Re: WAY OT--Crisis...virus! Need help

Guest section DW (dwguest@win.tue.nl)
Mon, 26 Apr 1999 13:42:35 +0200 (MET DST)


> Seeing the same thing with two of my Win95 boxes and a friend's computer (we
> don't even share files between ourselves). It wipes out the partition table.
> ICK! Where did it come from, and is there any way to recover the data?

Not easily. If you know roughly where things line up you can hunt for the
unix superblocks and FAT tables.

If you set one partition for the whole disk, that should let you back up the
first partition you had at least. It may also let you know a size so you can
hunt the next one

There are various rescue type programs around that try to
guess a partition table given a disk.

FAT partitions and partition table sectors can be recognized by the aa55
signature. Ext2 superblocks can be recognized by the ef53 signature.
A single scan over all disk sectors will give you all partition starts
(and possibly a few false alarms). Now a vague memory of the partition sizes
or inspection of the filesystem data quickly leads to a repaired
partition table.

Andries

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/