MBR and Partition disaster

[Brett]

Here's the summary of my problem: In trying to delete the MBR of a
hard drive that had a Linux OS on it I accidentally destroyed the MBR
and partitions from the primary hard drive that had XP Pro on it (it
had two partitions - one for programs/OS and the other for data) I
used a program called MBRWiz through XP's cmd prompt program. When I
list the partitions using this program it shows that I don't have any
partitions. However, when I use a similar program (MBRfix) I can get
the information about my C: and D: partions (size, clusters, free
space/clusters, etc) when I type in

"mbrfix volumeinformation c"

(my primary partion with XP and my programs) and

"mbrfix volumeinformation d"

(my files). However, when I go to list the partions using

"mbrfix /drive 0 listpartitions"

I get no readings at all. I haven't turned off my computer yet because
I don't want to lose anything. My computer is running fine now and I
can access all my files and partitions through My Computer. What is
the best way to get the mbr AND the partitions back without screwing up
my system? I've read that going through the recovery console will
bring back your MBR but how do you go from there to recovering the
partitions?
Any help will be greatly appreciated. I can email print screens of the
MBR program outputs if needed. Thanks a lot,

Brett

 

[Pennywise]

|>Here's the summary of my problem: In trying to delete the MBR of a
|>hard drive that had a Linux OS on it I accidentally destroyed the MBR
|>and partitions from the primary hard drive that had XP Pro on it (it
|>had two partitions - one for programs/OS and the other for data) I
|>used a program called MBRWiz through XP's cmd prompt program. When I
|>list the partitions using this program it shows that I don't have any
|>partitions. However, when I use a similar program (MBRfix) I can get
|>the information about my C: and D: partions (size, clusters, free
|>space/clusters, etc) when I type in

I would use a boot disk http://bootdisk.com/bootdisk.htm (Win98/me)
and run FDISK /MBR.

FWIW I always back up my MBR for just such problems with MBRTOOL.EXE

|>"mbrfix volumeinformation c"
|>
|>(my primary partion with XP and my programs) and
|>
|>"mbrfix volumeinformation d"
|>
|>(my files). However, when I go to list the partions using
|>
|>"mbrfix /drive 0 listpartitions"
|>
|>I get no readings at all. I haven't turned off my computer yet because
|>I don't want to lose anything. My computer is running fine now and I
|>can access all my files and partitions through My Computer. What is
|>the best way to get the mbr AND the partitions back without screwing up
|>my system? I've read that going through the recovery console will
|>bring back your MBR but how do you go from there to recovering the
|>partitions?
|>Any help will be greatly appreciated. I can email print screens of the
|>MBR program outputs if needed. Thanks a lot,
|>
|>Brett

 

[Brett]

That will fix the MBR but how do I get it to recognize the two partions
that are no longer visible (without losing any data)? The windows
recovery console on the XP CD will also fix the MBR but supposedly it
gives a warning about loss of partitions so I'm guessing it won't fix
the partition problem for me.

 

[Pennywise]

|>That will fix the MBR but how do I get it to recognize the two partions
|>that are no longer visible (without losing any data)? The windows
|>recovery console on the XP CD will also fix the MBR but supposedly it
|>gives a warning about loss of partitions so I'm guessing it won't fix
|>the partition problem for me.

You wouldn't by any wild chance have a listing of your HD partitions ?

Like:
Signature = 0x4b36bdea
StartingOffset PartitionLength StartingSector PartitionNumber
32256 4597899264 63 1
* 4597931520 42072307200 8980335 2
46670270976 41948895744 63 3
88619198976 41948895744 63 4
130568126976 41948895744 63 5
172517054976 27529979904 63 6
(their handy numbers to have available)

If so you can use a Diskeditor or type the number into partition magic
or the such, and recreate the partitions (data will be there)

Or else recovery software like Hiren's.BootCD

 

[Pennywise]

|>That will fix the MBR but how do I get it to recognize the two partions
|>that are no longer visible (without losing any data)?

FWIW messing with the MBR usually won't affect your partitions.

 

[Pennywise]

(e-mail address removed) wrote:

|>
|>|>That will fix the MBR but how do I get it to recognize the two partions
|>|>that are no longer visible (without losing any data)?

|>FWIW messing with the MBR usually won't affect your partitions.

Err, using FDISK /MBR

FIXMBR I've never used it so have no experience with it.

