Oh God, what have I done? DEBUG.EXE

[Brandy Sullivan]

I was playing with a very small executable file in DEBUG on a slave
drive on one of my computers when I forgot to "name" the file I wanted
to write to. When I executed the write command I got an error saying not
enough space on hard drive. This drive had 30gigs plus free space. I'm
using Win98se.

Now the drive shows up as unformatted in Explorer and Scandisk but does
still show a valid partition in FDISK. The contents of the drive were
not critical but it would be nice to recover them. Is my FAT corrupted
or what did I do?

Can I fix it with a little work of my own or does this require expensive
software or a data recovery company do fix it?

All advice is greatly appreciated. Thanks.
Brandy

[Robert Redelmeier]

Post by Brandy Sullivan
I was playing with a very small executable file in DEBUG
on a slave drive on one of my computers when I forgot to
"name" the file I wanted to write to. When I executed the
write command I got an error saying not enough space on

Oh sh!t. Under some circumstances, the `w` command
under DEBUG will write absolute sectors. I don't have
the reference handy. You may have trashed sector 0 [MBR].

Post by Brandy Sullivan
Can I fix it with a little work of my own or does this
require expensive software or a data recovery company do
fix it?

You can always try booting on a rescue disk and running:

C:> FDISK /MBR

-- Robert

[a***@NOW.AT.arargh.com]

On Fri, 2 Jul 2004 22:16:25 +0000 (UTC), Robert Redelmeier

Post by Robert Redelmeier

Post by Brandy Sullivan
I was playing with a very small executable file in DEBUG
on a slave drive on one of my computers when I forgot to
"name" the file I wanted to write to. When I executed the
write command I got an error saying not enough space on

Oh sh!t. Under some circumstances, the `w` command
under DEBUG will write absolute sectors. I don't have
the reference handy. You may have trashed sector 0 [MBR].

Post by Brandy Sullivan
Can I fix it with a little work of my own or does this
require expensive software or a data recovery company do
fix it?

C:> FDISK /MBR

That would only work if you trash only the first part of sector 0.
Debug would have trashed the whole thing.

[Brandy Sullivan]

Post by a***@NOW.AT.arargh.com

Post by Robert Redelmeier
C:> FDISK /MBR

That would only work if you trash only the first part of sector 0.
Debug would have trashed the whole thing.

I agree. I did try the above command and the only difference now is that
fdisk says there is no partition set to be active. If I set the
partition active it still shows the drive as apparently not formatted.

I'm considering using Hard Drive Mechanic to diagnose the drive. I hear
SpinRite 6 is good but not cheap.
Brandy

[Bill Leary]

Post by Brandy Sullivan

Post by a***@NOW.AT.arargh.com

Post by Robert Redelmeier
C:> FDISK /MBR

That would only work if you trash only the first part of sector 0.
Debug would have trashed the whole thing.

I agree. I did try the above command and the only difference now is that
fdisk says there is no partition set to be active. If I set the
partition active it still shows the drive as apparently not formatted.

I had a customer do something similar to a ten or fifteen gig hard disk. He
was "playing" with all the .EXE's in the DOS directory. He never could
remember what he did, except that he was using DEBUG. The upshot was that
when I looked at the drive with FDISK it claimed the drive had no
partitions. When I looked at it with some utilities of my own, the
directories where still there, but the MBR was garbage. I used a non-MS-DOS
FDISK (I *think* [REPEAT **THINK**] the Free-DOS version) to lay down a new
MBR without clobbering the directory entries on the drive and got everything
back instantly.

Beyond the obvious concern that the above scenario doesn't match what
happened in your case, and thus might not apply, I'm also concerned about
that if you tell DEBUG to W with no parameters, what does it take for
length? One byte? One sector? All of memory? Anyone know? I don't
recall ever reading, and I'm not about to conduct an experiment on any of my
working systems.

As with any advice or suggestions, watch your behind. I'm just offering a
potentially similar experience. May be helpful, may make things worse.

- Bill

[Charles A. Crayne]

On Sun, 4 Jul 2004 03:26:00 +0000 (UTC)
"Bill Leary" <***@crayne.org> wrote:

:if you tell DEBUG to W with no parameters, what does it take for
:length?

Hex value in BX:CX bytes.

-- Chuck

[Jim Carlock]

Adding on to what Crayne indicated and going a little farther.

I've always used the following command inside of DEBUG
to set the file size of a file to be written:

rcx

It should display a current value of cx followed by a linefeed
and then a colon prompting for a new filesize.

Basically, it goes like this (I'll leave the DEBUG prompts in):

-n filename.exe
-rcx
cx 0000
:200
-w
-q

Then run the file at the DOS prompt. The value of CX contains
the length of the file in hex. Where the executable starts I don't
know, but I do know all .com files start execution at hex addr
0x0100.

