Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Recovery of data from deleted MBR.

  1. #1

    Recovery of data from deleted MBR.

    I am writting this at a very depressed time. I just found out that an assclown friend of mine who was formatting a machine - deleted MBR of my HDD instead of the new HDD where he was suppose to install windows. It's a WD external HDD and holds all my data from few years. I dont keep any data on my laptop or live HDD which gets connected to internet daily but in an external drive that i attach only when i need the data.

    this HDD has eveything that i have worked on and personal data in last few years and loss of data from this is going to be very damaging.

    I am asking for urgent help from anyone who can suggest anything to recover the data.

    He did not install the windows but just deleted the MBR and realized what he was doing. I am getting a copy of Ontrack recovery software that i had used in the past which might help me.


    Any suggestion is helpful.













    (I wish for this downward spiral of life to end.)
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  2. #2
    Junior Member
    Join Date
    Apr 2004
    Location
    United States
    Posts
    24
    Yes... A long time sporadic troll finally coming out of the dark here... But since the forums aren't as busy as they once were I thought I actually contribute a bit.

    By MBR do you mean your partition table? If only your partition table is hosed you could pretty easily reconstruct it using something like a live boot cd (knoppix, system rescue cd, gparted come to mind).

    If you're lucky most hard disks start their first partition at sector 63. So running fdisk (the one for linux allows you to use the -u option to change units to sectors, I haven't touched Microsoft's fdisk for years so not sure what the flag would be for that one) create you partition starting at sector 63 then setting the ending size to the end of your disk might allow you to once again mount your filesystem.

    There are more complicated ways using TSK (the SleuthKit), to find your filesystem's signature to know which sector offset it starts at then reconstruct the partition table from that information but trying the sector 63 trick might be the quickest and easiest.

    Another tool I've used that can look for filesystems on a block device (regardless of the state of a partition table) is called testdisk, so something else to try if you're still having problems.

    Good luck.

  3. #3
    I honestly haven't tried to make sense of the first few sentence’s you've written but i did use testdisk and I’ve recovered the filesystem.


    Thank you very much, I really appreciate it.
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  4. #4
    Gonzo District BOFH westin's Avatar
    Join Date
    Jan 2006
    Location
    SW MO
    Posts
    1,187
    I wonder if you could have used the built-in fixmbr program that is included with the Windows installation disk?
    \"Those of us that had been up all night were in no mood for coffee and donuts, we wanted strong drink.\"

    -HST

  5. #5
    HYBR|D
    Guest
    Quote Originally Posted by westin View Post
    I wonder if you could have used the built-in fixmbr program that is included with the Windows installation disk?
    that's exactly what i was going to suggest.

    fixmbr
    &
    fixboot

    you didn't mention what OS you are using, if it's XP then just throw the install disc in boot from that, and enter the "Recovery Console" select the partition type in the administrator password and type the 2 commands, restart the machine and see if that works.

    I'm actually suprised Byte that considering you've done all these exams you didn't know how to fix a mbr

  6. #6
    There is no denying the fact that I did not use the fixmbr and fixboot command, it never even clicked my mind. I am not going to shy away from the fact that the only 2 things that i did once my friend told me what had happened was to download Ontrack recovery and start this thread.


    Like i've said before i did recover everything with the utility suggested earlier.

    Moving on I am not sure if fixboot would have worked since this is an external disk without a boot partition (my situation involved a WD USB based external HDD). Fixmbr may have done the trick, however it never clicked me.

    Lastly with the all exams that I've done none of them teach me anything that went on yesterday. I am not going to deny knowing basic commands such as fixmbr and fixboot is essential and again there is no denying that they never struck me.

    All that i did learning from real world experience and those exams is to keep my data off my laptop and get one more HDD and create a second backup (which i did today).


    Thanks again.

    Parth
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  7. #7
    HYBR|D
    Guest

    Post

    even if the fixboot / fixmbr didn't work, you could boot up from a *nix live CD/DVD and run gparted and manually re-add the mbr.

    i wasn't having a shot at you Byte, i was just awfully confused on how you didn't think of it.

  8. #8
    Hybrid buddy.. i came online just to tell you.. its all okay man.. i didnt take your reply as picking on me.. I'm sorry if my reply suggested otherwise..

    Monday .. So have a great week ..
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  9. #9
    Senior Member gore's Avatar
    Join Date
    Oct 2002
    Location
    Michigan
    Posts
    7,177
    You have a disk that's external and has VERY important info on it and it's not backed up anywhere else? Maybe use this as a lesson in making more than one copy of something important?

    Either get another drive you can copy this stuff too, or make a CD or something man.

  10. #10
    Disgruntled Postal Worker fourdc's Avatar
    Join Date
    Jul 2002
    Location
    Vermont, USA
    Posts
    797
    Hey,

    We're probably all more lackadaisical with our own systems. The shoemakers kids have the worst shoes...

    We all need to have a scare now and then. Back in the days before BIOS auto configured I updated a BIOS, had a brain fart and did not configure at startup and just about went on a killing frenzy when the board wouldn't recognize any drives, couldn't roll back, couldn't go forward....
    ddddc

    "Somehow saying I told you so just doesn't cover it" Will Smith in I, Robot

Similar Threads

  1. Windows Error Messages
    By cheyenne1212 in forum Miscellaneous Security Discussions
    Replies: 7
    Last Post: February 1st, 2012, 02:51 PM
  2. Port List
    By ThePreacher in forum Miscellaneous Security Discussions
    Replies: 17
    Last Post: December 14th, 2006, 09:37 PM
  3. Newbies, list of many words definitions.
    By -DaRK-RaiDeR- in forum Newbie Security Questions
    Replies: 9
    Last Post: December 14th, 2002, 08:38 PM
  4. Information Leakage from Optical Emanations
    By E5C4P3 in forum Miscellaneous Security Discussions
    Replies: 5
    Last Post: March 7th, 2002, 07:35 AM
  5. Traceroute: under the hood
    By antihaxor in forum Non-Security Archives
    Replies: 0
    Last Post: January 24th, 2002, 05:42 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •