Welcome, Guest. Please login or register.

Author Topic: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore  (Read 5399 times)

Description:

0 Members and 1 Guest are viewing this topic.

Offline Thomas

The name DF4 is usually used for a floppy-like drive connected to another controller. For example a LS120 connected to the IDE bus or an USB floppy drive connected to USB.

If there is no DF4 and PC4 in Devs/DosDrivers, then some software has to run in the background which creates them, for example Poseidon. They are not created automatically by Kickstart (like DF0 ... DF3).

That the HDD appears as not partitioned can have several reasons which might or might not be related to the DF4 thing. As you didn't write anything about your Amiga, it is difficult to guess. I think the PowerFlyer (a.k.a. FastATA) firmware automatically mounts LS120 drives as DF4. So if you have a PowerFlyer and the HDD just died, the PF could erroneously identify the dead HDD as an LS120 drive.

If the HDD is bigger than 4GB it could also be that you just hadn't installed the required drivers to use big harddrives and now some write access to a partition outside of the first 4GB hit the partition table.

Edit: a virus could also be a reason. If it is intelligent enough to find the driver / unit of the boot drive but is too stupid to see that it's partitioned and them tries to overwrite the boot block, it would hit the partition table. We need to look at the contents of block 0 of the HDD to find out what happened. If it starts with "DOS", then some kind of bootblock (virus or something else) has been written to it. Having a valid boot block in block 0 of the HDD could also fool the HDD driver into thinking it sees a floppy disk (DF4).
« Last Edit: December 15, 2011, 03:02:18 PM by Thomas »
 

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #1 on: December 15, 2011, 03:07:04 PM »
The more I think about it the more the "partition table overwritten by floppy bootblock" theory becomes the most plausible explanation.

Which program did you use to "read some disks on [your] df1: drive"? What did you specify as destination?

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #2 on: December 16, 2011, 09:34:42 AM »
Where is the hdd connected to?

Why do you give up so early? There are ways to recover.

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #3 on: December 16, 2011, 10:57:37 PM »
IDEfix97 should do the job quite well. OS 3.9 does not help with PFS3.

Just make sure that C:IDEfix is run from startup-sequence or even better run it as C:LoadIDE RESET instead (read the comments which are added to startup-sequence after the installation of IDEfix).

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #4 on: December 17, 2011, 03:22:01 PM »
They don't speak the same language: PFS3 uses TD64 and OS 3.9 introduces NSD.

You can use PFS3ds with OS 3.9, though.

It is support for large hard drives BTW, not for large partitions.

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #5 on: December 17, 2011, 05:59:46 PM »
Edit s:startup-sequence. At the top you should find a section which looks like this:

Code: [Select]

;BEGIN IDEfix
If Exists C:IDEfix
   ; You may want to exchange the following line with LoadIDE reset quiet
   ; to make IDEfix reset resident, or LoadIDE start quiet
   ; to start IDEfix immediately and have it reset resident
   ; from the next reboot. Make sure to put LoadIDE behind any Kickstart mappers!
   C:IDEfix
EndIf
;END IDEfix


Change it to look like this:

Code: [Select]

;BEGIN IDEfix
C:LoadIDE RESET QUIET
;END IDEfix


Then reboot and check version of scsi.device again.

Note that with PFS3 you need to wait at least 5 seconds after the last disk access before you reboot, otherwise changed buffers will not be written to disk (and changes to startup-sequence will be lost).

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #6 on: December 18, 2011, 11:25:49 AM »
I don't know what led to your problem. You didn't allow me to look at block 0 of the HDD to see by what it had been overwritten.

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #7 on: December 24, 2011, 12:25:56 PM »
Do you have any means to transfer files from the internet to your Amiga? Another Amiga perhaps? Or can you connect the Amiga HDD to a PC running WinUAE (through USB adapter for example)?

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #8 on: December 24, 2011, 01:32:52 PM »
Ok, then download the attached file and run it against your HDD.

For WinUAE:

- right-click on winuae.exe and select "run as administrator".
- go to the Quickstart page and select "expanded WinUAE example configuration". Ignore any complaints about missing Roms.
- go to the Roms page and select either KS 3.1 ROM (if available) or AROS KS ROM (builtin).
- go to harddrives page,
click on "add Harddrive" and select your Amiga HDD. Activate the "Read/Write" check box.
click on "add directory or archive", "select archive or plain file", then select the ReRDB.zip file.
click on "add directory or archive", "select directory" and navigate to C:\Users\Public.
- click on Start. It should boot into a DOS window with a 1> prompt.
- enter
rerdb uaehf.device 0 dumpfile public:documents/dump.bin
- check what is written under "reconstructed RDB". If you like what you see enter
rerdb uaehf.device 0 write
- now the HDD should have some partitions again. Depending on how much data was overwritten, the first partition(s) may be missing.
- please attach the C:\Users\Public\Documents\dump.bin file here so that I can analyse it.

For real Amiga:

- unpack the attached ZIP file.
- transfer the resulting file ReRDB to the Amiga
- on the Amiga open a Shell window
- enter
df0:rerdb scsi.device 0 dumpfile df0:dump.bin
- check what is written under "reconstructed RDB". If you like what you see enter
df0:rerdb scsi.device 0 write
- now the HDD should have some partitions again. Depending on how much data was overwritten, the first partition(s) may be missing.
- please attach the dump.bin file here so that I can analyse it.

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #9 on: December 24, 2011, 04:00:57 PM »
This is a hex dump of the dump file:

Code: [Select]
0000: 444F5300 5CEB2D01 00000370 60000006    DOS.\ë-....p`...    
0010: 60000060 2C790000 000448E7 FFFE41FA    `..`,y....Hç.þAú    
0020: FFE06100 002A303C 010022D8 51C8FFFC    .àa..*0<..&quot;ØQÈ.ü    
0030: 0C390044 000FE000 6700000E 4EF90007    .9.D..à.g...Nù..    
0040: F4104EF9 00C7E1B0 4EF9000F E01033FC    ô.Nù.Çá°Nù..à.3ü    
0050: 4E70000F E0000C79 4E70000F E0006600    Np..à..yNp..à.f.    
0060: 000A43F9 000FE000 4E7543F9 0007F400    ..Cù..à.NuCù..ô.    
0070: 4E752C79 00000004 61000040 4CDF7FFF    Nu,y....a..@Lß..    
0080: 60000020 646F732E 6C696272 61727900    `.. dos.library.    
0090: 464D464F 4A20584A 53565420 56322E32    FMFOJ XJSVT V2.2    
00A0: 00AE43FA FFE02C79 00000004 4EAEFFA0    .®Cú.à,y....N®.*    
00B0: 20402068 00167000 4E756100 00226100     @ h..p.Nua..&quot;a.    
00C0: 003E41FA 003A2D48 002E41EE 00224240    .>Aú.:-H..Aî.&quot;B@    
00D0: 7217D058 51C9FFFC 46403080 4E752C79    r.ÐXQÉ.üF@0.Nu,y    
00E0: 00000004 33FC4EF9 00000110 23EEFD9E    ....3üNù....#îý.    
00F0: 00000112 41FA0070 2D48FD9E 4E7513FC    ....Aú.p-Hý.Nu.ü    
0100: 00997628 51402C79 00000004 6100FFD0    ..v(Q@,y....a..Ð    
0110: 41FA0020 B1EEFE3A 67000016 33FC4EF9    Aú. ±îþ:g...3üNù    
0120: 00000100 23EEFE3A 00000102 2D48FE3A    ....#îþ:....-Hþ:    
0130: 4E752C79 00000004 0C690002 001C6700    Nu,y.....i....g.    
0140: 00380C69 0003001C 6700011C 0CA90006    .8.i....g....©..    
0150: E000002C 6600000A 13FC0000 76285140    à..,f....ü..v(Q@    
0160: 4EF90000 010048E7 FFFE6100 FF724CDF    Nù....Hç.þa..rLß    
0170: 7FFF4EF9 00000110 4AA9002C 6600FFE2    ..Nù....J©.,f..â    
0180: 48E7FFFE 33E9001C 0007F900 23E90024    Hç.þ3é....ù.#é.$    
0190: 0007F904 23E90028 0007F908 23E9002C    ..ù.#é.(..ù.#é.,    
01A0: 0007F90C 337C000E 001C2C79 00000004    ..ù.3|....,y....    
01B0: 6100FFAE 4AA90020 66000060 337C000F    a..®J©. f..`3|..    
01C0: 001C2C79 00000004 6100FF96 4AA90020    ..,y....a...J©.      
01D0: 66000048 337C0003 001C6100 00066000    f..H3|....a...`.    
01E0: 003A6100 005E41FA FE182348 0028237C    .:a..^Aúþ.#H.(#|    
01F0: 00000400 0024237C 00000000 002C2C79    .....$#|.....,,y    
0200: 00000004 6100FF5A 337C0004 001C2C79    ....a..Z3|....,y    
0210: 00000004 6100FF4A 4E754CDF 7FFF3379    ....a..JNuLß..3y    
0220: 0007F900 001C2379 0007F904 00242379    ..ù...#y..ù..$#y    
0230: 0007F908 00282379 0007F90C 002C6000    ..ù..(#y..ù..,`.    
0240: FF2041F9 76284E38 203CFFFF FFFF223C    . Aùv(N8 <....&quot;<    
0250: 000000FF 42829098 918251C9 FFFA23C0    ....B.....QÉ.ú#À    
0260: 76284E3C 4E750C79 111100F8 00006700    v(N<Nu.y...ø..g.    
0270: FEF00C39 00997628 51406600 FEE448E7    þð.9..v(Q@f.þäHç    
0280: FFFE2C79 00000004 43FAFDFA 4EAEFE68    .þ,y....CúýúN®þh    
0290: 23C07628 514E2C40 41FA006F 2208243C    #Àv(QN,@Aú.o&quot;.$<    
02A0: 000003EE 4EAEFFE2 23C07628 515241FA    ...îN®.â#Àv(QRAú    
02B0: 006E2408 263C0000 00D02239 76285152    .n$.&<...Ð&quot;9v(QR    
02C0: 4EAEFFD0 41FA004C 2208243C 000003EE    N®.ÐAú.L&quot;.$<...î    
02D0: 4EAEFFE2 23C07628 515241FA FD242408    N®.â#Àv(QRAúý$$.    
02E0: 263C0000 04002239 76285152 4EAEFFD0    &<....&quot;9v(QRN®.Ð    
02F0: 22397628 51522C79 7628514E 4EAEFFDC    &quot;9v(QR,yv(QNN®.Ü    
0300: 4CDF7FFF 6000FE5A 01432F4D 6F756E74    Lß..`.þZ.C/Mount    
0310: 0000432F 44000000 00000000 00000000    ..C/D...........    
0320: 03F30000 00000000 00010000 00000000    .ó..............    
0330: 00000000 00200000 03E90000 002048E7    ..... ...é... Hç    
0340: FFFE2C79 00000004 43F90000 00644EAE    .þ,y....Cù...dN®    
0350: FE6823C0 00000078 2C40223C 00000070    þh#À...x,@&quot;<...p    
0360: 243C0000 03ED4EAE FFE223C0 0000007C    $<...íN®.â#À...|    
0370: 243C0007 F000263C 00000400 22390000    $<..ð.&<....&quot;9..    
0380: 007C4EAE FFD62239 0000007C 2C790000    .|N®.Ö&quot;9...|,y..    
0390: 00784EAE FFDC4CDF 7FFF4EF9 0007F00C    .xN®.ÜLß..Nù..ð.    
03A0: 4E75646F 732E6C69 62726172 79005359    Nudos.library.SY    
03B0: 533A432F 44000000 00000000 00000000    S:C/D...........    
03C0: 03EC0000 00070000 00000000 000C0000    .ì..............    
03D0: 00160000 001E0000 002E0000 00400000    .............@..    
03E0: 004A0000 00500000 00000000 03F20000    .J...P.......ò..    
03F0: 762894E8 00000128 76289490 760F6744    v(.è...(v(..v.gD    