Curious about what the BX is used for... as I haven't used that
in particular. Is that the starting address of the executable ? Or is
that the absolute position to write the file on the disk drive ?

Because if Brandy only wrote one byte to root of the drive, then
maybe changing that one byte to the appropriate value would
fix the problem ???
--
Jim Carlock
http://www.microcosmotalk.com/
Post replies to the newsgroup.


"Charles A. Crayne" <***@crayne.org> wrote in message news:***@heimdall.crayne.org...
On Sun, 4 Jul 2004 03:26:00 +0000 (UTC)
"Bill Leary" <***@crayne.org> wrote:

:if you tell DEBUG to W with no parameters, what does it take for
:length?

Hex value in BX:CX bytes.

-- Chuck

[Bx.Cornwell]

Post by Jim Carlock
Adding on to what Crayne indicated and going a little farther.
I've always used the following command inside of DEBUG
rcx
It should display a current value of cx followed by a linefeed
and then a colon prompting for a new filesize.
-n filename.exe
-rcx
cx 0000
:200
-w
-q
Then run the file at the DOS prompt. The value of CX contains
the length of the file in hex. Where the executable starts I don't
know, but I do know all .com files start execution at hex addr
0x0100.
Curious about what the BX is used for... as I haven't used that
in particular. Is that the starting address of the executable ? Or is
that the absolute position to write the file on the disk drive ?
Because if Brandy only wrote one byte to root of the drive, then
maybe changing that one byte to the appropriate value would
fix the problem ???
--
Jim Carlock
http://www.microcosmotalk.com/
Post replies to the newsgroup.

bx is the high word of the filesize.. you can specify a 32-bit filesize in
msdos's debug.exe

[Jack Holm]

Once a long time ago the Novel server at the company where I worked went
down. Lots of important data was at risk. Using debug, we checked the boot
record and found that the first two bytes were not MZ which was necessary
for DOS to work. After using debug to rewrite the MZ bytes to the disk, the
data was once again available. I am not sure that this standard is still
followed, but check it out. If those two characters are supposed to be
there, and then you do what is the equivalent of a SYS command (copy the two
boot files to the boot sectors) then the drive should be recovered After
all, the contents of the boot sectors is the boot files, not the fat tables.

I toss this out for research and discussion

[Ivan Korotkov]

Post by Jack Holm
Once a long time ago the Novel server at the company where I worked went
down. Lots of important data was at risk. Using debug, we checked the boot
record and found that the first two bytes were not MZ which was necessary
for DOS to work. After using debug to rewrite the MZ bytes to the disk, the
data was once again available. I am not sure that this standard is still
followed, but check it out. If those two characters are supposed to be
there, and then you do what is the equivalent of a SYS command (copy the two
boot files to the boot sectors) then the drive should be recovered After
all, the contents of the boot sectors is the boot files, not the fat tables.

Correct me if I'm wrong, but what's the sence of MZ signature since boot
sector is executed before any OS, including DOS, gets loaded. AFAIK, boot
sector usually begins with EB or E8 byte (JMP).

[a***@NOW.AT.arargh.com]

On Sun, 4 Jul 2004 18:08:32 +0000 (UTC), "Jack Holm"

Post by Jack Holm
Once a long time ago the Novel server at the company where I worked went
down. Lots of important data was at risk. Using debug, we checked the boot
record and found that the first two bytes were not MZ which was necessary
for DOS to work. After using debug to rewrite the MZ bytes to the disk, the
data was once again available. I am not sure that this standard is still
followed, but check it out. If those two characters are supposed to be
there, and then you do what is the equivalent of a SYS command (copy the two
boot files to the boot sectors) then the drive should be recovered After
all, the contents of the boot sectors is the boot files, not the fat tables.
I toss this out for research and discussion

Whatever was done, you don't have it correct.

Neither the partition table nor the boot sector should ever start with
with "MZ". "MZ" is for DOS EXE's.

Boot sectors usually start with a 0xE9, and sometimes with an 0xEB.
Some systems check for the 0xE9 start, so that is best.

Partition tables' can start with most any instruction.

They must both end with 0x55AA in the last two bytes.

Unless a partition passes chkdsk or scandisk, writing any file to the
partition will likley trash it futher, so don't.

[David Peterson]

----- Original Message ----- <snip>

Post by Brandy Sullivan
I'm considering using Hard Drive Mechanic to diagnose the drive. I hear
SpinRite 6 is good but not cheap.
Brandy

http://www.grc.com/cih.htm - SpinRite by Steve Gibson, he also has a little
program for recovering hard drives trashed by the Chernobyl virus - it's
free.

