Look for filename in drive without valid MBR

Previously mscotgrove RemoveThis @aol.com <mscotgrove RemoveThis @aol.com> wrote:
>> Not quite what I found, when I traced this on sector level a long time
>> ago. The structure was as follows: A main partition table entry points
>> to a next partition sector, at the beginning of the space for the
>> extended partition. This then had the extended parition described in
>> entry 1 and a further partition sector pointed to, if I remember
>> correctly. From there on it was basically a linked list (there were 5
>> or so logical partitions), were entry 1 described the logical
>> partition and entry 2 pointed to an additional partition sector at the
>> beginning of the next logical partition.
>>
>> I don't know whether this is standard, but it seems the 4 entries in
>> the extended partitition description(s) are not all used.
>>
>> > For recovery, the only important thing is the start of the real
>> > partition.  Therefore recovery of the extended partition on it's own
>> > is not required.
>>
>> True, of course.
>>
>> Arno- Hide quoted text -
>>
>> - Show quoted text -

> What you describe is what I have always seen, but I think in theory,
> all 4 entries could be used. After all, the first extended pointer
> is any one of the 4 pointers in the boot sector. I don't remember
> seeing a pattern, but also I don't remember seeing more than one
> extended pointer at a time.

I have no idea whether this is required to be implemented fully general
(which would also aloww tree-like structures) or what the limits are.

Arno
 >> Stay informed about: Look for filename in drive without valid MBR 

>
>
>
> > One important thing is that it never changes the source.  
>
> ... so obviously there won't be any mistakes to make, yet that is what you wrote.
>
> And if it doesn't change the source you have to get yet another new disk
> to recover all your files to.
>

This is correct - to try and recover data onto the original disk is
very dangerous. Recovery is required when something has gone wrong,
and the normal operating system will not help. To have the greatest
chance of retaining your data, copy all files to a new location. Yes,
this may mean a new disk drive, but at say $100, this gives a large
peace of mind.

> > If the boot sector needs updating, it does so on a virtual boot sector,
>
> What's the point if it doesn't get used by the OS, the ultimate test.

The ultimate test is correctly recovered user files. Making the
original disk work again may be a bonus, but in my opinion, not very
important.

>
> > not the real thing, thus any trial and error mistake does not change the source.
>
> There's much more than just the bootsector(s) when it comes to trial and
> error. There is no excessive unused space on a drive to also keep virtual
> FATs directories and what have you.
>
> > Newsgroups are here to share information, and generally assist,
>
> They are also not meant to take commercially advantage of.
> Which is exactly what you do.
>
> I 'assist' in pointing you out.
>
> > not to run others down.
>
> I have no problem running commercial spammers down.
>

I have no intention of spamming. I will try and assist other members,
as well as asking questions. If I suggest my program may be of use, I
try and make it clear that I have an interest in the program, and so
it is not impartial advice. If someone asks how to do something, and
I have a solution, I will tell them - and often other members of the
newsgroup will suggest other programs as well. It is up to readers to
make their own mind up.

Could other members of the newsgroup tell me if I am right or wrong,
or somewhere in the middle.

>
>
>
>
> > Michael- Hide quoted text -
>
> - Show quoted text -- Hide quoted text -
>
> - Show quoted text -
 >> Stay informed about: Look for filename in drive without valid MBR 

