-
June 4th, 2010, 07:15 PM
#1
Recovery of data from deleted MBR.
I am writting this at a very depressed time. I just found out that an assclown friend of mine who was formatting a machine - deleted MBR of my HDD instead of the new HDD where he was suppose to install windows. It's a WD external HDD and holds all my data from few years. I dont keep any data on my laptop or live HDD which gets connected to internet daily but in an external drive that i attach only when i need the data.
this HDD has eveything that i have worked on and personal data in last few years and loss of data from this is going to be very damaging.
I am asking for urgent help from anyone who can suggest anything to recover the data.
He did not install the windows but just deleted the MBR and realized what he was doing. I am getting a copy of Ontrack recovery software that i had used in the past which might help me.
Any suggestion is helpful.
(I wish for this downward spiral of life to end.)
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
June 4th, 2010, 08:53 PM
#2
Yes... A long time sporadic troll finally coming out of the dark here... But since the forums aren't as busy as they once were I thought I actually contribute a bit.
By MBR do you mean your partition table? If only your partition table is hosed you could pretty easily reconstruct it using something like a live boot cd (knoppix, system rescue cd, gparted come to mind).
If you're lucky most hard disks start their first partition at sector 63. So running fdisk (the one for linux allows you to use the -u option to change units to sectors, I haven't touched Microsoft's fdisk for years so not sure what the flag would be for that one) create you partition starting at sector 63 then setting the ending size to the end of your disk might allow you to once again mount your filesystem.
There are more complicated ways using TSK (the SleuthKit), to find your filesystem's signature to know which sector offset it starts at then reconstruct the partition table from that information but trying the sector 63 trick might be the quickest and easiest.
Another tool I've used that can look for filesystems on a block device (regardless of the state of a partition table) is called testdisk, so something else to try if you're still having problems.
Good luck.
-
June 4th, 2010, 10:06 PM
#3
I honestly haven't tried to make sense of the first few sentence’s you've written but i did use testdisk and I’ve recovered the filesystem.
Thank you very much, I really appreciate it.
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
June 5th, 2010, 12:09 AM
#4
I wonder if you could have used the built-in fixmbr program that is included with the Windows installation disk?
\"Those of us that had been up all night were in no mood for coffee and donuts, we wanted strong drink.\"
-HST
-
June 5th, 2010, 06:13 AM
#5
Originally Posted by westin
I wonder if you could have used the built-in fixmbr program that is included with the Windows installation disk?
that's exactly what i was going to suggest.
fixmbr
&
fixboot
you didn't mention what OS you are using, if it's XP then just throw the install disc in boot from that, and enter the "Recovery Console" select the partition type in the administrator password and type the 2 commands, restart the machine and see if that works.
I'm actually suprised Byte that considering you've done all these exams you didn't know how to fix a mbr
-
June 5th, 2010, 07:18 PM
#6
There is no denying the fact that I did not use the fixmbr and fixboot command, it never even clicked my mind. I am not going to shy away from the fact that the only 2 things that i did once my friend told me what had happened was to download Ontrack recovery and start this thread.
Like i've said before i did recover everything with the utility suggested earlier.
Moving on I am not sure if fixboot would have worked since this is an external disk without a boot partition (my situation involved a WD USB based external HDD). Fixmbr may have done the trick, however it never clicked me.
Lastly with the all exams that I've done none of them teach me anything that went on yesterday. I am not going to deny knowing basic commands such as fixmbr and fixboot is essential and again there is no denying that they never struck me.
All that i did learning from real world experience and those exams is to keep my data off my laptop and get one more HDD and create a second backup (which i did today).
Thanks again.
Parth
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
June 6th, 2010, 04:29 AM
#7
-
June 7th, 2010, 04:20 PM
#8
Hybrid buddy.. i came online just to tell you.. its all okay man.. i didnt take your reply as picking on me.. I'm sorry if my reply suggested otherwise..
Monday .. So have a great week ..
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
June 7th, 2010, 11:38 PM
#9
You have a disk that's external and has VERY important info on it and it's not backed up anywhere else? Maybe use this as a lesson in making more than one copy of something important?
Either get another drive you can copy this stuff too, or make a CD or something man.
-
June 8th, 2010, 03:06 AM
#10
Hey,
We're probably all more lackadaisical with our own systems. The shoemakers kids have the worst shoes...
We all need to have a scare now and then. Back in the days before BIOS auto configured I updated a BIOS, had a brain fart and did not configure at startup and just about went on a killing frenzy when the board wouldn't recognize any drives, couldn't roll back, couldn't go forward....
ddddc
"Somehow saying I told you so just doesn't cover it" Will Smith in I, Robot
Similar Threads
-
By cheyenne1212 in forum Miscellaneous Security Discussions
Replies: 7
Last Post: February 1st, 2012, 02:51 PM
-
By ThePreacher in forum Miscellaneous Security Discussions
Replies: 17
Last Post: December 14th, 2006, 09:37 PM
-
By -DaRK-RaiDeR- in forum Newbie Security Questions
Replies: 9
Last Post: December 14th, 2002, 08:38 PM
-
By E5C4P3 in forum Miscellaneous Security Discussions
Replies: 5
Last Post: March 7th, 2002, 07:35 AM
-
By antihaxor in forum Non-Security Archives
Replies: 0
Last Post: January 24th, 2002, 05:42 PM
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|