Chernobyl acts a little like what you have done with debug, zeroing the
first 2048 sectors.

[Ivan Korotkov]

Post by a***@NOW.AT.arargh.com

Post by Robert Redelmeier
C:> FDISK /MBR

That would only work if you trash only the first part of sector 0.
Debug would have trashed the whole thing.

Therefore: Brandy, can you remember what _exactly_ you typed?

[flekso]

Post by Brandy Sullivan
I was playing with a very small executable file in DEBUG on a slave
drive on one of my computers when I forgot to "name" the file I wanted
to write to. When I executed the write command I got an error saying not
enough space on hard drive. This drive had 30gigs plus free space. I'm
using Win98se.
Now the drive shows up as unformatted in Explorer and Scandisk but does
still show a valid partition in FDISK. The contents of the drive were
not critical but it would be nice to recover them. Is my FAT corrupted
or what did I do?
Can I fix it with a little work of my own or does this require expensive
software or a data recovery company do fix it?
All advice is greatly appreciated. Thanks.
Brandy

What did you enter exactly ?
Try testdisk.exe utility, it has analyzing capabilites for just this
kind of mess, and it's free.

[Brandy Sullivan]

I ran testdisk, and among the output there is a line saying:
Partition sector doesn't have the endmark 0xAA55

Could this be the problem?

Post by flekso
Try testdisk.exe utility, it has analyzing capabilites for just this
kind of mess, and it's free.

[Ivan Korotkov]

Post by Brandy Sullivan
Partition sector doesn't have the endmark 0xAA55
Could this be the problem?

Most likely, no. In your case - definitely no. Incorrect magic in boot
sector just indicates that it has been overwritten.

[s***@crayne.org]

Post by Brandy Sullivan
Partition sector doesn't have the endmark 0xAA55
Could this be the problem?

It's the FIRST problem. You need to get a good partition table (including
this 0xaa55) before you can check (and possibly recover) the partitions
themselves.

========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
Patrick Klos Email: ***@klos.com
Klos Technologies, Inc. Web: http://www.klos.com/
==================== What goes around, comes around... =====================

[flekso]

Post by Brandy Sullivan
Partition sector doesn't have the endmark 0xAA55
Could this be the problem?

Post by flekso
Try testdisk.exe utility, it has analyzing capabilites for just this
kind of mess, and it's free.

Try [Analyze|, [Quit], Enter, [Search!] and mail me the screenshot.

[Brandy Sullivan]

Post by flekso
Try [Analyze|, [Quit], Enter, [Search!] and mail me the screenshot.

Please help me out by describing how I get a screenshot of this to send!
I've looked in the program and don't see the function.

Thanks.
Brandy

[flekso]

Post by Brandy Sullivan

Post by flekso
Try [Analyze|, [Quit], Enter, [Search!] and mail me the screenshot.

Please help me out by describing how I get a screenshot of this to send!
I've looked in the program and don't see the function.
Thanks.
Brandy

While the window is on screen press the 'Print' key on keyboard, and
paste that shot into paint or other. (maybe a bit of crop and
compress)

Alternatively, you could send somebody a remote assistance request,
although that presumes running XP; or some kind of terminal
connection.

[Brandy Sullivan]

I'm assuming the program runs in DOS or something similar as it has its own boot
disk very much like the Win98 boot disk I use. I've typed out the screen outputs
in another message on this thread because I didn't know how to save the
screenshot. When I try to "rebuild Boot Sector" it just does another analysis
and tells me again that there is no endmark or something similar. When I try the
"dump" option it shows me the debug of the boot sector but doesn't (thankfully?)
allow me to make changes.

Post by flekso
While the window is on screen press the 'Print' key on keyboard, and
paste that shot into paint or other. (maybe a bit of crop and
compress)
Alternatively, you could send somebody a remote assistance request,
although that presumes running XP; or some kind of terminal
connection.

[flekso]

I presumed from your post that there's an alternative system kicking
in there; there's a windows version of testdisk that you could use and
screenshoot..
Or give somebody access to your precious and see if they can manage to
break it some more..

Try getting yourself a Wind98 boot sector and writing it in the
damaged partition:

To bypass the file system and directly write to specific sectors, use
the following syntax:
w [address] [Drive] [firstsector] [number]


Debug bootsect.dos
l 1000
w 1000 !!!!A=1,B=2,C=3!!!! 0 1

Post by Brandy Sullivan
I'm assuming the program runs in DOS or something similar as it has its own boot
disk very much like the Win98 boot disk I use. I've typed out the screen outputs
in another message on this thread because I didn't know how to save the
screenshot. When I try to "rebuild Boot Sector" it just does another analysis
and tells me again that there is no endmark or something similar. When I try the
"dump" option it shows me the debug of the boot sector but doesn't (thankfully?)
allow me to make changes.

