mbr for maxtor 80gb hard drive?

[dandandan]

Hello,

Does anyone out there have a Maxtor 80GB Diamond Max Plus 9 hard
drive?

Through a combination of bad luck and stupidity I have lost my master
boot record and maybe my boot record (what's the difference?).

I stupidly reverted to a backed up copy of the mbr when prompted by
Norton Antivirus. Unfortunately I have recently changed the hard
drive and the old mbr that I reverted to does not recognise the new
disk. fdisk /mbr did not work.

Is anyone with this exact spec hard drive able to copy me a hex dump
of the master boot record?

Other details:
Name: Maxtor 80GB 6Y080L0 Diamond Max Plus 9 ARA 133 LBA
Cylinder: 39236
Head: 16
Sector: 255

Any other ideas much appreciated.

Many thanks,

Dan

 

[Rod Speed]

Does anyone out there have a Maxtor 80GB Diamond Max Plus 9 hard drive?

Through a combination of bad luck and stupidity I have lost my master
boot record and maybe my boot record (what's the difference?).

The master boot record is for the entire physical drive.

There is also a boot record in each partition on the physical drive.

I stupidly reverted to a backed up copy of the mbr when
prompted by Norton Antivirus. Unfortunately I have recently
changed the hard drive and the old mbr that I reverted to
does not recognise the new disk. fdisk /mbr did not work.

Is anyone with this exact spec hard drive able to
copy me a hex dump of the master boot record?

The detail is specific to how it was partitioned etc.

Other details:
Name: Maxtor 80GB 6Y080L0 Diamond Max Plus 9 ARA 133 LBA
Cylinder: 39236
Head: 16
Sector: 255

Any other ideas much appreciated.

Run findpart on it and post the output here
and Svend may well fix it for you with a bat file.
http://www.partitionsupport.com/utilities.htm

 

[dandandan]

Rod,

Thanks for your advice.

I ran findpart. It didn't work.

One line of output was writen to the screen immediately:

Disk: 2
Cylinders: 9964
Heads: 255
Sectors: 63
MB: 78160

Then, there was a long pause. The hard drive was spinning at a
constant rate but nothing else happened. I went out and came back 5
hours later and it was the same so I switched the computer off.

Anyway, the disk was set up in the simplest way - just the one
partition.

I think the problem is that the NAV restored an old mbr (presumanbly
restored from an NAV folder?) and this was for my old 6gb drive not
the new 80gb drive. When NAV recognised that the mbr had changed (of
course it had, i had changed the hard drive), it suggested it could be
due to virus activity and as I suspected a virus anyway i leapt in
there without thinking... Of course the restored mbr didn't know what
the 80gb drive was so it could not boot. So then it tried to boot to
the floppy, the CD etc until eventually it booted from the old mbr on
the D: drive (the old 6GB drive). So today I have a situation where
the 6gb drive is C: and the 80gb drive id d:. The directory of files
on D: shows nothing and the OS incorrectly recognises d: this also as
a 6gb drive.

I have ordered a new 80gb (exact same model) and I will get it
formatted in exactly the same way as mine was. Hopefully this will
give me the correct mbr for my 80gb drive. Am I talking sense here?

Thanks

 

[Svend Olaf Mikkelsen]

Rod,

Thanks for your advice.

I ran findpart. It didn't work.

One line of output was writen to the screen immediately:

Disk: 2
Cylinders: 9964
Heads: 255
Sectors: 63
MB: 78160

Then, there was a long pause. The hard drive was spinning at a
constant rate but nothing else happened. I went out and came back 5
hours later and it was the same so I switched the computer off.

Anyway, the disk was set up in the simplest way - just the one
partition.

I think the problem is that the NAV restored an old mbr (presumanbly
restored from an NAV folder?) and this was for my old 6gb drive not
the new 80gb drive. When NAV recognised that the mbr had changed (of
course it had, i had changed the hard drive), it suggested it could be
due to virus activity and as I suspected a virus anyway i leapt in
there without thinking... Of course the restored mbr didn't know what
the 80gb drive was so it could not boot. So then it tried to boot to
the floppy, the CD etc until eventually it booted from the old mbr on
the D: drive (the old 6GB drive). So today I have a situation where
the 6gb drive is C: and the 80gb drive id d:. The directory of files
on D: shows nothing and the OS incorrectly recognises d: this also as
a 6gb drive.

I have ordered a new 80gb (exact same model) and I will get it
formatted in exactly the same way as mine was. Hopefully this will
give me the correct mbr for my 80gb drive. Am I talking sense here?

