Hello,

Does anyone out there have a Maxtor 80GB Diamond Max Plus 9 hard
drive?

Through a combination of bad luck and stupidity I have lost my master
boot record and maybe my boot record (what's the difference?).

I stupidly reverted to a backed up copy of the mbr when prompted by
Norton Antivirus. Unfortunately I have recently changed the hard
drive and the old mbr that I reverted to does not recognise the new
disk. fdisk /mbr did not work.

Is anyone with this exact spec hard drive able to copy me a hex dump
of the master boot record?

Other details:
Name: Maxtor 80GB 6Y080L0 Diamond Max Plus 9 ARA 133 LBA
Cylinder: 39236
Head: 16
Sector: 255

Any other ideas much appreciated.

Many thanks,

Dan

dandandan <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...

> Does anyone out there have a Maxtor 80GB Diamond Max Plus 9 hard drive?

> Through a combination of bad luck and stupidity I have lost my master
> boot record and maybe my boot record (what's the difference?).

The master boot record is for the entire physical drive.

There is also a boot record in each partition on the physical drive.

> I stupidly reverted to a backed up copy of the mbr when
> prompted by Norton Antivirus. Unfortunately I have recently
> changed the hard drive and the old mbr that I reverted to
> does not recognise the new disk. fdisk /mbr did not work.

> Is anyone with this exact spec hard drive able to
> copy me a hex dump of the master boot record?

The detail is specific to how it was partitioned etc.

> Other details:
> Name: Maxtor 80GB 6Y080L0 Diamond Max Plus 9 ARA 133 LBA
> Cylinder: 39236
> Head: 16
> Sector: 255

> Any other ideas much appreciated.

Run findpart on it and post the output here
and Svend may well fix it for you with a bat file.
http://www.partitionsupport.com/utilities.htm

Rod,

Thanks for your advice.

I ran findpart. It didn't work.

One line of output was writen to the screen immediately:

Disk: 2
Cylinders: 9964
Heads: 255
Sectors: 63
MB: 78160

Then, there was a long pause. The hard drive was spinning at a
constant rate but nothing else happened. I went out and came back 5
hours later and it was the same so I switched the computer off.

Anyway, the disk was set up in the simplest way - just the one
partition.

I think the problem is that the NAV restored an old mbr (presumanbly
restored from an NAV folder?) and this was for my old 6gb drive not
the new 80gb drive. When NAV recognised that the mbr had changed (of
course it had, i had changed the hard drive), it suggested it could be
due to virus activity and as I suspected a virus anyway i leapt in
there without thinking... Of course the restored mbr didn't know what
the 80gb drive was so it could not boot. So then it tried to boot to
the floppy, the CD etc until eventually it booted from the old mbr on
the D: drive (the old 6GB drive). So today I have a situation where
the 6gb drive is C: and the 80gb drive id d:. The directory of files
on D: shows nothing and the OS incorrectly recognises d: this also as
a 6gb drive.

I have ordered a new 80gb (exact same model) and I will get it
formatted in exactly the same way as mine was. Hopefully this will
give me the correct mbr for my 80gb drive. Am I talking sense here?

Thanks

On 30 Jan 2004 02:02:31 -0800, (E-Mail Removed) (dandandan) wrote:

>Rod,
>
>Thanks for your advice.
>
>I ran findpart. It didn't work.
>
>One line of output was writen to the screen immediately:
>
>Disk: 2
>Cylinders: 9964
>Heads: 255
>Sectors: 63
>MB: 78160
>
>Then, there was a long pause. The hard drive was spinning at a
>constant rate but nothing else happened. I went out and came back 5
>hours later and it was the same so I switched the computer off.
>
>Anyway, the disk was set up in the simplest way - just the one
>partition.
>
>I think the problem is that the NAV restored an old mbr (presumanbly
>restored from an NAV folder?) and this was for my old 6gb drive not
>the new 80gb drive. When NAV recognised that the mbr had changed (of
>course it had, i had changed the hard drive), it suggested it could be
>due to virus activity and as I suspected a virus anyway i leapt in
>there without thinking... Of course the restored mbr didn't know what
>the 80gb drive was so it could not boot. So then it tried to boot to
>the floppy, the CD etc until eventually it booted from the old mbr on
>the D: drive (the old 6GB drive). So today I have a situation where
>the 6gb drive is C: and the 80gb drive id d:. The directory of files
>on D: shows nothing and the OS incorrectly recognises d: this also as
>a 6gb drive.
>
>I have ordered a new 80gb (exact same model) and I will get it
>formatted in exactly the same way as mine was. Hopefully this will
>give me the correct mbr for my 80gb drive. Am I talking sense here?
>
>Thanks

You can do this:

findpart tables fp-a.txt

and insert (not attach) the output here. This will only print the
partition tables.


