Weird FORMAT result trashed my primary partition

[Zepper]

Here's what I did.
- Booted to DOS via Win9x BootMenu.
- had three partitions: C~1.6G, D~2.0G, E~500M (dive~4.5G).
- changed to D, made directory, copied all data on E there.
- FORMAT E: /u
- Went along as usual and said it formatted ~500M.
- did DIR of E, data still there.
- did DIR of C, drive empty and approx 500M in size.
Had to pull out pretty fancy bag of tricks to come back from this one. Anyone have any idea how this happened so I can avoid in future?

 

[shathal]

Urm - virus per chance?

There's no way (unless you got your drive-letters wrong) how C:\ should have been formatted - the fact that the partition size changed as well is definately not good. Hmm - what exactly did you have to do to fix things? Maybe that info would shed some more light on the matter.

Hrmm ... I'd be very impressed if you managed somehow to change partition information with a normal FORMAT /U command...

 

[WarCon]

What does the /u command do, never heard of it myself.

These are the ones I know:
/V[:label] Specifies the volume label.
/Q Performs a quick format.
/F:size Specifies the size of the floppy disk to format (such as 160, 180, 320, 360, 720, 1.2, 1.44, 2.88).
/B Allocates space on the formatted disk for system files.
/S Copies system files to the formatted disk.
/T:tracks Specifies the number of tracks per disk side.
/N:sectors Specifies the number of sectors per track.
/1 Formats a single side of a floppy disk.
/4 Formats a 5.25-inch 360K floppy disk in a high-density drive.
/8 Formats eight sectors per track.
/C Tests clusters that are currently marked "bad."

Also would be curious how you recovered? And out of morbid curiousity, why didn't you use the format command in windows?

 

[edblor]

/u means unconditional and if I am not incorrect, it does not give much feedback when done, and does not report errors if found! It does what is asked and does not question the user

Edblor

 

[mastertech01]

Hmm, when you gave the format E: command were you in the E: or were you still in the D:, or did you do it from the A: prompt?

 

[WarCon]

So you would use the /u if you wanted to rewrite over clusters that were marked bad? Is that the purpose of this flag? If not am very curious, I like new info......

Heck how many low level's could I have avoided if that what this does.

........edit..........
Although it has be years since I have done a low-level, seems to kinda be a thing of the past.

 

[Zepper]

To answer various questions:

- I was logged to D: when I performed the format.
- I did not accidentally press C instead of E.
- I do almost all major disk configuration in DOS as I am more in control in that environment.
- format /u is supposed to be an unconditonal format. It used to write every sector on the partition with blank data, but doesn't do that any more. It does nothing with sectors that are marked bad. Does not save unformat information as does Quick format. There used to be a /M switch that would test sectors currently marked bad and restore to use those that tested good.
- FDISK reported that the primary partition was ~500MB after the error occurred, so the partition table was changed somehow.
- I used Lost & Found to recover the data and took the "opportunity" to upgrade to w98se. After recovering the data, I used fdisk to remove and recreate the primary partition.
- I don't believe there was a virus involved, but since the partition data was totally changed, there is no way to check. I do use Trend's antivirus software and Zone alarm. Few strange diskettes visit my system.
Thanks for your replies.
.bh.

 

[mobly99]

deleted

 

[Demon-Xanth]

another format.com/exe switch:
/autotest
Doesn't ask any questions and can format the drive that format.com/exe happens to be on as well as the drive currently selected.

Example:
In a system with only 1 partition, no floppy or CDROM drives
C:\> format c: /autotest
results in the C: drive being partitioned w/ no further questions.

 

[Zepper]

bump

 

[WarCon]

Thanks for the info Demon-Xanth, anymore cool switchs for format? And was curious if you edited scandisk.ini before scanning a disk with known bad clusters and one that you suspected to have more, whether you could change the setting in the scandisk.ini from Bad Clusters = prompt to Bad Clusters = Fix and it will stop bugging you every cluster it finds bad?

 

[bonkers325]

format /mbr
cleans boot record

 

[Zepper]

It's fdisk /MBR not format /MBR .
.bh.
also there is a /z:x , syntax: format /z:x d: /options where the number,x, will be the number of sectors per cluster.
.bh.

 

[WarCon]

Thanks Zepper.......... More input.

 

[AlexMc]

The /u switch should not remove entries from the bad cluster table. It simply stops Unformat utilities being used to recover the information on the drive after you have formatted it. You would normally use it if you had sensitive/secret stuff on a disk and you didn't want someone to be able to use data recovery tools to get the data back after you had formatted it. Although the switch still works I haven't seen it listed in the help of the format command since DOS 6.22 or Win95.

 

[Zepper]

bump for fresh eyes.

 

[Demon-Xanth]

Alex: I've also had to use it on systems w/ large HDs and small amounts of RAM (3.5GB on 8MB RAM) other wise it couldn't save the unformat info.



...don't ask why

 

[Zepper]

Bump-a-dump.

 

[randypj]

Umm.....another couple of questions:

AlexMc says /u stops unformat utilities from recovering data. Zepper used /u, but uncovered the data via Lost and Found.

1. So, I'm guessing L&F uses a very different method of recovery than would Norton unformat?

2. How does L&F do it. I mean I can see if you just used a regular format...but, geez....doesn't /u sort of actually wipe the info? Guess not, eh? Have you ever tried recovering via L&F after using a wipedisk program?

BTW, I've had friends use L&F and have been very successful with it.
--Randy