[AccessD] Horror of horrors

Mon Jan 9 17:50:36 CST 2023

OK I have file history set up on drive E:  Sadly only for the last few
weeks.  I have no idea what is in there though.

Once I get this all figured out I will be looking at how to prevent this
kinda stuff going forwards.

The bottom line is that I can get at a command prompt via this X:Windows
thing that is kinda booting.  I have a usb doodad for holding a drive and I
am going to do a real drive image recovery disk on that.  And actually try
a recovery immediately afterwards so it works.

On Mon, Jan 9, 2023 at 6:15 PM James Button via AccessD <
accessd at databaseadvisors.com> wrote:

> Also  - if the drive is a hard drive then the sectors with the data - NTFS
> $MFT
> etc. may well still be where they were
> And simply restating the partition table entry could  make the partition
> accessible
> - many data recovery facilities can recover 'deleted' partitions  or
> reset the
> partition format type entry
> Also - MBR mode will - hopefully have a simple 4 partition block
> GDP has a more complicated setup with a copy of the partition definitions
> towards the end of the drive, as well as a possibility of a BIOS type MBR
> partition specification.
>
> SSD devices are far more likely to be unrecoverable as the LBA Block id
> that
> windows will expect to be fixed will be linked to an actual memory block
> entry
> within the SSD controlling data
> And expect every write to get put onto a different block of the storage,
> with
> the link adjusted to point to that different block of storage.
>
> Also to consider - UEFI implications - although (AFAIK) most windows PC's
> will
> have been set to allow 'legacy' devices to be booted using MBR/BIOS type
> setup-
> avoiding the UEFI security
> And there may be a system (FAT mode) partition associated with the Boot and
> UEFI/OS selection entries.
>
> A primary question - do you have a "recovery' diskette (USB stick) - as
> that
> should contain the partition entries
>
> Additionally,
> At startup the PC will probably be accessing partitions by port, and
> specification location within the partition specification table(s)
> Until actual startup of the OS  the partitions do not actually have
> partition
> letters, so you should try looking at the storage device partition
> specifications and looking for use by their sizes.
> OK - newer versions of Windows want a partition to be assigned a letter
> and may
> ignore that if an earlier 'mounted' partition has been assigned that letter
> Also windows startup can still get confused if there are multiple
> 'internal' or
> at least connected at startup time drives with the same letter assigned to
> partitions
> so - having an additional partition as well as the usual OS one specified
> to be
> "C:"  may have the boot, or the OS startup  consider the interloper
> partition to
> be C, and the OS gets ignored, or assigned a different letter.
>
> Do you have a 'system image' backup set
> And maybe a OS partition backup
> Technique would be ( after trying other options)  to do the system image
> restore, then update the OS partition with the later partition image.
>
> BUT - first -
> What is the device type
> What partitions should be on it - are they there
> Any partition management software should report that !
>
> Contact the system 'supplier' and labeller  ( store you got it from) and
> whoever
> calls themselves the 'manufacturer' - maybe just the label glue-er
> Backup your data from the partitions you can access.
> Consider paying any extra to get a ('PE') restore facility that will copy
> an
> image to a drive on a new PC, then update that partition with drivers that
> match
> the new PC.
>
> Unless the problem was caused by some identifiable action on your part - or
> mains problem
> Then I would consider the storage unit to be untrustworthy
> The problem may be with the motherboard or malware - but how will you know
>
> Sorry I cannot be more enthusiastically specific about the chances - but
> there
> are many options in setup, and many possible causes for the problem
>
> If the data on the lost partition is important then maybe contact a data
> recovery organisation -
> and put a cost cap on their work, with a requirement that the device be
> returned
> even if not recoverable,
> so you can ask the supplier for a replacement, or restitution/recompense
> for the
> costs associated with the device failure
>
> JimB
>
> -----Original Message-----
> From: AccessD
> <accessd-bounces+jamesbutton=blueyonder.co.uk at databaseadvisors.com> On
> Behalf Of
> Helmut Kotsch via AccessD
> Sent: Monday, January 9, 2023 10:29 PM
> To: 'Access Developers discussion and problem solving'
> <accessd at databaseadvisors.com>
> Cc: Helmut Kotsch <hkotsch at arcor.de>
> Subject: Re: [AccessD] Horror of horrors
>
> You might be booting from an USB Drive / stick without knowing.
>
> Helmut
>
>
>
> -----Ursprüngliche Nachricht-----
> Von: AccessD [mailto:accessd-bounces+hkotsch=arcor.de at databaseadvisors.com
> ]
> Im Auftrag von John Colby
> Gesendet: Montag, 9. Januar 2023 23:12
> An: Access Developers discussion and problem solving
> Betreff: [AccessD] Horror of horrors
>
> I tried to boot my laptop today and it went into an endless boot loop /
> repair.  After mych stuff I got to a command prompt and discovered that the
> c: drive is now a raw" disk.
>
> It is booting to an X: drive which is a very basic system.  It contains
> windows but no users or anything else useful.  No idea where it (X) is
> coming from.
>
> I keep all my dev off on a D: disk which I can do a dir on and see all my
> files (whew) but my boot disk (c:) is nowhere to be found.
>
> So.... has anyone experienced this and more importantly figured out how to
> get the c: drive back to an NTFS system?  IOW recover the boot
> drive(partition)
>
> Luckily I have my old computer which is what I am using now.  The "new"
> computer is my new Lenovo Legion Pro and I really want to get it recovered
> without a format reinstall, although that would not be the end of the
> world.  I took the boot drive from this HP Pavillion, put it on another
> disk and used that to boot the Lenovo (to keep all of the multitude of
> installed programs intact).  Windows 10 did an admirable job of booting and
> working doing that.  I have been using the Lenovo for many many months
> now.
>
> Until today.
>
> Can anyone help me with this?
> --
> John W. Colby
> Colby Consulting
> --
> AccessD mailing list
> AccessD at databaseadvisors.com
> https://databaseadvisors.com/mailman/listinfo/accessd
> Website: http://www.databaseadvisors.com
>
> --
> AccessD mailing list
> AccessD at databaseadvisors.com
> https://databaseadvisors.com/mailman/listinfo/accessd
> Website: http://www.databaseadvisors.com
>
> --
> AccessD mailing list
> AccessD at databaseadvisors.com
> https://databaseadvisors.com/mailman/listinfo/accessd
> Website: http://www.databaseadvisors.com
>

-- 
John W. Colby
Colby Consulting