Urgent Help -- Data Recovery

ManOfSteel · Post by **ManOfSteel** » Thu Apr 17, 2008 12:47 am

Hello,

This is a long post, but please, bear with me for a while.

Yesterday, I probably made the worst computer mistake in my life.

I wanted to try what I thought was a live version of ReactOS, but as soon as it booted, I think it wiped out the MBR and maybe even the boot record that shows the location of the extended partition (I'm not 100% sure about this one).

I use Win98SE.
The HDD was originally partitioned with only one primary (C: ) and the rest was an extended containing 3 logicals (D: and E: on this drive and F: for the entire second HDD)).

If I try to boot from the CD or from the HDD, I now get this message:

F1...DOS
F5...Disk 2

F1 Default

Type the name of the Command Interpreter (e.g., c:\windows\command.com)
C>_

What's weird is that if I choose F1, Win98SE seems to load normally, then right after the Windows starting screens (big flying Windows logo) appear, it tells me it is unable to find command.com (I tried all possible paths). I can use a:\command.com of course, but it's useless since it can't start Windows either.
If I choose F5, it tells me it's an invalid boot drive (I guess F5 is for my second HDD, which is an extended partition and therefore cannot be booted from).

When I boot from a startup floppy, I can't access any partition as if none was partitioned.

Not ready reading drive C
Abort, Retry, Fail?

I wonder how is the new MBR able to partially boot from c:, load the startup logo (located AFAIK in c:\windows\????.sys) and try to load the command line when I can't even access c: from the floppy?

Now my big question: is there any hope to solve this or have I lost any chance of ever getting all my data back?
Is there for example any data recovery software (free or commercial, but reliable) that could "manually" read the entire disk to find the boot records or the FATs for D: and E: and recover some files from there?

I'll be grateful to the kind souls who could help me out of this terrible mess.

zaleschiemilgabriel · Post by **zaleschiemilgabriel** » Thu Apr 17, 2008 7:45 am

Whatever happened to your disk, it's probably irreversible if the CD you booted was a virus. Instead of looking for recovery software, you should be looking for anti-virus software that scans boot sectors. As for recovery, I remember seeing a recovery option somewhere in Partition Magic. That option scans unused space for partitions and restores them if they were deleted. You could also try the Ultimate Boot CD. Google for it; it has some nifty tools.

As for the missing "command.com", you're out of luck. If you manage to recover your documents, I suggest you back them up and reinstall the operating system. I also suggest against booting from the MBR again, as it may be infected with a virus.
Next time you try out a live CD, first try it inside an emulator, like Bochs.

Solar · Post by **Solar** » Thu Apr 17, 2008 7:51 am

zaleschiemilgabriel wrote:If you manage to recover your documents, I suggest you back them up and reinstall the operating system. I also suggest against booting from the MBR again, as it may be infected with a virus.

Second that. Get your hands on a real LiveCD (Knoppix, for example) including either a very good how-to or a person with the necessary know-how to get your data valuables saved on an external hard drive (or DVD-R or whatever). Then reinstall your system. Or better yet, reinstall your latest system backup. You have one, haven't you?

Zacariaz · Post by **Zacariaz** » Thu Apr 17, 2008 11:03 am

I have had much use for "easy recovery pro" in the past. however you do need another pc to prepare a recovery cd and you also need a place to put the recovered data, like an extern hardrive. Also you need a lot of patience.

Oh ya, allmost forgot. It is not free. Though it is possible to get around that problem if you rally want to.

This is of course only needed if you really have lost the data, if hte only problem is that you aren't able to access your data the above solution is the one you are looking for.

01000101 · Post by **01000101** » Thu Apr 17, 2008 2:10 pm

I would recommend connecting the drive externally to another computer with Windows and use Recover My Files, it is what I used to use at the computer shop I worked at, worked like a charm.

ManOfSteel · Post by **ManOfSteel** » Tue Apr 29, 2008 3:53 am

Hello and thank you for your replies.

The problem has been solved. It was the MBR that got corrupted. I could get it back in a few minutes with TestDisk.
Command.com could not be found because the first partition was "resized" to 40MB instead of 10GB when the partition table was corrupted, and the boot loader was therefore unable to read the entire FAT or locate the files (as they were probably outside the 10MB partition limits).

The CD was not a virus. The Bochs version worked just fine. Maybe something went wrong during the burning process.

staffi6636 · Post by **staffi6636** » Sat May 31, 2008 4:05 am

Hi, there are lots of software available on the net but I would like to recommend one of the best data recovery service provider called DiskEmergency. It has many ways to recover your data. You can submit problems online and get the job done quickly. Hope this will help you.

Brynet-Inc · Post by **Brynet-Inc** » Sat May 31, 2008 9:20 am

I might start my own data recovery service... seeing how gullible many people are, there is nothing those companies do that you can't do yourself at home for free.

None of them can recovery data that has been overwritten or zeroed, it's simply impossible, all they can do is restore the inodes/metadata of lost files.

Still sounds like a quick way to make a couple hundred bucks in... ~15 minutes.