|
A list of terms used in this page and
their explanation can be found here.
A step-by-step example of how to use this function can be found here
(for FAT partitions), or here (for NTFS
partitions).
Checking, repairing and rebuilding boot sectors.
|
Important! If there are indications that the disk is physically failing or if
bad sectors
are preventing repairs, you're advised to clone the disk
prior to making any repairs. |
Boot sector repair is a streamlined
process that always follows the same set of steps:
- Select the problem disk
- Select the problem partition
- Run the check, a brief report is shown
- If errors are found, select the repairs
you wish to have performed
Additional options are available when the
partition that requires repairs has been selected:
- you can edit the boot sector
- you can write boot code for a number of known boot sector types
Checking and repairing
After having selected the disk to work with, select [Rebuild boot sectors]
from the [Perform repairs] menu.
| At this point DiskPatch assumes the
partition tables to be correct. This means that if you have reason to
believe that the partition tables are not correct, do not perform a boot
sector rebuild; first perform the partition table repair. |
DiskPatch will show the 'create undo archive'
dialogue. Enter a description or leave the suggested text and press <enter>
to create the new undo file. Press <escape> at this point to skip
creating the undo file (not recommended). If enabled, all actions that will be performed
after this prompt will be captured in the undo file, including FAT repairs. This
could make the undo file quite large, so at certain points in the repair process
DiskPatch will check for free disk space. If there isn't enough disk space to hold
the FAT repair undo data, DiskPatch will notify you and disable the option 'save
FAT to undo' (read the configuration page for
more details).
Next a list of partitions that were found is shown. Select the partition you
wish to work with and press <enter>. A menu is shown that allows
you to select the action you wish to perform:
- Check and Fix Boot sector
This procedure will analyze the boot sector for the selected partition. A
results screen will be displayed and if errors were found a menu will be
shown that allows you to select the appropriate repairs. The full procedure
will be explained below.
- Display and Edit Boot sector
Allows you to edit the boot sector for the selected partition. Use this to
either view the current values in the boot sector, or to repair errors that
can be fixed by changing one or more values in the boot sector. Use this
feature with caution: editing the boot sector should be considered an
advanced recovery procedure.
- Inject boot code
Allows you to refresh the boot code in the boot sector for the selected
partition. When this option is selected you will have to select the
appropriate boot code type for the partition: Windows 9x/ME or Windows
2000/2003/XP.
This procedure may be necessary if you have rebuilt a boot sector from
scratch using the 'Check and Fix Boot sector' procedure.
Injecting boot code is only necessary for partitions that must be bootable;
data partitions do not need boot code.
The 'Check and Fix Boot sector'
procedure in detail
- Step 1: analysis
| If needed, pressing <escape> before the
repair has ended (except during FAT synchronization) will abort the
procedure without writing changes to the disk. |
When this option is selected DiskPatch will display a window that contains
information on the current step of the procedure and the result (if any).
Results (as displayed on the right side of the window) are color coded:
| green
: |
test passed, no errors found |
| yellow
: |
status could not be
determined, other errors need to be fixed first |
| red
: |
test failed, one or more
errors exist that need fixing |
During checking the screen may look something like this
(small differences exist for different partition types):
The tests that are performed are displayed
in this status window. Tests that may take some time will be accompanied by the
progress bar at the bottom of the DiskPatch main screen.
When the tests have been completed the 'suggested repairs' window will appear.
This window will always be displayed, even
if no errors were found. If needed you can enforce a repair by changing a repair
option to 'yes'.
If no errors were found you can either abort the operation by pressing
<escape> or selecting 'abort', or you can select continue; since no errors
were found the repair options will be set to 'no' so nothing will be repaired.
If errors were found the corresponding repair options will be set to 'yes'. If you select 'continue'
the repairs will be performed. You can enable or disable a repair option by
selecting it and pressing <enter>.
Select 'View analysis details' to display a detailed report about the errors
that were found, as displayed in the following example:
This example shows the results for a
FAT32 boot sector. This screen is slightly different when a NTFS boot sector is
displayed.
The 'View analysis details' screen shows
the boot sector. The current values are displayed and color coded to display any
errors, and the severity of the error:
| green
: |
value is correct |
| yellow
: |
value is incorrect but should
not cause the partition to be in-accessible.
yellow colored errors will not
trigger a repair |
| red
: |
value is incorrect and may
cause the partition to be in-accessible.
red colored errors will trigger
a repair |
The lower part of the window will display
details about the errors that were found (if any) in the FAT area. This will not
be displayed when a NTFS partition is analyzed.
Press any key to close this window and return to the 'Suggested repairs' window.
- Step 2: checking results and
selecting repair options
| If errors were detected and you
wish to see detailed information about the errors (in addition to the
information that is displayed in the 'View analysis details' window) before performing
repairs, you will need to look at the log file: abort the repair for now
and view the log file. Look for entries that are marked CBS (check boot
sector). |
The 'repair' menu may look like this
(small differences exist for different partition types):
Please note that the references to FAT(32) will not be displayed for NTFS
partitions, the 'Repair FAT' option will also not appear when repairing a NTFS
partition.
DiskPatch will enable the repairs that it considers to be essential; in most
cases you'll only need to select 'continue' to start the actual repairs. If
you wish to change a repair option, select it and press <enter>:
the option will toggle between yes and no.
When you are ready to continue, select 'Continue'.
- Step 3: the repair
DiskPatch will now continue with the repairs. The actions that are performed
during the repair are different for FAT, FAT32 and NTFS. FAT32 and NTFS require a little user
interaction. Repairs are explained in detail below:
- Step 3a: repairing FAT boot sectors and FAT tables for a FAT16 partition
The status window will display 'Collecting FAT data...'. This may take quite
some time. At this point DiskPatch is gathering data that is needed to rebuild
the boot sector. When that data has been collected the FAT repair phase will
start, if this option was selected. The 2 FAT tables will be synchronized if
needed. When this has finished the repair procedure is complete. DiskPatch will
display the end result for the repair; if errors occurred or if the repair could
not be completed, this will be displayed. If the repair completed without errors
this will also be displayed. Press any key to close the status window and return
to the partition list.
- Step 3b: repairing FAT boot sectors and FAT tables for a FAT32 partition
The status window will display 'Collecting FAT data...'. This may take quite
some time. At this point DiskPatch is gathering data that is needed to rebuild
the boot sector. When this phase has completed DiskPatch will continue with the
'find root cluster' phase. DiskPatch will scan the partition to find sectors
that look like they belong to the partition's root directory. If such a sector
is found it is displayed as a directory list. If the directory displayed is a
part of the partition's root then select 'Select as root cluster'.
Tips on how to identify the root
directory of a volume:
The listed directory entries have their attributes listed as well; the
column following the name contains the attribute list. There are 6
different attributes, denoted by a letter: "rhsvda".
r - listed entry is read-only
h - the entry is hidden
s - the entry is a system object (system files are sometimes protected
by this enabling this attribute)
v - the entry is the partition's volume label
d - listed entry is a directory
a - archive attribute is set
Any attribute that is not active for that particular directory entry is
not displayed: "....d." means that the entry is a directory
(the other attributes are not displayed and replaced by ".").
You can use this to identify a root directory. For example, a volume
label can only be found in a root directory, so seeing an object that
has the "v" attribute set is likely to be part of a root
directory. The volume label can also be helpful in identifying the
partition. Also system files (files with the "s" attribute
set) are usually found in a root directory; think of Windows boot files
(NTLDR, BOOT.INI) and dos boot files (IO.SYS, MSDOS.SYS), or swapfiles (PAGEFILE.SYS).
Use the objects with the "d" attribute set to identify a
volume; names like WINDOWS and PROGRA~1 are likely to be part of a root
directory. You may also see directory entries you recognize, which would
help you determine if the particular sector that is displayed is part of
the root directory you are looking for.
Looking at the dates may also help. Check for last modified dates on
files or folders that were recently created, or see if you recognize
dates: folders like WINDOWS and PROGRA~1 will have the Windows
installation date as the date that the folder was created. |
If the directory is not correct then continue the scan.
When the root cluster
has been located the FAT repair phase will start, if this option was selected.
The 2 FAT tables will be synchronized if needed. When this has finished the
repair procedure is complete. DiskPatch will display the end result for the
repair; if errors occurred or if the repair could not be completed, this will be
displayed. If the repair completed without errors this will also be displayed.
Press any key to close the status window and return to the partition list.
- Step 3c: repairing NTFS boot sectors
The first thing that needs to be determined is the cluster size for the
partition. DiskPatch can do that automatically, or you can select the cluster
size if it is known.
Selecting the cluster size manually will save some time, but you have to be
absolutely sure about the size you select; if you select the incorrect size the
MFT will not be located and the repair will fail. In general it's best to let
DiskPatch determine the cluster size automatically.
If you let DiskPatch determine the cluster size the following screen will
appear:
|
The analysis will take some time. If you feel that the cluster analyzer has
found the correct value, you can press <space> to continue the repair.
However, you should let the cluster analyzer run for at least 25 to 30 percent
of the area that is scanned (check the progress bar) before forcing the repair
to continue; the analysis algorithm needs a fair amount of data to determine the
correct cluster size. Letting the analysis run to completion will almost
guarantee a correct cluster size. |
When the cluster size has been determined
DiskPatch will attempt to locate the MFTs. This can be a lengthy process, the
entire partition needs to be searched.
| DiskPatch uses an advanced
algorithm to find MFTs and to determine which is the original and the
which is the mirror. It is possible however that DiskPatch 'gets it
wrong'. If the disk has been subjected to a lot of partition moving and
resizing, there could be several MFTs on the disk and DiskPatch could
inadvertently select the wrong MFT. This will manifest itself when you
try to access the partition; this will fail. If you suspect this to be
the case, contact DIY DataRecovery
support. Make sure to include the
correct information. |
When the MFTs have been located the
repair procedure is complete. DiskPatch will display the end result for the
repair; if errors occurred or if the repair could not be completed, this will be
displayed. If the repair completed without errors this will also be displayed.
Press any key to close the status window and return to the partition list.
After the repair
The first thing you should always do after DiskPatch has repaired a
partition, is
to verify the partition's contents using read-only methods. Under no circumstances should
you write or allow other software (for example Scandisk) to write to the
partition!
Using a boot diskette to boot the PC is a good way to ensure that no
software will automatically repair the partition. Please note that while you may be
able to access both FAT(32) type and NTFS partitions from a Linux boot diskette
or bootable CD/DVD (For example the Knoppix
CD), DOS is limited to accessing FAT(32) partitions only. To verify the
contents of a NTFS partition from DOS, we recommend the read/write driver
NTFS4DOS from Avira
(free for personal use).
If you are accessing the disk from another Windows installation, prevent Windows
from executing Scandisk or Checkdisk (if you are prompted during startup).
Verify that a normal directory structure is present. If you do not see the
directories or files you expected to see, or if you see the filenames displayed
as 'funny' ASCII characters, than this means that the internal file system structures
are damaged. You should use a file recovery tool (such as iRecover) to analyze
the partition and copy files from the partition.
|