[bulava]

Dear Friends,

Because of this problem: http://forums.techguy.org/windows-xp...p-windows.html

I took 6 DVD full of data from that PC but 7GB more remaining including very valuable 600MB plus of Incredimail e-mail data. I admit it was my mistake but I pray a way out to recover my windows partition else only option is to run a tool like GetDataBackNTFS by connecting with another disk (if that tool allows corrupted disk?). Any inputs are highly appreciated and thank you.

I left that 7GB data because it was tempting for me to try out rescuing Windows by toggling the active partition to C: drive (FC12 used to have the default BOOT flag). I blindly trusted a suggestion given by a Forum Guru and now am repenting so badly (prior to that my disk used to boot nicely no matter BOOT sector got corrupted).

Plan of Action:

a) I can't disturb any other machines which are used at my home and in my company to pull out a disk (actually most of the machines use SATA disks).
b) So I will use my Laptop disk as primary disk. Instead of wasting money on buying a new IDE disk, I intend to buy this product:

http://cgi.ebay.com/USB-TO-IDE-SATA-...item3ca5b15fd3

Please suggest is it a good idea going with that product (it costs here hardly $10)? Anyone used such a product to retrieve the data from recovery tools?

Thank you very much.

[Saga Lout]

Please take a look at my latest post in this thread

http://forums.techguy.org/windows-xp...p-windows.html

[bulava]

Originally Posted by Saga Lout

Please take a look at my latest post in this thread

http://forums.techguy.org/windows-xp...p-windows.html

Thank you. What's your suggestion on my plan of action? Should I buy that product or not?

[Saga Lout]

Originally Posted by bulava

Thank you. What's your suggestion on my plan of action? Should I buy that product or not?

I'm happy to admit to knowing precious little about Incredimail but I suspect you may need to run it to be able to create the data recovery options, and then import them into another machine or e-mail handler. Unless someone knows the location and filename extension of the data storage, I don't see a point in buying undelete or rescue software.

[bulava]

Originally Posted by Saga Lout

I'm happy to admit to knowing precious little about Incredimail but I suspect you may need to run it to be able to create the data recovery options, and then import them into another machine or e-mail handler. Unless someone knows the location and filename extension of the data storage, I don't see a point in buying undelete or rescue software.

GOOD NEWS: Data is intact. Results:

1) PCLinuxOS 2009.1 (May Mag. CD).1 Live CD: Shows ALL partitions and data intact. I even mounted and check my data, most of the folders. There is k3b on that live CD too but don't know where it will burn the data?? ( I mean on Live CD programs we open by CD (and loaded in RAM), so never tested if it burns a DVD or not (after removing Live CD from optical disk tray).

I tried to do fdisk -l but it says Unable to seek /dev/sda. So Partition table corrupt?

2) KDE4.3 Live CD - openSUSE11.1 base (Sep Mag. CD): Shows ALL partitions exactly the same way in PCLinuxOS way but I can't mount them (with a click) and I don't have its root password (not given anywhere or don't remember). But it's a positive result, am sure not we could mount NTFS from this CD too if we know root password - fdisk -l also ruled out.

3) ubuntu Karmic 9.10 (Dec Mag. CD: Once again I booted this Live CD, Palimpsest Disk utility shows the partitions clearly even with corresponding Windows Labels (WinXP_SP2 for C: drive etc).

IMPORTANT: It is clearly showing H: drive as Unallocated space and / of FC12 as Uallocated space. All other partitions are intact. GOOD NEWS: open all partitions from the File browser since sudo support is there by default). I am very happy (relieved).

I tried to do sudo fdisk -l (root access enabled by default) but it says Unable to seek /dev/sda. Same like PCQLinuxOS. This confirm partition table corrupt?

But, by which OS (culprit)? Who must be the culprit? Let's discuss on this detail. Hope more Gurus join in this discuss, don't know why such a thin participation!

I know the incredimail path. It would be in the All Users

It's in Documents and Settings>sunil>Local Settings>Application Data>IM folder.

