Inaccessible Partition XP Media Centre Edition

[sherjeel1]

Dear Friends,
I got this computer Packard bell with 200 GB hard drive, It came with
Windows XP media centre edition pre-installed. It had two partitions
one is a 6 GB one and the rest around 182 GB which had the main OS
installed. Some thing happened and the hard disk would just not load
the OS but just reboot after the OS selection screen. I even tried the
second option which was something like recovery console but it would
give something like NTLDR error. So I borrow another harddrive and
installed Windows 2003 server on it and trired to access the partion
but it says that the partition is unformatted. I ran this tool
findpart by Mr Svend Olaf and got following result. Is there anyone who
could help me with it.
Thanks in advance.

Findpart, version 4.79 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.2.3790

Disk: 2 Cylinders: 38913 Heads: 255 Sectors: 63 MB: 305242

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0C 63 40965687 20002 0 1 1 2549 254 63 B OK
2550 1 07 63584171532285240 2550* 1 1 38912*254 63 OK OK
Fdisk F6 sector 4180 0 1
Fdisk F6 sector 4180 1 1
Fdisk F6 sector 4181 0 1
Fdisk F6 sector 4181 1 1
Fdisk F6 sector 4182 0 1
Fdisk F6 sector 4182 1 1
Fdisk F6 sector 4183 0 1
Fdisk F6 sector 4183 1 1
Fdisk F6 sector 4184 0 1
Fdisk F6 sector 4220 0 1
Fdisk F6 sector 8310 0 1
Fdisk F6 sector 8310 1 1
21672 - 07 63276960537135234 21672 1 1 38911 254 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 39 9997 16 2 9997 0 0 0 06-10-24 3080

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1*0C 63 40965687 20002 0 1 1 2549*254 63 OK OK
0 2 0F 40965750584171595285240 2550* 0 1 38912*254 63 OK

2550 1 07 63584171532285240 2550* 1 1 38912*254 63 OK OK

 

[Svend Olaf Mikkelsen]

Dear Friends,
I got this computer Packard bell with 200 GB hard drive, It came with
Windows XP media centre edition pre-installed. It had two partitions
one is a 6 GB one and the rest around 182 GB which had the main OS
installed. Some thing happened and the hard disk would just not load
the OS but just reboot after the OS selection screen. I even tried the
second option which was something like recovery console but it would
give something like NTLDR error. So I borrow another harddrive and
installed Windows 2003 server on it and trired to access the partion
but it says that the partition is unformatted. I ran this tool
findpart by Mr Svend Olaf and got following result. Is there anyone who
could help me with it.
Thanks in advance.

Disk: 2 Cylinders: 38913 Heads: 255 Sectors: 63 MB: 305242

Disk 2 to Findpart is 300 GB. You describe a problem with a 200 GB
disk?

 

[sherjeel1]

Sorry the correct one is this :
Thanks.

Findpart, version 4.79 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.2.3790

Disk: 1 Cylinders: 24321 Heads: 255 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12582912 6144 0 1 1 783 64 48 B OK
0 - 0C380226420 10485760 5120 23668 0 1 24320 180 40 B OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 39 12265 4 2 12265 0 0 0 05-02-14 5219
23668 0 39 10221 4 2 10221 0 0 0 05-02-14 256

Partitions according to partition tables on first harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 1B 63 12594897 6149 0 1 1 783 254 63 NB OK
0 2*07 12582990378117810184627 783 65 1 24319*254 63 NB OK

 

[Svend Olaf Mikkelsen]

Findpart, version 4.79 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2006.

OS: Windows 5.2.3790

Disk: 1 Cylinders: 24321 Heads: 255 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12582912 6144 0 1 1 783 64 48 B OK
0 - 0C380226420 10485760 5120 23668 0 1 24320 180 40 B OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 39 12265 4 2 12265 0 0 0 05-02-14 5219
23668 0 39 10221 4 2 10221 0 0 0 05-02-14 256

Partitions according to partition tables on first harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 1B 63 12594897 6149 0 1 1 783 254 63 NB OK
0 2*07 12582990378117810184627 783 65 1 24319*254 63 NB OK

The first and the second partition are overlapping, but the actual
partition contents are not overlapping. In some cases that could
(should) prevent the operating systems from accessing the partitions.

