Look for filename in drive without valid MBR

Folkert Rienstra wrote:
>
> Right, much better killing it for sure by trying to get all that you don't
> really need in a very trying process than trying to get the few bits that
> you really need in a jiffy by repairing the minimum.


Folkert,


You clearly have very little experience of data recovery.

I suggest you pull the plug on your "contribution" to this thread - you
don't have sufficient expertise and could jeopardise the original
poster's chances of a successful recovery.



Duncan
--
Retrodata
www.retrodata.co.uk
Globally Local Data Recovery Experts
 >> Stay informed about: Look for filename in drive without valid MBR 

On 6 Jan 2008 08:21:19 GMT, Arno Wagner <me.TakeThisOut@privacy.net> wrote:

>Previously Bob Simon <nobody.TakeThisOut@nowhere.com> wrote:
>> On Sat, 5 Jan 2008 15:28:50 -0800 (PST), "mscotgrove@aol.com"
>> <mscotgrove.TakeThisOut@aol.com> wrote:
>
>>>On Jan 5, 10:52 pm, Bob Simon <nob....TakeThisOut@nowhere.com> wrote:
>>>> I had three partitions on a drive that had a hardware failure and now
>>>> can't be read by Windows.  The only files I really care about are
>>>> *.tax.  What utility will let me search for them and copy to a working
>>>> drive?
>>>
>>>The answer does depend on if the drive is still accessible logically.
>>>If the drive has become corrupted, but can be seen by a PC as a
>>>physical drive, then recovery is probably possible. If the drive
>>>cannot be seen by a PC (typically using a USB caddy) then you will
>>>require specialised data recovery company.
>>>
>>>For software recovery there are many possible programs, but the one I
>>>have developed, www.cnwrecovery.com does have a file filter to enable
>>>select of files by extension, such as .tax as you require. The free
>>>demo will indicate if recovery is possible. It will also reconstruct
>>>MBR if required.
>>>
>>>All recovery programs should always be used with the 'duff' drive as a
>>>slave or external drive to a working PC.
>>>
>>>Michael
>
>> Please ignore previous reply.
>
>> I can't image my bad drive until I buy a larger drive to hold the
>> image. In the mean time, I analysed the partitions and searched for
>> previous partions. Type xx non resident was found twice and the scan
>> is only around 20% complete. What does this mean?
>
>Operating the drive before imaging it is a very bad idea,
>since it may suffer additional damage. Waif for the new drive,
>imagie the old one. And then start messing around. Not before.
>
>Arno

I'm the OP and I'm back after having installed a new drive, imaged the
bad drive and then removing power from the bad drive. Now I'm ready
to try to reconstruct whatever I can from the image and am looking for
some pointers.

For tools, I have UBCD plus the program that Michael wrote,
cnwrecovery. I compared the current partition map with an old
printout from Ranish Partition Manager and they match. Here's a
section from RPM:
2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
3 Pri 2 Extended LBA 255 0 1 15770 254 63
4 A Log Windows NT NTFS 255 1 1 15770 254 63
5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63

Why is partition 4 listed as A Log? I'm pretty sure this is where the
data is that I really want to find.
 >> Stay informed about: Look for filename in drive without valid MBR 

You can try Stellar Phoenix Windows Data Recovery Software. It is a
partition recovery utility which recovers lost data from FAT 16, FAT
32, NTFS, NTFS5 file system. Stellar Phoenix is helpful in recovering
data from formatted hard drive or data lost due to software
malfunction, viruses or even sabotage.
Demo version can be downloaded from: http://www.stellarinfo.com/partition-recovery.htm
 >> Stay informed about: Look for filename in drive without valid MBR 