If only the MBR is damaged, a finding from the boot sector of the
first (and in this case only) partition, should be shown immediately.

It is difficult to say how long time a full search without findings
will take, but it should be less than 5 minutes for a 78160 MB disk
before a message "None found" is printed. After that a FAT search will
be run.

If the partition is an NTFS partition, and the boot sector damaged,
and the original geometry was another, Findpart will not find the NTFS
backup boot sector, which is in the very last sector of the partition.
You can do:

findpart 2 heads 240 fp-b.txt.

and give this 7 minutes:

findpart 2 fp-c.txt

If the partition was a FAT partition, you can do:

findpart findfat 2 0 4 fp-d.txt

Findpart can be interrupted with Ctrl-break. If it should be the case
that bad sectors are present, that will delay or stop the search.

It is unlikely that copying a MBR from another disk will recover a
partition, which Findpart cannot find, since then the partition itself
is damaged. The method should be to figure out what happened, or copy
data to another disk using recovery tools.
--
Svend Olaf

Svend,

Here is the output - the same for the 80gb disk (2) as the 6gb disk
(1). This worries me. The first (and only) thing we have tried so far
is fdisk /mbr ... maybe this has screwed things up even worse.


Findpart, version 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

OS: DOS 8.00 WINDOWS 4.90 Partition tables:

Disk: 1 Cylinders: 784 Heads: 255 Sectors: 63 MB: 6150

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK


Thanks,

Dan

On 2 Feb 2004 00:26:43 -0800, (E-Mail Removed) (dandandan) wrote:

>Svend,
>
>Here is the output - the same for the 80gb disk (2) as the 6gb disk
>(1). This worries me. The first (and only) thing we have tried so far
>is fdisk /mbr ... maybe this has screwed things up even worse.
>
>
>Findpart, version 4.38.
>Copyright Svend Olaf Mikkelsen, 2004.
>
>OS: DOS 8.00 WINDOWS 4.90 Partition tables:
>
>Disk: 1 Cylinders: 784 Heads: 255 Sectors: 63 MB: 6150
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK
>
>Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK
>
>
>Thanks,
>
>Dan

You can do:

findpart finddir 2 0 100 fp-e.txt

and mail me the file fp-e.txt. The file may be too large for usenet.
The purpose is to find traces from the previous partition in the
beginning of the disk.

Ideally the partition on disk 2 should be hidden to prevent further
damage. At least do not access the partition. If you want a batch file
to hide the partition, then do:

findpart tables fp-f.txt

and mail me fp-f.txt, so I am certain nothing was changed.
--
Svend Olaf

Svend,

Finddir, version FP 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

Searches for subdirectories and calculates cluster two
location. 'Cluster' is cluster number or cluster 2 CHS.
'KB' is cluster KB. May also say something about FAT location.

