Data recovery concepts

Data Recovery Concepts

Partition Boot Sector is damaged

The Partition Boot Sector contains information, with which the file system accesses the volume. On personal computers, the Master Boot Record uses the Partition Boot Sector on the system partition to load the operating system kernel files. The Partition Boot Sector is the first sector of the Partition.

For our first NTFS partition our boot sector looks like this:

Physical Sector: Cyl 0, Side 1, Sector 1
000000000   EB 5B 90 4E 54 46 53 20  20 20 20 00 02 01 00 00   e[?NTFS    .....
000000010   00 00 00 00 00 F8 00 00  3F 00 FF 00 3F 00 00 00   .....o..?.y.?...
000000020   00 00 00 00 80 00 80 00  3F 32 4E 00 00 00 00 00   ....Ђ.Ђ.?2N.....
000000030   5B 43 01 00 00 00 00 00  1F 19 27 00 00 00 00 00   [C........'.....
000000040   02 00 00 00 08 00 00 00  10 EC 46 C4 00 47 C4 0C   .........iFA.GA.
000000050   00 00 00 00 00 00 00 00  00 00 00 00 00 FA 33 C0   .............u3A
000000060   8E D0 BC 00 7C FB B8 C0  07 8E D8 C7 06 54 00 00   Z??.|u?A.ZOC.T..
000000070   00 C7 06 56 00 00 00 C7  06 5B 00 10 00 B8 00 0D   .C.V...C.[...?..
000000080   8E C0 2B DB E8 07 00 68  00 0D 68 66 02 CB 50 53   ZA+Ue..h..hf.EPS
000000090   51 52 06 66 A1 54 00 66  03 06 1C 00 66 33 D2 66   QR.f?T.f....f3Of
0000000A0   0F B7 0E 18 00 66 F7 F1  FE C2 88 16 5A 00 66 8B   .·...f?n?A?.Z.f‹
0000000B0   D0 66 C1 EA 10 F7 36 1A  00 88 16 25 00 A3 58 00   ?fAe.?6..?.%.?X.
0000000C0   A1 18 00 2A 06 5A 00 40  3B 06 5B 00 76 03 A1 5B   ?..*.Z.@;.[.v.?[
0000000D0   00 50 B4 02 8B 16 58 00  B1 06 D2 E6 0A 36 5A 00   .P?.‹.X.±.O?.6Z.
0000000E0   8B CA 86 E9 8A 36 25 00  B2 80 CD 13 58 72 2A 01   ‹E†eS6%.?ЂI.Xr*.
0000000F0   06 54 00 83 16 56 00 00  29 06 5B 00 76 0B C1 E0   .T.?.V..).[.v.Aa
000000100   05 8C C2 03 D0 8E C2 EB  8A 07 5A 59 5B 58 C3 BE   .?A.?ZAeS.ZY[XA?
000000110   59 01 EB 08 BE E3 01 EB  03 BE 39 01 E8 09 00 BE   Y.e.?a.e.?9.e..?
000000120   AD 01 E8 03 00 FB EB FE  AC 3C 00 74 09 B4 0E BB   ­.e..ue?¬>.t.?.»
000000130   07 00 CD 10 EB F2 C3 1D  00 41 20 64 69 73 6B 20   ..I.eoA..A disk 
000000140   72 65 61 64 20 65 72 72  6F 72 20 6F 63 63 75 72   read error occur
000000150   72 65 64 2E 0D 0A 00 29  00 41 20 6B 65 72 6E 65   red....).A kerne
000000160   6C 20 66 69 6C 65 20 69  73 20 6D 69 73 73 69 6E   l file is missin
000000170   67 20 66 72 6F 6D 20 74  68 65 20 64 69 73 6B 2E   g from the disk.
000000180   0D 0A 00 25 00 41 20 6B  65 72 6E 65 6C 20 66 69   ...%.A kernel fi
000000190   6C 65 20 69 73 20 74 6F  6F 20 64 69 73 63 6F 6E   le is too discon
0000001A0   74 69 67 75 6F 75 73 2E  0D 0A 00 33 00 49 6E 73   tiguous....3.Ins
0000001B0   65 72 74 20 61 20 73 79  73 74 65 6D 20 64 69 73   ert a system dis
0000001C0   6B 65 74 74 65 20 61 6E  64 20 72 65 73 74 61 72   kette and restar
0000001D0   74 0D 0A 74 68 65 20 73  79 73 74 65 6D 2E 0D 0A   t..the system...
0000001E0   00 17 00 5C 4E 54 4C 44  52 20 69 73 20 63 6F 6D   ...\NTLDR is com
0000001F0   70 72 65 73 73 65 64 2E  0D 0A 00 00 00 00 55 AA   pressed.......U?

