Partition wiped after File Permissions Repair

[pupiloko]

Got Windows XP SP3 32bit
Used Windows Repair (All In One) v2.7.5

Only just found this tool and used it once. Drive is all healthy out of bad sectors, wanted to fix permissions on it. After system restart partition changed to unbootable RAW making all my data redundant. Bad job with this program. Is there a way to restore a partition back to NTFS without reformatting?

[Shane]

The program wouldn't be able to harm the partition table at all. And with over 1.5 million machines the tool has ran on it hasnt never happened before.

My program itself doesnt set the permissions or even touch the file system. It calls on setacl.exe in the files folder to set permissions
http://helgeklein.com/setacl/

I did a search over at their forums and no users have reported any problem like that at all.

I have a feeling something else was going on with your system. Dont format the drive, I have a feeling something else is going on with it, are you able to do a chkdsk on it?

Shane

[pupiloko]

Thanks for reply.

Yea it was pretty strange for me too about permissions to mess with partition table but this was the only thing I done to the disk and no other programs were running. I do have a antivirus on it but I switched protection off for the time running. I connected the disk to other PC but cant do anything as system partition is unknown (no letter can be assigned) and windows constantly asks to format it. I guess I need to look somewhere else for answers now.

[Shane]

The file system should be able to be recovered since it wasnt formated, the data is still there.

I dont mind trying to help you find out what happened and get the drive back

Is it an external drive? If it is plug it into a different usb port. Reason why is I had an external that showed that way and when I put it in another usb port it showed up fine.

Also if it is an external, do you have another system you can plug it into and see if it shows up the same?

Shane

[pupiloko]

I was doing it on my laptop's main drive. After tool finished and asked to restart blue screen appeared just after BIOS with a message UNBOOTABLE_(dont remember). I took it out and plugged in through eSATA to PC, which then only shows it in Disk Management as RAW partition.

[Shane]

That is odd. If the file system had been messed up during the file permissions the system should have crashed during since the file system would have been lost and windows should have slammed on itself.

You should be able to use any free tool that can recover partitions, since none of the data was wiped or overwritten then you should be able to recover it.

Here is one free version
http://www.easeus.com/datarecoverywizardpro/

You already di a sector scan on it to make sure there isnt any bad sectors correct? That scan will take a long time.

Shane

[pupiloko]

Yea I did scan whole disk for bad sectors, took over an hour, with 0 sectors found. Reason I did this was a services start hang up for 1min after user login, which on windows xp was usually caused by permissions issue or ngen (.net framework) needed an update in my case. But this time it looks like there was something else I didn't come across yet.

[Shane]

The MBR is what holds the information for the file system.
http://en.wikipedia.org/wiki/Master_boot_record

If you had a MBR virus or something tried to overwrite the mbr then that could explain why it got lost. The MBR was already loaded so when windows restarted it would have tried to read the MBR and thats why it didnt crash during.

The setacl doesnt touch the mbr, so I am curious what would have.

Also found some more info on it
http://www.win.tue.nl/~aeb/partitions/partition_types-2.html

People often recommend the undocumented DOS command FDISK /MBR to solve problems with the MBR. This command however does not rewrite the entire MBR - it just rewrites the boot code, the first 446 bytes of the MBR, but leaves the 64-byte partition information alone. Thus, it won't help when the partition table has problems. Moreover, it can be dangerous to restore the boot code to its original state: if the cause of the problems was a boot sector virus, then vital information may have been stored elsewhere by the virus, and killing the virus may mean killing access to this information. (For example, the stoned.empire.monkey virus encrypts the original MBR to sector 0/0/3.) However, people who want to uninstall LILO, and do not know that LILO has a -u option, can use FDISK /MBR for this purpose.

So from the looks of it the MBR is what is the problem. You should be able to recover that, all the data is still there.

One thing to do would be to use a tool that allows you to look at the mbr
http://thestarman.pcministry.com/asm/mbr/BootToolsRefs.htm

I havent had to use a tool like that in a long time so I dont know which one would be best to use.

But that free tool I posted before should be able to recover the partition. The only time the MBR is touched is if you change any of the partition info, such as size or adding other partitions, or if something tries to replace or modify it. there are some nasty MBR viruses out there that are very very hard to get rid of because they are in the mbr.

Again you should be able to recover it, I am more curious to what touched the MBR in the first place.

Shane