It's obviously some kind of floppy boot block. And it contains the text "FMFOJ XJSVT V2.2" which matches this: http://www.vht-dk.dk/amiga/desc/txt/eleni22.htm

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #10 on: December 24, 2011, 10:17:28 PM »
To get DH1 back you just need to run IDEfix (or LoadIDE). Without it the area outside the first 4GB cannot be accessed and because of this DH1 appears to be unreadable. But the data is not lost, it's just not accessible.

To get DH0 back you need to run HDToolbox and create a new partition in the empty space before DH1. If you enter exactly the same values as your DH0 had before, you'll get all your files back.

But the most important issue is to get rid of the virus. This should be the first thing you do.

- switch off the Amiga.
- find a bootable floppy disk which you didn't use since you were infected.
- make sure that it has the write protect swich on
- boot from it and then check all other floppy disks one after the other. If you find a file called D in the C directory, delete it, delete the Mount command and overwrite the boot block by install df0:. Note that a Workbench disk will not boot without the Mount command, so if you have a proper Mount command on your uninfected disk, copy it to the formerly infected disk.
- Do this for every disk which might be infected. Be careful not to boot from an infected disk and not to run a program from an infected disk. Once you run an infected program you can (and must) start all over from the beginning again (switch off the Amiga, ...)

Every disk without the write protect switch on which you inserted into the drive while the Amiga was infected is probably infected now, too.

Be sure to keep the write protect switch on on all floppy disks. Only switch it off for a short period if you really want to save data to the disk and immediately enable it again afterwards.


Regarding backup of the RDB, there are some programs on Aminet which can do it.

TSGUI can do it, too: http://thomas-rapp.homepage.t-online.de/downloads/tsgui.lha
Just select a partiton on the harddrive, then choose "save RDB to file" from the menu.

Offline Thomas

Re: A1200 suddenly shows "df4:" and "Pc4:" and hd doesn't start anymore
« Reply #11 on: December 25, 2011, 12:59:53 PM »
Quote
Isn't the virus still on my HD ?


Same procedure here: switch off the computer, then boot from an uninfected floppy disk, delete c/D and c/Mount from the boot partition and copy back a clean Mount from the WB floppy or OS 3.9 CD.