Overwrote first x sectors with clone program
Posted: 30 Jan 2014, 13:10
Hi together,
this is a copy of my problem in the German board: http://forum.cgsecurity.org/phpBB3/date ... n-f10.html
I overwrote the first x sectors (almost 400 MB) of my hard disk (no.1:80 GB, ~78 GB NTFS + ~2 GB NTFS) with the sectors of another hard disk (no.2: 160 GB, ~2 GB NTFS + ~158 GB) while I tried to backup to a file. That means: MBR and partition table and boot sector of first partition are wrong. If the MFT is bad, too, I am not sure of. Testdisk now finds the MBR and partition table of hard disk no.2 and, by searching the sectors, the last partition of hard disk no1.
How can I restore or rebuild my old first partition? The copy of the boot sector can be found, because the end of the Partition is still correct.
I thought of overwriting the overwritten sectors with null. But I am not sure how many sectors are wrong and I don't want to destroy any more data. I could make a comparison with a small program (read sectors one by one of both hard disks, compare them, and if different, write sector number to screen and file, stop after e.g. 100 entries), but I am not able to write this program. I know this dd command from Linux and I know programming in VBA but I don't know how to do this.
There is a program called WinHex that finds almost all files and the structure, but restores only files up to 200kB in the free version.
this is a copy of my problem in the German board: http://forum.cgsecurity.org/phpBB3/date ... n-f10.html
I overwrote the first x sectors (almost 400 MB) of my hard disk (no.1:80 GB, ~78 GB NTFS + ~2 GB NTFS) with the sectors of another hard disk (no.2: 160 GB, ~2 GB NTFS + ~158 GB) while I tried to backup to a file. That means: MBR and partition table and boot sector of first partition are wrong. If the MFT is bad, too, I am not sure of. Testdisk now finds the MBR and partition table of hard disk no.2 and, by searching the sectors, the last partition of hard disk no1.
How can I restore or rebuild my old first partition? The copy of the boot sector can be found, because the end of the Partition is still correct.
I thought of overwriting the overwritten sectors with null. But I am not sure how many sectors are wrong and I don't want to destroy any more data. I could make a comparison with a small program (read sectors one by one of both hard disks, compare them, and if different, write sector number to screen and file, stop after e.g. 100 entries), but I am not able to write this program. I know this dd command from Linux and I know programming in VBA but I don't know how to do this.
There is a program called WinHex that finds almost all files and the structure, but restores only files up to 200kB in the free version.