Boot Sector Issues

[atticus887]

Hi there, hoping you guys can help. Frequent reader, first-time poster. Let me start you off with a brief story:

I'm working on a HDD that (according to the owner) was attacked by a virus causing "Error loading operating system" when trying to boot into Windows XP. I loaded the Windows XP CD-ROM, ran the Recovery Console, ran 'fixmbr' followed by (and I think this caused all of my grief) 'fixboot.' Now, the main partition which was NTFS is appearing as FAT12, with size of 10MB. It looks to me like 'fixboot' has overwritten the NTFS boot sector with a FAT12 boot sector.

Now, my only mission here is to recover data, not to make the drive bootable. I know that in order to view files from the missing partition, a valid boot sector must be intact. I've done 2 days of research, and used many programs (TestDisk, Active Partition Recovery, GetDataBack, Easeus, etc.) but have had no luck rebuilding the boot sector and accessing files. I manually tried to find the backup boot sector, also to no avail.

I'm attaching a screenshot of my boot sector dump, according to TestDisk.

On a side note, how important is changing options such as LBA, CHS, etc for the drive? Could it be that the drive was configured a certain way in the original machine's BIOS and now, in another machine, is not in the correct mode? At this point, I'm really trying to think outside the box.

Thanks!

Attachments

[lcoughey]

1. If you care about your client and their data at all, you will stop messing around with the original drive before you completely render the data unrecoverable.
2. Properly diagnose the drive and be sure that the drive has healthy heads, pcb and firmware modules (if you don't have the tools or need to ask what this means, send it to a pro)
3. Get a full clone of the drive to another drive of equal or larger size (if you cannot do this or have to ask how, send it to a pro)
4. Reconstruct and recover the file system from the clone

There is a lot more to safe professional data recovery than a few software programs you can download off the internet.

[fzabkar]

I have had the same problem, although in my case the original file system was FAT32. My approach was to manually repair the boot sector. The job was made a little harder because the copy in sector 6 was not an exact copy of the original (Windows XP had been installed over an existing Windows 9x installation).

The first thing I have to say is that the Microsoft programmer who is responsible for this evil bit of code is braindead. Since when does replacing a HDD boot sector with a 10MB FAT12 copy constitute a fix?

Now that I've got that out of the way, could you upload a dump of sector 0?

I would also write zeros to the FAT12 boot sector. Its presence will only confuse your data recovery software.

[atticus887]

1. If you care about your client and their data at all, you will stop messing around with the original drive before you completely render the data unrecoverable.
2. Properly diagnose the drive and be sure that the drive has healthy heads, pcb and firmware modules (if you don't have the tools or need to ask what this means, send it to a pro)
3. Get a full clone of the drive to another drive of equal or larger size (if you cannot do this or have to ask how, send it to a pro)
4. Reconstruct and recover the file system from the clone

There is a lot more to safe professional data recovery than a few software programs you can download off the internet.

Thanks for your input.

I ran the drive through Scandisk and the health report turned out okay. No bad sectors or problems. I backed the drive up to an image I was working with, but I'll follow your advice and clone it to another physical drive.

I haven't written anything to the drive or moved the partitions, so I thought that the data should still be there somewhere, but I'll take any advice I can get. Thanks again.

[atticus887]

I have had the same problem, although in my case the original file system was FAT32. My approach was to manually repair the boot sector. The job was made a little harder because the copy in sector 6 was not an exact copy of the original (Windows XP had been installed over an existing Windows 9x installation).

The first thing I have to say is that the Microsoft programmer who is responsible for this evil bit of code is braindead. Since when does replacing a HDD boot sector with a 10MB FAT12 copy constitute a fix?

Now that I've got that out of the way, could you upload a dump of sector 0?

I would also write zeros to the FAT12 boot sector. Its presence will only confuse your data recovery software.

Thanks for the response. Agree with you about the Microsoft programmer. I'll hold him - you punch.

Writing 0's is a great idea - I'll get on that immediately. Attached is sector 0.

Attachments

[atticus887]

Update:

I went ahead and wrote 0's to the FAT12 boot sector. I did some more research and started looking into rebuilding the NTFS boot sector manually with a program by Roadkil called Boot Build, which requires the following information:

Bytes per sector, sectors per cluster, reserved sectors, sectors per track, # of heads, # of total sectors, serial number, MFT cluster, MFT mirror cluster, hidden sectors, clusters per index and clusters per segment.

I'm able to gather all of the correct information except three categories: $MFT Cluster, $MFT Mirror Cluster, and Serial Number. I've tried a few freeware programs with no luck.

Any ideas?

