Jump to content











Photo
- - - - -

Recover MBR based on FAT and RD?

tool usb

  • Please log in to reply
4 replies to this topic

#1 betrand

betrand

    Frequent Member

  • Advanced user
  • 467 posts
  •  
    France

Posted 18 May 2014 - 06:04 PM

Hi,

 

I've got a 8Gb usb stick which has just gone wrong. No idea what happened, could be when copying files,

retrieving from Win7 Os without Eject, or at boot.

It's a USB I use to backup files (while still booting to grldr).

 

The MBR disappeared. Overwritten it seems (by some garbage).

I have the Rootdir, and the FAT. Maybe the beginning of the FAT is missing.

 

The files are still there, and the folders (referenced in the RD).

1-How do you find the RD of the subdirs (in hex-editor) (JustForInfo)?

2-There are a few partition recovery tools out there, which is the best,

 or which tool would enable to recover a MBR (partition table) based on the FAT & RD.

None I tried seem to do that.

I mean, the tool could analyse how the FAT and RD reference the clusters, deduce it is a Fat12/16/32,

deduce where the partition starts, and ask "Single partition?" or multi. Then 'close' the partition. :dubbio:

 

3-Is there a way to lock the used portions of the FAT and RD (attrib readonly?) so as to avoid rewrites.

And still write to empty clusters. (while unlocking for a defrag).

4-Is there a way to lock writing to MBR whatever the scenario?

 

Dunno if it makes sense. ;)

Cheers.



#2 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13649 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 19 May 2014 - 07:57 AM

First thing you make a "forensically sound" or "dd like" image of the stick.

Then you make a second copy of the image.

Then you try analyzing the copy of the image with TESTDISK:

http://www.cgsecurit...g/wiki/TestDisk

if the issue is just the corrupted MBR, it can fix it, just follow the tutorials.

If you cannot do it with TESTDISK, get DMDE:

http://dmde.com/

though it is perfectly possible to use DMDE to fix the missing/corrupted MBR, it will need some time, knowledge and experience, BUT it should be able to create automatically a virtual reconstruction of the filesystem, enough to copy off the copy of the image the files.

You can also use DMDE to just make the image, (or use dd or dsfo or clonedisk).

 

You ALWAYS leave the original alone after having imaged it.

You ALWAYS leave the image of the original alone after having made a copy of it.

You ALWAYS work on a copy of the image ONLY.

 

:duff:

Wonko



#3 betrand

betrand

    Frequent Member

  • Advanced user
  • 467 posts
  •  
    France

Posted 24 May 2014 - 03:28 PM

Thanks, DMDE did the trick.

It's a trial version so you can restore only the files which are visible on the panel.

Means you have to reload for each folder (subfolder).

It's Ok for flat folders, not if you have 17 subfolders, or 100!

I didn't try too much to repair the MBR, but as you said with time and experience,

it could do the trick :).

Good tool as its size is small.

 

I tried also the Dos version on a small image (for fun). Works.



#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13649 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 24 May 2014 - 04:14 PM

It's Ok for flat folders, not if you have 17 subfolders, or 100!

 

If you assume 100 folders, you may decide that the time needed to manually recover them has a value greater than US$ 16.00:

http://dmde.com/editions.html

or 0.16 US$/folder and actually buy (at what IMNSHO represents a very fair price) a one year license for it's Express version. (the one year license does not "expire", it only limits the transfer to other hardware after one year, that is if you buy a new machine and you keep it, the software will work on it forever).

 

You could further decide that you could afford instead to spend US$ 38.00 for a "Standard" edition or even US$ 75.00 for a Professional one, both allowing transfer to other hardware beyond the one year time limit.

 

:duff:

Wonko



#5 betrand

betrand

    Frequent Member

  • Advanced user
  • 467 posts
  •  
    France

Posted 26 May 2014 - 07:16 PM

Yeah, thanks Wonko for doing the price research for me!

It's ok, I needed about 4 folders.

But for future need, it seems (is) a good price.







Also tagged with one or more of these keywords: tool, usb

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users