I right clicked from ubuntu on IM folder: Clearly shows the volume name (WinXP_SP2) with size is 660.9MB and 2,479 items

Lastly, now point is, how to pull that data I need to explore

So, NO more UBCD testing etc things or need to remove the hard drive. These confirmations with my Eyes is more than enough. Please respond.

[Saga Lout]

You could use the LiveCD of PCLinuxOS to install it - having logged in as Root password "root" - and at worse, it would install over your existing Linux OS. As part of that installation, you get to set up a new Grub, after which Windows might open from the Grub menu. Don't set it as default, that would be pushing our luck.

If you don't want to install, simply pull the data out on to flash drives a bit at a time, or to an external hard disk in one fell swoop.

[bulava]

Originally Posted by Saga Lout

You could use the LiveCD of PCLinuxOS to install it - having logged in as Root password "root" - and at worse, it would install over your existing Linux OS. As part of that installation, you get to set up a new Grub, after which Windows might open from the Grub menu. Don't set it as default, that would be pushing our luck.

If you don't want to install, simply pull the data out on to flash drives a bit at a time, or to an external hard disk in one fell swoop.

Last night I booted with Parted Magic and mounted the USB flash drive and copied my Windows account Desktop and My Documents data successfully:

mount /dev/sda /mnt/usb/

root@PartedMagic:~# df

Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 253904 108428 145476 43% /
/dev/loop0 53248 53248 0 100% /lib/unionfs/usr
unionfs 253904 108428 145476 43% /usr
/dev/loop1 6144 6144 0 100% /lib/unionfs/firmware
unionfs 253904 108428 145476 43% /lib/firmware
/dev/loop2 8192 8192 0 100% /lib/unionfs/modules
unionfs 253904 108428 145476 43% /lib/modules
/dev/sda 508796 137920 370876 27% /mnt/usb
/dev/hda5 16779860 6784980 9994880 40% /media/Data <== XP data folders on
/dev/hda1 15727600 14716136 1011464 94% /media/WinXP_SP2 <== XP data folders

Did anyone tried Simple Burn program in the Parted Magic?

Here is the most important catch lol. Here is the boot.ini copied from my C: drive. I opened with Leafpad editor on the Parted Magic:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Looks like a problem in this boot.ini. isn't it?

[Saga Lout]

Originally Posted by bulava

Here is the most important catch lol. Here is the boot.ini copied from my C: drive. I opened with Leafpad editor on the Parted Magic:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Looks like a problem in this boot.ini. isn't it?

I don;t think that's the problem - that remains Grub being missing.

It may have picked up the first entry from Grub if you'd declared Windows to be default and the second line just confirms the instructions. Looks all right to me. I'm glad you have your data back - it now matters less if you re-Partition because the Windows Partition #1 is the most obvious. Partition #0 is almost certainly the recovery setup and anything else is Linux.

[bulava]

Originally Posted by Saga Lout

I don;t think that's the problem - that remains Grub being missing.

It may have picked up the first entry from Grub if you'd declared Windows to be default and the second line just confirms the instructions. Looks all right to me. I'm glad you have your data back - it now matters less if you re-Partition because the Windows Partition #1 is the most obvious. Partition #0 is almost certainly the recovery setup and anything else is Linux.

Very true, GRUB has gone and Windows was made to be the default boot OS.

I have been encouraged to correct the boot partition (to recover the entire windows, to pull up and running again!) area using TestDisk on the Parted Magic. Now I've taken almost 8GB of back up, nothing else to do with that PC. Do you suggest the same?

Do you have any idea about a good Ghost like free program? Thank you.

[Saga Lout]

You could try rewriting the MBR using an XP CD but I'm at a loss to understand why you won't put Grub back if you accept that removing it was the cause of the problem. I think I already posted that I haven't used Parted Magic so I can't comment on whether or not it can correct a Windows MBR.

As to a Ghost, I paid only £35 in the UK for Acronis True Image last week - Stateside posters may get it for less - I know of no freebie that I would rely on as much as that.

