From owner-freebsd-questions Mon Apr 26 19:52:36 1999 Delivered-To: freebsd-questions@freebsd.org Received: from inet.chip-web.com (c1003518-a.plstn1.sfba.home.com [24.1.82.47]) by hub.freebsd.org (Postfix) with SMTP id 330D614CA4 for ; Mon, 26 Apr 1999 19:52:25 -0700 (PDT) (envelope-from ludwigp@toy.chip-web.com) Received: (qmail 7538 invoked from network); 27 Apr 1999 02:52:23 -0000 Received: from speedy.chip-web.com (HELO speedy) (172.16.1.1) by inet.chip-web.com with SMTP; 27 Apr 1999 02:52:23 -0000 Message-Id: <4.1.19990426194744.00a51850@mail-r> X-Sender: ludwigp@toy.chip-web.com (Unverified) X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 Date: Mon, 26 Apr 1999 19:52:30 -0700 To: "Jonathan E. Lyons" , "Benjamin T. George" From: Ludwig Pummer Subject: Re: Accessing Virus Infected (Boot Sector) HDD Cc: freebsd-questions@FreeBSD.ORG In-Reply-To: <199904262017.PAA09079@kachina.som.siu.edu> References: <3724C63C.F81FA429@3-cities.com> <3724CD47.794BDF32@thekeyboard.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG At 01:22 PM 4/26/99 , Jonathan E. Lyons wrote: >Have you tried ndd.exe (older version of norton disk doctor) you may get >lucky and be able to rebuild the FAT table.. > >At 01:02 PM 4/26/99 -0700, Kent Stewart wrote: >>Not likely. Your first MB is where FAT, directory, and boot >>information go. You can recover the boot but the FAT and directory are >>gone forever. Since not all of your files will be loaded in contiguous >>locations, the random offsets are gone forever. FAT partitions (FAT32 definetely, but i think FAT16 also) are supposed to have 2 copies of the FAT table. I've seen scandisk copy one copy of the FAT over the other when one of them goes bad. I don't think scandisk could save you from a lost partition table too. Another alternative to Norton Disk Doctor is a product called Tiramisu, available from On-Track data recovery's web page. You can download it and install it to a floppy, run it, and see if it can recover any data. If it can, you call On-Track and they give you a registration code (in return for your credit card number). Then it recovers to another hard drive you have plugged in. I've used it (at the computer store where I work) to retrieve data from a drive that's been fdisked, formatted (not a quick-format, mind you), and Win98 installed on top of it. Quite impressive. --Ludwig Pummer ( ludwigp@bigfoot.com ) ICQ UIN: 692441 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message