EDIT: It's also worth noting that the backup boot sector is not there - at least not at the last sector of the partition. I read that this can happen with the dreaded FAT12 fixboot problem.



Here is the information I currently know:
Bytes per sector: 512
Sectors per cluster: 8
Reserved sectors: 0
Sectors per track: 63
Number of heads: 240
Total sectors: 185114096
Hidden sectors: 63
Clusters per index: 1
Clusters per segment: 246

Thanks.

[fzabkar]

According to the partition table, the first partition begins at LBA 0x3F (= sector 63). The size of this partition is 0x0B089DF1 (= 185 114 097 sectors). This means that the last sector of the partition (where the backup NTFS boot sector is located) is 185114159.

In my case, FIXBOOT did not touch the backup FAT32 boot sector, so I would expect that in your case it should also have left the backup intact.

BTW, I use the following resource for MBRs and boot sectors:
http://thestarman.pcministry.com/asm/mbr/index.html

[poehere]

If your mission is to recovrey data it should be done now. This one is not that hard to do.

If you cloned this HDD use RStudio or Get Data Back and get off your data on it

Simple solution and done

[fzabkar]

If your mission is to recovrey data it should be done now. This one is not that hard to do.

If you cloned this HDD use RStudio or Get Data Back and get off your data on it

Simple solution and done

The OP has already tried your "simple solution":

"I've done 2 days of research, and used many programs (TestDisk, Active Partition Recovery, GetDataBack, Easeus, etc.) but have had no luck rebuilding the boot sector and accessing files. I manually tried to find the backup boot sector, also to no avail."

You're right about it being "not hard to do", though. All that needs to be done is for the backup boot sector to be copied over the original one. From the first screenshot it would appear that TestDisk has looked in the wrong place for it.

FIXMBR writes to sector 0. FIXBOOT writes to sector 63. Repairing or replacing these two sectors is very simple for someone who has even a modicum of understanding about file systems. Data recovery software should be an extension of one's intellect, not a substitute for it.

[poehere]

Winhex does raw data recovry. He might not have another solution but raw recovery on this one. RAW recovery is better than no recovery at all. A lot of times this is all you can do

[fzabkar]

Maybe the OP's data recovery software is stumbling on the original problem rather than the new one introduced by Microsoft's rogue FIXBOOT utility?

All I know is that when I personally experienced the same problem, the solution was to reconstruct the boot sector. In my case I extracted the data in the backup boot sector (eg volume size, CHS values, sectors per cluster, etc) and I then patched these over a Windows XP FAT32 boot sector template which I extracted from an appropriate Win XP EXE file (DiskPart.exe, IIRC).

To the OP, DMDE (freeware) is a disk editor which is able to search for file system structures ("special sectors"), eg MFT record, NTFS Dir Record.

DMDE (DM Disk Editor and Data Recovery):
http://softdm.com/download.html

[poehere]

RAW Recovery buy and pay for Rstudio, or Winhex and get the data off a clone. Stop screwing around with original drive. That was first mistake. Any time a drive comes in with problems never touch it keep it like it is. Clone it and use the clone. That is where you ran into problems. If you had done this one the clone you could of fixed it easily with another clone. But now you did it on original drive and now you have major problems. Clone it before you do anything else on this one. Sorry you only way might now be raw recovery on a clone. Not on your origianl drive

[fzabkar]

Stop screwing around with original drive. That was first mistake. Any time a drive comes in with problems never touch it keep it like it is. Clone it and use the clone. That is where you ran into problems. If you had done this one the clone you could of fixed it easily with another clone. But now you did it on original drive and now you have major problems. Clone it before you do anything else on this one. Sorry you only way might now be raw recovery on a clone. Not on your origianl drive

What don't you understand about the following?

"I backed the drive up to an image I was working with, but I'll follow your advice and clone it to another physical drive.

I haven't written anything to the drive or moved the partitions."

[poehere]

I'm working on a HDD that (according to the owner) was attacked by a virus causing "Error loading operating system" when trying to boot into Windows XP. I loaded the Windows XP CD-ROM, ran the Recovery Console, ran 'fixmbr' followed by (and I think this caused all of my grief) 'fixboot.' Now, the main partition which was NTFS is appearing as FAT12, with size of 10MB. It looks to me like 'fixboot' has overwritten the NTFS boot sector with a FAT12 boot sector.

He did not back up the drive before this. He worked on original HDD to do this one. Sorry but he did work on original HDD and now he has problems. If the first step before doing this was clone it and do this on a clone he would of been fine. But he did this on original HDD. Now he has even more problems. I do not understand how you say he did not do it to original HDD