Okay, here's the story. (It's a long one).

It all started about 10 hours ago. I booted my PC (Windows XP), and discovered that no image was displaying on my monitor. I wondered what the problem was, and I thought that perhaps it was displaying through my onboard graphics, instead of my Nvidio Geforce FX 5200.

I unplugged my monitor from the Nvidia, and plugged it into the onboard, and Lo and Behold, I saw the familiar site of the windows startup screen. I checked the BIOs, and the PCI was set as primary display adapter, as it should be.

But, then, instead of starting up, (before login) it showed the mouse infront of a black background, (as it usually does before the log in screen) but when I moved the mouse, it moved on the screen with a horiffically low framerate, and it just stayed like that. It didn't proceed to the log in. I turned it off, restarted, went into safe mode, and it all worked fine.
So, in safe mode, I did a windows restore and rebooted,
problem was still there,
went back into safe mode, restored to an EARLIER point (a few days before the first one I went back to),
and when I restarted the problem was still there.
But, when I tried to go into safe mode, instead of going to the login screen, it did the same thing as when it WASN'T in safe mode, with the mouse and the low frame rate, except this time, it had "safe mode" written in the corners.
Then I began to worry, because now I couldn't boot in safe mode OR normal mode.
I then turned the computer off, unplugged everything, opened up my PC, and put my graphics card into a different PCI slot, in the hope that the BIOS would pick it up, and display through it instead of the onboard. When I plugged it all back together, nothing had changed.

I then thought that maybe if I reset the CMOS that maybe the BIOS would then detect the graphics card and set everything right.
I took apart my PC again, took out the small battery to the CMOS, waited about 10 seconds, and put it back. Plugged everything in, and nothing had changed.
I got a windows disk, and tried to reinstall windows. It booted from the disk, but before it got to the main menu thing, I just had a mouse infront of a blue background, with a really low framerate. And it didn't get past that point.
Same problem.
I got desperate, so I got my old ubuntu linux disk, and booted from it. Success!
I booted into linux, and not only that, but after 4 or 5 hours of tinkering, I managed to even get it to recognise my wireless network adapter, and connect to my router. I felt extremely pleased with myself, as I have never got a linux partition to connect to the internet.

Of course, as it was Ubuntu, it only booted from the disk, and I didn't bother to install it onto the hard disk. Every setting I changed got deleted when I restarted, as it would clear the RAM.

So, I booted into linux from the disk, set up the wireless internet. and got onto meebo (internet based instant messenger). I got talking to all of my MSN contacts.

I then thought perhaps, if I removed my graphics card, perhaps it had a fatal error and was sucking all of the power supply or something.

I turned off, took out the graphics card, (which wasn't actually doing anything, as my monitor was plugged into my onboard graphics). I took my Nvidia out, and put everything else back together, aside from the graphics card, and when I rebooted, Success!! I managed to get into windows!
Not sure what the actual problem was with the gfx card, but it worked.

I could boot into windows in normal mode, and safe mode. All of the problems were gone. (aside from the fact that i had no Nvidia graphics card plugged in)

That's when things REALLY started to go wrong.

Windows was unable to connect to my wireless internet.
I tried for ages, but it just wouldn't connect. I wanted to talk to my MSN contacts, so I booted Ubuntu Linux again, and meebo.
(I had to reconfigure all of the wireless network stuff).
That's when I thought I should install Ubuntu onto the hard drive, incase a similar problem with windows not booting occured. So, in Ubuntu, I resized my windows partition, and made another partition with the 3 gigs that I took off of the windows one. Well, I tried. Ubuntu Linux crashed halfway through.

As you can imagine, the windows partition, (with all of my PRECIOUS PRECIOUS files on that took me MONTHS to gather up) was wrecked.
Well, not wrecked, as such, but ubuntu SAW it, but the filesystem (which was previously "NTFS") had become "unknown", and there was a nasty looking exclaimation mark next to it. That's when I realised what the problem was. All of the files in my Windows partition were STILL INTACT, but the filesystem was set to nothing.