Thanks

You can do this:

findpart tables fp-a.txt

and insert (not attach) the output here. This will only print the
partition tables.


If only the MBR is damaged, a finding from the boot sector of the
first (and in this case only) partition, should be shown immediately.

It is difficult to say how long time a full search without findings
will take, but it should be less than 5 minutes for a 78160 MB disk
before a message "None found" is printed. After that a FAT search will
be run.

If the partition is an NTFS partition, and the boot sector damaged,
and the original geometry was another, Findpart will not find the NTFS
backup boot sector, which is in the very last sector of the partition.
You can do:

findpart 2 heads 240 fp-b.txt.

and give this 7 minutes:

findpart 2 fp-c.txt

If the partition was a FAT partition, you can do:

findpart findfat 2 0 4 fp-d.txt

Findpart can be interrupted with Ctrl-break. If it should be the case
that bad sectors are present, that will delay or stop the search.

It is unlikely that copying a MBR from another disk will recover a
partition, which Findpart cannot find, since then the partition itself
is damaged. The method should be to figure out what happened, or copy
data to another disk using recovery tools.

 

[dandandan]

Svend,

Here is the output - the same for the 80gb disk (2) as the 6gb disk
(1). This worries me. The first (and only) thing we have tried so far
is fdisk /mbr ... maybe this has screwed things up even worse.


Findpart, version 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

OS: DOS 8.00 WINDOWS 4.90 Partition tables:

Disk: 1 Cylinders: 784 Heads: 255 Sectors: 63 MB: 6150

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK


Thanks,

Dan

 

[Svend Olaf Mikkelsen]

Svend,

Here is the output - the same for the 80gb disk (2) as the 6gb disk
(1). This worries me. The first (and only) thing we have tried so far
is fdisk /mbr ... maybe this has screwed things up even worse.


Findpart, version 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

OS: DOS 8.00 WINDOWS 4.90 Partition tables:

Disk: 1 Cylinders: 784 Heads: 255 Sectors: 63 MB: 6150

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK


Thanks,

Dan

You can do:

findpart finddir 2 0 100 fp-e.txt

and mail me the file fp-e.txt. The file may be too large for usenet.
The purpose is to find traces from the previous partition in the
beginning of the disk.

Ideally the partition on disk 2 should be hidden to prevent further
damage. At least do not access the partition. If you want a batch file
to hide the partition, then do:

findpart tables fp-f.txt

and mail me fp-f.txt, so I am certain nothing was changed.

 

[dandandan]

Svend,

Finddir, version FP 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

Searches for subdirectories and calculates cluster two
location. 'Cluster' is cluster number or cluster 2 CHS.
'KB' is cluster KB. May also say something about FAT location.

