Main Forum > Tweaking.com Support & Help

Partition wiped after File Permissions Repair

<< < (2/2)

Shane:
That is odd. If the file system had been messed up during the file permissions the system should have crashed during since the file system would have been lost and windows should have slammed on itself.

You should be able to use any free tool that can recover partitions, since none of the data was wiped or overwritten then you should be able to recover it.

Here is one free version
http://www.easeus.com/datarecoverywizardpro/

You already di a sector scan on it to make sure there isnt any bad sectors correct? That scan will take a long time.

Shane

pupiloko:
Yea I did scan whole disk for bad sectors, took over an hour, with 0 sectors found. Reason I did this was a services start hang up for 1min after user login, which on windows xp was usually caused by permissions issue or ngen (.net framework) needed an update in my case. But this time it looks like there was something else I didn't come across yet.

Shane:
The MBR is what holds the information for the file system.
http://en.wikipedia.org/wiki/Master_boot_record

If you had a MBR virus or something tried to overwrite the mbr then that could explain why it got lost. The MBR was already loaded so when windows restarted it would have tried to read the MBR and thats why it didnt crash during.

The setacl doesnt touch the mbr, so I am curious what would have.

Also found some more info on it
http://www.win.tue.nl/~aeb/partitions/partition_types-2.html


--- Quote ---People often recommend the undocumented DOS command FDISK /MBR to solve problems with the MBR. This command however does not rewrite the entire MBR - it just rewrites the boot code, the first 446 bytes of the MBR, but leaves the 64-byte partition information alone. Thus, it won't help when the partition table has problems. Moreover, it can be dangerous to restore the boot code to its original state: if the cause of the problems was a boot sector virus, then vital information may have been stored elsewhere by the virus, and killing the virus may mean killing access to this information. (For example, the stoned.empire.monkey virus encrypts the original MBR to sector 0/0/3.) However, people who want to uninstall LILO, and do not know that LILO has a -u option, can use FDISK /MBR for this purpose.
--- End quote ---

So from the looks of it the MBR is what is the problem. You should be able to recover that, all the data is still there.

One thing to do would be to use a tool that allows you to look at the mbr
http://thestarman.pcministry.com/asm/mbr/BootToolsRefs.htm

I havent had to use a tool like that in a long time so I dont know which one would be best to use.

But that free tool I posted before should be able to recover the partition. The only time the MBR is touched is if you change any of the partition info, such as size or adding other partitions, or if something tries to replace or modify it. there are some nasty MBR viruses out there that are very very hard to get rid of because they are in the mbr.

Again you should be able to recover it, I am more curious to what touched the MBR in the first place.

Shane

Navigation

[0] Message Index

[*] Previous page