wrong mbr written Topic is solved

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
seajay
Posts: 5
Joined: 23 Jul 2013, 15:58

wrong mbr written

#1 Post by seajay »

I need help getting rid of an mbr written kto the wrong disk. I was copying files, preparing to do a fresh install of ubuntu when I accidentally changed the format of my internal 1tb ext4 storage drive to ntfs. I took that drive out out as well as a 400gb ntfs drive to do a recovery and finish copying files using an external usb mount. I copied files from the ntfs drive then switched to the ext4 and started an image. There was a problem and I had to back out but somehow the mbr from the ntfs wrote to the ext4 drive. Can I get this off safely so the data can be read and recovered from the ext4? Thanks in advance, years of experimental results are at stake.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: wrong mbr written

#2 Post by Fiona »

Did you run Quick and Deeper Search to have a try to find your partition?
If your partition is found, you can press p to have a try to list your files.
If you're not able to list your files and you receive an error message, please, please let me know.
If you run your diagnose, you can open your created testdisk.log and copy and paste the content in your post.

Fiona

seajay
Posts: 5
Joined: 23 Jul 2013, 15:58

Re: wrong mbr written

#3 Post by seajay »

Thanks Fiona, I appreciate the help with this. I would have responded sooner but needed to run the requested analyses again, they are attached.

Update, I miss-read, and thought I was attaching the log-it is pasted below:



Wed Jul 31 14:14:34 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.5.0-37-generic (#58~precise1-Ubuntu SMP Wed Jul 10 17:48:11 UTC 2013) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 3907029168 sectors
/dev/sda: user_max 3907029168 sectors
/dev/sda: native_max 3907029168 sectors
/dev/sda: dco 3907029168 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 781422768 sectors
/dev/sdb: user_max 781422768 sectors
/dev/sdb: native_max 781422768 sectors
/dev/sdb: dco 781422768 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - TOSHIBA DT01ACA200, S/N:238JZU9GS, FW:MX4OABB0
Disk /dev/sdb - 400 GB / 372 GiB - CHS 48641 255 63, sector size=512 - ST3400620AS, S/N:5QH02PXG, FW:3.AAC
Disk /dev/sdg - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DL 003-9VT166, FW:CC45
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512 - SAMSUNG HD103SJ, FW:0200

Partition table type (auto): None
Disk /dev/sdh - 1000 GB / 931 GiB - SAMSUNG HD103SJ
Partition table type: Intel

Analyse Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121601 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
1 * Linux 0 32 33 47417 154 33 761761792 [what]
Computes LBA from CHS for Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121602 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121602 255 63

recover_EXT2: s_block_group_nr=0/2905, s_mnt_count=31/33, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 95220224
recover_EXT2: part_size 761761792
Linux 0 32 33 47417 154 33 761761792 [what]
EXT4 Large file Sparse superblock, 390 GB / 363 GiB
BAD_RS LBA=3502337519 1053578
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 218010 109 3 248252 44 9 485833642
This partition ends after the disk limits. (start=3502337519, size=485833642, end=3988171160, disk end=1953536130)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 54897/190/14
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 54897/190/14
FAT12 54897 190 14 54897 235 58 2880 [W2POEB2_EN]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 54897/235/59
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 54897/235/59
FAT12 54897 235 59 54898 26 40 2880 [W2POEB3_EN]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 54898/26/41
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 54898/26/41
FAT12 54898 26 41 54898 72 22 2880 [W2POEB4_EN]
FAT12, 1474 KB / 1440 KiB

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=81/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 60597 217 37 182199 43 36 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973504512, size=1953525168, end=2927029679, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=81/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 60599 65 11 182200 146 10 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973527040, size=1953525168, end=2927052207, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=81/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 60600 0 1 182201 80 63 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973539000, size=1953525168, end=2927064167, disk end=1953536130)
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2041 GB / 1901 GiB)
The following partitions can't be recovered:
Linux 60597 217 37 182199 43 36 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
Linux 60599 65 11 182200 146 10 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
Linux 60600 0 1 182201 80 63 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
FAT32 LBA 218010 109 3 248252 44 9 485833642

