Re: undelete for partition tables?
> > Question: Was that possibly a Linux extended partition (type 85) as
> > opposed to a DOS extnded partition? That would explain why DOS fdisk
> > could delete it.
>
> Yes, originally this computer was set up by me with linux only. It was my
> colleague who starte messing with DOS fdisk. (Strictly speaking win98
> fdisk)
OK, but if it was a Linux type 85 extended partition, you would not be
able to access any Windows partitions inside of it *from* Win98. It
wouldn't recognize it as an extended partition. Also Win98 can't boot
from an extended/logical drive. It had to be installed on a primary that
has been deleted.
In the future, I would recommend saving the output of either...
1) Linux fdisk ==>> fdisk -l > part.txt (this does all drives)
2) Ranish PM ==>> part -d 1 -p -r > part.txt (for each drive)
...to a file on a floppy disk, so that a record of the partition
table(s) is always available. It makes a job like this a relative snap.
It's too late in this case of course.
Despite the (understandably) sketchy details here, I'll try to get you
started with the disk editor. Please understand that finding that
extended partition sector is just the beginning of the job.
I wrote some web pages last year after helping someone else with a
similar, but much easier, problem. The procedure for searching for a
sector with the Norton Disk Editor is outlined on this particular page:
http://www.concentric.net/~tompfr/pr_step3.html
The only significant differences in your case would be the range of
sectors to search and the search criteria. Since all partition sectors
should end with a "55 AA" as the last two bytes, the following can be
used as the search criteria:
specify hex values of 55 AA, located at an offset of 510 (decimal) in
the sector. The range of sectors to search would be essentially the
whole drive in your case. The Disk Editor can only search about half of
your drive (the first 8 GB)
Keep in mind that the partition sector you are looking for is not going
to be the only sector that will end with 55 AA. The MBR sector (first
sector on the drive), any FAT (16 or 32) boot record sector, and
remnants of previous partition boot records and partition sectors may be
found.
When you find a sector that has 55 AA at the end, you can use Diskedit
to view it as a partition table by hitting <F6>. What you are looking
for is a partition table sector with two entries, looking something like
this in the Disk Editor's partition table view:
http://www.concentric.net/~tompfr/nuembr.txt
Instead of me trying to cover every possible detail now (which is
impossible anyway), I suggest you try following my procedure and try to
account for the differences in your situation as you do it. If you have
specific questions or problems, feel free to ask. If you really want to
do this, you are going to have to get into this up to your eyeballs
anyway - I can only try to get you started.
There very likely is a better way to do this with Linux - I just don't
know it. There are professional data recovery firms that could also
handle this, but you are definitely talking about $$$ there.
Good luck,
Tom
Reply to: