Re: MBR apparently overwritten!

["Ben Cadieux" <ben.cadieux@xxxxxxxxx>]

Hi Petr,

Rebuilding a partition table is relatively trivial - err...compared to
some other data recovery tasks anyway.  You should first check to see
if the MBR is actually ruined (see what fdisk "sees" as the partitions
on the disk).  Chances are something else is wrong, not your MBR.

Oh, before you try messing around on the disk - you might want to
google around for backed up MBRs.  I know that windows detects changes
to your MBR, not sure if any OSes keep a real backup.  You might also
consider waiting to see if anyone else has a better suggestion than
re-writing it.

Anyway, if it's borked, you should re-write value boot code (using
fdisk or fbsd's sysinstall or something) and then start locating the
boot sector for each partition with a disk editor.  The first one will
probably be at sector 64.  Valid bootsectors end with the bytes 55AAh.

The next step is to find out how big that partition is.  I've never
seen a boot sector that didn't contain the # of sectors for that
partition somewhere in its data.  If you google for boot sector
information for the particular file system it belongs to, there should
be info about the offset to this value.  Write it down.

Once you have the sector # to the bootsector and the number of sectors
for the partition you can go back to the MBR and type it back in to
the appropriate locations.  If you need a disk editor, look for
wde_v30b.zip - I coded in a bootsector search function.  It'll take
awhile but it should find your windows boot sector.  I think norton's
diskedit makes editing these fields easy, but I can't recall if it
supported editing the mbr and entire disk or just fat partitions.

Best Regards,
Ben Cadieux