Offset       0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

The printout is formatted in three sections:

• Bytes 0x00– 0x0A are the jump instruction and the OEM ID (shown in bold print)
• Bytes 0x0B–0x53 are the BIOS Parameter Block (BPB) and the extended BPB
• This block contains such essential parameters as:
  • Bytes Per Sector (WORD, offset 0x0B),
  • Sectors Per Cluster (BYTE, offset 0x0D),
  • Media Descriptor (BYTE, offset 0x15),
  • Number of Heads (WORD, offset 0x1A),
  • Hidden Sectors (DWORD, offset 0x1C),
  • Total Sectors (LONGLONG, offset 0x28), etc...
• The remaining code is the bootstrap code (that is necessary for the proper system boot) and the end of sector marker (shown in bold print).

This sector is so important on NTFS that a duplicate of the boot sector is located on the disk.

The Boot Sector for FAT format looks different when compared to NTFS, however its BPB contains parameters similar to those listed for NTFS above. On the FAT system there is not an extra copy of this sector stored anywhere. Consequently, recovery on FAT is as half as successful as recovery on NTFS.

What Happens if the Partition Boot Sector is Damaged?

In our laboratory system, we will simulate a damaged or unreadable Partition Boot Sector by writing zeros to several lines:

000000000   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000010   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000020   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000030   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000040   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000050   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000000060   8E D0 BC 00 7C FB B8 C0  07 8E D8 C7 06 54 00 00   Z??.|u?A.ZOC.T..

If we try to boot in this condition, we see "Non System Disk" or "Disk Error..". After we fail to load from it and also fail from a floppy boot attempt, the partition becomes unbootable.

Because a normally functioning system relies on the boot sector to access a volume, it is highly recommended that you run disk-scanning tools such as Chkdsk regularly, as well as back up all of your data files to protect against data loss in case you lose access to the volume.

Tools like Active@ Partition Recovery and Active@ UNERASER allow you to create backup of MBR, Partition Table and Volume Boot Sectors so that if for some reason it fails to boot, you can restore your partition information and gain access to files/folders on that partition.

What Can I do if Partition Boot Sector is Damaged?

• If you have backup of the whole disk or MBR/Boot Sectors we can try to restore it from there.
• If you do not have backup, in case of NTFS we could try to locate the duplicate of Partition Boot Sector and get information from there.
• If duplicate boot sector is not found, only virtual partition recovery might be possible; and this depends on whether or not we can determine critical partition parameters such as Sectors per Cluster, etc.

Fixing NTFS Boot Sector Using Standard Windows NT/2000/XP Tools

On NTFS, a copy of the boot sector is stored at the middle or at the end of the Volume.

You can boot from a startup floppy disk or CD-ROM,choose the "Repair" option during setup, and run Recovery Console. When you are logged on, you can run FIXBOOT command to try to fix boot sector.

How can Recovery Software Help in This Situation?

• A recovery utility can backup MBR, Partition Table and Boot Sectors and restore them in case of damage
• It can try to find the duplicate boot sector on the drive and re-create the original one or perform virtual data recovery based on found partition parameters
• Some advanced techniques allow assuming drive parameters even if duplicate boot sector is not found (i.e. perform virtual partition recovery) and give the user virtual access to the data on the drive to be able to copy them to the safer location.