OS: DOS 8.00 WINDOWS 4.90

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

Start cylinder: 0 End cylinder: 100

--------- CHS ----- LBA -- Cluster (2) ----- LBA -KB YYMMDD
0 0 1 0 searched
1 136 39 24671 possible root
2 77 43 37023 1546 040127
2 80 54 37223 1 136 39 24671 4 040128
2 111 51 39173 possible root
8 159 27 138563 1555 030912
8 176 44 139651 2 111 49 39171 32 040126
9 164 31 154947 2 111 49 39171 32 030912
12 67 59 197059 2 111 49 39171 32 030912
12 68 60 197123 2 111 49 39171 32 030912
12 69 61 197187 2 111 49 39171 32 030912
12 78 6 197699 2 111 49 39171 32 031003
12 79 7 197763 2 111 49 39171 32 031003
12 248 48 208451 2 111 49 39171 32 030912
14 102 28 231363 2 111 49 39171 32 040126
14 166 28 235395 2 111 49 39171 32 031003
14 167 29 235459 2 111 49 39171 32 031003
14 168 30 235523 2 111 49 39171 32 031003
15 141 2 249859 2 111 49 39171 32 030912
15 221 18 254915 2 111 49 39171 32 030912
15 225 22 255171 2 111 49 39171 32 030912
35 243 20 577603 2 111 49 39171 32 030912
35 244 21 577667 2 111 49 39171 32 030912
40 193 29 654787 2 111 49 39171 32 030912
41 60 23 662467 2 111 49 39171 32 030912
41 174 9 669635 2 111 49 39171 32 030912
42 108 6 681539 2 111 49 39171 32 030912
48 21 41 772483 2 111 49 39171 32 030912
53 207 30 864515 2 111 49 39171 32 030912
53 209 32 864643 2 111 49 39171 32 030912
54 61 11 871363 2 111 49 39171 32 030912
59 143 24 956867 2 111 49 39171 32 031003
60 9 17 964483 2 111 49 39171 32 030912
72 49 45 1159811 2 111 49 39171 32 030912
78 178 40 1264323 2 111 49 39171 32 030912
78 179 41 1264387 2 111 49 39171 32 030912
78 183 45 1264643 2 111 49 39171 32 030912
78 187 49 1264899 2 111 49 39171 32 030912
78 191 53 1265155 2 111 49 39171 32 030912
78 195 57 1265411 2 111 49 39171 32 030912
78 199 61 1265667 2 111 49 39171 32 030912
78 204 2 1265923 2 111 49 39171 32 030912
78 208 6 1266179 2 111 49 39171 32 030912
78 212 10 1266435 2 111 49 39171 32 030912
78 216 14 1266691 2 111 49 39171 32 030912
78 220 18 1266947 2 111 49 39171 32 030912
78 224 22 1267203 2 111 49 39171 32 030912
78 228 26 1267459 2 111 49 39171 32 030912
78 232 30 1267715 2 111 49 39171 32 030912
78 236 34 1267971 2 111 49 39171 32 030912
78 240 38 1268227 2 111 49 39171 32 030912
78 244 42 1268483 2 111 49 39171 32 030912
78 248 46 1268739 2 111 49 39171 32 030912
78 252 50 1268995 2 111 49 39171 32 030912
79 1 54 1269251 2 111 49 39171 32 030912
79 5 58 1269507 2 111 49 39171 32 030912
79 9 62 1269763 2 111 49 39171 32 030912
79 14 3 1270019 2 111 49 39171 32 030912
79 18 7 1270275 2 111 49 39171 32 030912
79 22 11 1270531 2 111 49 39171 32 030912
79 26 15 1270787 2 111 49 39171 32 030912
79 30 19 1271043 2 111 49 39171 32 030912
79 34 23 1271299 2 111 49 39171 32 030912
79 38 27 1271555 2 111 49 39171 32 030912
79 97 22 1275267 2 111 49 39171 32 030912
79 115 40 1276419 2 111 49 39171 32 030912
79 144 5 1278211 2 111 49 39171 32 030912
79 153 14 1278787 2 111 49 39171 32 030912
80 62 50 1289155 2 111 49 39171 32 030912
80 63 51 1289219 2 111 49 39171 32 030912
80 77 1 1290051 2 111 49 39171 32 030912
80 118 42 1292675 2 111 49 39171 32 030912
80 128 52 1293315 2 111 49 39171 32 030912
