Recovery of data from deleted MBR.

I am writting this at a very depressed time. I just found out that an assclown friend of mine who was formatting a machine - deleted MBR of my HDD instead of the new HDD where he was suppose to install windows. It's a WD external HDD and holds all my data from few years. I dont keep any data on my laptop or live HDD which gets connected to internet daily but in an external drive that i attach only when i need the data.

this HDD has eveything that i have worked on and personal data in last few years and loss of data from this is going to be very damaging.

I am asking for urgent help from anyone who can suggest anything to recover the data.

He did not install the windows but just deleted the MBR and realized what he was doing. I am getting a copy of Ontrack recovery software that i had used in the past which might help me.


Any suggestion is helpful.













(I wish for this downward spiral of life to end.)

Yes... A long time sporadic troll finally coming out of the dark here... :) But since the forums aren't as busy as they once were I thought I actually contribute a bit.

By MBR do you mean your partition table? If only your partition table is hosed you could pretty easily reconstruct it using something like a live boot cd (knoppix, system rescue cd, gparted come to mind).

If you're lucky most hard disks start their first partition at sector 63. So running fdisk (the one for linux allows you to use the -u option to change units to sectors, I haven't touched Microsoft's fdisk for years so not sure what the flag would be for that one) create you partition starting at sector 63 then setting the ending size to the end of your disk might allow you to once again mount your filesystem.

There are more complicated ways using TSK (the SleuthKit), to find your filesystem's signature to know which sector offset it starts at then reconstruct the partition table from that information but trying the sector 63 trick might be the quickest and easiest.

Another tool I've used that can look for filesystems on a block device (regardless of the state of a partition table) is called testdisk, so something else to try if you're still having problems.

Good luck.

I honestly haven't tried to make sense of the first few sentence’s you've written but i did use testdisk and I’ve recovered the filesystem.


Thank you very much, I really appreciate it.

I wonder if you could have used the built-in fixmbr program that is included with the Windows installation disk?

Quote:

---

Originally Posted by westin

I wonder if you could have used the built-in fixmbr program that is included with the Windows installation disk?

---

that's exactly what i was going to suggest. :)

fixmbr
&
fixboot

you didn't mention what OS you are using, if it's XP then just throw the install disc in boot from that, and enter the "Recovery Console" select the partition type in the administrator password and type the 2 commands, restart the machine and see if that works.

I'm actually suprised Byte that considering you've done all these exams you didn't know how to fix a mbr :confused:

There is no denying the fact that I did not use the fixmbr and fixboot command, it never even clicked my mind. I am not going to shy away from the fact that the only 2 things that i did once my friend told me what had happened was to download Ontrack recovery and start this thread.


Like i've said before i did recover everything with the utility suggested earlier.

Moving on I am not sure if fixboot would have worked since this is an external disk without a boot partition (my situation involved a WD USB based external HDD). Fixmbr may have done the trick, however it never clicked me.

Lastly with the all exams that I've done none of them teach me anything that went on yesterday. I am not going to deny knowing basic commands such as fixmbr and fixboot is essential and again there is no denying that they never struck me.

All that i did learning from real world experience and those exams is to keep my data off my laptop and get one more HDD and create a second backup (which i did today).


Thanks again.

Parth

even if the fixboot / fixmbr didn't work, you could boot up from a *nix live CD/DVD and run gparted and manually re-add the mbr. :)

i wasn't having a shot at you Byte, i was just awfully confused on how you didn't think of it. ;)

Hybrid buddy.. i came online just to tell you.. its all okay man.. i didnt take your reply as picking on me.. I'm sorry if my reply suggested otherwise..

Monday .. So have a great week .. ;)

You have a disk that's external and has VERY important info on it and it's not backed up anywhere else? Maybe use this as a lesson in making more than one copy of something important?

Either get another drive you can copy this stuff too, or make a CD or something man.

Hey,

We're probably all more lackadaisical with our own systems. The shoemakers kids have the worst shoes...

We all need to have a scare now and then. Back in the days before BIOS auto configured I updated a BIOS, had a brain fart and did not configure at startup and just about went on a killing frenzy when the board wouldn't recognize any drives, couldn't roll back, couldn't go forward....

Hi there ByTe,

Been a bit busy these past few days so I couldn't help :(

I think that I understand your layout...............you have a laptop with its own HDD which is bootable and contains your OS. Your personal data are stored on an external (USB connection) that you have not defined as bootable? Effectively it is like a slave drive to a desktop?

"Fixboot" won't work because the drive isn't bootable ;)

"Fixmbr" might work (I have never tried in this particular situation) because it will find the backup record that is hidden on the drive and reinstall it:)

Your problem is that your Master File Table (MFT) was deleted. This contains metadata that defines an NTFS volume, and is a part of the MBR.

A recovery application such as you mentioned should work, as should the various bootable disks mentioned (remember to go into BIOS and allow them to boot ;)).

So, why am I posting this crap guys?

Well, there is this App I have been using for years........it works, and it is free, and there are Windoze and Linux versions.

WARNING:

This is pretty much an avenue of last resort, as it takes a long time to run, and requires a drive or partition of at least equal size to the one to be recovered.

It doesn't care about your MBR or whatever, as it works at a very low level, scanning your drive and re-assembling files. It will even re-assemble damaged files as best it can, and work on damaged drives, so long as they can spin.

It has never let me down, although I haven't had to use it a lot (thank God!)

Windows and Linux versions available :D

It is roadkil's "unstoppable copier"

http://www.roadkil.net/

There is a lot of other free stuff on his site, so I gave you the main link rather than the direct one:cool: