Folkert Rienstra <see_reply-to@myweb.nl> wrote:
Pathetic.

The poster, fuckwit.

Wasnt what was being discusssed, fuckwit.

Pity that wasnt what was being discusssed, fuckwit.

On 6 Jan 2008 08:21:19 GMT, Arno Wagner <me@privacy.net> wrote:

I'm the OP and I'm back after having installed a new drive, imaged the
bad drive and then removing power from the bad drive. Now I'm ready
to try to reconstruct whatever I can from the image and am looking for
some pointers.

For tools, I have UBCD plus the program that Michael wrote,
cnwrecovery. I compared the current partition map with an old
printout from Ranish Partition Manager and they match. Here's a
section from RPM:
2 >Pri 1 Windows NT NTFS 0 1 1 254 254 63
3 Pri 2 Extended LBA 255 0 1 15770 254 63
4 A Log Windows NT NTFS 255 1 1 15770 254 63
5 Pri 3 Windows FAT-32 LBA 15771 0 1 15932 254 63

Why is partition 4 listed as A Log? I'm pretty sure this is where the
data is that I really want to find.

You can try Stellar Phoenix Windows Data Recovery Software. It is a
partition recovery utility which recovers lost data from FAT 16, FAT
32, NTFS, NTFS5 file system. Stellar Phoenix is helpful in recovering
data from formatted hard drive or data lost due to software
malfunction, viruses or even sabotage.
Demo version can be downloaded from: http://www.stellarinfo.com/partition-recovery.htm

Previously Bob Simon <nobody@nowhere.com> wrote:
"Log" very likely means "Logical Partition".

The above would be primaries 1,3 and a logical contained in
primary 2, which is an extended patition,. i.e. a container
for logical partitions.

Arno

On Jan 8, 7:59*am, Arno Wagner <m...@privacy.net> wrote:
The partition function in my program will give the size of each
partition, and the starting location. If it needs to be
reconstructed, thye reconstruction routine will scan the drive looking
for possible starts, and where possible using values from pointer
blocks.

A lot of commercial PCs, such as Dell and Sony start a disk with a
short - often FAT - hidden partition that is used for recovery. The
data is then on the second logical partition.

Once a partition has been selected for recovery, for logical recovery
my NTFS function does require valid values for cluster size and the
start of the MFT. There are helper functions for each of these.
(Analyse disk...)

As you now have an image, you can make as many mistakes as you like,
and will not lose more data. For a partially damaged drive, the most
successful function to use with NTFS recovery is 'Recover from file
entries' This will read each MFT in sequence, rather than trying to
read with the logical directory tree. Thus, if a critical part of the
directory tree has failed, files will still be found with valid
names. If the MFT structure is damaged, the whole disk can be scanned
for MFTs.

On the NTFS screen is a function for file filter - this can be use to
select just your .tax files.

Function key F1 will give contect sensitive help on every screen

Michael

On Jan 8, 1:59*am, Arno Wagner <m...@privacy.net> wrote:
Does this mean that when I attempt to recover a file in the logical
NTFS partition, whatever software I'm using will automatically
rebuild the container first? Or is this typically a two-step process
where I must first re-create the extended partition, then the NTFS
partition?

On Jan 8, 3:04*pm, "bobneworle...@yahoo.com" <bobneworle...@yahoo.com>
wrote:
I can only speak for my own software but as far as I understand it,
the container is just a way to have more than 4 partitions. On the
boot sector, there is space for 4 records, ( starting at 0x1be) each
defining a partition. By using one of those records to point to an
extended partition, another 4 partitions may be added. The extended
partition overhead is typically 64 sectors.

For recovery, the only important thing is the start of the real
partition. Therefore recovery of the extended partition on it's own
is not required.

Michael

mscotgrove@aol.com wrote in news:0110bead-54de-43cb-a3c4-8c00c0ecc005@e23g2000prf.googlegroups.com
More nonsense.
After 'your' socalled 'mistake' you have to re-image again.
The only way to make mistakes without loosing data is to
keep yet another copy of the image as a backup or not to
allow any changes to the image and use it as a source only.

mscotgrove@aol.com wrote in news:457da410-83d1-4a89-bdb9-4df256fb6ba0@i7g2000prf.googlegroups.com

Rod Speed wrote in news:5ug5mkF1g2mmsU1@mid.individual.net
But obviously was what he meant, whitness subject title, dimwit.
And "Reconstructing current partitions" -plural- is obviously
not what it may look at first glance: reconstructing volumes.
It's just re-establishing simple pointers to relatively simple
partition tables.