80 130 54 1293443 2 111 49 39171 32 030912
80 139 63 1294019 2 111 49 39171 32 030912
80 154 14 1294915 2 111 49 39171 32 030912
80 163 23 1295491 2 111 49 39171 32 030912
80 166 26 1295683 2 111 49 39171 32 030912
81 174 33 1312259 2 111 49 39171 32 030912
81 177 36 1312451 2 111 49 39171 32 030912
81 178 37 1312515 2 111 49 39171 32 030912
81 179 38 1312579 2 111 49 39171 32 030912
81 182 41 1312771 2 111 49 39171 32 030912
81 191 50 1313347 2 111 49 39171 32 030912
82 37 23 1319683 2 111 49 39171 32 030912
82 73 59 1321987 2 111 49 39171 32 030912
82 98 20 1323523 2 111 49 39171 32 030912
82 127 49 1325379 2 111 49 39171 32 030912
82 128 50 1325443 2 111 49 39171 32 030912
82 129 51 1325507 2 111 49 39171 32 030912
82 134 56 1325827 2 111 49 39171 32 030912
82 175 33 1328387 2 111 49 39171 32 030912
83 34 19 1335555 2 111 49 39171 32 030912
83 105 26 1340035 2 111 49 39171 32 030912
83 106 27 1340099 2 111 49 39171 32 030912
83 107 28 1340163 2 111 49 39171 32 030912
83 111 32 1340419 2 111 49 39171 32 030912
83 114 35 1340611 2 111 49 39171 32 030912
83 217 10 1347075 2 111 49 39171 32 030912
83 220 13 1347267 2 111 49 39171 32 030912
83 225 18 1347587 2 111 49 39171 32 030912
83 226 19 1347651 2 111 49 39171 32 030912
83 227 20 1347715 2 111 49 39171 32 030912
83 234 27 1348163 2 111 49 39171 32 030912
83 235 28 1348227 2 111 49 39171 32 030912
84 49 33 1352579 2 111 49 39171 32 030912
84 215 7 1363011 2 111 49 39171 32 030912
86 228 18 1395971 2 111 49 39171 32 030912
86 229 19 1396035 2 111 49 39171 32 030912
86 235 25 1396419 2 111 49 39171 32 030912
86 238 28 1396611 2 111 49 39171 32 030912
87 210 63 1410947 2 111 49 39171 32 031003
87 212 1 1411011 2 111 49 39171 32 031003
87 219 8 1411459 2 111 49 39171 32 031003
87 226 15 1411907 2 111 49 39171 32 031003
87 227 16 1411971 2 111 49 39171 32 031003
87 228 17 1412035 2 111 49 39171 32 031003
87 229 18 1412099 2 111 49 39171 32 031003
87 249 38 1413379 2 111 49 39171 32 030912
87 251 40 1413507 2 111 49 39171 32 030912
88 74 54 1418435 2 111 49 39171 32 030912
88 127 43 1421763 2 111 49 39171 32 030912
88 130 46 1421955 2 111 49 39171 32 030912
90 75 53 1450627 2 111 49 39171 32 030912
90 204 54 1458755 2 111 49 39171 32 030912
90 210 60 1459139 2 111 49 39171 32 030912
90 233 19 1460547 2 111 49 39171 32 030912
90 237 23 1460803 2 111 49 39171 32 030912
90 249 35 1461571 2 111 49 39171 32 030912
91 22 63 1463363 2 111 49 39171 32 030912
91 33 10 1464003 2 111 49 39171 32 030912
91 36 13 1464195 2 111 49 39171 32 030912
91 38 15 1464323 2 111 49 39171 32 030912
91 100 13 1468227 2 111 49 39171 32 030912
91 104 17 1468483 2 111 49 39171 32 030912
91 160 9 1472003 2 111 49 39171 32 030912
91 170 19 1472643 2 111 49 39171 32 030912
91 171 20 1472707 2 111 49 39171 32 030912
91 230 15 1476419 2 111 49 39171 32 030912
91 239 24 1476995 2 111 49 39171 32 030912
92 67 43 1482243 2 111 49 39171 32 030912
92 68 44 1482307 2 111 49 39171 32 030912
92 70 46 1482435 2 111 49 39171 32 030912
92 91 3 1483715 2 111 49 39171 32 030912
92 92 4 1483779 2 111 49 39171 32 030912
98 22 56 1575811 2 111 49 39171 32 030912
100 0 1 1606500 searched