 

[Pegasus \(MVP\)]

Here's the summary of my problem: In trying to delete the MBR of a
hard drive that had a Linux OS on it I accidentally destroyed the MBR
and partitions from the primary hard drive that had XP Pro on it (it
had two partitions - one for programs/OS and the other for data) I
used a program called MBRWiz through XP's cmd prompt program. When I
list the partitions using this program it shows that I don't have any
partitions. However, when I use a similar program (MBRfix) I can get
the information about my C: and D: partions (size, clusters, free
space/clusters, etc) when I type in

"mbrfix volumeinformation c"

(my primary partion with XP and my programs) and

"mbrfix volumeinformation d"

(my files). However, when I go to list the partions using

"mbrfix /drive 0 listpartitions"

I get no readings at all. I haven't turned off my computer yet because
I don't want to lose anything. My computer is running fine now and I
can access all my files and partitions through My Computer. What is
the best way to get the mbr AND the partitions back without screwing up
my system? I've read that going through the recovery console will
bring back your MBR but how do you go from there to recovering the
partitions?
Any help will be greatly appreciated. I can email print screens of the
MBR program outputs if needed. Thanks a lot,

Brett

Recovery Expert from Acronis can restore missing partitions.

 

[Brett]

Sorry - I no longer have access to the partition information that lists
the partition start and stop information - before I deleted it I had it
though All it shows now is either (depending on the program I use) a
blank area where the partitions should be or a message that states 'No
partitions found on this disk.'

What I DO have is some info that might be extracted into something that
might work:

The volume information for my c: drive is as follows:
cluster size: 4096
total clusters: 2620595
free clusters: 425536
volume size: 10236 MB
free space: 1662 MB


The volume information for my c: drive is as follows:
cluster size: 4096
total clusters: 16914428
free clusters: 3825487
volume size: 66071 MB
free space: 14943 MB

Is this enough (or accurate) information that it can be used to
determine where the partitions start? Reading around it seems like the
MBR is quite small (512bytes?) and is located at the start of the disk.

If there is some way to access that info through a program that doesn't
reference the MBR I think I should be able to retrieve it - the
partitions still show up in My Computer (I haven't turned my computer
off for fear of what will happen when I try to restart it again). What
would be my possibilities if I had this information.

When I accidentally wiped the wrong hard drive MBR I had the option of
either:
/wipe=# 1=Wipes the MBR, 2-wipes the first 63 sectors of disk

I choose option 1

searching around I found this: http://en.wikipedia.org/wiki/MBR

It sounds like the MBR can contain the partitioning information but
sometimes it doesn't. What is the case for my computer?

if it's only 512bytes is it possible to recreate the file by hand with
the info that I have now and load it?

 

[Steve N.]

That will fix the MBR but how do I get it to recognize the two partions
that are no longer visible (without losing any data)? The windows
recovery console on the XP CD will also fix the MBR but supposedly it
gives a warning about loss of partitions so I'm guessing it won't fix
the partition problem for me.

The MBR holds the Master Boot Record and the partition table for the
disk. A short time ago a co-worked accidentally deleted a partition and
apparently the MBR on a disk with multiple partitions. He tried a few
3rd party recovery solutions that didn't work out, mostly because he was
unfamiliar with them and backed out. He wound up booting the XP CD,
entering the Recovery Console and running fixmbr. Upon reboot all
partitions were intact.

Steve N.

 

[Steve N.]

Sorry - I no longer have access to the partition information that lists
the partition start and stop information - before I deleted it I had it
though All it shows now is either (depending on the program I use) a
blank area where the partitions should be or a message that states 'No
partitions found on this disk.'

What I DO have is some info that might be extracted into something that
might work:

The volume information for my c: drive is as follows:
cluster size: 4096
total clusters: 2620595
free clusters: 425536
volume size: 10236 MB
free space: 1662 MB


The volume information for my c: drive is as follows:
cluster size: 4096
total clusters: 16914428
free clusters: 3825487
volume size: 66071 MB
free space: 14943 MB

Is this enough (or accurate) information that it can be used to
determine where the partitions start? Reading around it seems like the
MBR is quite small (512bytes?) and is located at the start of the disk.

If there is some way to access that info through a program that doesn't
reference the MBR I think I should be able to retrieve it - the
partitions still show up in My Computer (I haven't turned my computer
off for fear of what will happen when I try to restart it again). What
would be my possibilities if I had this information.

