[Gurd141]

One of my Western Digital 2TB hard drives went south (curiously, I've only ever had such problems with WD hard drives - at least 8 of them failed prematurely). There were read errors, and then soon the MBR/partition table effectively vanished, so the drive showed without any partitions at all. There were about 5 partitions, 3 (or 4?) NTFS and 2 non-standard ones. (They were all "basic" MBR partitions, not GPT or whatever).

So I made a sector-by-sector copy to a new Seagate 2TB drive, then ran the windows-based app "Active @ Partition Recovery" on the new drive. I used the "SuperScan" feature, and it "found" approximately 100 potentially recoverable partitions (gah! - I should have used the "QuickScan" mode instead).

However, it didn't/couldn't identify the two non-standard partitions, which is understandable. But I'm hoping I might be able to find those two with a manual search using a hex editor.

But how? I've read several discussions of the contents of the MBR/Partition Table that strongly suggest that the ONLY place the partitions are defined is in the Partition Table of the MBR, rather than, say, at the front of any given partition itself.

But that CAN'T be correct, can it? After all, the Active @ Partition Recovery tool found 100 possible partitions -- without any MBR/Partition Table whatsoever -- by examining the data through the full length of the drive! Therefore, it seems to me that there must be some signature or whatever at the start of the partition itself or else the tool couldn't have found anything at all. Am I wrong?

I have the exact sizes of the two non-standard partitions and I have old cloned copies of those partitions that I can use to obtain the data from the first sector (or whatever) to provide a hex pattern I can search for on the new hard drive. Please check my thinking here: I think that if I can perform a hex search to find the first sector of each non-standard partition, I can then insert that sector number and the known partition size into the MBR to "re-create" them. Is that possible? How hard would it actually be, considering that I'd have to try to deal with the whole "extended/logical partition" business, since there were more than 4 total partitions?

But a critical question remains: What do the "partition signatures" in the first sector actually look like (assuming they exist)?

Thanks enormously to anyone who can help!

[Advertisements]

Have you read this: Extended Boot Record.

Basically, a MBR has only enough room for 4 partitions. So, to get more, you need to define one partition in the MBR as an extended partition (type 0Fh). In the first sector of that partition, you have an EBR (which is like another MBR) that defines the logical partitions within that extended partition. It is also 512 bytes and ends with the magic number 55AAh.

Please use this informations at your own risk. I am no expert on hard drives.

[Buddierdl]

Have you read this: Extended Boot Record.

Basically, a MBR has only enough room for 4 partitions. So, to get more, you need to define one partition in the MBR as an extended partition (type 0Fh). In the first sector of that partition, you have an EBR (which is like another MBR) that defines the logical partitions within that extended partition. It is also 512 bytes and ends with the magic number 55AAh.

Please use this informations at your own risk. I am no expert on hard drives.

[Gurd141]

Thanks for your reply, Buddierdl! I apologize for the delay in responding; I was out of town.

While I appreciate your response, I was looking for different information. It turned out I was looking for Volume Boot Records, which are stored in the partitions themselves, rather than in the MBR/Partition Table.

But I haven't yet found where the partition signature or partition-type code is stored within the VBR, so I'm still working on that...

Thanks again!