[Sussex] HDDs

[Steve Dobson]

Mark

On Fri, Dec 17, 2004 at 09:17:21AM +0000, Mark Barber wrote:
> Only my daughter managed to get a boot sector virus on her Me machine 
> and when I restored it using NAV it disappeared completely from the boot 
> sequence. Rescue disks cant find it either though the BIOS can so no hw 
> fault. Have tried fdisk /mbr without success and Knoppix but that won't 
> boot either for some reason. I suspect the partition table has gone awol
 
I have a feeling that you're right.

First a quick google found this:
  http://support.microsoft.com/kb/q69013/
which says 
  "Fdisk has an undocumented parameter called /mbr that causes it to write
   the master boot record to the hard disk without altering the partition
   table information."
If the partition table has gone this won't have much effect, it will just
install the MS Boot Loader which then will not be able to find a bootable
partition.

Did you look at the boot messages from Knoppix?  Re-boot Knoppix, open
a shell and type "dmesg | less" to go looking for kernel messages about
the hard disks it found at boot.  The maybe some useful info in there 
about missing partition tables or whatever it is that is wrong (as all
my disks are working I can't know what the messages are).

You might also want to try Knoppix's "fdisk -l" (I assume that the disk
is the primary master) in Knoppix.  This will list the partition table
and will not alter the disk.  Again any messages may help us find out
what has gone AWOL.  On my working laptop I get the following (note you
have to be root to run this command):
  # fdisk -l

  Disk /dev/hda: 30.0 GB, 30005821440 bytes
  16 heads, 63 sectors/track, 58140 cylinders
  Units = cylinders of 1008 * 512 = 516096 bytes

     Device Boot Start End    Blocks    Id System
  /dev/hda1   *      1  1984    999904+ 83 Linux
  /dev/hda2       1985  2976    499968  82 Linux swap
  /dev/hda3       2977 58140  27802656   5 Extended
  /dev/hda5       2977 14881   6000088+ 83 Linux
  /dev/hda6      14882 22818   4000216+ 83 Linux
  /dev/hda7      22819 42659   9999832+ 83 Linux
  /dev/hda8      42660 58140   7802392+ 83 Linux

Your's will be different (I expect just the one Windows' partition taking
up the whole disk, but it depends how the disk was first setup).

If you have another disk (which must be at least the same size at the
problem one) you may like to make a copy of the data on it.  dd(1) on
the Knoppix CD will do this for you.  The command is (assuming that
the new disk is the secondary master):
   dd if=/dev/hda of=/dev/hdc bs=512
This copes from the primary master (hda) to the secondary master (hdc)
in block sizes of 512 bytes (1 sector at a time).  You can then swap 
this disk to that it is the primary master and try to write a new
partition table (but do not format it) to recover the data.

Steve