1

Warning in advance that this going to be a slightly long one.

I had an old Dell laptop running XP die last year due to returning a HDD read error when attempting to boot. I booted from a live linux USB and was able to mount the backup partition (but not the main system partition) and rescue my backed-up data. I assumed that the disk was physically on its last legs so wrote the laptop off.

Today I found the XP recovery CD and decided to have a go at reviving the laptop, which as you'll see was a big mistake. The XP Recovery Centre failed to resolve the problem so I removed the disk and connected it to a Samsung netbook via a HDD to USB connection. Unfortunately when I booted I forgot that I'd set USB to have priorty over the internal HDD and booted from the faulty drive. When I rebooted, the Samsung's internal drive (which had worked perfectly before) would no longer boot and produced the same error as the Dell drive. At that point tt dawned on me that the Dell laptop must have had some from of boot sector virus that I had now transferred to the netbook.

Booting the Samsung from the Linux USB, it is no longer possible to mount the internal HDD. Running fdisk reveals why:

Disk /dev/sda: 58.5 GB, 58506416640 bytes  
255 heads, 63 sectors/track, 7113 cylinders, total 114270345 sectors  
Units = sectors of 1 * 512 = 512 bytes  
Sector size (logical/physical): 512 bytes / 512 bytes  
I/O size (minimum/optimal): 512 bytes / 512 bytes  
Disk identifier: 0x00000000  
   Device Boot      Start         End      Blocks   Id  System  
/dev/sda1              63    14683409     7341673+  12  Compaq diagnostics  
/dev/sda2   *    14683410   163678207    74497399    7  HPFS/NTFS/exFAT  
/dev/sda3       163678208   312578047    74449920    7  HPFS/NTFS/exFAT  

The partitions are found correctly, but the disk size is reported incorrectly as 58.5Gb (it is actually 160Gb).

When fdisk is run on the drive from the Dell this also returns the correct partition structure but again incorrectly reports the disk size as 58.5Gb.

The fact that all the partition structure seems to be in place gives me hope that the disks could be restored to a functioning state, but I can't figure out how to rectify the problem and nothing I've found online so far has been terribly helpful.

Can anyone offer any ideas?

4
  • 2
    it is unlikely that malware is the cause of your issue. May 5, 2014 at 16:53
  • So why would a previously functioning HDD succumb to the exact same error as soon as the system had been booted with the other HDD. Could the faulty HDD have affected the laptop BIOS? That's the only alternative I can think of.
    – user320606
    May 5, 2014 at 16:59
  • 2
    a dying motherboard or power supply spring readily to mind. I'm not saying you are wrong, but what you describe wouldn't fit any modern commercial malware, since you can't do anything bad with an offline pc. May 5, 2014 at 17:04
  • In theory if the malware attempted to encrypt the drive and by doing so because of the age of the hardware that process failed it might be explain. But if that were the case it wouldn't have been on purpose. Boot sector infections are extremely rare, like you can count the number on one hand, when your dealing with thousands of new infections daily you can understand how rare they really are.
    – Ramhound
    May 5, 2014 at 18:05

1 Answer 1

1

To rescue the partition table using a linux ubuntu live USB, try testdisc and gpart.

To recover your files even with non-booting, invalid partition tables, try magicrescue along with testdisc as well.

I believe you are correct in thinking that changing the partition table to its original parameters is likely to yield a working system. (And if not, testdisk or magicrescue will still grab your files.) Of course there are many other recovery tools worth trying, but I mention the ones I have successfully used for similar predicaments. Good luck!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .