recovering a hozed windows partition?
James G. Sack (jim)
jgsack at san.rr.com
Tue Aug 28 11:11:57 PDT 2001
At 20:43 08/28/01 +1000, Serge Rey <serge at rohan.sdsu.edu> wrote:
>serge at bluesky:~$ sudo file -s /dev/hda1
>/dev/hda1: ASCII text
>> And how about
>> dd count=1 bs=512 if=/dev/hda1 | xxd -g 1 -a
>serge at bluesky:~$ sudo dd count=1 bs=512 if=/dev/hda1 | xxd -g 1 -a
>1+0 records in
>1+0 records out
>0000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>00001f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>nothing too promising there.
Oh-oh! At first glance it looks like the Windows partition has had it's
boot record zeroed! That's why you can't boot, fersure!
Whether the FAT, root-directory, and actual content is recoverable or not,
is the next question (if you need to pursue it).
If you're still interested, you could try
dd skip=1 count=1 bs=512 if=/dev/hda1 | xxd -g 1 -a
and look for the first few bytes of what should be the first FAT.
It should look something like
000000: f8 ff ff ff <etc>
The key info identifying a FAT is the "f8 ff" at the beginning, probably
repeated a couple of-times.
>i'll give the fsck a go tomorrow.
>i'm hestitant to try any windows disk utilities that might munge the
>linux partitions (i came across too many horror stories today along
>those lines in my google search).
If the boot record is gone, fsck may not be able to find the filesystem
data (the boot record contains disk metadata in a "Bios Parameter Block",
if I recall correctly).
..OR.. if the FAT is damaged, fsck will unlikely do much good.
If it's important, I would still recommend Norton, which is designed to
recover lost partitions and cope with damaged filesystem FAT, etc.
Unless misused <which *is* possible>, Norton won't damage non-dos partitions.
Another general pronouncement:
Hasty/reckless, inexpert, or otherwise improper recovery technique can
make things worse.
Further wisdom (?):
Proper recovery is a lot of trouble and tribulation. Try to avoid the
need for it <grin>.
More information about the KPLUG-List