Date: Thu, 24 Jul 2003 19:58:18 +0400 From: Yar Tikhiy <yar@freebsd.org> To: Josef Karthauser <joe@freebsd.org> Cc: fs@freebsd.org Subject: Re: [Off topic] Trashed NT disk Message-ID: <20030724155818.GA50385@comp.chem.msu.su> In-Reply-To: <20030723175448.GA33453@genius.tao.org.uk> References: <20030723175448.GA33453@genius.tao.org.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jul 23, 2003 at 06:54:48PM +0100, Josef Karthauser wrote: > > A friend of mine had the misfortune of accidently deleting the partition > table off a 60 gb ntfs drive during an NT install. The disk appears to > be intact with the exception of of the partition table, and I'm trying > to work out how to reconstruct it so that we can gain access to the ntfs > partition again. Is this something that anyone here has had to fight In fact, the structure of an NTFS volume is quite suitable for recovery. Its key structure file, MFT, is self-contained, so you can find its beginning by simply scanning the disk sector-by-sector, looking for "$MFT". However, I would start recovering such a disk by looking for the boot sector of the NTFS partition. It has a rather characteristic appearance even if viewed as a hex dump. The things to notice are the 8-byte system ID "NTFS " at the offset of 3 and the 0xAA55 signature in its two last bytes. After you have found the boot sector, you can fetch the 8-byte number of sectors in the volume at the offset of 0x28. Then you will be able to fill in the starting logical sector and the number of logical sectors fields of the partition record in MBR. Further reading: THE description of the NTFS structure: http://linux-ntfs.sourceforge.net/ntfs/index.html In particular, the format of the NTFS boot sector: http://linux-ntfs.sourceforge.net/ntfs/files/boot.html > One of the things that is confusing me is how the geometry reported by > the drive in a freebsd dmesg relates to the "bios" picture of the > geometry that I appear to be able to tweak with in fdisk. Today's typical drive is too large to be described by the classic MBR format, so your only concern about the drive's geometry is that the beginning of the partition should be correctly described within _the BIOS geometry_ so BIOS can load the boot sector. I doubt if the end of the partition field is used at all. The actual position and size of a partition are described for a modern OS by the logical starting sector and the number of logical sectors fields in MBR. Correct me if I'm wrong. On the dmesg vs. BIOS issue: To a programmer's view, a modern drive is just a linear array of sectors. However, software has stuck to the cylinder/head/sector (CHS) way of addressing. So drives report some fictitious geometry, with traditional IDE values for the number of heads and sectors per track at 16 (or perhaps 15) and 63, correspondingly. That's what the kernel and dmesg report. BIOS makes the thing worse by applying a kind of translation, so it can boot an OS from a partition located beyond the first ~500M (the limitation of the old BIOS interface and MBR format, where the maximum cylinder offset was at 1023; but the head offset could grow as large as 255 while the typical number of heads reported by an IDE drive was 15 or 16.) This translation can be done in BIOS software (usually called "Large mode") or by using LBA addressing on the wire ("LBA mode".) Now BIOS seems to be the only consumer of the old, CHS, fields in MBR -- the rest of software uses the logical offset and size fields that were introduced to the MBR format at some moment. That's why it's the BIOS geometry that you should care about when partitioning a drive. -- Yar
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030724155818.GA50385>