External Drive bad parameter on boot sector, please help

[swebb99]

Hi,

I have an external drive on my system which I store music and stuff
on. Last night when I plugged the drive in on my XP box instead of the
usual whiring followed by a directory scan dialog appeared it just
span up but without the dialog. When I clicked on the drive in
explorer (Z it asked me if I wanted to format the drive !!!!

I download IPC Inspector File recovery tool to try to get my data but
when selecting the external drive it reported that :-

"Bad parameter in boot sector bytes per sector (0) = 0!"

I then asked it to find logical drives which it did but it didn't
offer me any other options probably due to the boot sector issue.

Does anyone have any idea's how I may get my data back or repair the
boot sector as I have some recent holiday snaps on the drive I really
would like to recover.

Thanks for any help

Steve

 

[Arno Wagner]

Hi,

I have an external drive on my system which I store music and stuff
on. Last night when I plugged the drive in on my XP box instead of the
usual whiring followed by a directory scan dialog appeared it just
span up but without the dialog. When I clicked on the drive in
explorer (Z it asked me if I wanted to format the drive !!!!

I download IPC Inspector File recovery tool to try to get my data but
when selecting the external drive it reported that :-

"Bad parameter in boot sector bytes per sector (0) = 0!"

Hmm. That looks like the boot-sector has been zeroed. What
was the least thing you did to the drive when it was still
working?

I then asked it to find logical drives which it did but it didn't
offer me any other options probably due to the boot sector issue.
Likely.

Does anyone have any idea's how I may get my data back or repair the
boot sector as I have some recent holiday snaps on the drive I really
would like to recover.

Frist: Don't panic. Second you should not work on this drive. Make
a copy with an imaging software on sector level and work on the
copy only. If just the bootsector is gone, recovery is likely
possible, there are numerous posting in the history of this
group that recommend tools. However everything that was overwritten
is gone and it looks like nobody admits to be able to recover
overwritten data on current HDDs.

Arno

 

[swebb99]

Hi Arno,

Thanks for the reply. The last thing I did was write a couple of music
tracks onto the device and then I switched my laptop off sometime
later. The drive itself is an external WD MyBook Pro 500Gig so making
a backup is a bit of an issue ! The drive itself also isn't setup to
be bootable from I just use it for data.

I forgot to mention that when I ran PC Inspector I did get the option
to recover lost files from root and it did start finding things
however it couldn't find the name of any files for some reason

What tools would you suggest I try ?

Thanks again

Steve

 

[swebb99]

As it looks like the boot record has been corrupted is there a good
chance than fdisk /cmbr <disc no> will fix the problem ? PC Inspector
can see there is a logical drive there and gets the right name and
also if I get it to look at the drive it finds a lot of directories
but no files for some reason !

Thanks

Steve

 

[Arno Wagner]

As it looks like the boot record has been corrupted is there a good
chance than fdisk /cmbr <disc no> will fix the problem ? PC Inspector
can see there is a logical drive there and gets the right name and
also if I get it to look at the drive it finds a lot of directories
but no files for some reason !

That actually looks like the FAT might also have been wiped. Hmm.
Maybe you are running XP with SP1 or no SP? Then this migh be
the wrap-around bug for large drives. I don't know whether it
affects USB disks though. This bug causes weites over 128GB to
write to the start of the disk instead. Wipes the MBR and the FAT,
and makes the first partition pretty unrecoverable, I think.

Arno

 

[swebb99]

That actually looks like the FAT might also have been wiped. Hmm.
Maybe you are running XP with SP1 or no SP? Then this migh be
the wrap-around bug for large drives. I don't know whether it
affects USB disks though. This bug causes weites over 128GB to
write to the start of the disk instead. Wipes the MBR and the FAT,
and makes the first partition pretty unrecoverable, I think.

Arno

Hi Arno,

I'm using the latest version of xp with the all the current patches.
The drive is via USB2 and is a WD 500gig MyBook Pro.

I'm going to try these tools when I get a chance

http://www.easeus.com/index.htm

or

http://www.geocities.com/thestarman3/asm/mbr/BootToolsRefs.htm#TD

The 1st is a demo but if it works and can get to my data I'll probably
buy it because my pics are worth a lot to me.

Thanks for the reply

Steve

 

[Folkert Rienstra]

That actually looks like the FAT might also have been wiped. Hmm.
Maybe you are running XP with SP1 or no SP? Then this migh be
the wrap-around bug for large drives.

I don't know

Story of your life, babblebot.

whether it affects USB disks though.

