Ruben Laguna's blog

Feb 20, 2007 - 4 minute read - bootsector corruption data disk diskprobe mbr ntfs partition probe recover repair table windows

Hard disk odyssey!

Wow! Today is a great day I thought I missed my iTunes library and outlook email but I managed to recover it.

I’m not really sure how it happened. All began when I moved my old 60GB hard disk to another PC as an extra disk (not boot disk). The other PC had Windows XP installed in its main 250Gb hard disk. I didn’t notice at first but the BIOS didn’t recognized the 60GB disk correctly (wrong size, wrong id) and when I started the Disk Administrator in Windows, it warned me that the disk had’nt a signature and asked me to write a new one. I clicked OK and I think that screwed up the whole disk. As I found later, it ended up with a corrupted MBR and NTFS bootsector. I decided to reboot to see BIOS messages about the disk and now I noticed that size was wrong, etc. I changed the IDE cable (weird cabling problem), rebooted and now the size was ok but I couldn’t mount it in Windows, it didn’t recognized it as a NTFS volume.

The disk administrator did see the disk but the volume information was wrong. It recognized the PhysicalDisk 1 as a dynamic disk instead of basic with errors no format. I started to sweat, valuable assets are held in that disk : my iTunes library (with song ratings and purchased audiobooks). Well I decided to google a little bit about it and I found the following web references:

I will detail the procedure I followed to recover the disk from a state of Dynamic disk with no format to Basic disk with NTFS format.

  1. Use DiskProbe (download link) to read MBR. #* Start DiskProbe. #* Choose DRIVES -> Physical Drive. #* Double click on the PhysicalDriveX where X = the ordinal of the disk. Use Disk Administrator to find the ordinal of the disk. When you double click at the PhisicalDriveX it will appear in the Handle 0 area below #* Uncheck the Read Only checkbox #* Click on Set Active #* Click OK #* diskprobe1.png #* Select Sectors -> Read in the menu. Write 0 as Starting sector and 1 as Number of sectors. Then click Read.
  2. Now you should see something similar to the following diskprobe2.png
  3. You can tell that it the MBR because of the the ascii string “Invalid partition table” and because of the end of sector mark 0x55AA at offset 0x1FE.
  4. The disk signature (red) is located at 0x1B8 and the first entry of the partition table (yellow) is located at x1BE diskprobe3.png
  5. Examine the first entry in the partition table #* System ID -> 42. This means Dynamic disk . #* Relative sectors -> 3F 00 00 00. The value is little endian so it translated to 00 00 00 3F -> 63+ # Total sectors -> 51 B7 FC 06. Also little endian, translation: 06 FC B7 51 -> 117225297
  6. The System ID is wrong so I change it to 07 (NTFS). Sectors -> Write
  7. The other values are OK, #* I checked sector 63 and there is a NTFS bootsector there so I seems ok. #* 117225297 + 63 = 117225360 which match the value stated in Drives -> Volume Information in DiskProbe
  8. I restarted windows. And still nothing the same thing happens, Disk Administrator still shows the same information.
  9. I suspected that Disk Administrator was showing old information and I decided to reset the disk signature present in the MBR to zeroes to force Disk Administrator to reread disk information. In my case the disk signature was 81 7A 7C 4E (located at 0x1b8). As I read later, there are several entries in the Windows registry linked to the current value of the disk signature that hold information about the disk so I to make sure that those registry items get rewritten the best option is to reset the disk signature and let Disk Administrator to recreate those.
  10. Restarted Windows again. Now windows recognizes the drive and assigns it a drive letter but as an unformatted disk, no NTFS, no FAT, nothing.
  11. Using DiskProbe again I read the contents of sector 63, the NTFS bootsector of the partition. diskprobe4.png
  12. I review the values there using View -> NTFS bootsector diskprobe5.png
  13. The total sectors figure 117226241 is obviously wrong. The disk has only 117225360 sectors and the partition couldn’t be 881 sectors larger than the disk.
  14. I changed the value to 117225297 just the same value as in the MBR.
  15. Sectors -> Write to make changes permanent.
  16. Restart windows again. And WoW windows recognizes the drive and the files in it.
  17. Chkdsk /f to show some errors but nothing irrecoverable.

You can read more on using Disk Probe here