restore MBR

[ep]

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.
Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

Thanks

E

 

[Zvi Netiv]

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.

"Failed to be recognized" means that the BIOS doesn't recognize the drive
hardware. The next part of your post suggests that the drive IS recognized, but
its content cannot be accessed normally. This is quite different from a drive
that isn't recognized anymore by the BIOS.

Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

What recovery tool did you use?

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

FDISK is not the tool for restoring the MBR of a drive that has NTFS. If the
drive had just a single partition that occupied the entire drive capacity, then
you can try FIXMBR after having booted from the XP setup CD, into "restore
console". If only the MBR got damage then it may work. If not, then there are
other options to try.

Regards, Zvi

 

[Folkert Rienstra]

"Failed to be recognized" means that the BIOS doesn't recognize the drive
hardware.

That is what you make of it. That is the hardware part. There
is also the content part of the bios that is looking for executable
bootsectors. If it doesn't find one that can be construed as the
drive not being recognized when you know that there should be one.

The next part of your post suggests that the drive IS recognized, but
its content cannot be accessed normally.

This is quite different from a drive that isn't recognized anymore by the BIOS.

So obviously that wasn't the context in wich he
(meant to) say(d) that the drive wasn't recognized.

What recovery tool did you use?


FDISK is not the tool for restoring the MBR of a drive that has NTFS. If
the drive had just a single partition that occupied the entire drive capacity,
then you can try FIXMBR after having booted from the XP setup CD, into
"restore console".

What would be different if it didn't have
"a single partition that occupied the entire drive capacity"?

If only the MBR got damage then it may work.

Will that restore the partiton table too or ...?

If not,

.... guess not then.

 

[Zvi Netiv]

That is what you make of it. That is the hardware part. There
is also the content part of the bios that is looking for executable
bootsectors. If it doesn't find one that can be construed as the
drive not being recognized when you know that there should be one.

The BIOS will recognize the presence of the drive (hardware) regardless of
whether it contains a valid / executable MBR and bootsector(s) or not. A test
for BIOS recognition is FDISK being able to see the drive.

So obviously that wasn't the context in wich he
(meant to) say(d) that the drive wasn't recognized.

I understood what the OP meant, I was just pointing out the difference to him.

What would be different if it didn't have
"a single partition that occupied the entire drive capacity"?


Will that restore the partiton table too or ...?

FIXMBR works differently than FDISK with the /MBR argument. FIXMBR will write a
default partition table if none exists or if the existing one is corrupted.
Unlike FDISK /MBR - the latter will write a default DOS partition only if the
boot signature is 00 00 rather than 55 AA.

... guess not then.

FIXMBR doesn't check for actually existing partitions before rewriting the MBR.
If the partition table is good, then it will use that data, if not, then it will
write a default partition table. Quite a good chance to fix things on first
attempt, depending on the drive configuration before the MBR was damaged.

Regards, Zvi

 

[Brandon]

I have a drive that has been diagnosed as having a corrupted/missing MBR

(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.
Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

It looks like some people have already disagreed with what I'm about
to say but...

If you are using WindowsXP, simply clearing the MBR using "fdisk /mbr"
or "fixmbr" will allow Windows to work. I know this from first hand
experience with restoring WinXP after uninstalling Linux on dual boot
systems. However, if your drive is corrupt, that might be the least
of your problems. Or maybe your software misdiagnosed the problem.
What exactly was the problem you were having?

 

[Timothy Daniels]

If you are using WindowsXP, simply clearing the MBR
using "fdisk /mbr" or "fixmbr" will allow Windows to work.
I know this from first hand experience with restoring
WinXP after uninstalling Linux on dual boot systems.

What were the symptoms of disfunction after uninstalling
Linux from the dual boot system? Was it merely that the
dual boot option still presented itself at boot time?

