please help save my partition using findpart editpart

[perltcl]

hi

please help save my partition using findpart and editpart.
after reinstall window xp (twice) my second partition is gone.
it seem some people can use findpart and editpart to save their
partition.
please help.


Findpart, version 4.71 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.1.2600 Service Pack 2 All

Disk: 1 Cylinders: 2584 Heads: 240 Sectors: 63 MB: 19077

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63 20638737 10077 0 1 1 1364 239 63 B OK
678 - 07 63 10236177 4998 678 1 1 1354 239 63 BU OK
1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK
1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK
0 - 0C 38102400 967680 472 2520 0 1 2583 239 63 B OK
677 - 07 63 28833777 14078 677 1 1 2583 239 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
2520 0 33 944 4 2 944 0 0 0 000908 362

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63 20638737 10077 0 1 1 1364*239 63 OK OK
0 2 0F 20638800 18431280 8999 1365* 0 1 2583*239 63 OK

1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK

I can't remember what is the format for the second partion nor it's
size.
it's a long time ago.
please help, I have lots of pictures on second partition.
Thanks.

 

[Svend Olaf Mikkelsen]

hi

please help save my partition using findpart and editpart.
after reinstall window xp (twice) my second partition is gone.
it seem some people can use findpart and editpart to save their
partition.
please help.


Findpart, version 4.71 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.1.2600 Service Pack 2 All

Disk: 1 Cylinders: 2584 Heads: 240 Sectors: 63 MB: 19077

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 07 63 20638737 10077 0 1 1 1364 239 63 B OK
678 - 07 63 10236177 4998 678 1 1 1354 239 63 BU OK
1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK
1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK
0 - 0C 38102400 967680 472 2520 0 1 2583 239 63 B OK
677 - 07 63 28833777 14078 677 1 1 2583 239 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
2520 0 33 944 4 2 944 0 0 0 000908 362

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*07 63 20638737 10077 0 1 1 1364*239 63 OK OK
0 2 0F 20638800 18431280 8999 1365* 0 1 2583*239 63 OK

1365 1 0E 63 18431217 8999 1365* 1 1 2583*239 63 00 OK

I can't remember what is the format for the second partion nor it's
size.
it's a long time ago.
please help, I have lots of pictures on second partition.
Thanks.

If data are lost on this disk, the disk should be inserted as second
disk in a working system for examination, and the current 10077 MB
NTFS partition should not be accessed.

The explanation is that partitions may be overlapping, so lost data
can be damaged if data are written to the current partition.

There is a 9073 MB NTFS partition at cylinder 1355, which may be the
lost partition. That is inside the current primary partition.


Other methods, such as copying to an external disk or a network drive
letter using Findpart would be possible, as long as nothing is written
to the current partition.

 

[Fabien LE LEZ]

please help save my partition using findpart and editpart.

Some might disagree, but I've had too many hard-drive-related problems
with Windows to trust this OS for such a recovery.

Also, trying to repair a partition table while running an OS on the
same hard disk, is definitely a bad idea.

I'd recommend booting on a Linux CD-ROM and using gpart.
You can either ask gpart to completely recover the partition table, or
just ask it to detect the second partition and use fdisk.

Documentation: <http://www.stud.uni-hannover.de/user/76201/gpart/>

A boot disk that contains gpart: Recovery Is Possible. This disk has
been really helpful to me for lots of hard drive problems.
<http://www.tux.org/pub/people/kent-robotti/looplinux/rip/>

 

[perltcl]

If data are lost on this disk, the disk should be inserted as second
disk in a working system for examination, and the current 10077 MB
NTFS partition should not be accessed.

The explanation is that partitions may be overlapping, so lost data
can be damaged if data are written to the current partition.

There is a 9073 MB NTFS partition at cylinder 1355, which may be the
lost partition. That is inside the current primary partition.


Other methods, such as copying to an external disk or a network drive
letter using Findpart would be possible, as long as nothing is written
to the current partition.

This is a IBM notebook, it has floppy drive though.
I try chsdir.exe 1 2520 0 3, but it won't let me run in XP.
I do'nt have any DOS disks anymore.
I could try to find one on the net though.
I have 2 Knoppix CDs though.
I just started using Knoppix recently.
I try to mount the second partition but it failed.
What would you suggest? get a dos disk and run chsdir?
You seem to have helped a few people on the net.
Please help.

 

[Svend Olaf Mikkelsen]

This is a IBM notebook, it has floppy drive though.
I try chsdir.exe 1 2520 0 3, but it won't let me run in XP.
I do'nt have any DOS disks anymore.
I could try to find one on the net though.
I have 2 Knoppix CDs though.
I just started using Knoppix recently.
I try to mount the second partition but it failed.
What would you suggest? get a dos disk and run chsdir?
You seem to have helped a few people on the net.
Please help.

