First things first - I would image that drive before doing ANYTHING else...might even image it twice. My guess is that you still have all your information on the drive but if you do the wrong things, you can make that increasingly difficult to recover.
My personal preference for imaging a drive is to use Linux but there are other options as well. Assuming this drive is under 250 gigs (gotta start somewhere), I'd put a 250 gig IDE drive in the box, boot the Helix forensic Live CD (www.e-fense.com/helix). Once again, there are a TON of other options, this is just the one I'd use. I'd then go to the command-line and use dd to image the drive. The syntax would be something like [dd if=/dev/hda of=/dev/hdc]. In this case, hda is your old drive and hdc is the new drive (most machines have a CD that often is hdb). That will make a copy of the drive that you can always restore if things go badly. BTW, I'm making a TON of assumptions here. This is the forensics list so I'm assuming some of this makes sense. If it doesn't, do some research and figure it out before you just go any do it. For example, if you use dd with the if/of backwards, you will just have totally wiped your drive. A note about the 250 gig IDE - some BIOS' complain if the drive is over 250 gigs. Obviously if your initial drive is over 250, you need something bigger than 250. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Monday, April 17, 2006 5:22 AM To: [email protected] Subject: MBR deleted Hi everybody, I deleted by error the MBR of my hard disk. When it happens, I though that I could repair it making FDISK /MBR instruction, but I'm wrong. And now I have a hard disk that appears as not partitioned (I had 3 partitions) and where I can't do anything. I saw in the Internet some utilities as Active Partition Recovery that allow to repair deleted partitions, but I don't know if it's the utility I need to solve my problem. Can anyone help me? Thx a lot. JAVIER. **DISCLAIMER This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.