*TimDaniels*

 

[ep]

The drive is accessed as not being able to read from it. That is at Boot
time. I can boot from a floppy and have used EasyRecovery Professional
Trial to see I can "see" the data. However, the Trial does not let me do
that just analyze the drive. All the reports say it is OK with the
exception that the MBR is bad.

Does that help understand why I want to do this?

Last, how can I use "fixmbr" from a floppy? I have found reference to this,
but no specifics.

P.S. I do not want to write to the disk because it has data I need on it.
I also am trying to do all I can before resorting to sending it to a
recovery house (and the large expense of a 40G drive that was, as I recall,
over 70% full - not all data but that full).

Thanks
E

 

[Folkert Rienstra]

The BIOS will recognize the presence of the drive (hardware) regardless
of whether it contains a valid / executable MBR and bootsector(s) or not.

Yes, no one contents that.
He said it failed to be recognized without saying what 'it' was or what it was
that didn't 'recognize' it. 'It' and 'not recognized' therefor can be several things.

A test for BIOS recognition is FDISK being able to see the drive.

It is stil possible that a drive is (hardware) recognized by POST but not by
FDISK but then that would be of ones own doing (bios setup).

I understood what the OP meant, I was just pointing out the difference to him.

Well, "content cannot be accessed normally" is quite vague in pointing out a 'difference'.
To all intends and purposes it could actually mean the same thing as 'not recognized by bios'.

What would be different if it didn't have
"a single partition that occupied the entire drive capacity"?

[...]

Will that restore the partiton table too or ...?

FIXMBR works differently than 'FDISK with the /MBR argument'. FIXMBR will
write a default partition table if none exists or if the existing one is corrupted.
Unlike FDISK /MBR - the latter will write a default DOS partition only if the
boot signature is 00 00 rather than 55 AA.

Something seems amiss with that.
Presumably that is to read as :
Unlike FIXMBR, FDISK /MBR will write a default DOS par-
tition only if the boot signature is 00 00 rather than 55 AA.

What if the signature bytes are neither?

FIXMBR doesn't check for actually existing partitions before rewriting the MBR.
If the partition table is good, then it will use that data, if not, then it will
write a default partition table.

Quite a good chance to fix things on first attempt, depending
on the drive configuration before the MBR was damaged.

MBR's don't get damaged, they get overwritten completely.
There are two possibilities: It gets overwritten with garbage by a programming
error, destructive virus or crash, or it gets manipulated by a virus or partitioning
software (overlays included) or fix that reads it, changes it, and writes it back.
So FIXMBR and MBR/FIX only work successfully on the latter case.

Q:How big a chance that it will overwrite the existing but slightly unconventional
partition table that nonetheless still works? Or in other words, do you know what
it checks to determine whether the table is good? Are there risks of loosing it?

 

[Zvi Netiv]

[...]

A test for BIOS recognition is FDISK being able to see the drive.

It is stil possible that a drive is (hardware) recognized by POST but not by
FDISK but then that would be of ones own doing (bios setup).

It's possible that POST (the BIOS) will appear to detect the drive but FDISK
when run will return "no hard drive found". A closer inspection of the drive
parameter in the setup will show erratic data for the drive. This is a rare
hardware mode of failure. Setting the wrong parameters in the BIOS setup will
result in FDISK finding the drive, but with erratic configuration. FDISK
finding the drive (not necessarily with correct drive parameters) is a reliable
indicator whether the BIOS "sees" the drive or not.

[...]

Something seems amiss with that.
Presumably that is to read as :
Unlike FIXMBR, FDISK /MBR will write a default DOS par-
tition only if the boot signature is 00 00 rather than 55 AA.

That's better, and correct.

What if the signature bytes are neither?

FDISK /MBR will then leave the partition data as is, and correct the signature
to 55 AA. The only case where FDISK will write a new partition table is when
the signature is zero.

Regards, Zvi

 

[Zvi Netiv]

The drive is accessed as not being able to read from it. That is at Boot
time. I can boot from a floppy and have used EasyRecovery Professional
Trial to see I can "see" the data. However, the Trial does not let me do
that just analyze the drive. All the reports say it is OK with the
exception that the MBR is bad.