Rod Speed wrote in news:5uddubF1gjphgU1@mid.individual.net
> Folkert Rienstra <see_reply-to.RemoveThis@myweb.nl> wrote:
> > Rod Speed wrote in news:5ud50sF1h7k9pU1@mid.individual.net
> > > Folkert Rienstra <see_reply-to.RemoveThis@myweb.nl> wrote
> > > > Rod Speed wrote
> > > > > Bob Simon <nobody.RemoveThis@nowhere.com> wrote
> > > > > > mscotgrove.RemoveThis@aol.com <mscotgrove.RemoveThis@aol.com> wrote
> > > > > > > Bob Simon <nob....RemoveThis@nowhere.com> wrote
> > > > > > > > mscotgrove.RemoveThis@aol.com <mscotgrove.RemoveThis@aol.com> wrote
> > > > > > > > > Bob Simon <nob....RemoveThis@nowhere.com> wrote
> > >
> > > > > > > > > > I had three partitions on a drive that had a hardware
> > > > > > > > > > failure and now can't be read by Windows. The only files I
> > > > > > > > > > really care about are *.tax. What utility will let me
> > > > > > > > > > search for them and copy to a working drive?
[snip]
> > > > > > Thanks! While I understand the advice to work from a copy of the
> > > > > > damaged drive, I am almost overwhelmed by the urge to do something
> > > > > > right now. Would I be likely to make things worse by pressing the
> > > > > > "Reconstruct current partitions" button on the Partition analysis
> > > > > > screen?
> > >
> > > > > Very likely.
> > >
> > > > Such confidence in the duff guys sof(t)ware.
> > >
> > > Nothing to do with the software, everything to do with the state of
> > > the drive.
> > >
> > > Makes a lot more sense to clone it first before attempting to do
> > > anything else.
> >
> > Right, much better killing it for sure by trying to get all that you
> > don't really need in a very trying process than trying to get the few
> > bits that you really need in a jiffy by repairing the minimum.

> Reconstructing current partitions is nothing like repairing the minimum.

Of course it is.

And who said anything about "Reconstructing current partitions".
Just reconstructing the MBR. If the partition boot records are still in
tact, then that's dead easy and minimal effort and strain on the drive.
 >> Stay informed about: Look for filename in drive without valid MBR 

mscotgrove DeleteThis @aol.com wrote

> > This means that areas of the disk that are very damaged can be skipped.
> >
> > Pity you won't know that it's damaged after you have tried
> > those areas rather extensively already to make that conclusion.
> > And that is doing precisely what you are trying to avoid.
> >

> In actual fact, there is a mode so that when a number of bad sectors
> are detected consecuatively,

Which is just hit and miss.
If they are not 'consecutive' they are going to be read.

> another number can be jumped.

What number. There is no such number. Bad sectors are spread randomly.
You don't know where they are without reading them all. You can only set a
number if you already know where they are which is obviously after the fact.

> For instance, if 10 sectors in a row are found failed, the program can
> jump 1000 sectors.

Apart from that you can't even tell whether 10 consequtive sectors have
failed without trying 10 times to read each and every one to the last, what's
the point if nine fail. That doesn't make the following bad sectors go away.
Even finding one bad sector says absolutely nothing about whether there
will be more following.

> Each number can be varied. This means that the program will not dwell
> on reading bad sectors for too long.

The only way to not dwell on bad sectors is to read the drive with Read
Long (ie error recovery switched off). Every program that can't do that
or drive that won't support that is bound to hit the error recovery func-
tions of the drive that will get it into trouble and work it to it's death
even faster, and then the OS will just do that over once more.

>
> At then end of a image, it is always possible to go back and work on
> these problem areas, but only once the vast majority of the disk has
> been imaged.
>
> Some lonks from the help

[ more spam snipped]

>
>
> Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

On Jan 8, 7:59 am, Arno Wagner <m....TakeThisOut@privacy.net> wrote:
> Previously Bob Simon <nob....TakeThisOut@nowhere.com> wrote:
>
> > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m....TakeThisOut@privacy.net> wrote:
> > I'm the OP and I'm back after having installed a new drive, imaged the
> > bad drive and then removing power from the bad drive.  Now I'm ready
> > to try to reconstruct whatever I can from the image and am looking for
> > some pointers.  
> > For tools, I have UBCD plus the program that Michael wrote,
> > cnwrecovery.  I compared the current partition map with an old
> > printout from Ranish Partition Manager and they match.  Here's a
> > section from RPM:
> > 2 >Pri 1 Windows NT NTFS                0 1 1              254 254 63
> > 3   Pri 2 Extended LBA                   255 0 1          15770 254 63
> > 4   A Log Windows NT NTFS         255 1 1          15770 254 63
> > 5  Pri 3   Windows FAT-32 LBA 15771 0 1          15932 254 63
> > Why is partition 4 listed as A Log?  I'm pretty sure this is where the
> > data is that I really want to find.
>
> "Log" very likely means "Logical Partition".
>
> The above would be primaries 1,3 and a logical contained in
> primary 2, which is an extended patition,. i.e. a container
> for logical partitions.
>
> Arno

