OT: fdisk

[Robert]

On Sat, 2 Oct 2010 17:00:00 -0600 (MDT)
Warren Block <wblock at wonkity.com> wrote:

> On Sat, 2 Oct 2010, Robert wrote:
> 
> > Greetings
> >
> > I am in deep with the wife. Her computer went belly up. It was
> > running XP pro and I had backups going to a second drive. I can no
> > longer access that drive.
> >
> > I pulled it and attached it via USB to one of my FreeBSD machines
> > but it will not mount. It is a 500G hard drive and I get _wild_
> > results just looking at it with fdisk.
> >
> > ~> fdisk /dev/da1s1
> > ******* Working on device /dev/da1s1 *******
> 
> Wait a minute... shouldn't that be just "da1"?  da1s1 is the first
> slice (partition), and the data there should be your XP filesystem,
> probably NTFS.

Warren,

You are right. Here it is:

 ~> fdisk /dev/da1
******* Working on device /dev/da1 *******
parameters extracted from in-core disklabel are:
cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)

Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=60801 heads=255 sectors/track=63 (16065 blks/cyl)

Media sector size is 512
Warning: BIOS sector numbering starts with sector 1
Information from DOS bootblock is:
The data for partition 1 is:
sysid 7 (0x07),(NTFS, OS/2 HPFS, QNX-2 (16 bit) or Advanced UNIX)
    start 63, size 976773105 (476939 Meg), flag 0
	beg: cyl 0/ head 1/ sector 1;
	end: cyl 1023/ head 15/ sector 63
The data for partition 2 is:
<UNUSED>
The data for partition 3 is:
<UNUSED>
The data for partition 4 is:
<UNUSED>

Which looks a lot better. I can mount /dev/da1 and it shows 
 ~> ls -l /mnt
total 70044
-rwxr-xr-x  1 root  wheel      2560 Dec 31  1600 $AttrDef
-rwxr-xr-x  1 root  wheel         0 Oct  1 09:09 $BadClus
-rwxr-xr-x  1 root  wheel   4194304 Dec 31  1600 $Bitmap
-rwxr-xr-x  1 root  wheel      8192 Oct  1 09:09 $Boot
drwxr-xr-x  1 root  wheel         0 Oct  1 09:09 $Extend
-rwxr-xr-x  1 root  wheel  67108864 Oct  1 09:09 $LogFile
-rwxr-xr-x  1 root  wheel      4096 Oct  1 09:09 $MFTMirr
-rwxr-xr-x  1 root  wheel         0 Dec 31  1600 $Secure
-rwxr-xr-x  1 root  wheel    131072 Oct  1 09:09 $UpCase
-rwxr-xr-x  1 root  wheel         0 Oct  1 09:09 $Volume
-rwxr-xr-x  1 root  wheel     45124 Aug 18  2001 NTDETECT.COM
drwxr-xr-x  1 root  wheel         0 Oct  1 17:29 System Volume
Information 
-rwxr-xr-x  1 root  wheel       193 Oct  1 09:12 boot.ini
-rwxr-xr-x  1 root  wheel    222368 Aug 18  2001 ntldr

But I cannot mount /dev/da1s1

 ~> sudo mount_ntfs /dev/da1s1 /mnt
mount_ntfs: /dev/da1s1: Invalid argument

Patrick wrote

May be "photorec" will help (in systutils/testdisk).
http://www.cgsecurity.org/wiki/PhotoRec

I installed this and can successfully recover the date to a spare
slice. The problem is the data is all over the place. There is a ton if
png files from her playing games on facebook. This can be better than
nothing because I can go through the files and move/rename the ones we
want to keep.

Thank you both. I am willing to try any other suggestions. It appears
the the motherboard went gradually bad and hosed up this drive.

Robert