Remember: Do not write to C: until it is known that it is safe.

1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK

Regarding the partition at cylinder 1355:

It can be an old obsolete partition, or it can be the lost partition.
To verify if it is the lost partition, you can make a file listing to
the screen, using this command:

findpart findntfs 1 1355 1 1

Using the mouse on the scroll bars, it may be possible to temporarily
stop the screen scrolling, so you can read the output.


To list the content of the FAT32 partition ad cylinder 2520, you can
use:


findpart chsdir 1 2520 0 1

 

[perltcl]

Some might disagree, but I've had too many hard-drive-related problems
with Windows to trust this OS for such a recovery.

Also, trying to repair a partition table while running an OS on the
same hard disk, is definitely a bad idea.

I'd recommend booting on a Linux CD-ROM and using gpart.
You can either ask gpart to completely recover the partition table, or
just ask it to detect the second partition and use fdisk.

Documentation: <http://www.stud.uni-hannover.de/user/76201/gpart/>

A boot disk that contains gpart: Recovery Is Possible. This disk has
been really helpful to me for lots of hard drive problems.
<http://www.tux.org/pub/people/kent-robotti/looplinux/rip/>

well, I am not being ungratefull, but I did try and use gpart and I
only get:

gpart /dev/hda
.......
.......

Guessed primary partition table:
Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 10077mb #s(20638737) s(63-20638799)
chs: (0/1/1)-(1023/14/63)d (0/1/1)-(21839/14/63)r

Primary partition(2)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

I'm trying to save my second partition. also it doesn't seem to have
any further detail on what can be done from here....

 

[perltcl]

Remember: Do not write to C: until it is known that it is safe.



Regarding the partition at cylinder 1355:

It can be an old obsolete partition, or it can be the lost partition.
To verify if it is the lost partition, you can make a file listing to
the screen, using this command:

findpart findntfs 1 1355 1 1

Using the mouse on the scroll bars, it may be possible to temporarily
stop the screen scrolling, so you can read the output.



To list the content of the FAT32 partition ad cylinder 2520, you can
use:


findpart chsdir 1 2520 0 1

I just found the partition!
findpart findntfs 1 1355 1 1


Directories: 184
Files: 831
Trees: 1
Exe/dll files: 3
Exe/dll files signature: 3
Cluster KB: 4
MFT cluster no: 4
MFT size: 9755648
MFT cluster bytes: 4096
Listed files MB: 591

this kicks ass, all my pics are there! all my past homeworks.
how do I do from here?
thanks.

 

[Svend Olaf Mikkelsen]

I just found the partition!
findpart findntfs 1 1355 1 1


Directories: 184
Files: 831
Trees: 1
Exe/dll files: 3
Exe/dll files signature: 3
Cluster KB: 4
MFT cluster no: 4
MFT size: 9755648
MFT cluster bytes: 4096
Listed files MB: 591

this kicks ass, all my pics are there! all my past homeworks.
how do I do from here?
thanks.

OK. Realize that this partition begins inside your C: partition, and
that if you write to C: you may permanently loose access to the files.
The important Master File Table is inside the C: partition.

If we should discuss this further, you must access usenet from another
computer. Maybe you are already doing that?

 

[perltcl]

OK. Realize that this partition begins inside your C: partition, and
that if you write to C: you may permanently loose access to the files.
The important Master File Table is inside the C: partition.

If we should discuss this further, you must access usenet from another
computer. Maybe you are already doing that?

I do have a second computer with internet access.
considering I have already reinstalled xp twice,
also editpart and findpart etc. on c drive.
and also install several other softwares,
hell I am typing and posting on the same computer
but I digress, I will shut this off and use another computer.
thanks

 

[Folkert Rienstra]

Some might disagree,

Yes, you have already shown to mostly have no clue of anything in this group.

 

[Fabien LE LEZ]

Yes, you have already shown to mostly have no clue of anything in this group.

Arno has blacklisted you, so you're looking for someone else to fight
with, uh?

 

[Eric Gisin]

Arno has blacklisted you, so you're looking for someone else to fight
with, uh?

Care to explain why gpart did not find the partition that findpart did?

 

[perltcl]

Yes, you have already shown to mostly have no clue of anything in this group.

for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

slightly longer version involved: "Knoppix on notebook,
linux host with qemu windows guest,
netcat, dd if=/dev/hda conv=noerror,sync bs=512 | nc 192.168.0.1 9000"
My harddrive had "input/output error".

So, findpart save my day.