The partition function in my program will give the size of each
partition, and the starting location. If it needs to be
reconstructed, thye reconstruction routine will scan the drive looking
for possible starts, and where possible using values from pointer
blocks.

A lot of commercial PCs, such as Dell and Sony start a disk with a
short - often FAT - hidden partition that is used for recovery. The
data is then on the second logical partition.

Once a partition has been selected for recovery, for logical recovery
my NTFS function does require valid values for cluster size and the
start of the MFT. There are helper functions for each of these.
(Analyse disk...)

As you now have an image, you can make as many mistakes as you like,
and will not lose more data. For a partially damaged drive, the most
successful function to use with NTFS recovery is 'Recover from file
entries' This will read each MFT in sequence, rather than trying to
read with the logical directory tree. Thus, if a critical part of the
directory tree has failed, files will still be found with valid
names. If the MFT structure is damaged, the whole disk can be scanned
for MFTs.

On the NTFS screen is a function for file filter - this can be use to
select just your .tax files.

Function key F1 will give contect sensitive help on every screen

Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

On Jan 8, 1:59 am, Arno Wagner <m... RemoveThis @privacy.net> wrote:
> Previously Bob Simon <nob... RemoveThis @nowhere.com> wrote:
>
> > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m... RemoveThis @privacy.net> wrote:
> > I'm the OP and I'm back after having installed a new drive, imaged the
> > bad drive and then removing power from the bad drive.  Now I'm ready
> > to try to reconstruct whatever I can from the image and am looking for
> > some pointers.  
> > For tools, I have UBCD plus the program that Michael wrote,
> > cnwrecovery.  I compared the current partition map with an old
> > printout from Ranish Partition Manager and they match.  Here's a
> > section from RPM:
> > 2 >Pri 1 Windows NT NTFS                0 1 1              254 254 63
> > 3   Pri 2 Extended LBA                   255 0 1          15770 254 63
> > 4   A Log Windows NT NTFS         255 1 1          15770 254 63
> > 5  Pri 3   Windows FAT-32 LBA 15771 0 1          15932 254 63
> > Why is partition 4 listed as A Log?  I'm pretty sure this is where the
> > data is that I really want to find.
>
> "Log" very likely means "Logical Partition".
>
> The above would be primaries 1,3 and a logical contained in
> primary 2, which is an extended patition,. i.e. a container
> for logical partitions.
>
> Arno

Does this mean that when I attempt to recover a file in the logical
NTFS partition, whatever software I'm using will automatically
rebuild the container first? Or is this typically a two-step process
where I must first re-create the extended partition, then the NTFS
partition?
 >> Stay informed about: Look for filename in drive without valid MBR 

Previously Bob Simon <nobody DeleteThis @nowhere.com> wrote:
> On 6 Jan 2008 08:21:19 GMT, Arno Wagner <me DeleteThis @privacy.net> wrote:

> I'm the OP and I'm back after having installed a new drive, imaged the
> bad drive and then removing power from the bad drive. Now I'm ready
> to try to reconstruct whatever I can from the image and am looking for
> some pointers.

> For tools, I have UBCD plus the program that Michael wrote,
> cnwrecovery. I compared the current partition map with an old
> printout from Ranish Partition Manager and they match. Here's a
> section from RPM:
> 2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
> 3 Pri 2 Extended LBA 255 0 1 15770 254 63
> 4 A Log Windows NT NTFS 255 1 1 15770 254 63
> 5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63

> Why is partition 4 listed as A Log? I'm pretty sure this is where the
> data is that I really want to find.

"Log" very likely means "Logical Partition".

The above would be primaries 1,3 and a logical contained in
primary 2, which is an extended patition,. i.e. a container
for logical partitions.

Arno
 >> Stay informed about: Look for filename in drive without valid MBR 

On Jan 8, 3:04 pm, "bobneworle...@yahoo.com" <bobneworle... DeleteThis @yahoo.com>
wrote:
> On Jan 8, 1:59 am, Arno Wagner <m... DeleteThis @privacy.net> wrote:
>
>
>
>
>
> > Previously Bob Simon <nob... DeleteThis @nowhere.com> wrote:
>
> > > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m... DeleteThis @privacy.net> wrote:
> > > I'm the OP and I'm back after having installed a new drive, imaged the
> > > bad drive and then removing power from the bad drive.  Now I'm ready
> > > to try to reconstruct whatever I can from the image and am looking for
> > > some pointers.  
> > > For tools, I have UBCD plus the program that Michael wrote,
> > > cnwrecovery.  I compared the current partition map with an old
> > > printout from Ranish Partition Manager and they match.  Here's a
> > > section from RPM:
> > > 2 >Pri 1 Windows NT NTFS                0 1 1              254 254 63
> > > 3   Pri 2 Extended LBA                   255 0 1          15770 254 63
> > > 4   A Log Windows NT NTFS         255 1 1          15770 254 63
> > > 5  Pri 3   Windows FAT-32 LBA 15771 0 1          15932 254 63
> > > Why is partition 4 listed as A Log?  I'm pretty sure this is where the
> > > data is that I really want to find.
>
> > "Log" very likely means "Logical Partition".
>
> > The above would be primaries 1,3 and a logical contained in
> > primary 2, which is an extended patition,. i.e. a container
> > for logical partitions.
>
> > Arno
>
> Does this mean that when I attempt to recover a file in the logical
> NTFS partition, whatever software I'm using will automatically
> rebuild the container first?  Or is this typically a two-step process
> where I must first re-create the extended partition, then the NTFS
> partition?- Hide quoted text -
>
> - Show quoted text -

I can only speak for my own software but as far as I understand it,
the container is just a way to have more than 4 partitions. On the
boot sector, there is space for 4 records, ( starting at 0x1be) each
defining a partition. By using one of those records to point to an
extended partition, another 4 partitions may be added. The extended
partition overhead is typically 64 sectors.

For recovery, the only important thing is the start of the real
partition. Therefore recovery of the extended partition on it's own
is not required.

Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

On Jan 8, 5:00 pm, "Folkert Rienstra" <see_reply....RemoveThis@myweb.nl> wrote:
> mscotgr....RemoveThis@aol.com wrote innews:0110bead-54de-43cb-a3c4-8c00c0ecc005@e23g2000prf.googlegroups.com 
>
>
>
>
>
> > On Jan 8, 7:59 am, Arno Wagner <m....RemoveThis@privacy.net> wrote:
> > > Previously Bob Simon <nob....RemoveThis@nowhere.com> wrote:
>
> > > > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m....RemoveThis@privacy.net> wrote:
> > > > I'm the OP and I'm back after having installed a new drive, imaged the
> > > > bad drive and then removing power from the bad drive. Now I'm ready
> > > > to try to reconstruct whatever I can from the image and am looking for
> > > > some pointers.
> > > > For tools, I have UBCD plus the program that Michael wrote,
> > > > cnwrecovery. I compared the current partition map with an old
> > > > printout from Ranish Partition Manager and they match. Here's a
> > > > section from RPM:
> > > > 2 Pri 1 Windows NT NTFS 0 1 1 254 254 63
> > > > 3 Pri 2 Extended LBA 255 0 1 15770 254 63
> > > > 4 A Log Windows NT NTFS 255 1 1 15770 254 63
> > > > 5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63
> > > > Why is partition 4 listed as A Log? I'm pretty sure this is where the
> > > > data is that I really want to find.
>
> > > "Log" very likely means "Logical Partition".
>
> > > The above would be primaries 1,3 and a logical contained in
> > > primary 2, which is an extended patition,. i.e. a container
> > > for logical partitions.
>
> > > Arno
>
> > The partition function  in my program will give the size of each partition,
> > and the starting location.  If it needs to be reconstructed, thye recon-
> > struction routine will scan the drive looking  for possible starts, and
> > where possible using values from pointer blocks.
>
> > A lot of commercial PCs, such as Dell and Sony start a disk with a
> > short - often FAT - hidden partition that is used for recovery.  
> > The data is then on the second logical partition.
>
> > Once a partition has been selected for recovery, for logical recovery
> > my NTFS function does require valid values for cluster size and the
> > start of the MFT.  There are helper functions for each of these.
> > (Analyse disk...)
> > As you now have an image, you can make as many mistakes as you like,
> > and will not lose more data.
>
> More nonsense.
> After 'your' socalled 'mistake' you have to re-image again.
> The only way to make mistakes without loosing data is to
> keep yet another copy of the image as a backup or not to
> allow any changes to the image and use it as a source only.
>
>
>
> > For a partially damaged drive, the most
> > successful function to use with NTFS recovery is 'Recover from file
> > entries'  This will read each MFT in sequence, rather than trying to
> > read with the logical directory tree.  Thus, if a critical part of the
> > directory tree has failed, files will still be found with valid names.  
> > If the MFT structure is damaged, the whole disk can be scanned
> > for MFTs.
>
> > On the NTFS screen is a function for file filter - this can be use
> > to select just your .tax files.
>
> > Function key F1 will give contect sensitive help on every screen
>
> > Michael- Hide quoted text -
>
> - Show quoted text -- Hide quoted text -
>
> - Show quoted text -

It is a pity that you do not know what the software I wrote actually
does.

One important thing is that it never changes the source. If the boot
sector needs updating, it does so on a virtual boot sector, not the
real thing, thus any trial and error mistake does not change the
source.

Newsgroups are here to share information, and generally assist, not to
run others down.

Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

mscotgrove.RemoveThis@aol.com wrote in news:0110bead-54de-43cb-a3c4-8c00c0ecc005@e23g2000prf.googlegroups.com
> On Jan 8, 7:59 am, Arno Wagner <m....RemoveThis@privacy.net> wrote:
> > Previously Bob Simon <nob....RemoveThis@nowhere.com> wrote:
> >
> > > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m....RemoveThis@privacy.net> wrote:
> > > I'm the OP and I'm back after having installed a new drive, imaged the
> > > bad drive and then removing power from the bad drive. Now I'm ready
> > > to try to reconstruct whatever I can from the image and am looking for
> > > some pointers.
> > > For tools, I have UBCD plus the program that Michael wrote,
> > > cnwrecovery. I compared the current partition map with an old
> > > printout from Ranish Partition Manager and they match. Here's a
> > > section from RPM:
> > > 2 Pri 1 Windows NT NTFS 0 1 1 254 254 63
> > > 3 Pri 2 Extended LBA 255 0 1 15770 254 63
> > > 4 A Log Windows NT NTFS 255 1 1 15770 254 63
> > > 5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63
> > > Why is partition 4 listed as A Log? I'm pretty sure this is where the
> > > data is that I really want to find.
> >
> > "Log" very likely means "Logical Partition".
> >
> > The above would be primaries 1,3 and a logical contained in
> > primary 2, which is an extended patition,. i.e. a container
> > for logical partitions.
> >
> > Arno
>
> The partition function in my program will give the size of each partition,
> and the starting location. If it needs to be reconstructed, thye recon-
> struction routine will scan the drive looking for possible starts, and
> where possible using values from pointer blocks.
>
> A lot of commercial PCs, such as Dell and Sony start a disk with a
> short - often FAT - hidden partition that is used for recovery.
> The data is then on the second logical partition.
>
> Once a partition has been selected for recovery, for logical recovery
> my NTFS function does require valid values for cluster size and the
> start of the MFT. There are helper functions for each of these.
> (Analyse disk...)

> As you now have an image, you can make as many mistakes as you like,
> and will not lose more data.