Post by flekso
While the window is on screen press the 'Print' key on keyboard, and
paste that shot into paint or other. (maybe a bit of crop and
compress)
Alternatively, you could send somebody a remote assistance request,
although that presumes running XP; or some kind of terminal
connection.

[Brandy Sullivan]

Post by flekso
I presumed from your post that there's an alternative system kicking
in there; there's a windows version of testdisk that you could use and
screenshoot..
Or give somebody access to your precious and see if they can manage to
break it some more..

The version of TestDisk that I was using was 4.3 which booted up on a floppy.
After reading the above statement I re-googled TestDisk and made sure I got one
that would work in Windows.

The version I ended up with is 5.3 and while it seemed to give me identical
output regarding the condition of the drive, it actually made a difference when
I chose the Rebuild Boot Sector command.

Then when it said the boot sector was useless, it actually did something good
when I chose the command to write the "classic" boot sector to the drive.

After that when I rebooted and got a ScanDisk error on boot telling me to run
Windows ScanDisk and there may be a damaged FAT on the drive. When I ran Windows
ScanDisk it gave me a lot of errors but I chose "Fix" for each of them. After it
fixed the errors it converted a whole whack of fragments to files - many of them
were directories named DIR00001, DIR00002, and so on.

In the directory that used to contain Windows, the files were all messed up. In
another directory there were some text files that still had the correct names
and opened just fine.

And best of all, in the directory with all the data I wanted to recover, there
were four subdirectories which all had names I had chosen originally. Inside
each of these subdirectories were ALL THE FILES with the correct name, size and
THEY ALL WORK!!!

Yipee!

You guys ROCK!
Brandy

[f0dder]

*snip*

Post by Brandy Sullivan
And best of all, in the directory with all the data I wanted to
recover, there were four subdirectories which all had names I had
chosen originally. Inside each of these subdirectories were ALL THE
FILES with the correct name, size and THEY ALL WORK!!!

I would recommend against using standard scandisk to fix this kind
of problem. I'm very happy it worked for you, as scandisk can often
do a lot more damage than good (on a really messed up filesystem, at
least.) - crosslinked files and damaged directory structures uh oh :)

The trick is to get some proper data rescue programs, they will do a
much better job. Perhaps not worth spending the cash for, if you're
just going to lose a few vob files (assuming backup copies and not
personally created content), but faced with losing personal data files
and source code ("backups? my system never fails?"), it's certainly
worth it.

Also, always do *non-destructive* recovery - restore files to a 2nd
harddrive, rather than working directly on the filesystem.

I hope that you will never need this advice :-)

[Robert Green]

Post by flekso
I presumed from your post that there's an alternative system kicking
in there; there's a windows version of testdisk that you could use and
screenshoot..
Or give somebody access to your precious and see if they can manage to
break it some more..
Try getting yourself a Wind98 boot sector and writing it in the
To bypass the file system and directly write to specific sectors, use
w [address] [Drive] [firstsector] [number]
Debug bootsect.dos
l 1000
w 1000 !!!!A=1,B=2,C=3!!!! 0 1

A couple on comments on this:

This will work on a healthy partition but not on one damaged in the
way that this one is - you'll need a script to do it with int 13. Even
better, a disk editor.

You forgot to mention that the BIOS Parameter Block will have to be
edited.

These are the BPB fields you have to verify when using a copied boot
sector as a template (with definite or possible values based on the
information we have about this case):

Sectors per cluster: maybe 64 ???
Reserved sectors: maybe 32 ???
Sectors per track: 63
Heads: 255
Hidden sectors: 63
Total sectors: 145404252
Sectors per FAT: ???
Root start cluster: probably 2 ???

Getting the undetermined values right is only going to be possible if
we can determine the LBA for start of the data area. An easy way to
approach it is to do a search for "RECYCLED", ie, locate the first
sector of the root directory.

Another way is to locate a few sub directories and note their start
cluster numbers. Either way, if you find what you need, then it is
just a matter of simple arithmetic to fill out the BPB.

Doing this will not restore access to the partition (nothing will),
but it will probably allow for much better results in recovering files
from the partition.


Regards,

Bob

--
Robert Green
BootMaster Partition Recovery
http://bootmaster.filerecovery.biz

[Tim Roberts]

Post by flekso
I presumed from your post that there's an alternative system kicking
in there; there's a windows version of testdisk that you could use and
screenshoot..
Or give somebody access to your precious and see if they can manage to
break it some more..
Try getting yourself a Wind98 boot sector and writing it in the
To bypass the file system and directly write to specific sectors, use
w [address] [Drive] [firstsector] [number]
Debug bootsect.dos
l 1000
w 1000 !!!!A=1,B=2,C=3!!!! 0 1

Drives numbers start at 0. A: is 0, B: is 1, C: is 2, and so on.