OS: DOS 8.00 WINDOWS 4.90

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

Start cylinder: 0 End cylinder: 100

--------- CHS ----- LBA -- Cluster (2) ----- LBA -KB YYMMDD
0 0 1 0 searched
1 136 39 24671 possible root
2 77 43 37023 1546 040127
2 80 54 37223 1 136 39 24671 4 040128
2 111 51 39173 possible root
8 159 27 138563 1555 030912
8 176 44 139651 2 111 49 39171 32 040126
9 164 31 154947 2 111 49 39171 32 030912
12 67 59 197059 2 111 49 39171 32 030912
12 68 60 197123 2 111 49 39171 32 030912
12 69 61 197187 2 111 49 39171 32 030912
12 78 6 197699 2 111 49 39171 32 031003
12 79 7 197763 2 111 49 39171 32 031003
12 248 48 208451 2 111 49 39171 32 030912
14 102 28 231363 2 111 49 39171 32 040126
14 166 28 235395 2 111 49 39171 32 031003
14 167 29 235459 2 111 49 39171 32 031003
14 168 30 235523 2 111 49 39171 32 031003
15 141 2 249859 2 111 49 39171 32 030912
15 221 18 254915 2 111 49 39171 32 030912
15 225 22 255171 2 111 49 39171 32 030912
35 243 20 577603 2 111 49 39171 32 030912
35 244 21 577667 2 111 49 39171 32 030912
40 193 29 654787 2 111 49 39171 32 030912
41 60 23 662467 2 111 49 39171 32 030912
41 174 9 669635 2 111 49 39171 32 030912
42 108 6 681539 2 111 49 39171 32 030912
48 21 41 772483 2 111 49 39171 32 030912
53 207 30 864515 2 111 49 39171 32 030912
53 209 32 864643 2 111 49 39171 32 030912
54 61 11 871363 2 111 49 39171 32 030912
59 143 24 956867 2 111 49 39171 32 031003
60 9 17 964483 2 111 49 39171 32 030912
72 49 45 1159811 2 111 49 39171 32 030912
78 178 40 1264323 2 111 49 39171 32 030912
78 179 41 1264387 2 111 49 39171 32 030912
78 183 45 1264643 2 111 49 39171 32 030912
78 187 49 1264899 2 111 49 39171 32 030912
78 191 53 1265155 2 111 49 39171 32 030912
78 195 57 1265411 2 111 49 39171 32 030912
78 199 61 1265667 2 111 49 39171 32 030912
78 204 2 1265923 2 111 49 39171 32 030912
78 208 6 1266179 2 111 49 39171 32 030912
78 212 10 1266435 2 111 49 39171 32 030912
78 216 14 1266691 2 111 49 39171 32 030912
78 220 18 1266947 2 111 49 39171 32 030912
78 224 22 1267203 2 111 49 39171 32 030912
78 228 26 1267459 2 111 49 39171 32 030912
78 232 30 1267715 2 111 49 39171 32 030912
78 236 34 1267971 2 111 49 39171 32 030912
78 240 38 1268227 2 111 49 39171 32 030912
78 244 42 1268483 2 111 49 39171 32 030912
78 248 46 1268739 2 111 49 39171 32 030912
78 252 50 1268995 2 111 49 39171 32 030912
79 1 54 1269251 2 111 49 39171 32 030912
79 5 58 1269507 2 111 49 39171 32 030912
79 9 62 1269763 2 111 49 39171 32 030912
79 14 3 1270019 2 111 49 39171 32 030912
79 18 7 1270275 2 111 49 39171 32 030912
79 22 11 1270531 2 111 49 39171 32 030912
79 26 15 1270787 2 111 49 39171 32 030912
79 30 19 1271043 2 111 49 39171 32 030912
79 34 23 1271299 2 111 49 39171 32 030912
79 38 27 1271555 2 111 49 39171 32 030912
79 97 22 1275267 2 111 49 39171 32 030912
79 115 40 1276419 2 111 49 39171 32 030912
79 144 5 1278211 2 111 49 39171 32 030912
79 153 14 1278787 2 111 49 39171 32 030912
80 62 50 1289155 2 111 49 39171 32 030912
80 63 51 1289219 2 111 49 39171 32 030912
80 77 1 1290051 2 111 49 39171 32 030912
80 118 42 1292675 2 111 49 39171 32 030912
80 128 52 1293315 2 111 49 39171 32 030912
80 130 54 1293443 2 111 49 39171 32 030912
80 139 63 1294019 2 111 49 39171 32 030912
80 154 14 1294915 2 111 49 39171 32 030912
80 163 23 1295491 2 111 49 39171 32 030912
80 166 26 1295683 2 111 49 39171 32 030912
81 174 33 1312259 2 111 49 39171 32 030912
81 177 36 1312451 2 111 49 39171 32 030912
81 178 37 1312515 2 111 49 39171 32 030912
81 179 38 1312579 2 111 49 39171 32 030912
81 182 41 1312771 2 111 49 39171 32 030912
81 191 50 1313347 2 111 49 39171 32 030912
82 37 23 1319683 2 111 49 39171 32 030912
82 73 59 1321987 2 111 49 39171 32 030912
82 98 20 1323523 2 111 49 39171 32 030912
82 127 49 1325379 2 111 49 39171 32 030912
82 128 50 1325443 2 111 49 39171 32 030912
82 129 51 1325507 2 111 49 39171 32 030912
82 134 56 1325827 2 111 49 39171 32 030912
82 175 33 1328387 2 111 49 39171 32 030912
83 34 19 1335555 2 111 49 39171 32 030912
83 105 26 1340035 2 111 49 39171 32 030912
83 106 27 1340099 2 111 49 39171 32 030912
83 107 28 1340163 2 111 49 39171 32 030912
83 111 32 1340419 2 111 49 39171 32 030912
83 114 35 1340611 2 111 49 39171 32 030912
83 217 10 1347075 2 111 49 39171 32 030912
83 220 13 1347267 2 111 49 39171 32 030912
83 225 18 1347587 2 111 49 39171 32 030912
83 226 19 1347651 2 111 49 39171 32 030912
83 227 20 1347715 2 111 49 39171 32 030912
83 234 27 1348163 2 111 49 39171 32 030912
83 235 28 1348227 2 111 49 39171 32 030912
84 49 33 1352579 2 111 49 39171 32 030912
84 215 7 1363011 2 111 49 39171 32 030912
86 228 18 1395971 2 111 49 39171 32 030912
86 229 19 1396035 2 111 49 39171 32 030912
86 235 25 1396419 2 111 49 39171 32 030912
86 238 28 1396611 2 111 49 39171 32 030912
87 210 63 1410947 2 111 49 39171 32 031003
87 212 1 1411011 2 111 49 39171 32 031003
87 219 8 1411459 2 111 49 39171 32 031003
87 226 15 1411907 2 111 49 39171 32 031003
87 227 16 1411971 2 111 49 39171 32 031003
87 228 17 1412035 2 111 49 39171 32 031003
87 229 18 1412099 2 111 49 39171 32 031003
87 249 38 1413379 2 111 49 39171 32 030912
87 251 40 1413507 2 111 49 39171 32 030912
88 74 54 1418435 2 111 49 39171 32 030912
88 127 43 1421763 2 111 49 39171 32 030912
88 130 46 1421955 2 111 49 39171 32 030912
90 75 53 1450627 2 111 49 39171 32 030912
90 204 54 1458755 2 111 49 39171 32 030912
90 210 60 1459139 2 111 49 39171 32 030912
90 233 19 1460547 2 111 49 39171 32 030912
90 237 23 1460803 2 111 49 39171 32 030912
90 249 35 1461571 2 111 49 39171 32 030912
91 22 63 1463363 2 111 49 39171 32 030912
91 33 10 1464003 2 111 49 39171 32 030912
91 36 13 1464195 2 111 49 39171 32 030912
91 38 15 1464323 2 111 49 39171 32 030912
91 100 13 1468227 2 111 49 39171 32 030912
91 104 17 1468483 2 111 49 39171 32 030912
91 160 9 1472003 2 111 49 39171 32 030912
91 170 19 1472643 2 111 49 39171 32 030912
91 171 20 1472707 2 111 49 39171 32 030912
91 230 15 1476419 2 111 49 39171 32 030912
91 239 24 1476995 2 111 49 39171 32 030912
92 67 43 1482243 2 111 49 39171 32 030912
92 68 44 1482307 2 111 49 39171 32 030912
92 70 46 1482435 2 111 49 39171 32 030912
92 91 3 1483715 2 111 49 39171 32 030912
92 92 4 1483779 2 111 49 39171 32 030912
98 22 56 1575811 2 111 49 39171 32 030912
100 0 1 1606500 searched

