One of my Western Digital 2TB hard drives went south (curiously, I've only ever had such problems with WD hard drives - at least 8 of them failed prematurely). There were read errors, and then soon the MBR/partition table effectively vanished, so the drive showed without any partitions at all. There were about 5 partitions, 3 (or 4?) NTFS and 2 non-standard ones. (They were all "basic" MBR partitions, not GPT or whatever).
So I made a sector-by-sector copy to a new Seagate 2TB drive, then ran the windows-based app "Active @ Partition Recovery" on the new drive. I used the "SuperScan" feature, and it "found" approximately 100 potentially recoverable partitions (gah! - I should have used the "QuickScan" mode instead).
However, it didn't/couldn't identify the two non-standard partitions, which is understandable. But I'm hoping I might be able to find those two with a manual search using a hex editor.
But how? I've read several discussions of the contents of the MBR/Partition Table that strongly suggest that the ONLY place the partitions are defined is in the Partition Table of the MBR, rather than, say, at the front of any given partition itself.
But that CAN'T be correct, can it? After all, the Active @ Partition Recovery tool found 100 possible partitions -- without any MBR/Partition Table whatsoever -- by examining the data through the full length of the drive! Therefore, it seems to me that there must be some signature or whatever at the start of the partition itself or else the tool couldn't have found anything at all. Am I wrong?
I have the exact sizes of the two non-standard partitions and I have old cloned copies of those partitions that I can use to obtain the data from the first sector (or whatever) to provide a hex pattern I can search for on the new hard drive. Please check my thinking here: I think that if I can perform a hex search to find the first sector of each non-standard partition, I can then insert that sector number and the known partition size into the MBR to "re-create" them. Is that possible? How hard would it actually be, considering that I'd have to try to deal with the whole "extended/logical partition" business, since there were more than 4 total partitions?
But a critical question remains: What do the "partition signatures" in the first sector actually look like (assuming they exist)?
Thanks enormously to anyone who can help!
So I made a sector-by-sector copy to a new Seagate 2TB drive, then ran the windows-based app "Active @ Partition Recovery" on the new drive. I used the "SuperScan" feature, and it "found" approximately 100 potentially recoverable partitions (gah! - I should have used the "QuickScan" mode instead).
However, it didn't/couldn't identify the two non-standard partitions, which is understandable. But I'm hoping I might be able to find those two with a manual search using a hex editor.
But how? I've read several discussions of the contents of the MBR/Partition Table that strongly suggest that the ONLY place the partitions are defined is in the Partition Table of the MBR, rather than, say, at the front of any given partition itself.
But that CAN'T be correct, can it? After all, the Active @ Partition Recovery tool found 100 possible partitions -- without any MBR/Partition Table whatsoever -- by examining the data through the full length of the drive! Therefore, it seems to me that there must be some signature or whatever at the start of the partition itself or else the tool couldn't have found anything at all. Am I wrong?
I have the exact sizes of the two non-standard partitions and I have old cloned copies of those partitions that I can use to obtain the data from the first sector (or whatever) to provide a hex pattern I can search for on the new hard drive. Please check my thinking here: I think that if I can perform a hex search to find the first sector of each non-standard partition, I can then insert that sector number and the known partition size into the MBR to "re-create" them. Is that possible? How hard would it actually be, considering that I'd have to try to deal with the whole "extended/logical partition" business, since there were more than 4 total partitions?
But a critical question remains: What do the "partition signatures" in the first sector actually look like (assuming they exist)?
Thanks enormously to anyone who can help!