So you have a positive indication that only the MBR is bad.

Does that help understand why I want to do this?

Last, how can I use "fixmbr" from a floppy? I have found reference to this,
but no specifics.

You need to boot from your XP setup CD (you may need to change the boot device
order to CDROM as first), and select "repair" mode. When at the command prompt,
simply type FIXMBR and then Enter.

P.S. I do not want to write to the disk because it has data I need on it.
I also am trying to do all I can before resorting to sending it to a
recovery house (and the large expense of a 40G drive that was, as I recall,
over 70% full - not all data but that full).

If you want to play it safe, then you may clone the entire drive to another one
and work on the clone. This way you don't ruin your chances to give it out to a
recovery house (expect at least a 1,000 $ price tag for professional recovery).
For cloning software, check CloneDisk from www.resq.co.il/resq.php

Regards, Zvi

 

[ep]

Thanks to all that responded. Now I have information overload!!

First, I have a laptop, so making this a slave is not viable. I can use my
USB/Firewire external adapter and put it in that to do any recovery. I have
the drivers (DOS) for the adapter so do not have to worry about that.

Second, the BIOS is seeing the drive. If I put into the laptop as master,
boot, got to the BIOS details, it sees that it is there. From there I
cannot get it to work, just says "Non system disk" (sorry about the earlier
mention). That leads me to believe that the MBR is gone since it worked
fine for a long time.

Third, my laptop came with a "recovery partition" which I think is a bad
practice but........ I do NOT have Windows XP disks. I may be able to get
them, but that is not certain. Can I somehow get to the Recovery Console
using either a bootable CD or Floppy? If so, does someone have something I
can use? I don't need the full XP stuff, just the ability to get and use
Recovery Console to do the FIXMBR.

Last, if I get this drive back, I will back up as much as I can then chuck
it. It may be on its last leg (or maybe using crutches).

Again thanks for all the help. You guys (and gals) are the BEST>

E

 

[Folkert Rienstra]

[...]

A test for BIOS recognition is FDISK being able to see the drive.

It is still possible that a drive is (hardware) recognized by POST but not by
FDISK but then that would be of ones own doing (bios setup).

It's possible that POST (the BIOS) will appear to detect the drive but FDISK
when run will return "no hard drive found".

A closer inspection of the drive parameter in the setup will show erratic data
for the drive.

It's actually much simpler. This is what happens when you set type to NONE.
This is where the bios excludes the drive.

This is a rare hardware mode of failure.

I would consider that a BIOS bug, not a hardware failure.

Setting the wrong parameters in the BIOS setup will result in
FDISK finding the drive, but with erratic configuration.

Not an erratic configuration but the preferred configuration.
A good bios will not allow you set parameters that are unworkable.

FDISK finding the drive (not necessarily with correct drive parameters)
is a reliable indicator whether the BIOS "sees" the drive or not.
Right.

[...]

FIXMBR works differently than 'FDISK with the /MBR argument'. FIXMBR will
write a default partition table if none exists or if the existing one is corrupted.
Unlike FDISK /MBR - the latter will write a default DOS partition only if the
boot signature is 00 00 rather than 55 AA.

Something seems amiss with that.
Presumably that is to read as :
Unlike FIXMBR, FDISK /MBR will write a default DOS par-
tition only if the boot signature is 00 00 rather than 55 AA.

That's better, and correct.

What if the signature bytes are neither?

FDISK /MBR will then leave the partition data as is, and correct the signature
to 55 AA. The only case where FDISK will write a new partition table is when
the signature is zero.

Ok, thanks. I'll take it that you are refusing to answer the snipped questions?

 

[Zvi Netiv]

[...]
Ok, thanks. I'll take it that you are refusing to answer the snipped questions?

Think positive. I simply choose what to address. After all it's my time, isn't
it?

Regards, Zvi