Hi,

Facing a problem with a hdd having crucial data

- a hdd (NTFS 40 gb samsung - extended partition with 1 logical drive - 1 partition) working fine on a Windows Server 2003 box
- disconnected that hdd and plugged into a windows xp box already having 2 hdd, so total 3, bios showed only 2, some problem there -

anyway continued to windows
- now the new hdd does not show up in explorer, so went to Computer Mgmt -> Disk management, can see this new hdd, got only an

option to create a logical drive - by mistake, created a logical drive but did not format it.

Now the problem is
- When trying to access existing critical data on the hdd, prompts for a format since by mistake, we created a logical drive
- HDD is in an unusable state, new logical drive created but not formatted.

- Need to access old data, is there any tool that can remove this new logical drive and point me back to my old data?
Some kind of diskedit tool, we had earlier.

Badly in need for a solution for this. A quick reply will be appreciated.

Regards
mat_net

Welcome to http://www.pcguide.com/ubb/pcgubb.gif fourms.

You have two choices:

You can try to get the data off yourself with GetDataBack (http://www.runtime.org/)

or you can have a professioanl do it:

Drive Savers (http://www.drivesavers.com/)

The first choice is free or low cost and the second will be very expensive. A 20 GB hard drive can be up to $3000.00.

If you choose to go with drive savers, please let me know as I am a dealer and you will get a 10% discount. Additionally, they wave the recovery attempt fee. So of they can't get the data off, No charge. Also, they are supported by all of the HDD manufacturers. So even though will open your drive up and read the data off of the platters and put your drive back together, the HDD manufacturer will still honor your warranty.

How valuable is the data? How old is your backup? Can the data be reconstructed by hand.

As long as the drive is recognised in the BIOS and no partitions were deleted or formatted then either DIY software or simple editing of the partition tables should be all that is required.

already having 2 hdd, so total 3, bios showed only 2, some problem there - That is a worrying quote so something is not configured correctly or one of the three drives is truly not recognised.

Since your transferred drive is recognised (are you sure you are looking at the right drive??) in the WinXP Disk Management that is good news but which of the other two drives is not recognised and why needs an answer before any proper advice can be given.

Please post back specific details of how the three drives are attached, what type of drives they are and what partitions they contain; the more info the better.

I also suggest you go to ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/ and download PartInNT.zip Then unzip and run it and then choose Save As and save the results to disk. Then either upload the txt file or simply paste the results in a new post here.

Thanks for the reply Paul.
I'm sure of the 3 hdds - the original OS and the new transferred hdd were detected.

2 were on the primary ide as master & slave
and the new one as secondary slave.

the old logical drive should still be there, the new logical drive was created but not formatted.

Can you specifically mention how to edit those partition tables - any tools or the way to do it. It seems that will work.....

Regards
mat

PTedit32.zip from the same ftp folder is designed for the job. PTedit.zip for adding to a DOS floppy is worth having in case you screw up bootability and need to edit things back the way there were.

The first view shows the four primary partition tables.

You have to "hop" through the Go to EPBR values for each logical partition or "hop" back through them using the Go to Parent values.

Tip: write down the values before making any changes and you can always then edit them back to the way they were before you started.

Editing the boot sector's BPB and other such data is not so straightforward and may need editing in parallel with the raw partition tables' data using a disk hex editor. Hopefully that wont be necessary but WinHex (http://www.x-ways.net/winhex/index-m.html) is one of the easiest and best for that job should you want it.

Post back if you are unsure of what values to put into the tables.

the new logical drive was created but not formatted.
Out of interest what utility was used to do that.

Hi Paul,

This is the report from the PartinNT tool for the 2nd problematic HDD

PowerQuest PartitionInfo 8.0 -- Windows NT/2000 Version
Date Generated: 09/18/05 23:26:31
Copyright (c)1994-2002, PowerQuest Corporation
Permission is granted for this utility to be freely copied so long
as it is not modified in any way. All other rights are reserved.

PowerQuest, makers of PartitionMagic(r), Drive Image(tm), and DriveCopy(tm), can be reached at:
Voice: 801-437-8900
Fax: 801-226-8941
Web site: http://www.powerquest.com/support/
E-mail: magic@powerquest.com

General System Information:
Total Physical Memory (bytes): 535,216,128
Used Physical Memory: (bytes): 290,693,120
Maximum Page File Size: (bytes): 1,307,262,976
Current Page File Size: (bytes): 260,046,848



================================================== ================================================== =======
Disk Geometry Information for Disk 1: 5174 Cylinders, 240 Heads, 63 Sectors/Track
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect NumSects
================================================== ================================================== =======
0 0 80 0 1 1 07 1023 239 63 63 78,230,817
Info: End C,H,S values were large drive placeholders.
Actual values are:
0 0 80 0 1 1 07 5173 239 63 63 78230817

