Re: HD gone after Word wrote the first sectors

Folkert Rienstra <see_reply-to@xxxxxxxx> wrote
> Svend Olaf Mikkelsen <svolaf@xxxxxxxxxxxxxxxxxxxx> wrote
>> antonio__regina@xxxxxxxxxxx wrote

>>> I am asking expert advice.
>>> FACTS:
>>> I got a secondary HD for data that I carry with me home/work (IDE
>>> HD, bipartitioned Fat32). While I was saving a Word file, I
>>> noticed that the HD had the red light open for far too long.
>>> Result: the word file was saved in the very first sectors of the
>>> HD.
>>> I tried (I had a backup of that sector) to put back the first sector
>>> (Head 0, Cil. 0 Sector 1). I guess is the MBR. After that I was able
>>> to recover the 2nd partition with all files. But the first
>>> partition no: now I have a row drive for that, only with the right
>>> partition size.
>>> The 30 or so sectors following the first sector contain still the
>>> text of the Word file, in fact.
>>> AFTERMATH:
>>> I tried filerecoveryPro (demo version/recovery disabled) and it is
>>> able to find the first partition in the HD with all folders/files
>>> intact.
>>> The drive listed is indicated as noboot Drive. So I guess that the
>>> file structure should be somewhere in the first partition.
>>> 1st QUESTION:
>>> Apart buying Filerecovery Pro, can I try to search the file
>>> structure (or partion table not sure what it is called) of my first
>>> partition by using an hex editor and put it back where it should be?
>>> 2nd QUESTION:
>>> More in general on the causes of the disaster. Could be it due to
>>> heat problems? Is there a way to slow the HD down when is not in
>>> full use?
>>> Or could it depend to the use of high point controllers for an HD
>>> that is swapped to different Pcs? (btw, no bad Read/write sectors
>>> in the HD)? TIA
>>
>> Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
>> Copyright Svend Olaf Mikkelsen, 1999-2005.
>>
>> OS: Windows 5.1.2600 Service Pack 2 All
>>
>>
>>
>> Disk: 3 Cylinders: 19929 Heads: 255 Sectors: 63 MB: 156327
>>
>> --PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
>> 2679 1 0B 63225391887110054 2679* 1 1 16708*254 63 R0 OK
>> 0 - 0B 43038198225391887110054 2679 1 1 16708 254 63 B OK
>> Fdisk F6 sector 11827 0 1
>> Fdisk F6 sector 11827 1 1
>>
>> ------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
>> 2679 1 33 27508 32 2 27508 0 0 0 05-05-11 48172
>>
>> ------FAT CHS ------LBA Confidence Distance Type Sig
>> 0 1 35 97 8933 32 OK
>> 0 168 17 10600 8941 10503 32 OK
>>
>> Partitions according to partition tables on third harddisk:
>>
>> --PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
>> 0 1 0F 43038135225391950110054 2679* 0 1 16708*254 63 OK
>> 0 2*0C 63 43038072 21014 0 1 1 2678*254 63 NB OK
>>
>> 2679 1 0B 63225391887110054 2679* 1 1 16708*254 63 R0 OK
>>
>>
>> The boot sector and the backup boot sector are damaged,
>> seen by the fact that they were not located by Findpart.

> What is the point of publishing the results here

It allows us to see the washup, and pissed you off too. Wota bonus.

<reams of your puerile *** flushed where it belongs>

>> A few times lately I have seen that the FAT in the beginning of the
>> disk is printed using the alternative FAT finding format with
>> Distance ect., even if the signature of the first FAT copy is
>> present. I do not know why, but the first sector of the FAT may be
>> non standard in some way. It may also be possible that sector 35
>> only is searched if a boot sector is present.


<reams of your puerile *** flushed where it belongs>


>> For this reason we do not have the cluster size (without calculating)
>> and we do not have the root cluster number, which most often is 2.
>>
>> findpart findfat 3 0 1 35 10503
>>
>> may give that information.
>>
>> One real question that nobody ever asked,


<reams of your puerile *** flushed where it belongs>

>> is what Confidence is.


<reams of your puerile *** flushed where it belongs>

>> But the fact that second FAT copy has larger confidence may indicate
>> that the second FAT copy is better than the first, and that the
>> first FAT copy is damaged.
>>
>> Meaning that to repair the partition, we must find cluster size and
>> root cluster, examine that the partition is OK using the second FAT
>> copy, if yes copy the second FAT copy to the first and construct a
>> boot sector and copy it into place.
>>
>> For a FAT32 partition each FAT sector defines 128 clusters.
>> The cluster size then is: 43038072/(128*10503) = 32.01322,
>> and since it must be a natural number, it is 32 sectors, or 16 KB.
>>
>> The root cluster may be 2 as said.
>>
>> Then the command to copy the files may be:
>>
>> findpart chsdir 3 0 1 35 10503 16 2 copy fat2
>>
>> Do not expect to find a free or reliable tool to repair the
>> partition, although they may exist.


<reams of your puerile *** flushed where it belongs>


.

Quantcast