Partitions disappeared

W

wemaole

I suggest you use partition table doctor.It provides very useful
functions: Backup partition table, Restore partition table, Rebuild
partition table, undelete partition,Fixboot.
use rebuild partition table function,it can automatic find out harddisk
partition!
see more:http://www.ptdd.com
 
T

Tanmoy

That was a typographical mistake. I guess everyone could make out its
not rott but root. Regarding the issue of Partition locations, agreed
its known but how does a layman restore it? assuming he/she does not
know how to edit physical sectors manually. Moreover the structrure of
Boot Record is not known, so I asked for the SUHDLOG.DAT file.
Ah! in the rott! Splendid! And isn't that SUHDLOG.DAT?

that was a typographical mistake. I guess everyone could make out its
not rott but root.
Partition locations are already known. Read the rest of the thread.

Regarding the issue of Partition location, agreed its known but how
does a layman restore it? assuming he/she does not know how to edit
physical sectors manually. Moreover the structrure of Boot Record is
not known, so I asked for the SUHDLOG.DAT file
 
F

Folkert Rienstra

Tanmoy said:
That was a typographical mistake.

No, that were several. One would be an unfortunate mistake but
several gives insight in how much you can be trusted with ones data
if you can't even be bothered to check your posts before sending.
I guess everyone could make out its not rott but root.
Regarding the issue of Partition locations, agreed
its known but how does a layman restore it? assuming he/she does not
know how to edit physical sectors manually.

Not only can you barely write, you don't read very well either, don't
you, "Tanmoy". Who said anything about editing "physical sectors".
Moreover the structrure of Boot Record is not known, so I asked
for the SUHDLOG.DAT file.

Oh, and my SUHDLOG.DAT is 3 years old. I have had several HDs
since then and I'm 100% certain that my current one (36GB) is par-
titioned differently from when I originally installed on a 4 GB one.
I would most certainly destroy my system if I followed your advice.
"Tanmoy" (e-mail address removed)> wrote in message news:[email protected]...

Ah! in the rott! Splendid! And isn't that SUHDLOG.DAT?

that was a typographical mistake. I guess everyone could make out its
not rott but root.
Partition locations are already known. Read the rest of the thread.

Regarding the issue of Partition location, agreed its known but how
does a layman restore it? assuming he/she does not know how to edit
physical sectors manually. Moreover the structrure of Boot Record is
not known, so I asked for the SUHDLOG.DAT file
 
J

Joep

Tanmoy said:
That was a typographical mistake. I guess everyone could make out its
not rott but root. Regarding the issue of Partition locations, agreed
its known but how does a layman restore it? assuming he/she does not
know how to edit physical sectors manually. Moreover the structrure of
Boot Record is not known, so I asked for the SUHDLOG.DAT file.

Hi.

Yes, you are right, it's just, we see here (this thread) a living example of
what could happen if you're not exact and to the point with the instructions
you give. And in that light, not even getting a simple thing as a filename
right doesn't add to the confidence. Yes indeed the bootrecord appears to be
lost, and I very much doubt if that's the only component that's damaged; the
partition table EPBR was trashed, the boot sector as well, no FAT was found
so part of the first FAT at least is damaged as well. And because of that I
doubt if knowing what the boot sector looked like will do much good. If this
were up to me, I'd try the recover the last logical and recover data from
the first logical partition using a file recovery tool. You could even
redefine the partition to make it a little easier on the tool of your
choice.

As far as I understand the files you refer to are created during setup. If
the partitioning changed since that there's not too much use for those
files. In fact data has been lost more than once because of those files and
the restoration of partition tables and boot sectors from those files.
Because of that I'd never rely on them. IMO it's better to scan a disk,
analyse the results of the scan, and plan and perform interventions based on
at analysis.