Results
Linux 0 32 33 47417 154 33 761761792 [what]
EXT4 Large file Sparse superblock, 390 GB / 363 GiB
FAT12 54897 190 14 54897 235 58 2880 [W2POEB2_EN]
FAT12, 1474 KB / 1440 KiB
FAT12 54897 235 59 54898 26 40 2880 [W2POEB3_EN]
FAT12, 1474 KB / 1440 KiB
FAT12 54898 26 41 54898 72 22 2880 [W2POEB4_EN]
FAT12, 1474 KB / 1440 KiB

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121602 255 63

recover_EXT2: s_block_group_nr=0/2905, s_mnt_count=31/33, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 95220224
recover_EXT2: part_size 761761792
Linux 0 32 33 47417 154 33 761761792 [what]
EXT4 Large file Sparse superblock, 390 GB / 363 GiB

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/7452, s_mnt_count=0/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 0 0 1 121601 80 63 1953525168 [New Volume]
EXT4 Large file Sparse superblock Backup superblock, 1000 GB / 931 GiB
Partition not added.
BAD_RS LBA=3502337519 1053578
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 0C
FAT32 LBA 218010 109 3 248252 44 9 485833642
This partition ends after the disk limits. (start=3502337519, size=485833642, end=3988171160, disk end=1953536130)
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 54897/190/14
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 54897/190/14
FAT12 54897 190 14 54897 235 58 2880 [W2POEB2_EN]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 54897/235/59
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 54897/235/59
FAT12 54897 235 59 54898 26 40 2880 [W2POEB3_EN]
FAT12, 1474 KB / 1440 KiB
check_FAT: Unusual media descriptor (0xf0!=0xf8)
FAT12 at 54898/26/41
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)

FAT12 at 54898/26/41
FAT12 54898 26 41 54898 72 22 2880 [W2POEB4_EN]
FAT12, 1474 KB / 1440 KiB

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=81/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 60597 217 37 182199 43 36 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973504512, size=1953525168, end=2927029679, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=81/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 60599 65 11 182200 146 10 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973527040, size=1953525168, end=2927052207, disk end=1953536130)

recover_EXT2: s_block_group_nr=0/7452, s_mnt_count=81/37, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244190646
recover_EXT2: part_size 1953525168
Linux 60600 0 1 182201 80 63 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
This partition ends after the disk limits. (start=973539000, size=1953525168, end=2927064167, disk end=1953536130)
Disk /dev/sdh - 1000 GB / 931 GiB - CHS 121602 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1000 GB / 931 GiB) seems too small! (< 2041 GB / 1901 GiB)
The following partitions can't be recovered:
Linux 60597 217 37 182199 43 36 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
Linux 60599 65 11 182200 146 10 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
Linux 60600 0 1 182201 80 63 1953525168 [New Volume]
EXT4 Large file Sparse superblock Recover, 1000 GB / 931 GiB
FAT32 LBA 218010 109 3 248252 44 9 485833642

Results
Linux 0 32 33 47417 154 33 761761792 [what]
EXT4 Large file Sparse superblock, 390 GB / 363 GiB
FAT12 54897 190 14 54897 235 58 2880 [W2POEB2_EN]
FAT12, 1474 KB / 1440 KiB
FAT12 54897 235 59 54898 26 40 2880 [W2POEB3_EN]
FAT12, 1474 KB / 1440 KiB
FAT12 54898 26 41 54898 72 22 2880 [W2POEB4_EN]
FAT12, 1474 KB / 1440 KiB

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

seajay
Posts: 5
Joined: 23 Jul 2013, 15:58

Re: wrong mbr written

#4 Post by seajay »

Any help with this...please! pretty please!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: wrong mbr written

#5 Post by cgrenier »

If I understand correctly you are looking for the ext4 partition named [what],
Run TestDisk, Intel, Analyse, Quick Search, Write, confirm, MBR Code, confirm, Quit and reboot.

seajay
Posts: 5
Joined: 23 Jul 2013, 15:58

Re: wrong mbr written

#6 Post by seajay »

[what] is the mbr that was written inadvertently, the partition I need to recover is the ext4 that was the entire disk.

seajay
Posts: 5
Joined: 23 Jul 2013, 15:58

Re: wrong mbr written

#7 Post by seajay »

OK, I got my files back. First in disk utility (ubuntu I deleted the erroneously added [what] partition then I ran fsck /dev/sdh, clicked yes to all the repairs it wanted to make and......voila! Disk mounted and data is back :D

Locked