------FAT CHS ------LBA Confidence Distance Type Sig
57 119 39 923240 15 32 NB

Findpart, version 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

OS: DOS 8.00 WINDOWS 4.90 Partition tables:

Disk: 1 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0C 63160071597 78159 0 1 1 9963 254 63 OK OK

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK

Thanks,

Dan

 

[Svend Olaf Mikkelsen]

Findpart, version 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

OS: DOS 8.00 WINDOWS 4.90 Partition tables:

Disk: 1 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0C 63160071597 78159 0 1 1 9963 254 63 OK OK

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*0B 63 12594897 6149 0 1 1 783 254 63 OK OK

Reply no. 1.

From the previous description disk 2 is the problem disk on which you
currently cannot access the data.

To hide the partition on disk 2, to prevent further damage, you can
download dandan1.bat in

http://inet.uni2.dk/~svolaf/dandan1.zip

Put dandan1.bat in the same directory as findpart.exe, and run
dandan1.bat, which contains:

set findpart=edit
findpart 2 0 1 - 2C 0 0 2 9963 254 63 0 9964 255 63 26
set findpart=
findpart tables fp2-1.txt

The Findpart verification that the correct disk is edited, does not
work in this case, since you now have two disks with same geometry. I
however have verified that the first parameter is 2, for disk number
2. The change will be effective after reboot.

If the batch file does not change the partition table, it can be
because there is not enough environment space to set the findpart
environment variable to edit. As far as I remember, this most often
happens in Windows ME.

 

[Svend Olaf Mikkelsen]

Svend,

Finddir, version FP 4.38.
Copyright Svend Olaf Mikkelsen, 2004.

Searches for subdirectories and calculates cluster two
location. 'Cluster' is cluster number or cluster 2 CHS.
'KB' is cluster KB. May also say something about FAT location.