Does one know how to use the information as it is presented by Findpart?
Yes, that's the question. Either you know, or you don't. The latter seems to
be the case more frequently, and in those cases 99 out of 100 times Svend
has to come to the rescue. Svend recently indicated that he's slowing down a
bit, or has to slow down a bit, because there's so many requests for help
that he fears he may not be able to maintain the high quality of his
support. Svend has a reputation to keep up ;-). It is also because of this
reputation, so it seems, that people trust him blindly to resolve an issue,
or at least that he knows where and when to stop so it doesn't turn into a
bigger mess. I know what Svend is capable of (as anyone that visits this
group on a regular basis probably). If Svend created a batch file to fix my
disk I'd not have too much trouble running that. No offense intended, but
you I don't know, so that's a bit more difficult. F'Nut (alias Folkert) I do
know and I'd never let him touch my disk, before you know it, you have 'free
space partitions' (don't ask me, only he knows) all over the place.

Anyway ... There are tools available that are able to resolve many of the
issues that can be resolved with the help of Findpart and Svend in a safe
manner. Tools that allow about ordinary users to solve issues even when they
don't know how to edit a disk and without indepth knowledge on partition
table and boot sector structures. Tools that only require the user to select
the correct disk and the partitions that need repair.

If people do not want to use those (often commercial) tools then they either
need to be patient or take some risks. I suggest they first clone the victim
disk or practice on a dummy disk.
 
A

Annika K

Thank you very much for your help. Using my "modified" plan of attack I was
able to restore the E: drive (and this is the one that was of most
importance to me). When I try to select the D: drive I get an error message
which reads "D:\ is not accessible. A device attached to the system is not
functioning." At this stage, do I give up on the data on that partition?
What other options are still available to me?

For those who are interested, here is what my PTEdit screen looked like in
the end...(I didn't bother removing the 3rd and 4th lines as that seemed
optional)

Starting Ending Sectors
Type Boot Cyl Head Sector Cyl Head Sector Before Sectors
------------------------------------------------------------------
0B 1023 254 63 1023 254 63 63 117194112
05 1023 254 63 1023 254 63 117194175 261554202
C1 9F 473 187 57 97 150 29 2960922799 89931260
51 33 158 72 17 302 240 1 886023102 2723627765
 
T

Tanmoy

Folkert said:
No, that were several. One would be an unfortunate mistake but
several gives insight in how much you can be trusted with ones data
if you can't even be bothered to check your posts before sending.


Not only can you barely write, you don't read very well either, don't
you, "Tanmoy". Who said anything about editing "physical sectors".


Oh, and my SUHDLOG.DAT is 3 years old. I have had several HDs
since then and I'm 100% certain that my current one (36GB) is par-
titioned differently from when I originally installed on a 4 GB one.
I would most certainly destroy my system if I followed your advice.

I guess its time you learn to read well too ! in my earlier post I said

if you had installed Windows 98 on this HD (and not cloned from another
drive OK). It doesnt matter if its 3 yrs old installation as long as
you did not change the partition structure.

I hope you would agree that what findpart or any other utility reports
is the present partition structure, and many virus do alter the
structure of the partition table. Till date I havent come across any
that alters SUHDLOG.DAT. (let me know if there is one whic alters
SUHDLOG.DAT)

If there is no partition alteration after installation of WIN98 and you
know to extract the partition and Boot Record out of SUHDLOG.DAT, I
doubt if there is any other better utilty to recreate the original
ones.
"Tanmoy" (e-mail address removed)> wrote in message Hi... If you had installed Windows 98 on this HD you should be able to
see 2 files SUHODLOG.DAT and SUHODLOG.BAK in rott of C:\

Ah! in the rott! Splendid! And isn't that SUHDLOG.DAT?

that was a typographical mistake. I guess everyone could make out its
not rott but root.
these are
hidden system files. Send me these two files and I will send you your
original Partition table

Partition locations are already known. Read the rest of the
thread.