I could have just unplug the harddrive and plug it in another machine
with windows running, though that would be no fun.... netcat is just so
much fun...

I did try to mount the "netcated" diskimage with calculated offset=$((
63*512*1355*240)) or $(( 63*512*1356*240)) but no success.
maybe someone could further enlighten me...

mount -t ntfs -o loop,ro,offset=$((63*512*1355*240)) rescued.img /tmp/l
mount -t ntfs -o loop,ro,offset=$((63*512*1356*240)) rescued.img /tmp/l

dmesg | tail
NTFS-fs error (device loop2): ntfs_fill_super(): Not an NTFS volume.

If I could mount the rescued image, it would have been a better and
faster solution.....
still all thanks goes to findpart.

 

[perltcl]

for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

slightly longer version involved: "Knoppix on notebook,
linux host with qemu windows guest,
netcat, dd if=/dev/hda conv=noerror,sync bs=512 | nc 192.168.0.1 9000"
My harddrive had "input/output error".

So, findpart save my day.

I could have just unplug the harddrive and plug it in another machine
with windows running, though that would be no fun.... netcat is just so
much fun...

I did try to mount the "netcated" diskimage with calculated offset=$((
63*512*1355*240)) or $(( 63*512*1356*240)) but no success.
maybe someone could further enlighten me...

mount -t ntfs -o loop,ro,offset=$((63*512*1355*240)) rescued.img /tmp/l
mount -t ntfs -o loop,ro,offset=$((63*512*1356*240)) rescued.img /tmp/l

dmesg | tail
NTFS-fs error (device loop2): ntfs_fill_super(): Not an NTFS volume.

If I could mount the rescued image, it would have been a better and
faster solution.....
still all thanks goes to findpart.

One more detail : I have to force geometry with findpart findntfs heads
240, since qemu has strange bios that report "255" heads....

 

[perltcl]

One more detail : I have to force geometry with findpart findntfs heads
240, since qemu has strange bios that report "255" heads....

One more detail: working with linux is fun,
but working with people who use linux is no fun,
because they have no idea of "supporting your software"....

 

[perltcl]

for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

that should be: "findpart findntfs heads 240 2 1355 1 1 showsys copy"
or was it : "findpart heads 240 findntfs 2 1355 1 1 showsys copy"

 

[perltcl]

Care to explain why gpart did not find the partition that findpart did?

Didn't you read my posted output from gpart,
the output shows no indication of finding the partition at CHS: 1355 1
1
while findpart finds serveral "OK" partition on first try.
not to mention findpart has support for listing and copying.
where I did I find that with gpart? or anywhere on their web site?

 

[perltcl]

that should be: "findpart findntfs heads 240 2 1355 1 1 showsys copy"
or was it : "findpart heads 240 findntfs 2 1355 1 1 showsys copy"

sorry that should be:
findpart.exe findntfs 2 1355 1 1 heads 240

 

[Folkert Rienstra]

One more detail : I have to force geometry with findpart findntfs heads
240,

since qemu has strange bios that report "255" heads....

And why is that strange?

 

[Svend Olaf Mikkelsen]

for the benefit of other people, I did recover all my data.
the short version is "findpart findntfs 2 0 1 1 showsys copy"

slightly longer version involved: "Knoppix on notebook,
linux host with qemu windows guest,
netcat, dd if=/dev/hda conv=noerror,sync bs=512 | nc 192.168.0.1 9000"
My harddrive had "input/output error".

So, findpart save my day.

I could have just unplug the harddrive and plug it in another machine
with windows running, though that would be no fun.... netcat is just so
much fun...

I did try to mount the "netcated" diskimage with calculated offset=$((
63*512*1355*240)) or $(( 63*512*1356*240)) but no success.
maybe someone could further enlighten me...

mount -t ntfs -o loop,ro,offset=$((63*512*1355*240)) rescued.img /tmp/l
mount -t ntfs -o loop,ro,offset=$((63*512*1356*240)) rescued.img /tmp/l

dmesg | tail
NTFS-fs error (device loop2): ntfs_fill_super(): Not an NTFS volume.

If I could mount the rescued image, it would have been a better and
faster solution.....
still all thanks goes to findpart.

Nice that the problem was solved. I do not understand all the "heads"
issues, but it seems as you found a solution.

In bytes, the offset to the partition would be

Disk: 1 Cylinders: 2584 Heads: 240 Sectors: 63 MB: 19077

1355 1 07 63 18582417 9073 1355* 1 1 2583*239 63 OK OK

(1355 * 240 * 63 + 1 * 63 + (1 - 1)) * 512 = 10489683456


Last time I looked at the mount offset option, it would not work for
values larger than 2^31 bytes, but that may have changed.