================================================== ================================================== =======
Disk Geometry Information for Disk 2: 5174 Cylinders, 240 Heads, 63 Sectors/Track
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect NumSects
================================================== ================================================== =======
0 0 00 1 0 1 0F 1023 255 63 15,167 78,248,791
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
Actual values are:
0 0 00 1 0 48 0F 5176 45 3 15167 78248791
Info: Partition didn't begin on head boundary.
ucBeginSector expected to be 1, not 48.
Error #109: Partition ends after end of disk.
ucEndCylinder (5176) must be less than 5174.
Info: Partition didn't end on cylinder boundary.
ucEndHead expected to be 239, not 45.
Info: Partition didn't end on cylinder boundary.
ucEndSector expected to be 63, not 3.
15,167 0 00 0 241 48 06 1023 180 3 15,230 78,248,728
Info: End C,H,S values were large drive placeholders.
Actual values are:
15167 0 00 0 241 48 06 5176 45 3 15230 78248728
Error #105: Partition didn't begin on head boundary.
ucBeginHead expected to be 0 or 1, not 241.
Error #106: Partition didn't begin on head boundary.
ucBeginSector expected to be 1, not 48.
Error #109: Partition ends after end of disk.
ucEndCylinder (5176) must be less than 5174.
Error #108: Partition didn't end on cylinder boundary.
ucEndHead expected to be 239, not 45.
Error #108: Partition didn't end on cylinder boundary.
ucEndSector expected to be 63, not 3.



================================================== ================================================== =======
Partition Information for Disk 1: 38,198.7 Megabytes
Volume PartType Status Size MB PartSect # StartSect TotalSects
================================================== ================================================== =======
C: NTFS Pri,Boot 38,198.6 0 0 63 78,230,817


================================================== ================================================== =======
Partition Information for Disk 2: 38,198.7 Megabytes
Volume PartType Status Size MB PartSect # StartSect TotalSects
================================================== ================================================== =======
Unallocated Pri 7.4 None -- 63 15,104
ExtendedX Pri 38,207.4 0 0 15,167 78,248,791
EPBR Log 38,207.4 None -- 15,167 78,248,791
D: FAT16B Log 38,207.4 15,167 0 15,230 78,248,728


================================================== ================================================== =======
Boot Record for drive C: (Drive: 1, Starting sector: 63, Type: NTFS)
================================================== ================================================== =======
1. Jump: EB 52 90
2. OEM Name: NTFS
3. Bytes per Sector: 512
4. Sectors per Cluster: 8
5. Reserved Sectors: 0
6. Number of FATs: 0
7. Root Dir Entries: 0
8. Total Sectors: 0
9. Media Descriptor: 0xF8
10. Sectors per FAT: 0
11. Sectors per Track: 63 (0x3F)
12. Number of Heads: 240 (0xF0)
13. Hidden Sectors: 63 (0x3F)
14. Total Sectors (>32MB): 0 (0x0)
15. Unused: 0x80008000
16. Total NTFS Sectors: 78230816
17. MFT Start Cluster: 786432
18. MFT Mirror Start Clust: 16
19. Clusters per FRS: 246
20. Clusters per Index Blk: 1
21. Serial Number: 0x44B4E256B4E24A4E
22. Checksum: 0 (0x0)
23. Boot Signature: 0xAA55

=======================

Also attaching the results of running the ptedit32 tool
zip with the screenshots - monochrome & zipped to keep it below 19 kb

could you suggest the appropriate values

Thanks Paul

Regards
mat

Try editing Parent to:
0F_00_1_0_1_1023_255_63_1520_78248791

and EPBR to:
07_00_1_1_1_1023_255_63_63_78248728

The EPBR value for Type has assumed NTFS but you need to set the correct type for whatever the original format of the logical partition was. It was obviously not FAT16 as indicated in the PartInfo results.

The most problematic value is the 'Sectors Before' value for the extended partition (Parent). The value of 1520 is based on one cylinder of 240 virtual heads containing 63 sectors per track. It is normal to start the extended partition on the first available cylinder (excluding the mbr if the extended partition is at the start of the drive) and so this value was calculated based on the virtual heads and sectors per track shown by PTedit. If we need to search for the actual start of that partition boot sector using WinHex or similar we can do that later on.

If no good then try editing Parent to:
05_00_1_0_1_1023_255_63_1520_78248791

The type 05 here is for extended partitions whereas 0F is for extendedX partitions. Windows can have problems with extended partitions if the last partition on the drive is a non-dos (eg ntfs) partition as in the case I have guessed at.

Take care to use 0 (zeros) and not O (upper case letter o) in all the above.

I just realised that the virtual heads has a non-standard value and I didn't correct the tables in line with this. It may make no difference anyway since the drive is larger than 8.4 GB and thus using LBA but you might also want to adjust the ending head values from 254 to 239, viz:-

0F_00_1_0_1_1023_239_63_1520_78248791

07_00_1_1_1_1023_239_63_63_78248728

We managed to recover the data to a great extent using GetDataBack.
Thanks for the help Paul

As long as you can access such a drive with software - then GDB is usually amazingly successful.

Now that you have your data back, you really need to develop a method of backing up your data on a regular basis. Especially if you are taking the HDD out of one PC and putting it in another.....