When I accidentally wiped the wrong hard drive MBR I had the option of
either:
/wipe=# 1=Wipes the MBR, 2-wipes the first 63 sectors of disk

I choose option 1

searching around I found this: http://en.wikipedia.org/wiki/MBR

Good article.

It sounds like the MBR can contain the partitioning information but
sometimes it doesn't. What is the case for my computer?

When it doesn't is in the case of the implementation of an EMBR
(Extended MBR) available with some boot managing software, ususally to
allow for more that 4 partitions per disk. In your case I think it'd be
safe to assume the MBR does cotain partition table.

if it's only 512bytes is it possible to recreate the file by hand with
the info that I have now and load it?

Try fixmbr first. Your MBR is already toast. It shouldn't make it worse,
it won't alter the data on disk other than that in the MBR.

Steve N.

 

[Brett]

Alright - thanks for the info - I found a program called TestDisk by
CGSecurity which was able to find the 2 partitions and add them back to
the MBR as well as a function which seeminly rewrote the MBR. When I
ran the two programs which I had used to initially screw up my computer
both partitions showed back up. I'm going to take the plunge and
restart my computer....hopefully it will boot up fine. If not I'm
going to try the fixmbr in the recovery console. I'll let everyone
know what happens. Thanks for the advice and wish me luck!
Brett

 

[Pennywise]

|>Sorry - I no longer have access to the partition information that lists
|>the partition start and stop information - before I deleted it I had it
|>though All it shows now is either (depending on the program I use) a
|>blank area where the partitions should be or a message that states 'No
|>partitions found on this disk.'
|>
|>What I DO have is some info that might be extracted into something that
|>might work:
|>
|>The volume information for my c: drive is as follows:
|>cluster size: 4096
|>total clusters: 2620595
|>free clusters: 425536
|>volume size: 10236 MB
|>free space: 1662 MB

Nope you need outside help
http://homepage.ntlworld.com/hiren.thanki/bootcd.html
search around for the download (Torrent) if you think you anything can
be of use.

Did you use a Floppy (Like MaxBlast) to set up your HD? If so it takes
a copy of partition table which you can use - just revert back to that
point.

A pain in the A$$ method that does work is to use a DIsk Editor (I use
Norton Deskedit), and find the starting point of each partition then
rebuild it. Lots of work but a great learning experience

 

[Pennywise]

|>Alright - thanks for the info - I found a program called TestDisk by
|>CGSecurity which was able to find the 2 partitions and add them back to
|>the MBR as well as a function which seeminly rewrote the MBR.

Thanks for that, bookmark'd

 

[Brett]

<breathing a sigh of relief> Well I rebooted and it worked fine and
both partitions showed up. I guess I learned my lesson about fooling
around with the MBR without backing it up. Along the way I've learned
a decent amount (as well as wasting half a day). Thanks again,
Brett

 

[Steve N.]

Alright - thanks for the info - I found a program called TestDisk by
CGSecurity which was able to find the 2 partitions and add them back to
the MBR as well as a function which seeminly rewrote the MBR. When I
ran the two programs which I had used to initially screw up my computer
both partitions showed back up. I'm going to take the plunge and
restart my computer....hopefully it will boot up fine. If not I'm
going to try the fixmbr in the recovery console. I'll let everyone
know what happens. Thanks for the advice and wish me luck!
Brett

Ok. Good luck.

Steve N.

 

[Steve N.]

<breathing a sigh of relief> Well I rebooted and it worked fine and
both partitions showed up. I guess I learned my lesson about fooling
around with the MBR without backing it up. Along the way I've learned
a decent amount (as well as wasting half a day). Thanks again,
Brett

Good! I am glad you got things back to normal.

I still believe fixmbr would have done the trick. As I said, I'd seen it
work before. Still I am very glad it's all good now.



Steve N.

 

[abohner]

I know this thread is stale, but I wanted to clarify in case others run into the same problem.

Yes, the MBR does contain the partition table, but this section is typically untouched when 'repairing' the MBR with apps such as fixmbr, mbrwiz, Fdisk /mbr, etc. Repairing the MBR reassigns those bytes associated with booting the given OS so control can be handed over to the OS from the BIOS, thus enabling the machine to once again boot.

If the partition structure is lost there are applications which will scan the disk looking for specific partition information, then populate the partition table with this information. Common apps I have used for this are Testdisk, FindPart, and as well as Acronis DiskDirector.

I hope this helps. Best of luck!
Alex