[flekso]

Post by Tim Roberts

Post by flekso
I presumed from your post that there's an alternative system kicking
in there; there's a windows version of testdisk that you could use and
screenshoot..
Or give somebody access to your precious and see if they can manage to
break it some more..
Try getting yourself a Wind98 boot sector and writing it in the
To bypass the file system and directly write to specific sectors, use
w [address] [Drive] [firstsector] [number]
Debug bootsect.dos
l 1000
w 1000 !!!!A=1,B=2,C=3!!!! 0 1

Drives numbers start at 0. A: is 0, B: is 1, C: is 2, and so on.

Really sorry OP, hope you didn't try this one out.
If you did, then you have to go through the same process, for the
newly damaged drive(hopefuly your drive was the last slave in the
system).
Also there's a complete concise debug.com reference in 2k/xp help
docs.

[Robert Green]

Post by Brandy Sullivan
I was playing with a very small executable file in DEBUG on a slave
drive on one of my computers when I forgot to "name" the file I wanted
to write to. When I executed the write command I got an error saying not
enough space on hard drive. This drive had 30gigs plus free space. I'm
using Win98se.
Now the drive shows up as unformatted in Explorer and Scandisk but does
still show a valid partition in FDISK. The contents of the drive were
not critical but it would be nice to recover them. Is my FAT corrupted
or what did I do?
Can I fix it with a little work of my own or does this require expensive
software or a data recovery company do fix it?
All advice is greatly appreciated. Thanks.
Brandy

Here is a simple way to determine exactly what damage was caused and
whether it is fixable (involves use of a commercial product [$19.95]
but diagnostics can be done with the free demo).

Download BootMaster (http://bootmaster.filerecovery.biz) and execute
the install file to create a rescue disk (you will need one 1.44 MB
floppy).

Boot the system from the rescue disk. At the menu select item 7
(BootMaster Diagnostics). Select Drive 2 and "Normal" mode at the
dialogs. The diagnostic scan will create the text file
"A:\BMD00.TXT".

You can paste that file into your reply and also copy to
***@filerecovery.biz. I should be able to tell you whether it is
fixable and the best approach.

Regards,

Bob

--
Robert Green
BootMaster Partition Recovery
http://bootmaster.filerecovery.biz

[Brandy Sullivan]

Post by Robert Green
Here is a simple way to determine exactly what damage was caused and
whether it is fixable (involves use of a commercial product [$19.95]
but diagnostics can be done with the free demo).
Download BootMaster (http://bootmaster.filerecovery.biz) and execute
the install file to create a rescue disk (you will need one 1.44 MB
floppy).
Boot the system from the rescue disk. At the menu select item 7
(BootMaster Diagnostics). Select Drive 2 and "Normal" mode at the
dialogs. The diagnostic scan will create the text file
"A:\BMD00.TXT".
You can paste that file into your reply and also copy to
fixable and the best approach.
Regards,
Bob
--
Robert Green
BootMaster Partition Recovery
http://bootmaster.filerecovery.biz

This is the output file. I recognize two of the three partitions, those extended logical
partitions for my Win98se setup files and another partition called "Reserve". Does anything in
this output look fishy?

BootMaster Diagnostics (Version 2.4)
Copyright (c) 2003 by Robert Green
07-05-2004 12:11:56
DOS Version 7.10.253 Normal

Drive 2 C: 9733 H: 255 S: 63 Size: 79735 Last LBA: 156355584

0 X 12 0 1 1 9050 254 63 63 145404252
0 A 12 0 1 1 858 254 63 63 145404252
0 R 15 9051 0 1 9731 254 63 145404315 10940265
0 A 15 859 0 1 515 254 63 145404315 10940265
145404315 E 6 9051 1 1 9089 254 63 63 626472
145404315 A 6 859 1 1 897 254 63 63 626472
145404315 E 5 9090 0 1 9731 254 63 626535 10313730
145404315 A 5 898 0 1 515 254 63 626535 10313730
145404378 M 6 9051 1 1 9089 254 63 145404378 626472 WIN98SE
145404378 6 16 145404378 1 626472 153 255 63 [00011011]
145404379 F 9051 1 2 153 0[0] 0 0
145404685 D 0 BASE4.CAB BASE5.CAB BASE6.CAB CATALOG3.CAB
146030850 E 11 9090 1 1 9731 254 63 63 10313667
146030850 A 11 898 1 1 515 254 63 63 10313667
146030913 M 12 9090 1 1 9731 254 63 146030913 10313667 RESERVED
146030913 3 8 146030913 32 10313667 10063 2 255 63 6 [00011111]
146030945 F 9090 1 33 10063 0[0] 0 0
146051071 D 2 RECYCLED åSIF18E2.TMP RIDERS åLUBPL~1
156344579 N 7 0 1 1 9731 254 63 63 156344517 Unknown
156344579 $ 8 63 156344516 255 63 786432 9771532 1940 [00]