The output does not give enough information to diagnose the problem.

You can do for further examination:

findpart findfile 1 mft fp-a.txt

and mail me the file fp-a.txt as attached file. If the file is not
very big, you can insert (not attach) it here in stead.

The search will take some time to run. It searches for NTFS boot
sectors and master file table file records.

 

[sherjeel1]

The output is pasted below.

Thanks.

Findfile, version FP 4.79.
Copyright Svend Olaf Mikkelsen, 2006.

Searches for file records and index records. The T field
contains F for file records, D for directory file records,
or I for index records. Index records do not contain
information about file locations.

OS: Windows 5.2.3790

Disk: 1 Cylinders: 24321 Heads: 255 Sectors: 63 MB: 190779

Mft

Start cylinder: 0 End cylinder: 24320 Index records not shown.

--------- CHS ----- LBA T -Record Cluster Name
816 35 10 13111254 Boot or backup
Sectors per cluster: 8
MFT cluster: 802815
MFT mirror cluster: 3840283
Partition sectors: 61444530
1183 9 49 19005510 F 0 802815 $MFT
Size: 232718336
Allocated: 232718336
Fragments: 1
Clusters: 4
Cluster KB: Unknown
Time: 2005-02-15 18:08:06
Access: 2006-10-15 09:50:44
1183 9 51 19005512 F 1 3840283 $MFTMirr
Size: 4096
Allocated: 4096
Fragments: 1
Clusters: 1
Cluster KB: 4
Time: 2005-02-15 18:08:06
2695 159 63 43305254 F 0 802815 $MFT
Size: 232718336
Allocated: 232718336
Fragments: 1
Clusters: 4
Cluster KB: Unknown
Time: 2005-02-15 18:08:06
2695 160 2 43305256 F 1 3840283 $MFTMirr
Size: 4096
Allocated: 4096
Fragments: 1
Clusters: 1
Cluster KB: 4
Boot CHS: 783 65 1
Offset MB: 15001
Time: 2005-02-15 18:08:06
5865 249 32 94236943 Boot or backup
Sectors per cluster: 8
MFT cluster: 802815
MFT mirror cluster: 3840283
Partition sectors: 378117810
Finished.

 

[Svend Olaf Mikkelsen]

Findfile, version FP 4.79.
Copyright Svend Olaf Mikkelsen, 2006.

Searches for file records and index records. The T field
contains F for file records, D for directory file records,
or I for index records. Index records do not contain
information about file locations.

OS: Windows 5.2.3790

Disk: 1 Cylinders: 24321 Heads: 255 Sectors: 63 MB: 190779

Mft

Start cylinder: 0 End cylinder: 24320 Index records not shown.

--------- CHS ----- LBA T -Record Cluster Name
816 35 10 13111254 Boot or backup
Sectors per cluster: 8
MFT cluster: 802815
MFT mirror cluster: 3840283
Partition sectors: 61444530

This is the boot sector of a 30002 MB NTFS partition.

1183 9 49 19005510 F 0 802815 $MFT
Size: 232718336
Allocated: 232718336
Fragments: 1
Clusters: 4
Cluster KB: Unknown
Time: 2005-02-15 18:08:06
Access: 2006-10-15 09:50:44

This is a master file table file record. The partition was accessed
October, 15.

Partition location for this partition assuming 4 KB cluster size would
be sector 19005510 - 8 * 802815 = 12582990. This is CHS 783/65/1.

