cgsecurity.org

Posted: **04 Mar 2015, 07:49**

I have a drive that seems to have lost its MBR. I'm not sure what to do at this current point. The log files seem to indicate that it is seeing a FAT table and whatnot.

Hard disk list
<Good drives listing removed>
Disk /dev/sdc - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - Seagate External Drive, S/N:J5TVK9VT

Partition table type default to Intel
Disk /dev/sdc - 80 GB / 74 GiB - Seagate External Drive
Partition table type: Intel

Analyse Disk /dev/sdc - 80 GB / 74 GiB - CHS 9729 255 63
Current partition structure:

Partition: Read error

search_part()
Disk /dev/sdc - 80 GB / 74 GiB - CHS 9729 255 63
FAT32 at 0/1/1
FAT1 : 32-19105
FAT2 : 19106-38179
start_rootdir : 38180 root cluster : 2
Data : 38180-156296291
sectors : 156296322
cluster_size : 64
no_of_cluster : 2441533 (2 - 2441534)
fat_length 19074 calculated 19075
file_pread(6,16,buffer,2111(0/33/33)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,2112(0/33/34)) ReadFile Data error (cyclic redundancy check).

file_pread(6,16,buffer,2113(0/33/35)) ReadFile Data error (cyclic redundancy check).

file_pread(6,1,buffer,2113(0/33/35)) ReadFile Data error (cyclic redundancy check).

file_pread(6,2,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,156303360(9729/110/46)) lseek err Invalid argument
file_pread(6,1,buffer,156303359(9729/110/45)) lseek err Invalid argument
file_pread(6,14,buffer,156303361(9729/110/47)) lseek err Invalid argument
file_pread(6,3,buffer,156303375(9729/110/61)) lseek err Invalid argument
file_pread(6,3,buffer,156303422(9729/111/45)) lseek err Invalid argument
file_pread(6,8,buffer,156303438(9729/111/61)) lseek err Invalid argument
file_pread(6,11,buffer,156303485(9729/112/45)) lseek err Invalid argument
file_pread(6,2,buffer,156305407(9729/143/14)) lseek err Invalid argument

Results

interface_write()

No partition found or selected for recovery

At this point, I'm not sure what to do. I am considering putting the drive in a linux machine and making an image to a bigger drive. I have used photorec and have recovered some files.

Windows does not assign the drive a letter. If I try to do anything to it in the Computer Management, it asks me if I want to initialize the disk with an MBR or GPT. I have so far refused to do either.

Thanks,
IMarv

Posted: **04 Mar 2015, 07:51**

You should clone the disk using gnu ddrescue to a new empty disk.
Once the copy is done, remove the original disk and use TestDisk on the clone to recreate the partition table.

Posted: **05 Mar 2015, 13:35**

The cloned drive reports that there is no end marker for the partition. Can I create a partition that uses min-max values since the drive only ever had one? ddrescue could not recover only the first 8k of the drive, everything else was retrieved successfully it thinks.

Thanks,
IMarv

Posted: **10 Mar 2015, 01:35**

In my case, I got lucky, only the first 2048 bytes seemed to have been bad.
All I needed to do was create a MBR and a partition of 0/1/1 to the end with the right file system type and it found everything. I don't know if the real drive can be fixed, but the image was.

Thanks,
IMarv

cgsecurity.org

Partition: Read error

Partition: Read error

Re: Partition: Read error

Re: Partition: Read error

Re: Partition: Read error