6 replies to this topic

[bilou_gateux]

I have a friend's hewlett packard faulty laptop.

I have dissassembled laptop, unmounted 2.5" SATA drive and asked friend to connect it as second drive to  SATA controller of her desktop computer.

for unknown reason, she wasn't successfull to view content of disk.

she gave me drive back and I connected it to another desktop computer SATA controller.

 

booted Windows 7 Professional from Disk 0 (desktop computer system drive)

Under disk management console, i have following infos about laptop drive :

Disk 1 Dynamic but no volumes. french windows OS here, says : étranger

 

I downloaded TestDisk 7, launched program and analysed sdb

Found four partitions

 

1 P W2K Dynamic/SFS 1985 sectors

2 * W2K Dynamic/SFS 407552 sectors

3 P W2K Dynamic/SFS 596682752 sectors

4 P W2K Dynamic/SFS 28048048 sectors

 

Disk /dev/sdb

D HPFS - NTFS

D HPFS - NTFS

D HPFS - NTFS

D FAT32 LBA [HP_TOOLS]

 

I can list files (P) from the partition i need to recover data (partition 3)

i currently do not have a large disk with enough free space to backup as image the content of partition 3

 

What are the best options to make partitions viewable under Windows 7 from the desktop.

I will find a 3rd big disk to make an image backup of the wanted partition 3. don't need content of others partitions.

 

Let me know if i need to give more detailled infos to diagnose the problem.

[Wonko the Sane]

Generally speaking it is extremely rare that Dynamic Disks were actually used, and even less probable on a laptop.

As a matter of fact it is instead rather common that *something* changes the Partition ID from an "original" 07 to the ID of a dynamic disk (which is 42).

 

You can try to:

1. backup the MBR
2. backup the PBR's of each partition/volume (you never know)
3. check if (as I presume the partition ID's are now 42)
4. change them to 07

 

If this is not the specific case, at the most the volume/partition will continue remaining inaccessible and you can always restore the backed up MBR (or manually revert from 07 to 42).

 

If you want, make a copy of the MBR and of the PBR's backups, compress them into a .zip or .7z archive and attach it, and I'll have a look at them.

 

Use DSFO or HDhacker to create the copy/backup to a RAW file.

 

Wonko

[Agent47]

I have seen users unwillingly converting basic disk to dynamic when they try to create a new partition when there is already four primary partitions in the partition table. HP laptops are one example. In addition to the large visible "C:" partition, usually there will be  "System" , "HP Tools" and "Recovery" partitions which are usually hidden from the user. If we shrink the "C" and try to create a new partition using the free space, "Disk Management" will prompt to convert the disk to "Dynamic" since there is no more free slot in the partition table. 

[bilou_gateux]

@wonko

 

That were the case, partition ID's are now 42.

 

don't know the original ID of partition 1

changed ID of 2nd, 3rd and 4th partition

partition 2 ID 07 [NTFS] System Reserved

partition 3 ID 07 [NTFS] WINDOWS 7 HOME

partition 4 ID 0C [FAT32 LBA] HP_TOOLS

 

I can browse content of 2 and 3

 

[Wonko the Sane]

Good .

The 1985 sectors of "first partition" are too similar to 2048 (default start for first partition under Vista and later) - 63 (default start for first partition under XP/2003 and earlier) to be a coincidence.

And anyway, set apart the crazy partitioning schemes jaclaz (and Wonko the Sane) sometimes use to workaround some stupid limitation of *something*, like here:

http://reboot.pro/to...o-gpt/?p=186449

noone in his/her right mind would make a partition around 1 Mb in size, and Windows tools default anyway to one whole cylinder (around 8 Mb) as minimum size.

That "first" partition is most probably an artifact, and should be all 00's.

 

There is also no real reason why you shouldn't be able to access/browse the last one (the [HP_TOOLS] one.

 

The whole disk should be (the accessible/partitioned space, there may well be some "slack" at the end of it):

63+1985+407552+596682752+28048048=625,140,400 sectors, which seems "just right" for a 320 Gb disk, as 625,140,400*512=320,071,884,800

 

The 407,552*512=208,666,624 is the "normal" 200 Mb partition that Windows 7 uses as "boot" (called aptly "system" by MS) and should contain just the BOOTMGR+\boot\ folder.

The 59,6682,752*512=305,501,569,024 is the "normal" main partition for Windows 7, the "system" partition (called aptly "boot" by MS) and actually the only partition that the final user should normally be able to use, the one that gets the C:\ drive letter, around 300 Gb in size.

The 28,048,048*512=14,360,600,576 is the around 14 Gb partition that should contain (as the label suggests) the HP_TOOLS, including the OEM recovery image.

This partition has normally no drive letter associated, but you don't really-really need a "big" disk to image that, a 16 Gb USB stick would do.

 

What do you mean by "I can browse content of 2 and 3"?

Can you assign a drive letter to this last volume?

What is the output of mountvol?

 

 

Consider that since this volume is filled "in factory" and never touched afterwards it is likely to be not fragmented, so, even if - for any reason - the FAT tables are corrupted, the files in it can be recovered by direct carving.

The issue here may be if the *whatever*, as Agent47 suggested possibly the "final user", see also:

http://h30434.www3.h...ion/td-p/197434

that messed with dynamic disks also botched the MBR code it may be difficult (or impossible) to recreate it (this depends on the specific way the HP guys set up the "recovery partition", old models used PCAngel and it was a PITA to recreate a valid one making use of F11):

http://www.msfn.org/...d-not-be-found/

whilst more recent models may be using the default Windows RE mechanism

This is the old referenced page about Windows 7 HP recovery partition:

https://web.archive....cname=c01895783

and this is current one:

http://support.hp.co...ument/c01868346

 

If you can image the whole disk "as is", it would make sense to attempt doing a Recovery or have the HP tool attempt to repair the recovery partition from the booted 7.

 

Wonko

[bilou_gateux]

Good .

 

What do you mean by "I can browse content of 2 and 3"?

Can you assign a drive letter to this last volume?

What is the output of mountvol?

Wonko

Yes drive letters are assigned to:

partition 2 "system" partition

and partition 3 "normal" main partition for Windows 7

I can view content (browse using Windows Explorer) of both.

Content of HP_TOOLS partition doesn't matter.

Laptop is definitively dead and will not be repaired.

 

Only User partition content is unvaluable.

I will backup files using Microsoft WIM image format (imagex tool)

next clear disk

next format with a single partition

restore files from the wim image to disk

put the disk in 2.5" external USB enclosure

and suggest her (my friend owner of the dead laptop) to keep it as a backup.

and also put a copy of files to the other disk (multimedia external USB disk) she already own to be safe.

and give it back to her to use as a backup disk

[Wonko the Sane]

Content of HP_TOOLS partition doesn't matter.

Laptop is definitively dead and will not be repaired.

 

Good.

Then everything is fine and dandy

Anyway, poor little HP laptop.

 

By the way, which exact model is it?

There is some value in a dead laptop if it has a still working Nvidia GeForce card of the models that overheated...

 

Wonko