mscotgrove DeleteThis @aol.com wrote in news:49327186-7ade-4a7f-b126-a21052d33e22@v67g2000hse.googlegroups.com
> On Jan 8, 5:00 pm, "Folkert Rienstra" <see_reply... DeleteThis @myweb.nl> wrote:
> > mscotgr... DeleteThis @aol.com wrote innews:0110bead-54de-43cb-a3c4-8c00c0ecc005@e23g2000prf.googlegroups.com
> > > On Jan 8, 7:59 am, Arno Wagner <m... DeleteThis @privacy.net> wrote:
> > > > Previously Bob Simon <nob... DeleteThis @nowhere.com> wrote:
> >
> > > > > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m... DeleteThis @privacy.net> wrote:
> > > > > I'm the OP and I'm back after having installed a new drive, imaged the
> > > > > bad drive and then removing power from the bad drive. Now I'm ready
> > > > > to try to reconstruct whatever I can from the image and am looking for
> > > > > some pointers.
> > > > > For tools, I have UBCD plus the program that Michael wrote,
> > > > > cnwrecovery. I compared the current partition map with an old
> > > > > printout from Ranish Partition Manager and they match. Here's a
> > > > > section from RPM:
> > > > > 2 Pri 1 Windows NT NTFS 0 1 1 254 254 63
> > > > > 3 Pri 2 Extended LBA 255 0 1 15770 254 63
> > > > > 4 A Log Windows NT NTFS 255 1 1 15770 254 63
> > > > > 5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63
> > > > > Why is partition 4 listed as A Log? I'm pretty sure this is where the
> > > > > data is that I really want to find.
> >
> > > > "Log" very likely means "Logical Partition".
> >
> > > > The above would be primaries 1,3 and a logical contained in
> > > > primary 2, which is an extended patition,. i.e. a container
> > > > for logical partitions.
> >
> > > > Arno
> >
> > > The partition function in my program will give the size of each partition,
> > > and the starting location. If it needs to be reconstructed, thye recon-
> > > struction routine will scan the drive looking for possible starts, and
> > > where possible using values from pointer blocks.
> >
> > > A lot of commercial PCs, such as Dell and Sony start a disk with a
> > > short - often FAT - hidden partition that is used for recovery.
> > > The data is then on the second logical partition.
> >
> > > Once a partition has been selected for recovery, for logical recovery
> > > my NTFS function does require valid values for cluster size and the
> > > start of the MFT. There are helper functions for each of these.
> > > (Analyse disk...)
> > > As you now have an image, you can make as many mistakes as you like,
> > > and will not lose more data.
> >
> > More nonsense.
> > After 'your' socalled 'mistake' you have to re-image again.
> > The only way to make mistakes without loosing data is to
> > keep yet another copy of the image as a backup or not to
> > allow any changes to the image and use it as a source only.
> >
> > > For a partially damaged drive, the most
> > > successful function to use with NTFS recovery is 'Recover from file
> > > entries' This will read each MFT in sequence, rather than trying to
> > > read with the logical directory tree. Thus, if a critical part of the
> > > directory tree has failed, files will still be found with valid names.
> > > If the MFT structure is damaged, the whole disk can be scanned
> > > for MFTs.
> >
> > > On the NTFS screen is a function for file filter - this can be use
> > > to select just your .tax files.
> >
> > > Function key F1 will give contect sensitive help on every screen
> >
> > > Michael- Hide quoted text -
> >
> > - Show quoted text -- Hide quoted text -
> >
> > - Show quoted text -
>
> It is a pity that you do not know what the software I wrote actually
> does.

Apparently neither do you ...

>
> One important thing is that it never changes the source.

.... so obviously there won't be any mistakes to make, yet that is what you wrote.

And if it doesn't change the source you have to get yet another new disk
to recover all your files to.

> If the boot sector needs updating, it does so on a virtual boot sector,

What's the point if it doesn't get used by the OS, the ultimate test.

> not the real thing, thus any trial and error mistake does not change the source.

There's much more than just the bootsector(s) when it comes to trial and
error. There is no excessive unused space on a drive to also keep virtual
FATs directories and what have you.

> Newsgroups are here to share information, and generally assist,

They are also not meant to take commercially advantage of.
Which is exactly what you do.

I 'assist' in pointing you out.

> not to run others down.

I have no problem running commercial spammers down.

>
> Michael
 >> Stay informed about: Look for filename in drive without valid MBR 

Arno Wagner wrote in news:5ujojkF1imhquU2@mid.individual.net
> Previously mscotgrove.RemoveThis@aol.com <mscotgrove.RemoveThis@aol.com> wrote:
> > > Not quite what I found, when I traced this on sector level a long time
> > > ago. The structure was as follows: A main partition table entry points
> > > to a next partition sector, at the beginning of the space for the
> > > extended partition. This then had the extended parition described in
> > > entry 1 and a further partition sector pointed to, if I remember
> > > correctly. From there on it was basically a linked list (there were 5
> > > or so logical partitions), were entry 1 described the logical
> > > partition and entry 2 pointed to an additional partition sector at the
> > > beginning of the next logical partition.
> > >
> > > I don't know whether this is standard, but it seems the 4 entries in
> > > the extended partitition description(s) are not all used.
> > >
> > > > For recovery, the only important thing is the start of the real
> > > > partition. Therefore recovery of the extended partition on it's own
> > > > is not required.
> > >
> > > True, of course.
> > >
> > > Arno- Hide quoted text -
> > >
> > > - Show quoted text -
>
> > What you describe is what I have always seen, but I think in theory,
> > all 4 entries could be used. After all, the first extended pointer
> > is any one of the 4 pointers in the boot sector. I don't remember
> > seeing a pattern, but also I don't remember seeing more than one
> > extended pointer at a time.