------FAT CHS ------LBA Confidence Distance Type Sig
57 119 39 923240 15 32 NB

Findpart, version 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

OS: DOS 8.00 WINDOWS 4.90 Partition tables:

Disk: 1 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0C 63160071597 78159 0 1 1 9963 254 63 OK OK

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK

Thanks,

Dan

On 4 Feb 2004 14:01:52 -0800, (E-Mail Removed) (dandandan) wrote:

>Findpart, version 4.38.
>Copyright Svend Olaf Mikkelsen, 2004.
>
>OS: DOS 8.00 WINDOWS 4.90 Partition tables:
>
>Disk: 1 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0C 63160071597 78159 0 1 1 9963 254 63 OK OK
>
>Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160
>
>-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
> 0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK


Reply no. 1.

From the previous description disk 2 is the problem disk on which you
currently cannot access the data.

To hide the partition on disk 2, to prevent further damage, you can
download dandan1.bat in

http://inet.uni2.dk/~svolaf/dandan1.zip

Put dandan1.bat in the same directory as findpart.exe, and run
dandan1.bat, which contains:

set findpart=edit
findpart 2 0 1 - 2C 0 0 2 9963 254 63 0 9964 255 63 26
set findpart=
findpart tables fp2-1.txt

The Findpart verification that the correct disk is edited, does not
work in this case, since you now have two disks with same geometry. I
however have verified that the first parameter is 2, for disk number
2. The change will be effective after reboot.

If the batch file does not change the partition table, it can be
because there is not enough environment space to set the findpart
environment variable to edit. As far as I remember, this most often
happens in Windows ME.
--
Svend Olaf

On 4 Feb 2004 14:01:52 -0800, (E-Mail Removed) (dandandan) wrote:

>Svend,
>
>Finddir, version FP 4.38.
>Copyright Svend Olaf Mikkelsen, 2004.
>
>Searches for subdirectories and calculates cluster two
>location. 'Cluster' is cluster number or cluster 2 CHS.
>'KB' is cluster KB. May also say something about FAT location.
>
>OS: DOS 8.00 WINDOWS 4.90
>
>Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160
>
>Start cylinder: 0 End cylinder: 100
>
>--------- CHS ----- LBA -- Cluster (2) ----- LBA -KB YYMMDD
> 0 0 1 0 searched
> 1 136 39 24671 possible root
> 2 77 43 37023 1546 040127
> 2 80 54 37223 1 136 39 24671 4 040128
> 2 111 51 39173 possible root
> 8 159 27 138563 1555 030912
> 8 176 44 139651 2 111 49 39171 32 040126
> 9 164 31 154947 2 111 49 39171 32 030912
> 12 67 59 197059 2 111 49 39171 32 030912
> 12 68 60 197123 2 111 49 39171 32 030912
> 12 69 61 197187 2 111 49 39171 32 030912
> 12 78 6 197699 2 111 49 39171 32 031003

> 98 22 56 1575811 2 111 49 39171 32 030912
> 100 0 1 1606500 searched
>
>------FAT CHS ------LBA Confidence Distance Type Sig
> 57 119 39 923240 15 32 NB

It seems as the FAT of this partition was lost. It was a FAT32
partition covering the entire disk. The FAT size was 19538 sectors for
each of 2 FAT copies (39171-95)/2. The cluster size is 32 KB.

January 27 and January 28 (the date of your first message), two
directories were written to the 6149 MB partition, which the disk
contains according to the current partition table. Since FAT was not
found for any data in any partition, I guess that the 6149 MB
partition was newly formatted on top of the 78160 MB partition.

This is a FAT32 without FAT recovery case, meaning that it can be
quite easy to recover files that were not fragmented, while recovering
fragmented files can be complicated. When the disk is protected in a
hidden partition, you can attempt to copy files using recovery
programs. I may also be able to help. In mail that however will only
work for not fragmented files.

I would note that we do not have a standard Findpart search for the
disk, since the first report was that the search did not work. Meaning
that depending on the story of the disk, other partitions could be
located later on the disk.
--
Svend Olaf

Yes, what you say agrees with what my friend thought - the FAT on disk
2 is gone. Maybe I lost it by running fdisk /mbr on 27 Jan.

If I run your bat file, disk 2 will be made safe from overwriting? I
will do this first.

What can I do next to try to recover the files on disk 2? I think that
most files will be not fragmented (I defragmented the disk recently).

Thanks Svend,

Best Regards,

Dan