Discos Rígidos: NTFS.com Fixing and repair MBR.Fix MBR.Recover boot record.Recovery.


MBR is damaged

The Master Boot Record (MBR) will be created when you create the first partition on the hard disk. It is very important data structure on the disk. The Master Boot Record contains the Partition Table for the disk and a small amount of executable code for the boot start. The location is always the first sector on the disk.

The first 446 (0x1BE) bytes are MBR itself, the next 64 bytes are the Partition Table, the last two bytes in the sector are a signature word for the sector and are always 0x55AA.

For our disk layout we have MBR:

Physical Sector: Cyl 0, Side 0, Sector 1
000000000   33 C0 8E D0 BC 00 7C FB  50 07 50 1F FC BE 1B 7C   3AZ??.|uP.P.u?.|
000000010   BF 1B 06 50 57 B9 E5 01  F3 A4 CB BE BE 07 B1 04   ?..PW?a.o¤E??.±.
000000020   38 2C 7C 09 75 15 83 C6  10 E2 F5 CD 18 8B 14 8B   8,|.u.??.aoI.‹.‹
000000030   EE 83 C6 10 49 74 16 38  2C 74 F6 BE 10 07 4E AC   i??.It.8,to?..N¬
000000040   3C 00 74 FA BB 07 00 B4  0E CD 10 EB F2 89 46 25   <.tu»..?.I.eo‰F%
000000050   96 8A 46 04 B4 06 3C 0E  74 11 B4 0B 3C 0C 74 05   –SF.?.<.t.?.<.t.
000000060   3A C4 75 2B 40 C6 46 25  06 75 24 BB AA 55 50 B4   :Au+@?F%.u$»?UP?
000000070   41 CD 13 58 72 16 81 FB  55 AA 75 10 F6 C1 01 74   AI.Xr.?uU?u.oA.t
000000080   0B 8A E0 88 56 24 C7 06  A1 06 EB 1E 88 66 04 BF   .Sa?V$C.?.e.?f.?
000000090   0A 00 B8 01 02 8B DC 33  C9 83 FF 05 7F 03 8B 4E   ..?..‹U3E?y..‹N
0000000A0   25 03 4E 02 CD 13 72 29  BE 46 07 81 3E FE 7D 55   %.N.I.r)?F.?>?}U
0000000B0   AA 74 5A 83 EF 05 7F DA  85 F6 75 83 BE 27 07 EB   ?tZ?i.U…ou??'.e
0000000C0   8A 98 91 52 99 03 46 08  13 56 0A E8 12 00 5A EB   S?‘R™.F..V.e..Ze
0000000D0   D5 4F 74 E4 33 C0 CD 13  EB B8 00 00 00 00 00 00   OOta3AI.e?......
0000000E0   56 33 F6 56 56 52 50 06  53 51 BE 10 00 56 8B F4   V3oVVRP.SQ?..V‹o
0000000F0   50 52 B8 00 42 8A 56 24  CD 13 5A 58 8D 64 10 72   PR?.BSV$I.ZX?d.r
000000100   0A 40 75 01 42 80 C7 02  E2 F7 F8 5E C3 EB 74 49   .@u.B€C.a?o^AetI
000000110   6E 76 61 6C 69 64 20 70  61 72 74 69 74 69 6F 6E   nvalid partition
000000120   20 74 61 62 6C 65 00 45  72 72 6F 72 20 6C 6F 61    table.Error loa
000000130   64 69 6E 67 20 6F 70 65  72 61 74 69 6E 67 20 73   ding operating s
000000140   79 73 74 65 6D 00 4D 69  73 73 69 6E 67 20 6F 70   ystem.Missing op
000000150   65 72 61 74 69 6E 67 20  73 79 73 74 65 6D 00 00   erating system..
000000160   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000170   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000180   00 00 00 8B FC 1E 57 8B  F5 CB 00 00 00 00 00 00   ...‹u.W‹oE......
000000190   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0000001A0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
0000001B0   00 00 00 00 00 00 00 00  A6 34 1F BA 00 00 80 01   ........¦4.?..€.
0000001C0   01 00 07 FE 7F 3E 3F 00  00 00 40 32 4E 00 00 00   ...?>?...@2N...
0000001D0   41 3F 06 FE 7F 64 7F 32  4E 00 A6 50 09 00 00 00   A?.?d2N.¦P....
0000001E0   41 65 0F FE BF 4A 25 83  57 00 66 61 38 00 00 00   Ae.??J%?W.fa8...
0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 AA   ..............U?

 

What will happen if the first sector has been damaged (by virus, for example)?

Lets overwrite the first 16 bytes with zeros.

000000000   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000010   BF 1B 06 50 57 B9 E5 01  F3 A4 CB BE BE 07 B1 04   ?..PW?a.o¤E??.±.

 

When we try to boot after hardware testing procedures, we see just blank screen without any messages. It means the piece of code at the beginning of the MBR could not be executed properly. That’s why even error messages could not be displayed. However, if we boot from the floppy, we can see FAT partition, files on it and we are able to perform standard operations like file copy, program execution… It happens because in our example only part of the MBR has been damaged which does not allow the system to boot properly. However, the partition table is safe and we can access our drives when we boot from the operating system installed on the other drive.

What will happen if sector signature (last word 0x55AA) has been removed or damaged?

Lets write zeros to the location of sector signature.

Physical Sector: Cyl 0, Side 0, Sector 1
0000001E0   41 65 0F FE BF 4A 25 83  57 00 66 61 38 00 00 00   Ae.??J%?W.fa8...
0000001F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

When we try to boot now, we see an error message like “Operating System not found”.