> I have no idea

Indeed, babblebot.

> whether this is required to be implemented fully general
> (which would also aloww tree-like structures) or what the limits are.
>
> Arno
 >> Stay informed about: Look for filename in drive without valid MBR 

Arno Wagner wrote in news:5uis36F1i2ad2U2@mid.individual.net
> Previously mscotgrove.TakeThisOut@aol.com <mscotgrove.TakeThisOut@aol.com> wrote:
> > On Jan 8, 3:04 pm, "bobneworle...@yahoo.com" bobneworle....TakeThisOut@yahoo.com wrote:
> > > On Jan 8, 1:59 am, Arno Wagner <m....TakeThisOut@privacy.net> wrote:
> > > > Previously Bob Simon <nob....TakeThisOut@nowhere.com> wrote:
> > >
> > > > > On 6 Jan 2008 08:21:19 GMT, Arno Wagner <m....TakeThisOut@privacy.net> wrote:
> > > > > I'm the OP and I'm back after having installed a new drive, imaged the
> > > > > bad drive and then removing power from the bad drive. Now I'm ready
> > > > > to try to reconstruct whatever I can from the image and am looking for
> > > > > some pointers.
> > > > > For tools, I have UBCD plus the program that Michael wrote,
> > > > > cnwrecovery. I compared the current partition map with an old
> > > > > printout from Ranish Partition Manager and they match. Here's a
> > > > > section from RPM:
> > > > > 2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
> > > > > 3 Pri 2 Extended LBA 255 0 1 15770 254 63
> > > > > 4 A Log Windows NT NTFS 255 1 1 15770 254 63
> > > > > 5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63
> > > > > Why is partition 4 listed as A Log? I'm pretty sure this is where the
> > > > > data is that I really want to find.
> > >
> > > > "Log" very likely means "Logical Partition".
> > >
> > > > The above would be primaries 1,3 and a logical contained in
> > > > primary 2, which is an extended patition,. i.e. a container
> > > > for logical partitions.
> > >
> > > > Arno
> > >
> > > Does this mean that when I attempt to recover a file in the logical
> > > NTFS partition, whatever software I'm using will automatically
> > > rebuild the container first? Or is this typically a two-step process
> > > where I must first re-create the extended partition, then the NTFS
> > > partition?- Hide quoted text -
> > >
> > > - Show quoted text -
>
> > I can only speak for my own software but as far as I understand it,
> > the container is just a way to have more than 4 partitions.
>
> Basically, yes.
>
> > On the boot sector, there is space for 4 records, ( starting at 0x1be)
> > each defining a partition. By using one of those records to point to an
> > extended partition, another 4 partitions may be added. The extended
> > partition overhead is typically 64 sectors.

> Not quite what I found, when I traced this on sector level a long time
> ago.

Yeah, why bother to read the definition when you can do it the hard way.

> The structure was as follows:

> A main partition table entry

Whatever that is.
Presumably he means the Extended Partition entry in the MBR.

> points to a next partition sector,

Whatever that is.
Presumably he means the address of the EPBR (Extended Partition Boot
Record) that describes both the enclosed logical partition and the re-
maining free extended partition.

> at the beginning of the space for the extended partition.

> This then had the extended parition

Not the extended partition but the logical partition within the extended partititon.

> described in entry 1

Just like any other ordinary primary partition definition.

> and a further partition sector pointed to,

the next Extended Partition Boot Record pointer and remaining free ex-
tended partition description.

> if I remember correctly.

Guess not then, babblebot.

> From there on it was basically a linked list (there were 5
> or so logical partitions), were entry 1 described the logical
> partition and entry 2 pointed to an additional partition sector
> at the beginning of the next logical partition.

It's a linked list directly from the start of the MBR entry.