Hey,

I'm having a similar problem. I bought a new HD, Seagate 200GB Barracuda, set it up as my boot drive, installed Windows (BIOS doesnt support 137+ HD's) ect. With the hard drive came their hard drive utility with like 2 options, so I ran the software and it created 2 partitions by itself without asking me ANYTHING, didn't ask if I wanted to create a partition or extend the current one. Of course, the program doesnt have any options to delete or edit the partitions. When I try to use Partiton Magic it says:

Disk 1 (190799MB 4321c 255h 63s) appears to have partitions created using a different drive geometry (254h 63s)

Then it goes to say that no changes should be made to the partitions and that it may cause data loss, and that I should backup everything and reformat and use the new drive geometry.

Partition Info

PowerQuest PartitionInfo 8.0 -- Windows NT/2000 Version
Date Generated: 09/21/05 20:14:20
Copyright (c)1994-2002, PowerQuest Corporation
Permission is granted for this utility to be freely copied so long
as it is not modified in any way. All other rights are reserved.

PowerQuest, makers of PartitionMagic(r), Drive Image(tm), and DriveCopy(tm), can be reached at:
Voice: 801-437-8900
Fax: 801-226-8941
Web site: http://www.powerquest.com/support/
E-mail: magic@powerquest.com

General System Information:
Total Physical Memory (bytes): 804,765,696
Used Physical Memory: (bytes): 391,249,920
Maximum Page File Size: (bytes): 1,969,291,264
Current Page File Size: (bytes): 368,934,912



================================================== ================================================== =======
Disk Geometry Information for Disk 1: 24321 Cylinders, 255 Heads, 63 Sectors/Track
System PartSect # Boot BCyl Head Sect FS ECyl Head Sect StartSect NumSects
================================================== ================================================== =======
0 0 80 0 1 1 07 1023 254 63 63 268,430,022
Info: End C,H,S values were large drive placeholders.
Actual values are:
0 0 80 0 1 1 07 16708 254 63 63 268430022
0 1 00 1023 0 1 0F 1023 253 63 268,430,085 122,270,652
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
Actual values are:
0 1 00 16709 0 1 0F 24319 253 63 268430085 122270652
Info: Partition didn't end on cylinder boundary.
ucEndHead expected to be 254, not 253.
268,430,085 0 00 1023 1 1 07 1023 254 63 268,430,148 122,270,652
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
Actual values are:
268430085 0 00 16709 1 1 07 24319 254 63 268430148 122270652
268,430,085 1 00 1023 0 1 05 1023 253 63 390,700,8004,294,967,233
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
Actual values are:
268430085 1 00 24320 0 1 05 24319 253 63 3907008004294967233
Info: Partition didn't end on cylinder boundary.
ucEndHead expected to be 254, not 253.
390,700,800 0 00 1023 1 1 07 1023 253 63 390,700,8634,294,967,170
Info: Begin C,H,S values were large drive placeholders.
Info: End C,H,S values were large drive placeholders.
Actual values are:
390700800 0 00 24320 1 1 07 24319 253 63 3907008634294967170
Error #108: Partition didn't end on cylinder boundary.
ucEndHead expected to be 254, not 253.

================================================== ================================================== =======
Partition Information for Disk 1: 190,779.7 Megabytes
Volume PartType Status Size MB PartSect # StartSect TotalSects
================================================== ================================================== =======
C: NTFS Pri,Boot 131,069.3 0 0 63 268,430,022
ExtendedX Pri 59,702.5 0 1 268,430,085 122,270,652
EPBR Log 59,702.5 None -- 268,430,085 122,270,715
Warning #113: EPBR partition starting at 268430085 overlaps extended partition.
H: NTFS Log 59,702.5 268,430,085 0 268,430,148 122,270,652
Error #113: Logical starting at 268430148 overlaps extended partition.
EPBR Log 2,097,152.0 268,430,085 1 390,700,8004,294,967,233
Unallocated Pri 7.8 None -- 390,700,800 16,065
I: QNX, UN*X Log 2,097,151.9 390,700,800 0 390,700,8634,294,967,170

================================================== ================================================== =======
Boot Record for drive C: (Drive: 1, Starting sector: 63, Type: NTFS)
================================================== ================================================== =======
1. Jump: EB 52 90
2. OEM Name: NTFS
3. Bytes per Sector: 512
4. Sectors per Cluster: 8
5. Reserved Sectors: 0
6. Number of FATs: 0
7. Root Dir Entries: 0
8. Total Sectors: 0
9. Media Descriptor: 0xF8
10. Sectors per FAT: 0
11. Sectors per Track: 63 (0x3F)
12. Number of Heads: 255 (0xFF)
13. Hidden Sectors: 63 (0x3F)
14. Total Sectors (>32MB): 0 (0x0)
15. Unused: 0x80008000
16. Total NTFS Sectors: 268430021
17. MFT Start Cluster: 4
18. MFT Mirror Start Clust: 16776876
19. Clusters per FRS: 246
20. Clusters per Index Blk: 1
21. Serial Number: 0x01C5BB170DF61480
22. Checksum: 0 (0x0)
23. Boot Signature: 0xAA55

Edit version of Partition Info, not pertaining to my other drives. Attached it just in case.

Any ideas?