1183 9 51 19005512 F 1 3840283 $MFTMirr
Size: 4096
Allocated: 4096
Fragments: 1
Clusters: 1
Cluster KB: 4
Time: 2005-02-15 18:08:06
2695 159 63 43305254 F 0 802815 $MFT
Size: 232718336
Allocated: 232718336
Fragments: 1
Clusters: 4
Cluster KB: Unknown
Time: 2005-02-15 18:08:06
2695 160 2 43305256 F 1 3840283 $MFTMirr
Size: 4096
Allocated: 4096
Fragments: 1
Clusters: 1
Cluster KB: 4
Boot CHS: 783 65 1
Offset MB: 15001
Time: 2005-02-15 18:08:06

The findings cylinder 2695 are the MFT file record mirror. We see
again partition CHS 783 65 1.

5865 249 32 94236943 Boot or backup
Sectors per cluster: 8
MFT cluster: 802815
MFT mirror cluster: 3840283
Partition sectors: 378117810

This is the boot sector or backup boot sector for a 378117810/2/1024 =
184627 MB NTFS partition. If the sector is the backup, partition
location is 94236943 - 378117810 + 1, which is negative.

If the sector is the boot sector, the last sector of the partition is
94236943 + 378117810 - 1 = 472354752. This is CHS 29402/184/31, which
is after the end of the disk.

The MFT cluster number matches the MFT found.

If the sector was located 128 GB lower than expected, the boot sector
would be 94236943 - 378117810 + 1 + 2^28, which is negative.

Finished.

If I calculated correctly, the boot sector findings do not match the
master file table findings.

You can try this command in a directory empty except for findpart.exe:

findpart listmft 1 1183 9 49

 

[sherjeel1]

Thank you very much for the help. This command gave me a file
listmft.bin and a list of files on screen almost all of the data on the
drive but I could not find a way to copy them. So is there no way to
get my harddrive back in its original shape ?

Thanks.

 

[Svend Olaf Mikkelsen]

Thank you very much for the help. This command gave me a file
listmft.bin and a list of files on screen almost all of the data on the
drive but I could not find a way to copy them. So is there no way to
get my harddrive back in its original shape ?

Thanks.

Did you press F1 for help?

Pressing F7 should just begin copying.


Note that if files are copied, you cannot be certain that the files
are correct, depending on the exact nature of the damage.

If the file listmft.bin is still in the directory, you should see the
file browser without initial search.

Also:

findpart findntfs 1 783 65 1 copy

may copy files, but this command does not utilize that we already have
located the master file table.

 

[sherjeel1]

I have copied all the files using the first file to another hard drive
and I
think thats all the files it should have (103 GB ). I am really
grateful to
you but again same question is there anyway I could get my harddrive
back in
its original shape ?

Thanks,
Kashif.

 

[Svend Olaf Mikkelsen]

I have copied all the files using the first file to another hard drive
and I
think thats all the files it should have (103 GB ). I am really
grateful to
you but again same question is there anyway I could get my harddrive
back in
its original shape ?

Thanks,
Kashif.

Nice that files were copied.

Both the boot sector and the backup boot sector for the damaged
partition are missing, although there is a boot sector at a wrong
location.

Also the partitions do not end at cylinder boundaries, so I would say
that it should be very important if a repair attempt should be made.
It is not something I would attempt for free.

Remember that the current partition table entries are overlapping.

 

[sherjeel1]

Well I would really like to know how much it would cost me so I could
see if I can afford it or not. But still thanks for all the help you
have extended towards me till now.

 

[Svend Olaf Mikkelsen]

Well I would really like to know how much it would cost me so I could
see if I can afford it or not. But still thanks for all the help you
have extended towards me till now.

The only chance would be that the internal damage in the NTFS
partition is limited to the boot sector.

Why would it be so important to repair the original partitions?

Can't you create new partitions and copy the files back?

 

[sherjeel1]

Its just that I have lost the original Recovery CD which came with it
and so I cannot get its original OS back in its place. I do not even
have a backup of the CD. I do have the CD key but its useless without
the original CD. If I install another OS then I would be looking around
for the drivers. So I was really trying my best to get the original
system back in its place.