[SOLVED] Restoring lost MBR

[Morella]

Ok so a while back I screwed up. I was rushing a computer installation and stupidly erased the MBR. No I didn't back it up at any time (I didn't even know you could do that.) So I'm wondering if there is any way to get the data back. The hard drive hasn't been used since this mistake. It has been sitting in the comp with the sata cable unplugged just to make sure nothing gets written to it.

This hard drive was partitioned something like this.
750GB drive
P1: 40GB ntsf reserved for Windows junk (empty of data)
P2: 40GB for Mandriva
P3: Grub (?) I think it was suggested that this should be a separate partition for dual-booting or period
P4: Seems like one was suggested for something else not sure if this one exists.
P5: Storage ntsf - I think it was something like 655GB or something like that.

My computer set up when this happened was two hard drives with windows xp pro on the other and it was dual-booting from Grub on the 750GB drive with the now erased mbr


I know a guy who does data recovery and he was saying he thinks I should be able to get the data back using Ubuntu (or linux in general), but thus far I haven't gotten any info as to how.

I currently have a Ubuntu system set up that I can use to attempt the recovery from. Not sure which version I can boot it up if it's important. Plugging the drive into the system Ubuntu doesn't automatically show it as a drive. I used something from the terminal (I forgot what program) and it found the drive (so I know it's definitely good and linux can see it I guess).

So how can I restore this data? All I care about is the Storage partition anything else can be recreated. I am VERY new to linux so step by step is probably needed. Any help?

[rokytnji]

I won't be a lotta help with your problem but I bet if you post the results of

sudo fdisk -l

That is a small case L

Some of the other members will be able to decipher what is what. You can use any Live Cd (Ubuntu) to get this info and post it. Good Luck

Ps make sure the drive is plugged in when you do this

[Morella]

Here are the results:
Disk /dev/sda: 750.1 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x436b436a

Device Boot Start End Blocks Id System

Disk /dev/sdb: 200.0 GB, 200049647616 bytes
255 heads, 63 sectors/track, 24321 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x43124311

Device Boot Start End Blocks Id System
/dev/sdb1 * 1 5222 41945683+ 7 HPFS/NTFS
/dev/sdb2 5223 24321 153412717+ 7 HPFS/NTFS

Disk /dev/sdc: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x000c8365

Device Boot Start End Blocks Id System
/dev/sdc1 * 1 18662 149902483+ 83 Linux
/dev/sdc2 18663 19457 6385837+ 5 Extended
/dev/sdc5 18663 19457 6385806 82 Linux swap / Solaris

[devils casper]

Disk /dev/sda: 750.1 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x436b436a

Device Boot Start End Blocks Id System

Is that a complete output?
Above output is not showing any partition in 750GB hard disk. Execute this

sudo fdisk -l /dev/sda

Post output here.

If it doesn't display partition structure of /dev/sda, it means partition table has been corrupted. Its easy to restore partition table. Just post the output here and let us check whats wrong.

[Morella]

Yeah the partition table is gone. Isn't that a part of the MBR?

Output:
Disk /dev/sda: 750.1 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x436b436a

Device Boot Start End Blocks Id System

[devils casper]

MBR contains Boot Loader and Hard disk signatures too. Corrupted MBR doesn't list correct disk size. Problem is with Partition Table only.

Download testdisk in Ubuntu and execute its script. Testdisk will recover partition table correctly.

Or Download PartedMagic LiveCD. Testdisk is available in it.

Testdisk's Windows version is also available. Plug-in corrupted disk in a machine having Windows OS and run testdisk exe file to recover its partition table.

[Morella]

Hmm, I installed testdisk, but I am running into some problems. I'm following the instructions here: cgsecurity.org/wiki/TestDisk_Step_By_Step and I get to the quick search for the partitions and when I try command P it comes back with:


Disk /dev/sda - 750 GB / 698 GiB - CHS 91202 255 63
Partition Start End Size in sectors
L Linux 1 2 1 1020 254 63 16386174
L HPFS - NTFS 1528 1 1 8054 254 63 104856192 [Linux Disk]
L HPFS - NTFS 8055 1 1 91200 254 63 1335740427 [storage]


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continueSegmentation fault


It doesn't matter which of the partitions I choose. Maybe this is to how it should be? I'm not really sure where to go from here. My gut says to try the deeper search but I don't see that anywhere.

[devils casper]

Testdisk is detecting partitions correctly but throwing an error.
Are you using Ubuntu LiveCD or Windows OS?

[Morella]

I installed testdisk to Ubuntu. Should I use a liveCD instead?

[linuxd]

ya
the live cd will be more effective.