cgsecurity.org

I have a bit of an unusual problem.

I was trying to recover a corrupted hard drive from an old Dell laptop which no longer boots by connecting the drive as an external USB drive to a newer Samsung netbook. However, I accidentally attempted to boot from the old hard drive and when I next tried to boot the Samsung from it's internal drive, that drive would no longer boot.

The Samsung drive is 160Gb and should have a small recovery partition plus two larger partitions of approx. 75Gb. When I run testdisk from a live Linux USB I get this for the drive:

Disk /dev/sda - 58 GB / 54 GiB - SAMSUNG HM160HI

Hidden sectors are present.

size 114270345 sectors
user_max 114270345 sectors
native_max 312581808 sectors
dco 312581808 sectors
Host Protected Area (HPA) present.

So the drive size has been redefined somehow.

However, the correct partition structure still seems to be there, but with some of it falling outside the range of the disk capacity:

Current partition structure:
Partition Start End Size in sectors

1 P Compaq Diagnostics 0 1 1 913 254 63 14683347
2 * HPFS - NTFS 914 0 1 10188 126 50 148994798
Invalid NTFS or EXFAT boot
3 P HPFS - NTFS 10188 126 51 19457 21 20 148899840
3 P HPFS - NTFS 10188 126 51 19457 21 20 148899840


Testdisk will only look for data with the 58Gb disk volume, so any idea how I get to the rest of the data?

As root, run "hdparm -N /dev/sda"
312581808 should be the value listed by the first command for the total size of the disk.
Run "hdparm -N p312581808". This will remove the Host Protect Area.

/dev/sda:
setting max visible sectors to 312581808 (permanent)
SET_MAX_ADDRESS failed: Input/output error
max sectors = 114270345/312581808, HPA is enabled

Also tried temporary change (i.e. without the p) but same result.

Okay, have removed the HPA using HDAT2. I now get UNMOUNTABLE_BOOT_VOLUME error when I boot, but hopefully I can fix the boot sector to recover from this.

So I have now tried to restore the corrupted boot sector using Backup BS. However, testdisk tell me the backup is identical to the current boot sector. Does this mean the back up is corrupt as well? If so, how should I proceed?

Fixed using Windows Recovery!