Thus the first thing if computer does not boot is to run Disk Viewer and check the first physical sector on HDD, whether it looks like valid MBR or not:

  • check, may be it’s filled up with zeros or any other single character
  • check whether error messages (like you can see above “Invalid partition table”…) are present or not
  • check whether disk signature (0x55AA) is present or not

The simplest way to repair or re-create MBR is to run Microsoft’s standard utility called FDISK with a parameter /MBR, like

	A:\> FDISK.EXE  /MBR

FDISK is a standard utility included in MS-DOS, Windows 95, 98, ME.

If you have Windows NT / 2000 / XP, you can boot from startup floppy disks or CD-ROM, choose repair option during setup, and run Recovery Console. When you are logged on, you can run FIXMBR command to fix MBR.

Also you can use third party MBR recovery software or if you’ve created MBR backup, restore it from there (Active@ Partition Recovery has such capabilities).

What will happen if the first sector is bad/unreadable?

Most likely we’ll get the same black screen, which we got when trying to boot. When you try to read it using Disk Viewer/Editor you should get an error message saying that sector is unreadable. In this case recovery software is unable to help you to bring HDD back to the working condition, i.e. physical partition recovery is not possible. The only thing that can be done is to scan and search for partitions (i.e. perform virtual partition recovery), and in case if something is found – display them and give the user an opportunity to save important data to another location. Third party software, like Active@ UNERASER, will help you here.

 

Recommended software:

Active@ Partition Recovery

NTFS.com Fixing and repair MBR.Fix MBR.Recover boot record.Recovery.

Blogged with the Flock Browser
Anuncios

Publicado el 8 mayo 2009 en 4to Info, Hardware, Informática, Interpretar datos, Manipulación y Preservación de Datos TTP, Seguridad y etiquetado en , , . Guarda el enlace permanente. 2 comentarios.

  1. Since computer users are human, the user can be the primary cause of computer failure. And we operators of our computers are in most cases but that, we operate the computer but know very little concerning software and hardware components and peripherals.

    Since this is the case, you should ASSUME NOTHING when diagnosing any computer problem. We diagnosed a new PC with a video display problem. After briefly looking at the video card it took a while to see that the video card was not pushed into the adapter slot completely.

    Even though I looked at the card, I failed to check it thoroughly. This cause me to spend more time on troubleshooting that was not needed.The thought of a hard drive failure strikes terror in the heart of every computer user.

    This is because a hard drive failure may lead to invaluable data loss. Here are the most common procedures you should perform when you experience hard drive failure.

    General Hard Drive Troubleshooting

    The hard drive can display problems such as “retry, abort, ignore” or “cannot read sectors” while operating. This is an indication that there may be bad or unreadable spots on the drive. Reformatting and reinstalling the operating system can normally correct this problem. This will cause you to loose all data on your drive so it is important to always have a good backup of yourfiles daily.

    There are good good utilities you can purchase that can repair hard drive problems without destroying data. The utility Spinrite is a good utility and only cost $200.00 which is a good price if you want to avoid the hassle of reformatting the drive and restoring the operating system. Here are some general hard drive problems you should start from and we’ll be more specific later.

    Use Operating System Utilities

    First you may be able to correct those bad spots and errors from your hard drive by performing those PC maintenance in the operating system. Windows has Disk Defragment and you should run disk defragment after running Scandisk since scandisk will need to fix any problems it finds. After scanning the drive and defraging the files, run Disk Cleanup to ensure all junk files have been delete.

    Check Drive cables and connections

    If there is on indication that the drive is receiving power (you don’t hear that familiar clicking noise or the drive light is no working) check the 4 wire connector coming from the power supply.

    If the connection is secure, you can remove the power supply connector and do two things. You can check to see if there is voltage with a multimeter. But its much faster to connect another 4 wire connector to the drive to see if the drive works. There are normally extra connectors from the power supply or you can use the connection to the cdrom drive to test for voltage from the power supply.

    If the connection indicates no or very little voltage (4 volts or less) from the power supply, the power supply may be going bad. Now check and double check all connections, especially if you are someone else have recently worked inside the computer.

    If the drive will not boot up…?

    Boot the computer with your bootable DOS disk. If you don’t have one made, STOP and make one NOW by clicking on Start, Settings, Control Panel, Add and Remove Programs and Startup Disk.

    Try to access drive C: by typing DIR C: and press Enter. If you see the directories on drive C: try to make the drive bootable by typing sys a: c: and press Enter. The system files should be restored and the drive may be restored to boot on its own.

    If this fails, you may have to reformat and partition the drive with the setup utility that came with your drive or computer.

    If the Drive boots but hangs up at boot…?

    Turn the computer off, open the system unit and disconnect the ribbon cable at the motherboard end. Turn on the PC AND You will get an error message that the drive is bad and in most cases will go into your BIOS. Change the hard drive type to AUTO and shut off the computer.

    Reconnect the ribbon cable and see if the hard works properly. The drive settings should be restored and should operate fine.

    A hard drive that fails to boot up may also have a bad controller. If the controller is mounted on the hard drive, there is not much you can do except replace the drive.

Responder

Introduce tus datos o haz clic en un icono para iniciar sesión:

Logo de WordPress.com

Estás comentando usando tu cuenta de WordPress.com. Cerrar sesión /  Cambiar )

Google+ photo

Estás comentando usando tu cuenta de Google+. Cerrar sesión /  Cambiar )

Imagen de Twitter

Estás comentando usando tu cuenta de Twitter. Cerrar sesión /  Cambiar )

Foto de Facebook

Estás comentando usando tu cuenta de Facebook. Cerrar sesión /  Cambiar )

w

Conectando a %s

A %d blogueros les gusta esto: