I've already completed the recovery on a client's drive, so this is really an academic question.

The 1st LBA sector of this NTFS drive was corrupted, and repeatedly trying an algorithm to recover data with ECC turned off didn't work. The first few bytes should have been 55AAh.

Is there an exact duplicate of the first sector mirrored on the drive? Is it in a "standard" offset location or would I have to do a search for, say, 55AA in order to find it?

Jon

_________________
http://www.datasaversllc.com

there is a copy of the mbr on the last sector of the ntfs partition.
If you have ntfs explorer from runtime , you can search for :
Partition Tables,MBR , MFT's , Directories, etc .

As i know, the MBR have no backup on the disk again.
But it is easily reproducible.

Janos

MBR not partition table.. there is a copy of mbr (or boot record) on
fat32 and ntfs
on fat32 it is 6 sectors after the first.
on ntfs it is last sector..
hfs and hfs+ also have similar backup towards the end of the volume

i am sorry, but as i know, the MBR is Master Boot Record, it is equal to the LBA 0 on the disk. (As i know, there is no copy of this.)
The first sector of the partition, is boot record.

Regards,
Janos

Hy jono, the MBR Code No, but partition table u could got the information to rebuild it from the LBA 63, Volume Boot Sector, or viceversa, if u lost the VBS, u could rebuild it with the infomation from Partition Table, thats applied for FAT & NTFS

Regards

Hi,

Also there's some misunderstanding, since the first bytes of the MBR (LBA0) is rarely 55 AA. U are probably thinking of the signature of the MBR that is at offset 0x1FE and it should contain 55 AA indeed for a valid MBR.

pepe

_________________
Adatmentés - Data recovery