Regarding the issue of Partition location, agreed its known but how
does a layman restore it? assuming he/she does not know how to edit
physical sectors manually. Moreover the structrure of Boot Record is
not known, so I asked for the SUHDLOG.DAT file
 
F

Folkert Rienstra

Annika K said:
Thank you very much for your help. Using my "modified" plan of attack I was
able to restore the E: drive (and this is the one that was of most importance to me).
When I try to select the D: drive I get an error message which reads
"D:\ is not accessible.

As expected.
A device attached to the system is not functioning."

The error that one gets is probably dependent on what the gar-
bage data in the partition's bootrecord is. Apparently the file
system thinks that it is formatted but it can't make sense of it.
At this stage, do I give up on the data on that partition?
What other options are still available to me?

I believe I gave you some hints. Maybe you should read them again?
Btw, WinHex is here: http://www.x-ways.net/winhex/index-m.html
For those who are interested, here is what my PTEdit screen looked like in
the end...
(I didn't bother removing the 3rd and 4th lines as that seemed optional)

It may start to bother you if you keep running reports and they show up
in there each time and clutter up the report. If not, then who cares, right?
Starting Ending Sectors
Type Boot Cyl Head Sector Cyl Head Sector Before Sectors
------------------------------------------------------------------
0B 1023 254 63 1023 254 63 63 117194112
05 1023 254 63 1023 254 63 117194175 261554202
C1 9F 473 187 57 97 150 29 2960922799 89931260
51 33 158 72 17 302 240 1 886023102 2723627765

You could re-run Findpart again although if Findpart does it's job cor-
rectly it is expected to still give the same info re the detected structures
(FAT and Bootrecord search), but you never know until you try it, right?
Maybe that that previously missing, now restored signature has some
influence on how Findpart conducts it's search.

The only differences to be expected are that the partiton tables now
should show show the re-added partitions and the EPBR signature OK.
And the 1023 254 63 entries will likely prompt Findpart to add extra
lines with the socalled 'actual' values (that aren't the actual values at all).

Please setup your newsreader properly. The below quotation is unreadable.

[snip]
 
M

Mark M

No, that were several. One would be an unfortunate mistake but
several gives insight in how much you can be trusted with ones data
if you can't even be bothered to check your posts before sending.


The pot called the kettle black.

It is "several give" not "several gives".
Your ellipsis leaves out "mistakes".

To leave off an 's' may be a typo but to add one is ignorance.


Not only can you barely write, you don't read very well either,
don't you, "Tanmoy".


Double negatives can be used to give emphasis but here your double
negative is nonsense.
 
F

Folkert Rienstra

Tanmoy said:
I guess its time you learn to read well too ! in my earlier post I said

if you had installed Windows 98 on this HD

Of course I have Win98 installed on my drive, how else would I be able
to run it if it wasn't 'installed'. Doesn't mean that I actually performed
the installation procedure of Windows on this particular drive.
(and not cloned from another drive OK).

Who said anything about cloning. Oh, and 'cloned' would actually
be alright, if not, it would not be a real clone, now wouldn't it.
It doesnt matter if its 3 yrs old installation as long
as you did not change the partition structure.

Right, that is what matters if you go that route, that the files actually
represent the current scheme.
I hope you would agree that what findpart or any other utility reports
is the present partition structure, and many virus do alter the
structure of the partition table.

So what?
The FAT tables and partition bootrecords out of place would give
you immediate notice that something like that would have happened.
Did you even bother to try and find out what the Findpart report
is actually showing?
 
T

Tanmoy

Thanks for your support. I feel this is a tech group and one should not
be too much bothered with minor grammatical mistakes. Everone would
agree that english is spoken and written in different ways in the
world. However there are guys who would like to deviate from the real
technical issue and say something else.
 
J

Joep

Tanmoy said:
Thanks for your support. I feel this is a tech group and one should not
be too much bothered with minor grammatical mistakes.

Yes, that is the easy way out. My post that apart from the typo addresses
the context of the typo plus the usability of sudhlog.dat you did not
answer:

Tanmoy said:
That was a typographical mistake. I guess everyone could make out its
not rott but root. Regarding the issue of Partition locations, agreed
its known but how does a layman restore it? assuming he/she does not
know how to edit physical sectors manually. Moreover the structrure of
Boot Record is not known, so I asked for the SUHDLOG.DAT file.

Hi.

Yes, you are right, it's just, we see here (this thread) a living example of
what could happen if you're not exact and to the point with the instructions
you give. And in that light, not even getting a simple thing as a filename
right doesn't add to the confidence. Yes indeed the bootrecord appears to be
lost, and I very much doubt if that's the only component that's damaged; the
partition table EPBR was trashed, the boot sector as well, no FAT was found
so part of the first FAT at least is damaged as well. And because of that I
doubt if knowing what the boot sector looked like will do much good. If this
were up to me, I'd try the recover the last logical and recover data from
the first logical partition using a file recovery tool. You could even
redefine the partition to make it a little easier on the tool of your
choice.

As far as I understand the files you refer to are created during setup. If
the partitioning changed since that there's not too much use for those
files. In fact data has been lost more than once because of those files and
the restoration of partition tables and boot sectors from those files.
Because of that I'd never rely on them. IMO it's better to scan a disk,
analyse the results of the scan, and plan and perform interventions based on
at analysis.

Does one know how to use the information as it is presented by Findpart?
Yes, that's the question. Either you know, or you don't. The latter seems to
be the case more frequently, and in those cases 99 out of 100 times Svend
has to come to the rescue. Svend recently indicated that he's slowing down a
bit, or has to slow down a bit, because there's so many requests for help
that he fears he may not be able to maintain the high quality of his
support. Svend has a reputation to keep up ;-). It is also because of this
reputation, so it seems, that people trust him blindly to resolve an issue,
or at least that he knows where and when to stop so it doesn't turn into a
bigger mess. I know what Svend is capable of (as anyone that visits this
group on a regular basis probably). If Svend created a batch file to fix my
disk I'd not have too much trouble running that. No offense intended, but
you I don't know, so that's a bit more difficult. F'Nut (alias Folkert) I do
know and I'd never let him touch my disk, before you know it, you have 'free
space partitions' (don't ask me, only he knows) all over the place.

Anyway ... There are tools available that are able to resolve many of the
issues that can be resolved with the help of Findpart and Svend in a safe
manner. Tools that allow about ordinary users to solve issues even when they
don't know how to edit a disk and without indepth knowledge on partition
table and boot sector structures. Tools that only require the user to select
the correct disk and the partitions that need repair.

If people do not want to use those (often commercial) tools then they either
need to be patient or take some risks. I suggest they first clone the victim
disk or practice on a dummy disk.
 
F

Folkert Rienstra

Tanmoy said:
Thanks for your support.

And now we know in what ballpark you play.
I feel this is a tech group and one should not be too
much bothered with minor grammatical mistakes.

And yet that is exactly what your buddy Mark focussed on
and you thank him for it.

Who is everone?
would agree that english is spoken and written in different ways in
the world.

And what has that got to do with typos?
However there are guys who would like to deviate from the real
technical issue and say something else.

Like you are doing now.

And that's why it obviously became "gives", as in ... , that "gives" ...
It all depends on how you interpret what was "left out".

Deliberately changing what was said to point out a possible mis-
take is malice by someone who apparently has an axe to grind.
 
S

Svend Olaf Mikkelsen

I am runing Windows 98 on a 200 Gig HD. There are 3 partitions on the HD.
One is about 10 gigs and holds the operating system. Yesterday the other
two partitions disappered while windows was running. So far I have rebooted
a couple of times (before i realized what was going on) and attempted to fix
the mbr with "FDISK /MBR" which did not fix the problem. I have run
FindPart and will include the ouput from that below. But after this point I
am out of my league. Is the output from FindPart enough to restore the
partitions? I am not concerned with the data on the OS partition. I am
fine with having to reinstall the OS. It's the data on the other 2 drives
that I am interested in. Can someone please guide me through this?

Thank you very much.