[bulava]

Originally Posted by Saga Lout

You could try rewriting the MBR using an XP CD but I'm at a loss to understand why you won't put Grub back if you accept that removing it was the cause of the problem. I think I already posted that I haven't used Parted Magic so I can't comment on whether or not it can correct a Windows MBR.

No, I haven't removed GRUB. First, as I explained in the first post, I wanted to DEL only H NTFS partition but due to some strange reason it looks like Disk Manager deleted the adjacent Linux / partition too.

That's what left me totally puzzled, end result is total mess of the XP booting itself!!

Right now am running TestDisk (analysing the disk) on the Parted Magic. I will post here the analysis results. I am NOT going to *write* anything to that disk yet...will thoroughly dig this problem since I've the complete data in my hands safely.

[bulava]

Originally Posted by Saga Lout

You could try rewriting the MBR using an XP CD but I'm at a loss to understand why you won't put Grub back if you accept that removing it was the cause of the problem.

TestDisk Analysis update:

Disk /dev/hda - 80 GB / 74 GiB - CHS 9730 255 63
Partition Start End Size in sectors
* HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]
P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [Software]
L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]
L Linux Swap 5352 1 1 5416 254 63 1044162
L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]
D HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]
D HPFS - NTFS 6200 1 1 8549 254 63 37752687 [Pharma]
D Linux 7506 1 1 8549 254 63 16771797
P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos]

It is very evident from the above that strange things have happened *without* any deliberate mistake from my end. What might have done such a bad thing?

Now, what would be your suggestion to do next with TestDisk?

Should I post any other detail from TestDisk please let me know. Awaiting for a response...thank you.

[bulava]

One last thorough examination I've done. Tomorrow is the self-set D-Day to recover the partitions so that the PC could be up and running as usual...

***When I ran Analyse***

Disk /dev/hda - 80 GB / 74 GiB - CHS 9729 255 63
Current partition structure:
Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]
2 P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [Software]
3 E extended LBA 3263 0 1 8549 254 63 84935655
5 L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]
X extended 5352 0 1 5416 254 63 1044225
6 L Linux Swap 5352 1 1 5416 254 63 1044162
X extended 5417 0 1 6199 254 63 12578895
7 L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]
X extended 6200 0 1 7505 254 63 20980890
8 L HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]
X extended 31653 238 32 57542 205 56 415904731
Must be in extended partition
3 E extended LBA 3263 0 1 8549 254 63 84935655
X extended 31653 238 32 57542 205 56 415904731

NOTE: Does NOT show deleted Linux / partition! (FC12 / was in extended, that's why extended LBA mismatch ???)

***When I ran Quick search***

Disk /dev/hda - 80 GB / 74 GiB - CHS 9729 255 63

Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]
2 P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [Software]
3 E extended LBA 3263 0 1 8549 254 63 84935655
4 P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos]
5 L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]
6 L Linux Swap 5352 1 1 5416 254 63 1044162
7 L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]
8 L HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]

NOTE: Again, doesn't show FC12 / partition.

**When I ran Deep search***

Disk /dev/hda - 80 GB / 74 GiB - CHS 9730 255 63
Partition Start End Size in sectors
* HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2] OK - 16 GB
P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [Software] OK - 10 GB
L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data] OK - 17 GB
L Linux Swap 5352 1 1 5416 254 63 1044162 OK
L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research] OK - 6+ GB
D HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma] NOTOK - 10 GB - When 'P - shows correct data.
D HPFS - NTFS 6200 1 1 8549 254 63 37752687 [Pharma] NOTOK - 19 GB - NTFS found using backup sector! When 'P' - Can't open filesystem. Filesystem seems damaged.
D Linux 7506 1 1 8549 254 63 16771797 <= FC12 / - 8+ GB - NOTOK- EXT4 Large file Sparse superblock Backup superblock. When 'P' - No file found, filesystem seems damaged.
P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos] OK - 9+ GB

NOTE: Here, it shows FC12 / partition...at last Please note the duplicated 'D' NTFS partitions and observations.

Please post your analysis and suggestions on how to tackle this complex situation.

PS: What is the meaning of L : load backup?

Thank you very much for your efforts, hope tomorrow I could put an end to this vexing problem

[Saga Lout]

I'm afraid all the analysis tells me nothing new. The Partitions you expected to be in place are still in place and you still have two almost working Operating Systems. What you lack, and have done since Post #1, is a workable boot system so you need to choose between Windows MBR and Grub - the latter being the one that could kickstart both systems. I've posted that several times but my argument gets no stronger with repetition - perhaps someone on the Linux Forum could persuade you.

Sorry, but I don'.t seem to be able tio contribute any more to this thread.

[bulava]

Originally Posted by Saga Lout

What you lack, and have done since Post #1, is a workable boot system so you need to choose between Windows MBR and Grub - the latter being the one that could kickstart both systems.

UPDATE:

Wrote the TestDisk Quick search result to the disk, it said to be to Reboot. I did that and I got the same:

I get the windows crashed options:

Safe Mode
Safe Mode with Networking
......
......
......
Start Windows Manually.


*****TestDisk Quick Search file system result*****
Disk /dev/hda - 80 GB / 74 GiB - CHS 9729 255 63

Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]
2 P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [Software]
3 E extended LBA 3263 0 1 8549 254 63 84935655
4 P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos]
5 L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]
6 L Linux Swap 5352 1 1 5416 254 63 1044162
7 L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]
8 L HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]

NOTE: Again, doesn't show FC12 / parition.

Now I rebooted with Windows XP SP2 CD.....

First SUCCESS sign - CD is booting now (it refused to boot after I changed the default boot flag to Windows, remember?):

Now I pressed 'R' and I got a very positive dialogue - Recovery console asking me:

1: C:\Windows

Which Windows installation would you like to log onto
(To Cancel, press ENTER)? 1 <=== I remember I have give the input here as 1

Now, Type the Adminstrator's Passord: I DID THAT

Now, recovery console jumped to

C:\Windows (never happened till this step to me earlier).

Now I did type FIXMBR, I got this **CAUTION**

This computer appears to have a non-standard or invalid master boot record.

FIXMBR may damage your partition tables if you proceed.

This could cause all the partitions on the current hard disk to become inaccessible

If you are not having problems accessing your drive, do not continue (BUT AM HAVING THE PROBLEM, ISN'T IT?)

Are you sure you want to write a new MBR?

NOTE: I didn't get NTFS Boot sector recovery screen after Quick Search write with Parted Magic

I clicked 'Y'. It said....

Writing new MBR on physical drive \Device\Harddisk0\Partition0

The new MBR has been succesfully written....and am back to:

C:\WINDOWS

I got the windows crashed options, again:

Safe Mode
Safe Mode with Networking
......
......
......
Start Windows Manually

I clicked on the Start Windows Manually..........

Yep! Yep!!!

Windows BOOTED, and am into Admin account

Once I booted into the Admin account, Windows quickly detected VOLUME changes and updates it. Then for the safety sake I Started the Logical Disk Manager Administrative Service in AUTO mode (Logical Disk Manager I keep always AUTO) and I rebooted again.

No problem...lol in fact machine seems to got little more faster in restart/reboot

Next, I opened Event log, NO ERROR MESSAGES or anything warning.

Next, opened important thing Disk Management...........

I can see ALL WINDOWS and Linux /swap as healthy....ONLY Linux / is showing as FREE space...very funny....I DEL the H drive it's INTACT....instead Linux / has gone

I suspect that because I opened Explorer window and click the mouse on the H drive and forgot?

Updated KIS 2010 and logged into my account to check the mails...tons of mails lol.
Rebooted..
Logged into Admin account....and opened Event log...wow not a single error or warning

I am so happy it ended in a good way....now it's almost all over. Yes, I can re-install the FC 12 and hand that PC back to my Mom.

But, I feel bad for Linux / partition

SOLVED THE PROBLEM