findpart recovered unreadable files (Please help with editpart)

[seewhyzone]

Hi: My 400GB Seagate 7200.9 SATA drive lost the partition info (just
1 partition with NTFS), all the files are there, but I can not access
or restore it. I read all the info I can find on findpart and still
stuck.

When I tried findntfs copy option, I recovered tons of files,
but not a single one is readable. Here is my info.
Can someone show me how to use editpart to restore the
partition please? Much appreciated.

Email : see why zone at gmail dot com (remove space
please)


Findpart info
OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
2747+- 07 63737279106359999 2747 127 4 48640 254 63 BU OK



This is with MBR info:

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

Start cylinder: 1 End cylinder: 48640 Index records not shown.

--------- CHS ----- LBA T -Record Cluster Name
391 160 25 6291519 F 0 786432 $MFT
Size: 32768
Allocated: 32768
Fragments: 1
Clusters: 8
Cluster KB: 4
Boot CHS: 0 1 1
Offset MB: 3072
Time: 2006-09-06 00:36:22
Access: 2006-09-06 00:36:26
391 160 27 6291521 F 1 4038655 $MFTMirr
Size: 4096
Allocated: 4096
Fragments: 1
Clusters: 1
Cluster KB: 4
Time: 2006-09-06 00:36:22
391 160 29 6291523 F 2 770046
MFT offset from search begin: 3064 MB
391 160 31 6291525 F 3 Small
391 160 33 6291527 F 4 786430
391 160 35 6291529 D 5 4038665
391 160 37 6291531 F 6 4038668
391 160 39 6291533 F 7 0
391 160 41 6291535 F 8 Small
391 160 43 6291537 F 9
391 160 45 6291539 F 10 4038915
391 160 47 6291541 D 11
391 160 49 6291543 F 12 Small
391 160 51 6291545 F 13 Small
391 160 53 6291547 F 14 Small
391 160 55 6291549 F 15 Small
391 161 10 6291567 F 24
391 161 12 6291569 F 25
391 161 14 6291571 F 26
391 161 16 6291573 D 27
391 161 18 6291575 F 28 Small

 

[seewhyzone]

Complete output of findpart

Findpart, version 4.81 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
2747+- 07 63737279106359999 2747 127 4 48640 254 63 BU OK

No FATs found.

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 42 63781417602381551 0 1 1 48640*254 63 OK

 

[Svend Olaf Mikkelsen]

Hi: My 400GB Seagate 7200.9 SATA drive lost the partition info (just
1 partition with NTFS), all the files are there, but I can not access
or restore it. I read all the info I can find on findpart and still
stuck.

When I tried findntfs copy option, I recovered tons of files,
but not a single one is readable. Here is my info.
Can someone show me how to use editpart to restore the
partition please? Much appreciated.

Email : see why zone at gmail dot com (remove space
please)


Findpart info
OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
2747+- 07 63737279106359999 2747 127 4 48640 254 63 BU OK



This is with MBR info:

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

Start cylinder: 1 End cylinder: 48640 Index records not shown.

--------- CHS ----- LBA T -Record Cluster Name
391 160 25 6291519 F 0 786432 $MFT
Size: 32768
Allocated: 32768
Fragments: 1
Clusters: 8
Cluster KB: 4
Boot CHS: 0 1 1
Offset MB: 3072
Time: 2006-09-06 00:36:22
Access: 2006-09-06 00:36:26
391 160 27 6291521 F 1 4038655 $MFTMirr
Size: 4096
Allocated: 4096
Fragments: 1
Clusters: 1
Cluster KB: 4
Time: 2006-09-06 00:36:22
391 160 29 6291523 F 2 770046
MFT offset from search begin: 3064 MB
391 160 31 6291525 F 3 Small
391 160 33 6291527 F 4 786430
391 160 35 6291529 D 5 4038665
391 160 37 6291531 F 6 4038668
391 160 39 6291533 F 7 0
391 160 41 6291535 F 8 Small
391 160 43 6291537 F 9
391 160 45 6291539 F 10 4038915
391 160 47 6291541 D 11
391 160 49 6291543 F 12 Small
391 160 51 6291545 F 13 Small
391 160 53 6291547 F 14 Small
391 160 55 6291549 F 15 Small
391 161 10 6291567 F 24
391 161 12 6291569 F 25
391 161 14 6291571 F 26
391 161 16 6291573 D 27
391 161 18 6291575 F 28 Small

Which command did not copy files correctly?

For one of the partitions on the disk you can try:

findpart findntfs 2 2747 127 4 backupboot 737279106 copy


The boot sector for the partition shown by "findpart findfile" is
missing, and the partition was last accessed September, 2006. That
partition cannot be restored by editing the partition table.

 

[seewhyzone]

Wow, getting reply from the man himself, I feel like getting reply
from Linus on a Linux group. Findpart so far is the ONLY util that
can even see my lost partition, I tried EasyRecorver, Ontrack Crisis
Center, Data Dcotor, and EAESUS Data Recory, nothing worked.

Svend, the command line worked, I can recover the files, however I
rather restore the partition. I did not have a boot partition on this
drive, only a storage partition. Does the command starts at
737279106 sector?

My older copy command must not starting at the right place. All I can
recover are file names, not actual files.

Thanks again.

 

[Svend Olaf Mikkelsen]

Wow, getting reply from the man himself, I feel like getting reply
from Linus on a Linux group. Findpart so far is the ONLY util that
can even see my lost partition, I tried EasyRecorver, Ontrack Crisis
Center, Data Dcotor, and EAESUS Data Recory, nothing worked.

Svend, the command line worked, I can recover the files, however I
rather restore the partition. I did not have a boot partition on this
drive, only a storage partition. Does the command starts at
737279106 sector?

My older copy command must not starting at the right place. All I can
recover are file names, not actual files.

Thanks again.

To make the partition visible by editing the partition would require
that we first verify that the partition is internally OK.

findpart findntfs 2 2747 127 4 summary fp-a.txt

findpart findntfs 2 2747 127 4 summary fp-b.txt root

The 737279106 number is the number of sectors in the partition. It is
used in the copy command to locate the backup boot sector. We do not
know if the boot sector of the partition is OK. It was not located
using the default Findpart search, since it is at a non standard
location, and no other found partition did end before it.

The partition is located at cylinder 2747, head 127, sector 4. That is
LBA 44138559 for this disk geometry.

To verify that the boot sector is present:

findpart findfile 2 2747 2747 mft fp-c.txt

 

[seewhyzone]

Hi Svend:
I am pretty happy already to buy a new hard drive and have
findpart to copy my files over. It would be best to restore the
partition though but you said editpart might not work if it doesn't
have a boot partition? This drive only has 1 or 2 storage partition,
I don't boot from it so it has no OS partition.

Here is the output of the commands:

findpart findntfs 2 2747 127 4 summary fp-a.txt

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

CHS 2747/127/4 LBA: 44138559

Directories: 3886
Files: 117102
Trees: 1
Exe/dll files: 1313
Exe/dll files signature: 1313
Not referenced files: 3
Cluster KB: 4
MFT cluster no: 786432
MFT size: 124846080
MFT cluster bytes: 4096
Listed files MB: 348942

findpart findntfs 2 2747 127 4 summary fp-b.txt root

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

CHS 2747/127/4 LBA: 44138559

Root

Directories: 3886
Files: 117099
Exe/dll files: 1313
Exe/dll files signature: 1313
Cluster KB: 4
MFT cluster no: 786432
MFT size: 124846080
MFT cluster bytes: 4096
Listed files MB: 348922

The 737279106 number is the number of sectors in the partition. It is
used in the copy command to locate the backup boot sector. We do not
know if the boot sector of the partition is OK. It was not located
using the default Findpart search, since it is at a non standard
location, and no other found partition did end before it.

The partition is located at cylinder 2747, head 127, sector 4. That is
LBA 44138559 for this disk geometry.

To verify that the boot sector is present:

findpart findfile 2 2747 2747 mft fp-c.txt

Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

Mft

Start cylinder: 2747 End cylinder: 2747 Index records not shown.

--------- CHS ----- LBA T -Record Cluster Name
2747 127 4 44138559 Boot or backup
Sectors per cluster: 8
MFT cluster: 786432
MFT mirror cluster: 46079944
Partition sectors: 737279106
Finished.

 

[Svend Olaf Mikkelsen]

Hi Svend:
I am pretty happy already to buy a new hard drive and have
findpart to copy my files over. It would be best to restore the
partition though but you said editpart might not work if it doesn't
have a boot partition? This drive only has 1 or 2 storage partition,
I don't boot from it so it has no OS partition.

Here is the output of the commands:
Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

CHS 2747/127/4 LBA: 44138559

Directories: 3886
Files: 117102
Trees: 1
Exe/dll files: 1313
Exe/dll files signature: 1313
Not referenced files: 3
Cluster KB: 4
MFT cluster no: 786432
MFT size: 124846080
MFT cluster bytes: 4096
Listed files MB: 348942



Disk: 2 Cylinders: 48641 Heads: 255 Sectors: 63 MB: 381551

CHS 2747/127/4 LBA: 44138559

Root

Directories: 3886
Files: 117099
Exe/dll files: 1313
Exe/dll files signature: 1313
Cluster KB: 4
MFT cluster no: 786432
MFT size: 124846080
MFT cluster bytes: 4096
Listed files MB: 348922

It is probably possible to recover the partition by editing the
partition table on the disk, using Findpart.

I however would say, that in any case you should have two copies from
your data, so why not initially copy the files using Findpart?

This partition is not at the beginning of the disk. It is the
partition at the beginning of the disk that cannot be recovered by
editing the partition table.