FindPart Output....................

Findpart, version 4.42.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: DOS 7.10

Disk: 1 Cylinders: 24792 Heads: 255 Sectors: 63 MB: 194474

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0C 63 19534977 9538 0 1 1 1215 254 63 B OK
8511 1 0B 63261554202127712 8511 1 1 24791 254 63 OK OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 9530 8 2 9530 0 0 0 05-03-07 454
8511 1 33 31921 32 2 31921 0 0 0 05-02-21 75808
13317 0 33 Second FAT not found.

Partitions according to partition tables on first harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1*0C 63 19534977 9538 0 1 1 1215 254 63 OK OK
0 2 0F 19535040378748440184935 1216 0 1 24791 254 63 OK

No signature CHS: 1216 0 1

We need the explanation that the first logical partition is not listed
in the search output.

The most likely explanation seems to be the Windows 98 128 GB or 32 GB
problem, although I did not calculate the scenario, which could be:
data written to the 127712 MB partition were written at wrong
locations, and damaged the first logical, and maybe more, and of
course damaged the structure of the 127712 MB partition too.

Do we have a confirmation that the newest version of Intel Application
Accelerator is installed in Windows 98?

If important data are on the disk, the partitions should be made
hidden, and the disk inserted as disk number 2 in a known good Windows
system for further examination and file copying.
 
F

Folkert Rienstra

Folkert Rienstra said:
Hmm.

" > 0 1*0C 63 19534977 9538 0 1 1 1215 254 63 OK OK "
" > 0 2 0F 19535040 378748440 184935 1216 0 1 24791 254 63 OK "

Findpart seems to have a mind of it's own. Svend should look into that.

Svend, your comments please why Findpart shows different values from the actual ones
and not finding a problem with that.
[snip]
 
S

Svend Olaf Mikkelsen

Folkert Rienstra said:
Hmm.

" > 0 1*0C 63 19534977 9538 0 1 1 1215 254 63 OK OK "
" > 0 2 0F 19535040 378748440 184935 1216 0 1 24791 254 63 OK "

Findpart seems to have a mind of it's own. Svend should look into that.

Svend, your comments please why Findpart shows different values from the actual ones
and not finding a problem with that.
[snip]

I do not see any problem. The primary FAT32 partition ends cylinder
1215, head 254, sector 63. Ptedit shows the content of the 10 bits for
the cylinder in the partition table entry. Usually 1023 would have
been used in the primary partition table, but I am not aware of any
operating system, which cares.

I guess the original poster mailed me too. My suggestion is that the
partitions are made hidden, and the disk inserted in a known good
Windows system for further examination.

Also see my other message in this thread.
 
F

Folkert Rienstra

Svend Olaf Mikkelsen said:
Folkert Rienstra said:
Here is my plan of attack...Please look it over and correct any misunderstandings
that I may have...

First of all, here is the First PTEdit screen before I make any changes....

Starting Ending Sectors
Type Boot Cyl Head Sector Cyl Head Sector Before Sectors
------------------------------------------------------------------
0C 80 0 1 1 191 254 63 63 19,534,977
0F 00 192 0 1 215 254 63 19535040 378,748,440

Hmm.

" > 0 1*0C 63 19534977 9538 0 1 1 1215 254 63 OK OK "
" > 0 2 0F 19535040 378748440 184935 1216 0 1 24791 254 63 OK "

Findpart seems to have a mind of it's own. Svend should look into that.

Svend, your comments please why Findpart shows different values from the actual ones
and not finding a problem with that.
[snip]

I do not see any problem.

Svend, the problem obviously, is that Findpart does not show the
actual values, especially since they are less than 1023 254 63 on
a drive/partition bigger than 8GB.
The primary FAT32 partition ends cylinder 1215, head 254, sector 63.
Ptedit shows the content of the 10 bits for the cylinder in the partition
table entry.