>
> I don't know whether this is standard, but it seems the 4 entries in
> the extended partitition description(s) are not all used.
>
> > For recovery, the only important thing is the start of the real
> > partition. Therefore recovery of the extended partition on it's
> > own is not required.
>
> True, of course.
>
> Arno
 >> Stay informed about: Look for filename in drive without valid MBR 

mscotgrove.DeleteThis@aol.com wrote in
news:562b9d7b-504d-427a-8d2a-d4edc4855fb0@q77g2000hsh.googlegroups.com
> > > One important thing is that it never changes the source.
> >
> > ... so obviously there won't be any mistakes to make, yet that is what you
> > wrote.
> >
> > And if it doesn't change the source you have to get yet another new disk
> > to recover all your files to.
> >

> This is correct - to try and recover data onto the original disk

That's not what I said. I said that you need 2 new disks, not one.

> is very dangerous.

Yes it is with all those mediocre "me too" products.

> Recovery is required when something has gone wrong,

Rather depends on what went wrong. To acquire 2 new drives to recover
from a drive that had it's MBR wiped by mistake or accident or whatever
is rather over the top. Or that has different copies of FAT, and so on.

> and the normal operating system will not help.

Which it already won't with only minor problems.

> To have the greatest chance of retaining your data, copy all files to a
> new location.

> Yes, this may mean a new disk drive,

Two (2) new disk drives.

> but at say $100,

Times 2.

> this gives a large peace of mind.

Actually a lot of hassle, even the possibility of breaking something else in
the process of installing and de-installing of various hardware and/or cables.
Not to mention the huge amount of time that is involved in the copying.

>
> > > If the boot sector needs updating, it does so on a virtual boot sector,
> >
> > What's the point if it doesn't get used by the OS, the ultimate test.

> The ultimate test is correctly recovered user files.

For which you don't need to save anything to the disk at all, virtual or not.

> Making the original disk work again may be a bonus,

> but in my opinion, not very important.

Of course you don't find that important.
Your way earns you money, selling your product, alternative ways don't.

>
> >
> > > not the real thing, thus any trial and error mistake does not change the
> > > source.
> >
> > There's much more than just the bootsector(s) when it comes to trial and
> > error. There is no excessive unused space on a drive to also keep virtual
> > FATs directories and what have you.
> >
> > > Newsgroups are here to share information, and generally assist,
> >
> > They are also not meant to take commercially advantage of.
> > Which is exactly what you do.
> >
> > I 'assist' in pointing you out.
> >
> > > not to run others down.
> >
> > I have no problem running commercial spammers down.
> >

> I have no intention of spamming.

Yes you do. You only advice to use your own program.
You have no intention of recommending other products.

> I will try and assist other members,

Is that what you call it.

> as well as asking questions.

Nothing wrong with asking questions. Problem with you is that your
questions often have to do with your software and your software
becomes the topic of discussion and the question becomes yet another
advertorial for your software. IOW your questions are suspect:
Whitness: "ps The customer is happy with data recovered"

> If I suggest my program may be of use, I try and make it clear that
> I have an interest in the program,

You are actually trying to sell it, nomatter how you sugar coat it.

> and so it is not impartial advice.

> If someone asks how to do something, and I have a solution,

Usually that happens after you hooked someone into downloading
your program that prompts such question in the first place.

> I will tell them - and often other members of the
> newsgroup will suggest other programs as well.

So now you force others into naming other products
so as to level the playing field again.

> It is up to readers to make their own mind up.

> Could other members of the newsgroup tell me if I am right or wrong,
> or somewhere in the middle.

This type of question usually only invites the trolls (like Babblebot, Rodd-
less and Odiferous) within the group. The rest usually doesn't give a toss.

>
> > > Michael- Hide quoted text -
> >
> > - Show quoted text -- Hide quoted text -
> >
> > - Show quoted text -
 >> Stay informed about: Look for filename in drive without valid MBR 

"mscotgrove@aol.com" wrote:

<edited for brevity>

> I have no intention of spamming. I will try and assist other members,
> as well as asking questions. If I suggest my program may be of use, I
> try and make it clear that I have an interest in the program, and so
> it is not impartial advice. If someone asks how to do something, and
> I have a solution, I will tell them - and often other members of the
> newsgroup will suggest other programs as well. It is up to readers to
> make their own mind up.
>
> Could other members of the newsgroup tell me if I am right or wrong,
> or somewhere in the middle.


Hello, Michael:

You're right, and keep those helpful posts coming, please! <g>


Cordially,
John Turco <jtur DeleteThis @concentric.net>
 >> Stay informed about: Look for filename in drive without valid MBR