Need a HD partition table recovery expert - Disk Editor
Greetings;
I am trying to recover data off of a drive. I can only assume that this person that I'm trying to help has nuked the partition table. I read the several great responses that Mark Wharton wrote concerning recovering a disk. It was similar to this. I've tried data recover from getdataback which came up with nothing. I tried the recover partition; also nothing.
I'll attach the Sector 0, two shots of sector 63 (which I believe are important, though I am only guessing), a shot of sector 2048, and the ending sector of the disk.
I'm pretty sure I just need to tell the disk what Partition Table (FAT32/NTFS/etc) is on the disk for it to be recognizable. There is a lot of data on the disk, so I'm pretty certain that everything is still there.
*quick edit* I did not notice the archived forums. I'm going to hunt over there while I await a response here.
Thank you so much for replying!
I definitely should have stated that this was an external WD drive.
Let us assume that there was no encryption.
It was being used by a Windows XP machine, but I do not know how it was formatted (oh joy, I know. I can't seem to find the drive standard, and because it is a 1 TB drive, the format could be either FAT32 or NTFS).
It was not being booted, as far as I know, but I will try that and let you know if anything pops out at me.
I'll search for NTFS and let you know what turns up.
Thanks again!
Unfortunately (or fortunately...? I haven't a clue) there was no "NTFS" found in the front of the drive (didn't search the whole drive, I hope that's OK).
The View As NTFS/FAT32 boot loader, and couldn't really see anything that stood out. Should I perhaps search for something while in that view? Something like ".doc" or the like?
Here is what normal XP NTFS and FAT32 boot sectors look like. You could try searching for some of the text.
Matt (responding to your PM):
Since the 64-byte partition table contains all zeros then your hunch is correct - your friend managed to delete it. If GetDataBack or TestDisk can't find anything on the disk then this doesn't look like it will have a good outcome. But try one thing before coming to that conclusion. If the disk was formatted by XP then the first partition on the disk should start at sector 63. Since sector 63 doesn't look like an NTFS boot sector then perhaps the disk was formatted as FAT32. So let's make an educated guess that this was the case. Therefore, the first entry in the partition table should look like the attached screen shot. I've modified the ending sector so that the size of the partition is the nearest integer multiple of 63. Enter the values shown, save the sector, and then see what you can see.
Mud and Mark, thank you both so much for your collective insight. Mud, I'm searching for the above, but it doesn't look like it's finding anything.
Mark, before I pull the trigger on this, I realized (and by realized, I mean I was told via email about an hour ago) that this was an external drive that was made by western digital (like a My Book) and then the connector was pulled and placed into an Antec external drive. I'm starting to wonder if this is going to make a difference or not.
Also, because this was not a boot-able drive, should I leave "boot" flag unchecked?
I guess I could uncheck it and then check it...
I'll give it a shot, as nothing else has seemed to work thus far.
It is saying "None Partition: 0xC (FAT32 LBA)
Can I attempt the same thing except trying it as an NTFS Partition?
Also, I'm going to do a search for msdos and NTFS... I'm starting to wonder if WD left a hidden partition at the beginning of the drive (with all of their software they bundle).
Thanks again!
So, I found an "NTFS" within the drive, but it seems very deep to be what we're looking for.
Sorry, for the additional edit, but I don't want to keep posting new replies and hogging up the forums. I made the change that you told me to at sector 0... I'm starting to think that was a mistake. I was looking at the bottom left of your screenshot, and saw that you were at absolute zero, so I figured that was where I was to start.
When I saw that the switch to FAT32 didn't work, I started to look over the drive, and I have realized that sector 63 looks nothing like the above posted screens that Mud took.
If this is the case, should I mark the absolute zero sector with nothing and alter 63?
The partition table is in Sector 0 so that information has to go there.
Whether the partition is marked "bootable" or not shouldn't make any difference.
Sector 63 does not look like a normal boot sector. Did you search the entire drive?
Have you just scrolled through the sectors using the Disk Editor to see if anything looks like normal file data? Usually, you can see things like text files, Word files, databases, etc. since they contain a lot of text. Video, pictures, and music type files will look more like random data.
Did you find out for sure that the drive was setup standard (no compression, no encryption, no special formatting or configuration used)?
Is the drive just a regular WD drive or is it actually out of a MyBook?
This is out of a My Book (an actual external drive... the particulars of how this got messed up are just incredible. Needless to say, I am the second person looking at this drive. The original person clearly didn't do their homework). I'll look for word files, etc. I've tried before, but I like where you're going with this.
Do you have a similar MyBook available so you could compare what the MBR, partition table, and boot sector look like?
Have you tried installing the MyBook software and then seeing if you can access the drive?
Some of those drives support password protection and hardware encryption. Some also were able to be hacked to enable hardware encryption.
Thanks again for the help.
I will find out that info ASAP. I have not tried installing the MyBook software... good idea...
Unfortunately, I have no other HDD to make comparisons with.