When I tried to boot windows, I had a "error loading operating system" message. I tried to get a DOS floppy (with fdisk on it), but my PC had no floppy drive, as was using a USB floppy drive. My PC didn't boot from it. I'm still not sure why it doesn't boot from floppies.
I tried installing MSDOS onto the unpartitioned space left over, and using the fdisk command to restore my partitions to what is kept in the MBR, but there wasn't enough space, I needed 16 MB for a FAT16 filesystem, and i only had 7.
I tried using the Recovery console on the windows disk (Which was working now, as I had removed my graphics card), and tried the "fixdisk" command, but it didn't help.

Now,

What I want to know, is:

How can I ACCESS the MBR on my hard drive IN LINUX, and RESTORE all of the partitions on my Hard Drive to what is stored in the MBR!?

Any help would be GREATLY appreciated, and if you CAn'T help, if you could point me in the right direction, so I can seek help elsewhere, I would also be very grateful.

Thanks in advance.



...Told you it was a long story.


If you help me, you officially own my soul.

Well, I don't know how to fix your disk, BUT I do know of a program that can help you recover some of the files as long as you don't format the disk.

What you would need is another ext3 hard drive/partition to store the data on. Then use the program foremost from linux (either your Ubuntu install or a liveCD) to find different data types on your windows partition and write the output to the new drive. It may not get you all your data, but it will get a good amount. Be ready to sift through it all for garbage though. You'll probably get some damaged jpegs, mpegs, etc, but it was good enough for my parents who had a fatal virus and I would say I got 90%+ of their photos and documents back...

I would use a minimum file size of something like 20KB, otherwise you'll get a bunch of gif's and crap from internet history. Oh, and if anyone has been using your machine for, umm, late night entertainment, you'll get a bunch of that too (my little brother seemed to have been doing some surfing...). So maybe don't sift through the videos/jpegs in front of young children or anyone else who would be offended...

Ah, but you see:

Ubuntu Linux can't read the partition AT ALL....It doesn't even know what filesystem it is. It's completely unknown. All of the files are there, but they are completely unreadable because the programs that try to read them go "ooh can't read this. Isn't NTFS" when it IS, it's just labelled as corrupted, or unknown.

What I'm trying to do, is reset the partitions to the Master Boot Record (the stored information of what the partitions were like before they get changed).

But I don't know how.

But I'll try that program anyway....if I can find it..


...oh, and the important files are about 6 gigs of music files.
And I can;t make another partition, I only have 7 megs of unpartitioned space left. And I can't resize the other one, because Linux doesn't know what filesystem it is...

You could have killed your Xp partition by resizing it unsuccessfully.

Don't do any formatting, resizing or partition creation if you want your data back.

Your first concern is to find out how bad the situation is. Can the partitions be seen? To do this you boot to Ubuntu Live CD and issue the following terminal command
and report what Linux has to say about your partitions. The "-l" is negative big "L".

If Linux can list out your partition without an error meesage then there is hope.

Try to run testdisk from any Linux LiveCD, it may fix your partition table.

There's no way I can follow the first post--WAY too long.
First, if there is irreplaceable data on that drive, then STOP--Don't do anything else to it. If you want to try data recovery yourself, then start by making at least one clone of the drive--2 would be better.

The safer thing is to simply get it to a professional service.

Make sure that the Linux live distro you are using has the NTFS kernel module loaded.
"sudo /sbin/lsmod" will show the modules loaded.
"sudo /sbin/lsmod | grep ntfs" should show you if it is loaded.
"sudo /sbin/modprobe ntfs" will load in the kernel module if it is available.

I definitely second the suggestion of first making a clone of the disk and then using testdisk to try to repair things. It can usually detect partitions and filesystems just fine.

I think linux CAN see the partitions, because the partition editor can still see them.

here's what happened:
Is there any hope?

The partition table looks OK and error reported isn't related to it.

However this information only confirms the partition table is error free and the information inside the partition may be accessible as only two Linux partitions or may not be accessible if they haven't been unformatted.

I could be wrong but I was hoping to see a partition Type 7 indicating a NTFS system for your Windows.

Did you have any recollection of what the partition table was like before this adventure? If you haven't had any other partition you may be able to recover the partition data just by deleting the two Type 83 Linux partitions and create one Type 7 NTFS partition. I am of course assuming your WIndows uses NTFS filing system which is the de facto standard for WIn2k and XP.