OS: DOS 8.00 WINDOWS 4.90

Disk: 2 Cylinders: 9964 Heads: 255 Sectors: 63 MB: 78160

Start cylinder: 0 End cylinder: 100

--------- CHS ----- LBA -- Cluster (2) ----- LBA -KB YYMMDD
0 0 1 0 searched
1 136 39 24671 possible root
2 77 43 37023 1546 040127
2 80 54 37223 1 136 39 24671 4 040128
2 111 51 39173 possible root
8 159 27 138563 1555 030912
8 176 44 139651 2 111 49 39171 32 040126
9 164 31 154947 2 111 49 39171 32 030912
12 67 59 197059 2 111 49 39171 32 030912
12 68 60 197123 2 111 49 39171 32 030912
12 69 61 197187 2 111 49 39171 32 030912
12 78 6 197699 2 111 49 39171 32 031003

98 22 56 1575811 2 111 49 39171 32 030912
100 0 1 1606500 searched

------FAT CHS ------LBA Confidence Distance Type Sig
57 119 39 923240 15 32 NB

It seems as the FAT of this partition was lost. It was a FAT32
partition covering the entire disk. The FAT size was 19538 sectors for
each of 2 FAT copies (39171-95)/2. The cluster size is 32 KB.

January 27 and January 28 (the date of your first message), two
directories were written to the 6149 MB partition, which the disk
contains according to the current partition table. Since FAT was not
found for any data in any partition, I guess that the 6149 MB
partition was newly formatted on top of the 78160 MB partition.

This is a FAT32 without FAT recovery case, meaning that it can be
quite easy to recover files that were not fragmented, while recovering
fragmented files can be complicated. When the disk is protected in a
hidden partition, you can attempt to copy files using recovery
programs. I may also be able to help. In mail that however will only
work for not fragmented files.

I would note that we do not have a standard Findpart search for the
disk, since the first report was that the search did not work. Meaning
that depending on the story of the disk, other partitions could be
located later on the disk.

 

[dandandan]

Yes, what you say agrees with what my friend thought - the FAT on disk
2 is gone. Maybe I lost it by running fdisk /mbr on 27 Jan.

If I run your bat file, disk 2 will be made safe from overwriting? I
will do this first.

What can I do next to try to recover the files on disk 2? I think that
most files will be not fragmented (I defragmented the disk recently).

Thanks Svend,

Best Regards,

Dan

 

[Svend Olaf Mikkelsen]

Yes, what you say agrees with what my friend thought - the FAT on disk
2 is gone. Maybe I lost it by running fdisk /mbr on 27 Jan.

If I run your bat file, disk 2 will be made safe from overwriting? I
will do this first.

What can I do next to try to recover the files on disk 2? I think that
most files will be not fragmented (I defragmented the disk recently).

Thanks Svend,

Best Regards,

Dan

If you ran dandan1.bat, and it went as expected (can be seen in the
file fp2-1.txt), Windows will not attempt to access the disk after
reboot. There will be a large unknown partition covering the entire
disk. When you later will use the disk, that partition should be
deleted.

I assume you now have two equal size disks in the PC, and that you
have plenty of free space in the partition on disk 1.

I recommend that you do in a Windows ME DOS box:

findpart gb32 1

and read on the screen if 32 GB problems are present. Probably they
are not.

To attempt to copy files from the damaged FAT32 partition without FAT,
you can do this:

Create a new directory in the root of C:

Get Findpart version 4.41 at my page.

Get dandan2.bat in

http://inet.uni2.dk/~svolaf/dandan2.zip

Put the Findpart exe and library files (needed in Windows 95/98/ME)
and dandan2.bat in the new directory.

Run dandan2.bat, which contains:

findpart cyldir 2 0 1 33 19538 32 2 cdir.txt fp2-2.txt nofat
findpart cyldir 2 tree +lost

If this goes as expected, files will be copied.

Note that even if files are copied, they will only be correct if they
were not fragmented. The file copying will take some time.

I do not know what other recovery tools may be able to do with a FAT32
partition without FAT, but if files are wrong or missing, it may be
possible that other tools, or hand work, will work better.

 

[dandandan]

Svend,
I have recovered most of the ‘lost' files from disk 2 to disk 1 using
a utility called ‘GetDataBack for FAT'. It searched the disk and found
most of the files plus some garbage files, old deleted stuff etc. I
copied the whole lot to disk 1. Most of the important stuff is saved.
Yippee! Some of the recent files I was working on (excel) will not
open so I guess some stuff is lost. The irreplaceable photos my young
daughter are saved. Thanks for all your wise advice Svend. I am very
thankful to you for taking the time to help me.
Dan