e 00 66 81 3e 03 00 4e hf.??..f?>..N
070 54 46 53 75 15 b4 41 bb-aa 55 cd 13 72 0c 81 fb TFSu?A??U?r.??
080 55 aa 75 06 f7 c1 01 00-75 03 e9 dd 00 1e 83 ec U?u.??..u.??.??
090 18 68 1a 00 b4 48 8a 16-0e 00 8b f4 16 1f cd 13 h.?H?..???
0a0 9f 83 c4 18 9e 58 1f 72-e1 3b 06 0b 00 75 db a3 ????Xr?;...u??
0b0 0f 00 c1 2e 0f 00 04 1e-5a 33 db b9 00 20 2b c8 ..?....Z3??. +?
0c0 66 ff 06 11 00 03 16 0f-00 8e c2 ff 06 16 00 e8 f?.....???..?
0d0 4b 00 2b c8 77 ef b8 00-bb cd 1a 66 23 c0 75 2d K.+?w??.??f#?u-
0e0 66 81 fb 54 43 50 41 75-24 81 f9 02 01 72 1e 16 f??TCPAu$??..r
0f0 68 07 bb 16 68 70 0e 16-68 09 00 66 53 66 53 66 h.?hp.h..fSfSf
100 55 16 16 16 68 b8 01 66-61 0e 07 cd 1a 33 c0 bf Uh?.fa..?3??
110 28 10 b9 d8 0f fc f3 aa-e9 5f 01 90 90 66 60 1e (??.????_.??f`
120 06 66 a1 11 00 66 03 06-1c 00 1e 66 68 00 00 00 .f?.f...fh...
130 00 66 50 06 53 68 01 00-68 10 00 b4 42 8a 16 0e .fP.Sh..h.?B?.
140 00 16 1f 8b f4 cd 13 66-59 5b 5a 66 59 66 59 1f .???fY[ZfYfY
150 0f 82 16 00 66 ff 06 11-00 03 16 0f 00 8e c2 ff .?.f?.....???
160 0e 16 00 75 bc 07 1f 66-61 c3 a0 f8 01 e8 09 00 ..u?.fa???.?..
170 a0 fb 01 e8 03 00 f4 eb-fd b4 01 8b f0 ac 3c 00 ??.?..????.???<.
180 74 09 b4 0e bb 07 00 cd-10 eb f2 c3 0d 0a 41 20 t.?.?..????..A
190 64 69 73 6b 20 72 65 61-64 20 65 72 72 6f 72 20 disk read error
1a0 6f 63 63 75 72 72 65 64-00 0d 0a 42 4f 4f 54 4d occurred...BOOTM
1b0 47 52 20 69 73 20 6d 69-01 00 00 00 67 00 80 00 GR is mi....g.?.
1c0 01 00 04 fe ff ff 00 00-00 00 16 11 1c 1d 00 00 ...???......
1d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
1e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
1f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 aa ..............U?
I recommend the following resource for analysing boot sectors and
MBRs:
NTFS Volume Boot Record Of Win2K & Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
The section from 0x000 to 0x053 corresponds to a valid NTFS volume.
I believe that you may be able to access your data if you edit the
partition table (offset 0x1C2) so that the partition ID byte is 07
(=NTFS) rather than 04. Then install the drive in a Vista or Windows 7
system, or install it in a USB enclosure that uses 4KB LBAs rather
than 512-bytes, in which case Win XP will be able to access it.
Western Digital and Seagate 3TB external drives do it this way in
order to maintain compatibility with Win XP.
You could also trying mounting the drive using Linux or DMDE (after
editing the partition ID).
DM Disk Editor and Data Recovery (Free Edition):
http://softdm.com/download.html
That said, we still don't know if the data are encrypted.
- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.