If you had only one NTFS partition then by using a Live CD in terminal mode with the command "cfdisk /dev/hda" you can delelte the two Linux partitions hda1 & hda2, create only one primary partition hda1 using the entire space, select it to be Type 7 and click "write". After a reboot you could have the NTFS partition back and all the data could be accessible if it is mounted on a boot-up Linux filing system from a Live CD. It is really that simple.

A Windows can become unbootable if any one of its system files is damaged or corrupted. The user may think the end of world is near but with a Linux Live CD 99.99% (of 100% including the damaged system file) of the files can be salvaged and that is directly from my experience. The damage if done is usually inflicted by the user him/herself not knwoing the right way.

The common concensus of the repliers here is to run program "testdisk". The version I used is a DOS based program downloadable from Internet to operate in a floppy, using Win98/Dos as the operating system. That program examines your filing index in the boot sector area in an attempt to rebuild the partition table again. You need to have some idea of what you have got before in order to benefit from the recovery.

Your initial information is confusing and the current partition table does not bear the result supporting your claim that you lost the partition table during a resizing exercise in Ubuntu. If that is the case we would see Type 7 NTFS partition in your table but there is none. This suggests Ubuntu did not resize the partition but was installing itself on top of your Windows, therby overwriting everythinh had bit been successful.

What I could confirm is the partition table can be destroyed totally without affecting the data inside the partitions. The partition table has 64 bytes, 16 bytes per each of the 4 primary partitions, stored at the 447th to 510th bytes of the MBR which is the first sector (512 bytes) of your hard disk. The fdisk-l confirm to us you have only one disk and hda name tells us it is an IDE or PATA disk. (i.e not no a Sata disk). For your comfort I have rebuilt over 60 partitions in a couple of IDE disks half a dozen times and suffered possible one or two partitions so far. So here is an example of even over 100 partitions can be secured as long as you have a record of the partition table.

Therefore if you know the partition details before the adventure then there is a good possibility to get back a lion share of your data. The loss is likely coming from the "resizing" exercise as Ubuntu could moving the files around to suit the size you specified. Had it been successful your original partition table would have been altered.

In using the testdisk program you don't have to commit to the change and so you should report back the following

(1) Information of the partition suggested by testdisk

(2) Information of your partition scheme before the damage (Just the number of partitions, what filing format and preferably the sizes if you can remember them).

Your hope of securing the data back depends on how well you know your previous partition table when you had only WIndows.

Sorry if my initial post was confusing, I was in a panic.

1. Before linux crashed while resizing the partition table, the partition table looked like this:

(ALL NUMBERS USED ARE APPROXIMATE VALUES)

windows partition (NTFS). . . 74 GB
Unused space. . . . . . . . . . . . 7 MB

I was only running linux from the boot disk.

2. I was attempting to create this partition table:

Windows Partition (NTFS). . . .71 GB
Linux Partition. . . . . . . . . . . . . 3 GB

While doing this, it crashed.

3. It then got corrupted and looked like this:

(!) Windows partition (Unknown File system). . . .74 GB
(!) Unused Space (Unknown File system). . . . . . .7 MB

Could you take me through all of the steps I should go through after knowing this information to try to solve the problem?

I don't want to make a mistake and destroy all of my data..

And I am having difficulty locating this testdisk program.
And, of course, I can't download and install it because it would only save to the memory and get removed when I reboot...so if you could link me, then I could save it to floppy on a different computer.

And surely if I deleted both of the partitions, and made one out of them, it would delete all of my data?

OK the news looks good to me.

Let me reiterate again that when you delete or create partitions you are only messing around with 64 bytes in the MBR. The data inside the partition is NOT touched. However without a truly accurate partition the means of addressing the data is denied. That is all. A user can change the partition table 100 times. As long as he doesn't write the partitions in the hard disk he can get everything back at the 101th time by restoring the correct partition table back.

I say your information looks promising because Ubuntu resizing exercise mostly probably just managed to altered the partition type only.

The ratio of 74Gb/7Mb of your original set up is about 74,000:7 or 10,571:1.

Your current partition table indicate the ratio of hda1:hda2 is 9728:1 because there are 9729 cylinders. hda1 occupies 9728 leaving the last cylinder (or part of it) as the hda2. Iregard the two ratio sufficiently close to speculate the sizes of the two partitions have never been altered, as the display gives the size in nearest unit in one cylinder but hda2 can actually be a fraction of one cylinder.

If this is the case then all you need to do is to run the cfdisk program, just change the partition type from 83 back to 7 and finalise it by writing the partition table before exiting the cfdsik program.

I therefore propose the following steps

(1) Boot up Ubuntu Live CD
(2) Click terminal (from the accessory or system icon)
(3) Inside the terminal or text mode invoke the cfdisk program to partition hda by typing
(4) You will see two partitions listed along side with their details. Use the keboard's vertical arrow keys ( may need horizontal arrow keys to assist navigation) to select the first partition hda1 and then use the horizontal arrow keys to select "Type". Press the "Enter" key after the selection.
(5) You will be given over 100 filing system choices to view and request a partition type number. Type 7 as it is for NTFS partition.
(6) Select "Write" to write the partition table
(7) Select "quit" to exist the cfdisk program
(8) Type "sudo reboot" to reboot the PC leaving the Ubuntu CD in the drive.

Ubuntu should mount the hda1 in the /media/hda1 or /mnt/hda1 on a reboot. If it doesn't you mount it manually as follow

(a) Repeat Steps (1) & (2) of the above
(b) Make a temporary directory on /mnt and mount device hda1 on it by typing
[code]sudo mkdir /mnt/hda1
sudo mount /dev/hda1 /mnt/hda1
(c) check the content of /mnt/hda1 by command
(d) Investigate /mnt/hda1 by repeating (c)

Report back

An explanation - In standard Ubuntu you are disallowed to log in as root (or the Admin) and so if hda1 is displayed in the desktop you will have no privilege to look inside. In terminal mode the "sudo" provide such a privilege. If you are able to see your old folders in mounted hda1 with the above procedure go out to buy a bottle of champagne as you may need one.

Right, ok:

I did the first part, setting the partition to NTFS, but here's what happened when I tried to mount it:


ubuntu@ubuntu:~$ sudo mkdir /mnt/hda1
ubuntu@ubuntu:~$ sudo mount /dev/hda1 /mnt/hda1
mount: you must specify the filesystem type



I am VERY new to the linux Command Line Interface, so I don't know how to specify the filesystem type...





And I'm far too young to buy alcahol. Which is a shame.


EDIT:

And another thing I noticed:
when I try to look at the partitions in Gnome partition editor, the main partition and the unused space are still set to unknown filesystem, and there's that nasty exclaimation mark next to them...

And also Windows still has an error loading operating system.

Well that is a bit of bad news.

To mount a NTFS system the full command would be
I said the news is bad because if the partition is "good" then modern Linux will know it is a NTFS system. If it runs into trouble and couldn't make the sense out of the partition type then it will ask the information for the filing system.

Never mind the champagne I was asking you to hit it on your head if thing doesn't work out.

I suggest you have a go at the above mounting command and repeat the exercise in Post #9 to consolidate your position, fdisk -l should show up your partition hda1 in Type 7 in NTFS format.

I do not expect your hard disk would boot by Windows. What I wish to achieve is to make it readable in Linux so that your data can be copied out. If Linux can't mount it because it cannot work with the filing system then it may the end of the road. In such a case the damage would have been due to the partition being formatted by Ubuntu in the past.

Your chance of getting the data back depends on if Linux can mount it or not.

You can ask for a second opinion by place your disk, either as an external disk via a USB or as an internal slave disk (with another hard disk as the master) in a different computer that runs Windows. That Windows system can read your hard disk if the filing system is intact. Chances if Linux can mount it so will be another MS Windows.

If you have not overwritten the actual data on the partition, then you can use testdisk. Testdisk searches through the data on the disk to look for the signatures of partitions, and rebuild the proper partition table from it. Download the Linux static binary from: http://www.cgsecurity.org/wiki/TestDisk_Download and run it. If there's data left on the disk, testdisk will find it. I've recovered at least a half-dozen disks with bad partition tables using testdisk.