And so should Findpart.
It does that when it is 1023 254 63, but fails to do that when it is not.
Usually 1023 would have been used in the primary partition table,

Exactly. When it is, Findpart makes a point of that.
Now that it isn't it lies about it and lets us believe that all is OK.
(Actually the fact that it doesn't show the actual values is now an
indication that something is amiss, which is pretty rediculous).
but I am not aware of any operating system, which cares.

Yes you do. Stop stonewalling, it doesn't become you.

When the CHS isn't what it is supposed to be you can fall prey to the
32GB bug, which is what may have happened to her in the first place.

When CHS sectors is not 63, (when it should have been 63) the drive
will not even boot.
I guess the original poster mailed me too.

You guess.
My suggestion is that the partitions are made hidden, and the disk
inserted in a known good Windows system for further examination.

Please define "a known good Windows system".
She probably was on one until this happened to her.
Also see my other message in this thread.

Where you prove that you actually are
"aware of any operating system, which cares".
 
J

Joep

"Hmmm" ... Always a good idea to say that if you don't have a clue and you
want to hide that fact...
that.

Oh he *should*? Maybe you *should* s-t-f-u?
Svend, your comments please why Findpart shows different values from the actual ones
and not finding a problem with that.



[snip]

I do not see any problem.

Svend, the problem obviously

Perhaps not *that* obvious since he doesn't see it, or me f-w-i-w...
, is that Findpart does not show the
actual values, especially since they are less than 1023 254 63 on
a drive/partition bigger than 8GB.



And so should Findpart.

Says who? You, F'Nut, the great master of masters of partition tables?
It does that when it is 1023 254 63, but fails to do that when it is not.


Exactly. When it is, Findpart makes a point of that.
Now that it isn't it lies about it and lets us believe that all is OK.

And since CHS values are ignored, there actually isn't anything there to be
woried about. However, although your arguments stink, I agree that it would
be nice to see what's actually in the partition table for the simple reason
that Finpart states "Partitions according to partition tables".
(Actually the fact that it doesn't show the actual values is now an
indication that something is amiss, which is pretty rediculous).


Yes you do.

WTF F'Nut, when he says he doesn't, he doesn't.
Stop stonewalling, it doesn't become you.

OMFG ...
When the CHS isn't what it is supposed to be you can fall prey to the
32GB bug, which is what may have happened to her in the first place.

What has CHS got to do with 32 Gb bug?
When CHS sectors is not 63, (when it should have been 63) the drive
will not even boot.

I think it does as long as LBA start is 63. I think I tried that once.
You guess.

That's what he said.
Please define "a known good Windows system".

One that supports the size of the disk?
She probably was on one until this happened to her.

That remains to be seen
Where you prove that you actually are
"aware of any operating system, which cares".

Oh F'Nut, you're so smart! You should have been a lawyer, the way you set up
people and catch their little lies! Or maybe Svend is talking about
something other than CHS values which is relevant?
 
S

Svend Olaf Mikkelsen

Svend, the problem obviously, is that Findpart does not show the
actual values, especially since they are less than 1023 254 63 on
a drive/partition bigger than 8GB.

I may make mistakes, but I do not think I do in this case. I cannot
use more time on it. No, values shown as larger than 1023 254 63 are
larger than that.

Looking at the output in the original message: There are no Findpart
errors.

Findpart, version 4.42.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: DOS 7.10

Disk: 1 Cylinders: 24792 Heads: 255 Sectors: 63 MB: 194474

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0C 63 19534977 9538 0 1 1 1215 254 63 B OK
8511 1 0B 63261554202127712 8511 1 1 24791 254 63 OK OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 9530 8 2 9530 0 0 0 05-03-07 454
8511 1 33 31921 32 2 31921 0 0 0 05-02-21 75808
13317 0 33 Second FAT not found.

Partitions according to partition tables on first harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1*0C 63 19534977 9538 0 1 1 1215 254 63 OK OK
0 2 0F 19535040378748440184935 1216 0 1 24791 254 63 OK

No signature CHS: 1216 0 1
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top