How to find partitions other than in MBR?

By Ghred
Aug 30, 2013
Post New Reply
  1. One of my Western Digital 2TB hard drives went south (curiously, I've only ever had such problems with WD hard drives - at least 8 of them failed prematurely). There were read errors, and then soon the MBR/partition table effectively vanished, so the drive showed without any partitions at all. There were about 5 partitions, 3 (or 4?) NTFS and 2 non-standard ones. (They were all "basic" MBR partitions, not GPT or whatever).

    So I made a sector-by-sector copy to a new Seagate 2TB drive, then ran the windows-based app "Active @ Partition Recovery" on the new drive. I used the "SuperScan" feature, and it "found" approximately 100 potentially recoverable partitions (gah! - I should have used the "QuickScan" mode instead).

    However, it didn't/couldn't identify the two non-standard partitions, which is understandable. But I'm hoping I might be able to find those two with a manual search using a hex editor.

    But how? I've read several discussions of the contents of the MBR/Partition Table that strongly suggest that the ONLY place the partitions are defined is in the Partition Table of the MBR, rather than, say, at the front of any given partition itself.

    But that CAN'T be correct, can it? After all, the Active @ Partition Recovery tool found 100 possible partitions -- without any MBR/Partition Table whatsoever -- by examining the data through the full length of the drive! Therefore, it seems to me that there must be some signature or whatever at the start of the partition itself or else the tool couldn't have found anything at all. Am I wrong?

    I have the exact sizes of the two non-standard partitions and I have old cloned copies of those partitions that I can use to obtain the data from the first sector (or whatever) to provide a hex pattern I can search for on the new hard drive. Please check my thinking here: I think that if I can perform a hex search to find the first sector of each non-standard partition, I can then insert that sector number and the known partition size into the MBR to "re-create" them. Is that possible? How hard would it actually be, considering that I'd have to try to deal with the whole "extended/logical partition" business, since there were more than 4 total partitions?

    But a critical question remains: What do the "partition signatures" in the first sector actually look like (assuming they exist)?

    Thanks enormously to anyone who can help!
  2. jobeard

    jobeard TS Ambassador Posts: 13,271   +280

    The MBR is not in the partition table(s) but in sector 0 of the HD.

    Only RARELY does anyone (or software) play with the partition type numbers as getting it wrong and the P.T. gets creamed.

    If you *must* know, see this.
  3. jobeard

    jobeard TS Ambassador Posts: 13,271   +280

    not with the legacy system; FOUR partitions are max and one of those can have Extended Partitions in it. A BOOTABLE partition can not be an Extended Partition.
    see this.

    The newer GPT technique is described here.
  4. Ghred

    Ghred Newcomer, in training Topic Starter

    Thanks, jobeard, for your replies! I apologize for the delay in responding; I was out of town.

    While I appreciate your responses, I was looking for different information. I needed to find a partition using a raw hex search from data within the partitions themselves, not from within the MBR/Partition table.

    It turns out what I was looking for are Volume Boot Records (VBR), which are stored within the partitions themselves. But I haven't yet figured out where within a given VBR the partition-type signature is stored, so I'm still looking for more information...

    Thanks again.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.