Partition Repair & Recovery

scott · 发表于 2006-12-3 05:38:50

All file systems use the first sector of a hard drive as a partition block. This sector contains the total number of sectors in the drive (a.k.a. Disk Capacity), size of the primary partition, defines the file system on the primary partition, the location of the next partition and the location of the boot block. The partition combined with the boot block is also referred to as the Master Boot Record or Boot Strap. In a Hex Viewer or Editor using Absolute Sector mode this will be sector 1(one). In LBA mode it is sector 0(zero).

A partition is one sector or 512 bytes in length and defines the size of the partition and indicates the beginning sector of the boot block(s). All partitions have a signature located in the last 2 bytes of the sector which is 55AA (hex, of course). The use of "overlay" programs such as Disk Manager in some cases installs additional sectors, which will need to be considered, that changes the location of partitions and boot sectors. If you've used one of these programs, you're pretty much on your own to figure-out how to fix or replace a partition. Of course, you could send your media to a data recovery service company. If your data is mission-critical, that would not be a bad idea. If you're hardcore, poor or just plain stubborn you can try the following;

Partition Recovery - Patching
First - You'll need a hard drive that is the same size or larger than the one that has failed. We'll call this the "clone drive". Doing this prior to imaging the drive would not be a bad idea and can save you from doing things twice.

Second - If the drive is exactly the same size as the one that failed you can skip this step. Set your BIOS hard drive setting to match the Cylinders, Heads and Sectors that the failed drive used. LBA mode can be set to Auto. Note: Using autodetect for the drive will not work as the capacity will be too large.

Third - Partition the drive to have the same size partition that existed on the failed drive and format the partition with the same file system that existed on the failed drive.

Fourth - Using a hex editor, copy sector 1 (or sector 0 depending how it's viewed) to a file. We'll call this "Sec1file".

Fifth - Image the failed drive to the "clone drive".

Sixth - Using a hex editor again, copy "Sec1file" to sector 1 (or sector 0, depending on how it's viewed) to the "clone drive".

The partition has now been replaced with one that is presumably good. If that was the only thing wrong with the structure, the drive should now mount properly in the operating system. If it does mount, you're ready to start copying data off the "clone drive" to a safe location. Once the data is copied off the "clone drive" you can then wipe the "clone drive" and re-install it normally. Using a patched drive for live data is not recommended.

Partition recovery can also be accomplished by modifying the content of the partition in specific areas with specific values. This is refered to as a manual rebuild of the partition sector and is not recommended for the typical end-user.

Partition Type Indicator
The partition type indicator is located at hex offset 1C2. The value can be changed to reflect the correct operating system/file system in the event it is corrupted or otherwise altered. Change the value to one of the following;
00 - Empty partition-table entry
01 - DOS FAT12
04 - DOS FAT16 (up to 32 MB)
05 - DOS 3.3+ extended partition
06 - DOS 3.31+ FAT16 (over 32 MB)
07 - OS/2 HPFS, Windows NT NTFS, Advanced Unix
08 - OS/2 v1.0-1.3, AIX bootable partition, SplitDrive
09 - AIX data partition
0A - OS/2 Boot Manager
0B - Windows 95+ FAT32
0C - Windows 95+ FAT32 (using LBA-mode INT 13 extensions)
0E - DOS FAT16 (over 32 MB, using INT 13 extensions)
0F - Extended partition (using INT 13 extensions)
17 - Hidden NTFS partition1B - Hidden Windows 95 FAT32 partition
1C - Hidden Windows 95 FAT32 partition (using LBA-mode INT 13 extensions)
1E - Hidden LBA VFAT partition
42 - Dynamic disk volume
50 - OnTrack Disk Manager, read-only partition
51 - OnTrack Disk Manager, read/write partition
81 - Linux
82 - Linux Swap partition, Solaris (Unix)
83 - Linux native file system (ext2fs/xiafs)
85 - Linux EXT
86 - FAT16 volume/stripe set (Windows NT)
87 - HPFS fault-tolerant mirrored partition, NTFS volume/stripe set BE - Solaris boot partition
C0 - DR-DOS/Novell DOS secured partition
C6 - Corrupted FAT16 volume/stripe set (Windows NT)
C7 - Corrupted NTFS volume/stripe set
F2 - DOS 3.3+ secondary partition
Source: winhex Help File

Use extreme caution when changing these values. Running a file system repair utility after changing this value can render your data unrecoverable.

Comments
Shameless plug ... Automatic partition r
Written by JoepThis email address is being protected from spam bots, you need Javascript enabled to view it on 2006-11-28 07:47:14 IP: 62.221.202.104
--------------------------------------------------------------------------------
Hello,

For those lacking the confidence for editing partition tables themselves:

DIY DataRecovery DiskPatch is a utility that will recover lost partitions for you automatically. It will scan the disk and list the partitions. All you have to do is select the partitions you need back ...

Recommendation
Written by Rick MyersThis email address is being protected from spam bots, you need Javascript enabled to view it on 2006-11-28 08:07:15 IP: 69.171.178.103
--------------------------------------------------------------------------------
While Joep offers his comment as a "Shameless Plug" I can recommend DiskPatch without reservation. I've tested the product from multiple angles and worked with Joep during the testing. Not only does the product perform as stated, support is unparalleled.

Only registered users can write comments.
Please login or register.