More nonsense.
After 'your' socalled 'mistake' you have to re-image again.
The only way to make mistakes without loosing data is to
keep yet another copy of the image as a backup or not to
allow any changes to the image and use it as a source only.

> For a partially damaged drive, the most
> successful function to use with NTFS recovery is 'Recover from file
> entries' This will read each MFT in sequence, rather than trying to
> read with the logical directory tree. Thus, if a critical part of the
> directory tree has failed, files will still be found with valid names.
> If the MFT structure is damaged, the whole disk can be scanned
> for MFTs.
>
> On the NTFS screen is a function for file filter - this can be use
> to select just your .tax files.
>
> Function key F1 will give contect sensitive help on every screen
>
> Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

mscotgrove.DeleteThis@aol.com wrote in news:457da410-83d1-4a89-bdb9-4df256fb6ba0@i7g2000prf.googlegroups.com
> On Jan 8, 3:04 pm, "bobneworle...@yahoo.com" <bobneworle....DeleteThis@yahoo.com> wrote:
> > On Jan 8, 1:59 am, Arno Wagner <m....DeleteThis@privacy.net> wrote:
> > > Previously Bob Simon <nob....DeleteThis@nowhere.com> wrote:
> >
> > > > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m....DeleteThis@privacy.net> wrote:
> > > > I'm the OP and I'm back after having installed a new drive, imaged the
> > > > bad drive and then removing power from the bad drive. Now I'm ready
> > > > to try to reconstruct whatever I can from the image and am looking for
> > > > some pointers.
> > > > For tools, I have UBCD plus the program that Michael wrote,
> > > > cnwrecovery. I compared the current partition map with an old
> > > > printout from Ranish Partition Manager and they match. Here's a
> > > > section from RPM:
> > > > 2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
> > > > 3 Pri 2 Extended LBA 255 0 1 15770 254 63
> > > > 4 A Log Windows NT NTFS 255 1 1 15770 254 63
> > > > 5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63
> > > > Why is partition 4 listed as A Log? I'm pretty sure this is where the
> > > > data is that I really want to find.
> >
> > > "Log" very likely means "Logical Partition".
> >
> > > The above would be primaries 1,3 and a logical contained in
> > > primary 2, which is an extended patition,. i.e. a container
> > > for logical partitions.
> >
> > > Arno
> >
> > Does this mean that when I attempt to recover a file in the logical
> > NTFS partition, whatever software I'm using will automatically
> > rebuild the container first? Or is this typically a two-step process
> > where I must first re-create the extended partition, then the NTFS
> > partition?- Hide quoted text -
> >
> > - Show quoted text -
>
> I can only speak for my own software but as far

> *as I understand it,*

> the container is just a way to have more than 4 partitions. On the
> boot sector, there is space for 4 records, ( starting at 0x1be) each
> defining a partition. By using one of those records to point to an
> extended partition, another 4 partitions may be added. The extended
> partition overhead is typically 64 sectors.
>
> For recovery, the only important thing is the start of the real
> partition. Therefore recovery of the extended partition on it's own
> is not required.
>
> Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

> Not quite what I found, when I traced this on sector level a long time
> ago. The structure was as follows: A main partition table entry points
> to a next partition sector, at the beginning of the space for the
> extended partition. This then had the extended parition described in
> entry 1 and a further partition sector pointed to, if I remember
> correctly. From there on it was basically a linked list (there were 5
> or so logical partitions), were entry 1 described the logical
> partition and entry 2 pointed to an additional partition sector at the
> beginning of the next logical partition.
>
> I don't know whether this is standard, but it seems the 4 entries in
> the extended partitition description(s) are not all used.
>
> > For recovery, the only important thing is the start of the real
> > partition.  Therefore recovery of the extended partition on it's own
> > is not required.
>
> True, of course.
>
> Arno- Hide quoted text -
>
> - Show quoted text -

What you describe is what I have always seen, but I think in theory,
all 4 entries could be used. After all, the first extended pointer
is any one of the 4 pointers in the boot sector. I don't remember
seeing a pattern, but also I don't remember seeing more than one
extended pointer at a time.

Michael
 >> Stay informed about: Look for filename in drive without valid MBR