[Robert Green]

Post by Brandy Sullivan

Post by Robert Green
Here is a simple way to determine exactly what damage

was caused and

Post by Brandy Sullivan

Post by Robert Green
whether it is fixable (involves use of a commercial

product [$19.95]

Post by Brandy Sullivan

Post by Robert Green
but diagnostics can be done with the free demo).
Download BootMaster (http://bootmaster.filerecovery.biz)

and execute

Post by Brandy Sullivan

Post by Robert Green
the install file to create a rescue disk (you will need

one 1.44 MB

Post by Brandy Sullivan

Post by Robert Green
floppy).
Boot the system from the rescue disk. At the menu select

item 7

Post by Brandy Sullivan

Post by Robert Green
(BootMaster Diagnostics). Select Drive 2 and "Normal"

mode at the

Post by Brandy Sullivan

Post by Robert Green
dialogs. The diagnostic scan will create the text file
"A:\BMD00.TXT".
You can paste that file into your reply and also copy to

whether it is

Post by Brandy Sullivan

Post by Robert Green
fixable and the best approach.
Regards,
Bob
--
Robert Green
BootMaster Partition Recovery
http://bootmaster.filerecovery.biz

This is the output file. I recognize two of the three

partitions, those extended logical

Post by Brandy Sullivan
partitions for my Win98se setup files and another

partition called "Reserve". Does anything in

Post by Brandy Sullivan
this output look fishy?
BootMaster Diagnostics (Version 2.4)
Copyright (c) 2003 by Robert Green
07-05-2004 12:11:56
DOS Version 7.10.253 Normal

I took out extraneous data and formatted the report to make
it more readable.
156355584

Post by Brandy Sullivan
0 X 12 0 1 1 9050 254 63 63

145404252

Post by Brandy Sullivan
0 R 15 9051 0 1 9731 254 63 145404315

10940265

Your FAT32 primary partition should be here, but there is no
trace of it.
The boot sectors and at least most of the FATs have been
overwritten.

Post by Brandy Sullivan
145404315 E 6 9051 1 1 9089 254 63 63

626472

Post by Brandy Sullivan
145404315 E 5 9090 0 1 9731 254 63 626535

10313730

Post by Brandy Sullivan
145404378 M 6 9051 1 1 9089 254 63 145404378

626472 WIN98SE

Post by Brandy Sullivan
145404378 6 16 145404378 1 626472 153 255 63

[00011011]

Post by Brandy Sullivan
145404379 F 9051 1 2 153 0[0] 0 0
145404685 D 0 BASE4.CAB BASE5.CAB BASE6.CAB

CATALOG3.CAB

Post by Brandy Sullivan
146030850 E 11 9090 1 1 9731 254 63 63

10313667

Post by Brandy Sullivan
146030913 M 12 9090 1 1 9731 254 63 146030913

10313667 RESERVED

Post by Brandy Sullivan
146030913 3 8 146030913 32 10313667 10063 2 255 63 6

[00011111]

Post by Brandy Sullivan
146030945 F 9090 1 33 10063 0[0] 0 0
146051071 D 2 RECYCLED åSIF18E2.TMP RIDERS åLUBPL~1
156344579 N 7 0 1 1 9731 254 63 63

156344517 Unknown

Post by Brandy Sullivan
156344579 $ 8 63 156344516 255 63 786432 9771532 1940

[00]

The above "Unknown" partition is just a relic (the backup
boot sector) of an old NTFS partition.

Re-run the diagnotics in "Deep" mode. This will locate even
a small surviving scrap of the FATs (if such exists). "Deep"
is very slow, but you don't really need to run it more than
10 minutes - if it hasn't found anything by then, it is not
going to. Just press ESC to stop it. If it reports anything
at all below the line that begins "Drive 2" then send it to
me (BMD01.TXT).

If it does find something maybe we can at least rebuild the
parition boot sector, so that recovery software can have
something to go on, but restoring the partition is not going
to be possible.

If it doesn't find anything, you can still try a raw mode
recovery, which can recover common file types (ms-office
stuff, JPGs, etc.) if the files are contiguous.

Regards,

Bob

[Brandy Sullivan]

Post by Robert Green
The above "Unknown" partition is just a relic (the backup
boot sector) of an old NTFS partition.
Re-run the diagnotics in "Deep" mode. This will locate even
a small surviving scrap of the FATs (if such exists). "Deep"
is very slow, but you don't really need to run it more than
10 minutes - if it hasn't found anything by then, it is not
going to. Just press ESC to stop it. If it reports anything
at all below the line that begins "Drive 2" then send it to
me (BMD01.TXT).