This bug causes weites over 128GB to write to the start of the disk instead.
Wipes the MBR and the FAT, and makes the first partition pretty unrecoverable,

Babblebot clueless as always.

*If* the MBR and FAT were both overwritten PC Inspector obviously wouldn't know 'the right name'.

I think.

Well, there's your problem, babblebot. You think you do but you don't.

 

[swebb99]

Story of your life, babblebot.


Babblebot clueless as always.

*If* the MBR and FAT were both overwritten PC Inspector obviously wouldn't know 'the right name'.


Well, there's your problem, babblebot. You think you do but you don't.

Got the data back Used TestDisk and it found that the mbr had been
blanked. I got it to overwrite it with the backup one it found and
everything is back again

I've run AVG on my discs and its found no virus code anywhere so not
sure what is blanking (all zero's) the MBR !

Thanks for info

Steve

 

[swebb99]

Got the data back Used TestDisk and it found that the mbr had been
blanked. I got it to overwrite it with the backup one it found and
everything is back again

I've run AVG on my discs and its found no virus code anywhere so not
sure what is blanking (all zero's) the MBR !

Thanks for info

Steve

Hi Arno,

I think you were right about the 127gig limit !

I've just checked the drive now it is back and sure enough there is
128gig of data on it. So I suspect the last thing I wrote caused the
bug that is still outstanding on XP2 even now !

I'll repartition the disc so I have a few partitions on it including a
NTFS one for big files.

Steve

 

[Folkert Rienstra]

Weird, if the problem was only the MBR or the partition bootsector.

the backup one

Huh? You must have used something to create that backup before.
There is a standard backup for the partition bootsector though.
You sure it was the MBR and not the partition bootsector?

Another weird coincidence. Data doesn't usually contain all zeroes.

Hi Arno,

I think you were right about the 127gig limit !

Very likely not if *only* the mbr got overwritten.
That would be a huge coincidence.

And it's the 137GB limit, not the 127 (or 128)GB limit.

I've just checked the drive now it is back and sure enough there is
128gig of data on it.

Another coincidence, meaning that the data would have to be totally
unfragmented in that case. But admittedly not totally impossible.

So I suspect the last thing I wrote caused the
bug that is still outstanding on XP2 even now !

That particular bug has nothing to do with USB.
USB tailgates such as USB to IDE bridges contain firmware
though... that may have a similar bug as that in Windows.

 

[Arno Wagner]

Hi Arno,

I think you were right about the 127gig limit !

I've just checked the drive now it is back and sure enough there is
128gig of data on it. So I suspect the last thing I wrote caused the
bug that is still outstanding on XP2 even now !

Hmm. It should not be, SP2 supposedly fixed the problem.

But 128GB is a limit were an additional bit becomes necessary. Maybe
you have some specific drivers installed for that drive that cause the
problem?

I'll repartition the disc so I have a few partitions on it including a
NTFS one for big files.

Do that.

Arno

 

[Folkert Rienstra]

Hmm. It should not be, SP2 supposedly fixed the problem.

There is no windows problem with USB, you babblebot moron.
There never was. There is nothing that windows can correct for lack
of 48-bit LBA support in an USB tailgate device like an USB-IDE
bridge in an external harddrive.

But 128GB is a limit were an additional bit becomes necessary.

No. Really? And how many high level drivers suffer from that.

 

[John Turco]

swebb99 wrote:

Got the data back Used TestDisk and it found that the mbr had been
blanked. I got it to overwrite it with the backup one it found and
everything is back again

I've run AVG on my discs and its found no virus code anywhere so not
sure what is blanking (all zero's) the MBR !

Thanks for info

Steve

Hello, Steve:

I hope you've learned your lesson, now: Never store data on a single
hard drive, floppy disk, optical disc or tape! You need one backup
copy of it, at least, and preferably more.

Good luck!


Cordially,
John Turco <[email protected]>

 

[Arno Wagner]

swebb99 wrote:

<heavily edited, for brevity>

Hello, Steve:

I hope you've learned your lesson, now: Never store data on a single
hard drive, floppy disk, optical disc or tape! You need one backup
copy of it, at least, and preferably more.

Generally I agree. One exception: MOD is reliable enough that a single
copy will be enough for not too critical stuff. (still have not lost
a single byte after using them for 10 years now....)

Arno

 

[John Turco]

Generally I agree. One exception: MOD is reliable enough that a single
copy will be enough for not too critical stuff. (still have not lost
a single byte after using them for 10 years now....)

Arno

Hello, Arno:

Don't forget DVD-RAM, either, mein freund.


Cordially,
John Turco <[email protected]>