Pity that is all he want's, whatever it's called, dimwit.

Thank you for so graciously acknowledging my point, Roddles.

On Jan 8, 5:00*pm, "Folkert Rienstra" <see_reply...@myweb.nl> wrote:
It is a pity that you do not know what the software I wrote actually
does.

One important thing is that it never changes the source. If the boot
sector needs updating, it does so on a virtual boot sector, not the
real thing, thus any trial and error mistake does not change the
source.

Newsgroups are here to share information, and generally assist, not to
run others down.

Michael

Folkert Rienstra <see_reply-to@myweb.nl> wrote:
Wasnt the command he was asking about, fuckwit.

<reams of your pathetic excuse for bullshit flushed where it belongs>

Previously mscotgrove@aol.com <mscotgrove@aol.com> wrote:
Sound design for software not targetted at experts (which I gather
this is). Also a nifty feature for experts. If the (prevalent?) case
that the disk is actually fine, this seems to be a valid alternative
to working on an image.

Something Folkert does not understand and very likely never will.
He is here to run others down.

Arno

Previously mscotgrove@aol.com <mscotgrove@aol.com> wrote:
Basically, yes.

Not quite what I found, when I traced this on sector level a long time
ago. The structure was as follows: A main partition table entry points
to a next partition sector, at the beginning of the space for the
extended partition. This then had the extended parition described in
entry 1 and a further partition sector pointed to, if I remember
correctly. From there on it was basically a linked list (there were 5
or so logical partitions), were entry 1 described the logical
partition and entry 2 pointed to an additional partition sector at the
beginning of the next logical partition.

I don't know whether this is standard, but it seems the 4 entries in
the extended partitition description(s) are not all used.

True, of course.

Arno

What you describe is what I have always seen, but I think in theory,
all 4 entries could be used. After all, the first extended pointer
is any one of the 4 pointers in the boot sector. I don't remember
seeing a pattern, but also I don't remember seeing more than one
extended pointer at a time.

Michael

Previously mscotgrove@aol.com <mscotgrove@aol.com> wrote:
I have no idea whether this is required to be implemented fully general
(which would also aloww tree-like structures) or what the limits are.

Arno

mscotgrove@aol.com wrote in news:49327186-7ade-4a7f-b126-a21052d33e22@v67g2000hse.googlegroups.com
Apparently neither do you ...

.... so obviously there won't be any mistakes to make, yet that is what you wrote.

And if it doesn't change the source you have to get yet another new disk
to recover all your files to.

What's the point if it doesn't get used by the OS, the ultimate test.

There's much more than just the bootsector(s) when it comes to trial and
error. There is no excessive unused space on a drive to also keep virtual
FATs directories and what have you.

They are also not meant to take commercially advantage of.
Which is exactly what you do.

I 'assist' in pointing you out.

I have no problem running commercial spammers down.

Arno Wagner wrote in news:5ujojkF1imhquU2@mid.individual.net
Indeed, babblebot.

Arno Wagner wrote in news:5uis36F1i2ad2U2@mid.individual.net
Yeah, why bother to read the definition when you can do it the hard way.

Whatever that is.
Presumably he means the Extended Partition entry in the MBR.

Whatever that is.
Presumably he means the address of the EPBR (Extended Partition Boot
Record) that describes both the enclosed logical partition and the re-
maining free extended partition.

Not the extended partition but the logical partition within the extended partititon.

Just like any other ordinary primary partition definition.

the next Extended Partition Boot Record pointer and remaining free ex-
tended partition description.

Guess not then, babblebot.

It's a linked list directly from the start of the MBR entry.

This is correct - to try and recover data onto the original disk is
very dangerous. Recovery is required when something has gone wrong,
and the normal operating system will not help. To have the greatest
chance of retaining your data, copy all files to a new location. Yes,
this may mean a new disk drive, but at say $100, this gives a large
peace of mind.

The ultimate test is correctly recovered user files. Making the
original disk work again may be a bonus, but in my opinion, not very
important.

I have no intention of spamming. I will try and assist other members,
as well as asking questions. If I suggest my program may be of use, I
try and make it clear that I have an interest in the program, and so
it is not impartial advice. If someone asks how to do something, and
I have a solution, I will tell them - and often other members of the
newsgroup will suggest other programs as well. It is up to readers to
make their own mind up.

Could other members of the newsgroup tell me if I am right or wrong,
or somewhere in the middle.