I tried the "deep" mode even before you advised me to and it showed the
two working partitions as well as an NTFS partition (the one you
mentioned above?) but not the original large active partition with all
the data. The text I pasted was from the BMD01.txt file. Oddly enough,
when I first ran the Win98se Emergency Boot disk it DID show the
partitions as they were before the debug fiasco. But it said there were
no partitions set as "active".

Post by Robert Green
If it does find something maybe we can at least rebuild the
parition boot sector, so that recovery software can have
something to go on, but restoring the partition is not going
to be possible.

I'm not sure if it matters but the drive is set up as a slave and wasn't
ever set up to actually be a boot drive, though I realize it would still
have a boot sector.

Post by Robert Green
If it doesn't find anything, you can still try a raw mode
recovery, which can recover common file types (ms-office
stuff, JPGs, etc.) if the files are contiguous.

Most of the data lost were .VOB files which I created using NeoDVD. Some
were over 1G in size.

Thanks for all your help.
Brandy.

[Brandy Sullivan]

I'm not sure how to do a screenshot of any of these programs or their output so
I'm going to type out what they say and maybe you can make some sense of it.

Using testdisk, I get a strange result now. When I first run the program I see
what looks like all the partitions that should be there, including the one that
I thought I'd lost.

- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)
Check current partition structure
Partition Start End Size
test_FAT :
Partition sector doesn't have the endmark 0xAA55
1 * FAT32 LBA 0 1 1 9050 254 63 145404252
1 * FAT32 LBA 0 1 1 9050 254 63 145404252
2 E extended LBA 9051 0 1 9731 254 63 10940265
5 L FAT16 >32M 9051 1 1 9089 254 63 626472 [WIN98SE]
X extended 9090 0 1 9731 254 63 10313730
6 L FAT32 9090 1 1 9731 254 63 10313667 [RESERVED]
- - - - -


But when I run the analysis, it then shows only the following two partitions:


- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)

Partition Start End Size
L VFAT LBA 9051 1 1 9089 254 63 626472 [WIN98SE]
L FAT32 LBA 9090 1 1 9731 254 63 10313667 [RESERVED]
- - - - -


And when I run the deep analysis I see nothing at all for the first 8-10 minutes
but when it hits about cylinder 9051 and later I see:


- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)

Partition Start End Size
D HPFS - NTFS 0 1 1 9731 254 63 156344517
D VFAT LBA 9051 1 1 9089 254 63 626472 [WIN98SE]
D FAT32 LBA 9090 1 1 9731 254 63 10313667 [RESERVED]
- - - - -


If I go into the Advanced section of the program it lets me select from a list
identical to the first set of partitions listed above. If I choose the 1 * FAT32
LBA one and select the [ Boot ] option it shows me this:

- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)
1 * FAT32 LBA 0 1 1 9050 254 63 145404252

Boot sector

test_FAT :
Partition sector doesn't have the endmark 0xAA55
Backup boot sector
test_FAT :
Partition sector doesn't have the endmark 0xAA55
First sectors (Boot code and partition information) are not identical.
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not identical.
- - - - -

At this point I didn't want to take any actions in case I made things worse. I
certianly don't know what I'm doing with this program.

I hope all this information gives you something to go on. Thanks again all of
you for all your help.

Brandy

[Robert Green]

Post by Brandy Sullivan
I'm not sure how to do a screenshot of any of these

programs or their >output so I'm going to type out what they
say and maybe you can make some >sense of it.

Post by Brandy Sullivan
Using testdisk, I get a strange result now. When I first

run the program >I see what looks like all the partitions
that should be there, including >the one that I thought I'd
lost.

Nothing strange about it. Its showing you exactly what's
there, including the lost partition's entry in the partition
table. The partition itself no longer exists, though.

Post by Brandy Sullivan
- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)
Check current partition structure
Partition Start End

Size

Post by Brandy Sullivan
Partition sector doesn't have the endmark 0xAA55

The above line means in effect that the partition boot
sector was not found for the first partition, ie, the boot
sector has been overwritten.

Post by Brandy Sullivan
1 * FAT32 LBA 0 1 1 9050 254 63

145404252

Post by Brandy Sullivan
1 * FAT32 LBA 0 1 1 9050 254 63

145404252

Post by Brandy Sullivan
2 E extended LBA 9051 0 1 9731 254 63

10940265

Post by Brandy Sullivan
5 L FAT16 >32M 9051 1 1 9089 254 63

626472 [WIN98SE]

Post by Brandy Sullivan
X extended 9090 0 1 9731 254 63

10313730

Post by Brandy Sullivan
6 L FAT32 9090 1 1 9731 254 63

10313667 [RESERVED]

Post by Brandy Sullivan
- - - - -
But when I run the analysis, it then shows only the

following two >partitions:

Because the first FAT32 partition no longer exists (its boot
sectors and FATs have been overwritten), though some of its
data may still be recoverable.

Post by Brandy Sullivan
- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)
Partition Start End

Size

Post by Brandy Sullivan
L VFAT LBA 9051 1 1 9089 254 63

626472 [WIN98SE]

Post by Brandy Sullivan
L FAT32 LBA 9090 1 1 9731 254 63

10313667 [RESERVED]

Post by Brandy Sullivan
- - - - -
And when I run the deep analysis I see nothing at all for

the first 8-10 >minutes but when it hits about cylinder 9051

Post by Brandy Sullivan
- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)
Partition Start End

Size

Post by Brandy Sullivan
D HPFS - NTFS 0 1 1 9731 254 63

156344517

The NTFS partition is not actually present - as I mentioned
before there is a relic backup boot sector present at the
end of the disk.

Post by Brandy Sullivan
D VFAT LBA 9051 1 1 9089 254 63

626472 [WIN98SE]

Post by Brandy Sullivan
D FAT32 LBA 9090 1 1 9731 254 63

10313667 [RESERVED]

Post by Brandy Sullivan
- - - - -
If I go into the Advanced section of the program it lets me

select from >a list identical to the first set of partitions
listed above. If I choose >the 1 * FAT32 LBA one and select

Post by Brandy Sullivan
- - - - -
Disk 81 - CHS 9732 255 63 - 76340 MB (Mxd BIOS mode)
1 * FAT32 LBA 0 1 1 9050 254 63

145404252

Post by Brandy Sullivan
Boot sector
Partition sector doesn't have the endmark 0xAA55
Backup boot sector
Partition sector doesn't have the endmark 0xAA55
First sectors (Boot code and partition information) are

not identical.

Post by Brandy Sullivan
Second sectors (cluster information) are not identical.
Third sectors (Second part of boot code) are not

identical.

In other words, neither the boot sector or the backup boot
sector is present. Neither are the FATs - I guess Test Disk
does not analyze FATs.

Post by Brandy Sullivan
- - - - -
At this point I didn't want to take any actions in case I

made things >worse. I certianly don't know what I'm doing
with this program.

Post by Brandy Sullivan
I hope all this information gives you something to go on.

Thanks again >all of you for all your help.

This just verifies my earlier analysis based on the
BootMaster Diagnostics report.

Your only hope is a raw mode recovery, and given your
desription of the files contained in that partition I'm
afraid its a pretty small hope.

Regards,

[Brandy Sullivan]

Post by Robert Green
Your only hope is a raw mode recovery, and given your
desription of the files contained in that partition I'm
afraid its a pretty small hope.

Is there any reason to either try or not try the Rebuild Boot Sector option?

There is also a Dump Boot Sector option. The description for this is "Dump boot
sector and backup boot sector".

I also see options that say "Write the Classic MBR code to the first sector" and
Change disk geometry (expert only).

Any point in fooling with those?

Brandy

[Robert Green]

Post by Brandy Sullivan

Post by Robert Green
Your only hope is a raw mode recovery, and given your
desription of the files contained in that partition I'm
afraid its a pretty small hope.

Is there any reason to either try or not try the Rebuild Boot
Sector option?

It probably won't hurt anything, but I don't know enough about
Test Disk to give you a good answer. Send your earlier post with
the analysis results to the developer and see what he thinks.

If it can be rebuilt reliably you will probably get somewhat better
results with file recovery.

Post by Brandy Sullivan
There is also a Dump Boot Sector option. The description for
this is "Dump boot sector and backup boot sector".

No help there.

Post by Brandy Sullivan
I also see options that say "Write the Classic MBR code to the first sector" > and Change disk geometry (expert only).

No help there.

Post by Brandy Sullivan
Any point in fooling with those?

As noted above.

Regards,

Robert Green

Post by Brandy Sullivan
Brandy

[f0dder]

Brandy Sullivan wrote:

*snip*

Post by Brandy Sullivan
Can I fix it with a little work of my own or does this require
expensive software or a data recovery company do fix it?

If you end up in the unfortunate situation where you need to do a
data recovery, I can recommend GetDataBack from http://www.runtime.org/ .
It's commercial, but considering I managed to save 30+ GB (99% of my
data) after a crash caused by LargeSystemCache=1 and ATi detonator
drivers, I'd say the product is worth it.

Hope there's an easier fix for you, though.