restore MBR

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.
Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

Thanks

E

"ep" wrote:

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.

"Failed to be recognized" means that the BIOS doesn't recognize the drive
hardware. The next part of your post suggests that the drive IS recognized, but
its content cannot be accessed normally. This is quite different from a drive
that isn't recognized anymore by the BIOS.

Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

What recovery tool did you use?

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

FDISK is not the tool for restoring the MBR of a drive that has NTFS. If the
drive had just a single partition that occupied the entire drive capacity, then
you can try FIXMBR after having booted from the XP setup CD, into "restore
console". If only the MBR got damage then it may work. If not, then there are
other options to try.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

"Zvi Netiv" wrote in message
"ep" wrote:

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.

"Failed to be recognized" means that the BIOS doesn't recognize the drive
hardware.

That is what you make of it. That is the hardware part. There
is also the content part of the bios that is looking for executable
bootsectors. If it doesn't find one that can be construed as the
drive not being recognized when you know that there should be one.

The next part of your post suggests that the drive IS recognized, but
its content cannot be accessed normally.

This is quite different from a drive that isn't recognized anymore by the BIOS.

So obviously that wasn't the context in wich he
(meant to) say(d) that the drive wasn't recognized.


Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

What recovery tool did you use?

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

FDISK is not the tool for restoring the MBR of a drive that has NTFS. If
the drive had just a single partition that occupied the entire drive capacity,
then you can try FIXMBR after having booted from the XP setup CD, into
"restore console".

What would be different if it didn't have
"a single partition that occupied the entire drive capacity"?

If only the MBR got damage then it may work.

Will that restore the partiton table too or ...?

If not,

.... guess not then.

then there are other options to try.

Regards, Zvi

"Folkert Rienstra" wrote:
"Zvi Netiv" wrote in message
"ep" wrote:

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.

"Failed to be recognized" means that the BIOS doesn't recognize the drive
hardware.

That is what you make of it. That is the hardware part. There
is also the content part of the bios that is looking for executable
bootsectors. If it doesn't find one that can be construed as the
drive not being recognized when you know that there should be one.

The BIOS will recognize the presence of the drive (hardware) regardless of
whether it contains a valid / executable MBR and bootsector(s) or not. A test
for BIOS recognition is FDISK being able to see the drive.

The next part of your post suggests that the drive IS recognized, but
its content cannot be accessed normally.

This is quite different from a drive that isn't recognized anymore by the BIOS.

So obviously that wasn't the context in wich he
(meant to) say(d) that the drive wasn't recognized.

I understood what the OP meant, I was just pointing out the difference to him.

Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

What recovery tool did you use?

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

FDISK is not the tool for restoring the MBR of a drive that has NTFS. If
the drive had just a single partition that occupied the entire drive capacity,
then you can try FIXMBR after having booted from the XP setup CD, into
"restore console".

What would be different if it didn't have
"a single partition that occupied the entire drive capacity"?

If only the MBR got damage then it may work.

Will that restore the partiton table too or ...?

FIXMBR works differently than FDISK with the /MBR argument. FIXMBR will write a
default partition table if none exists or if the existing one is corrupted.
Unlike FDISK /MBR - the latter will write a default DOS partition only if the
boot signature is 00 00 rather than 55 AA.

If not,

... guess not then.

FIXMBR doesn't check for actually existing partitions before rewriting the MBR.
If the partition table is good, then it will use that data, if not, then it will
write a default partition table. Quite a good chance to fix things on first
attempt, depending on the drive configuration before the MBR was damaged.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.
Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

It looks like some people have already disagreed with what I'm about
to say but...

If you are using WindowsXP, simply clearing the MBR using "fdisk /mbr"
or "fixmbr" will allow Windows to work. I know this from first hand
experience with restoring WinXP after uninstalling Linux on dual boot
systems. However, if your drive is corrupt, that might be the least
of your problems. Or maybe your software misdiagnosed the problem.
What exactly was the problem you were having?

"Brandon" wrote:
If you are using WindowsXP, simply clearing the MBR
using "fdisk /mbr" or "fixmbr" will allow Windows to work.
I know this from first hand experience with restoring
WinXP after uninstalling Linux on dual boot systems.


What were the symptoms of disfunction after uninstalling
Linux from the dual boot system? Was it merely that the
dual boot option still presented itself at boot time?

*TimDaniels*

The drive is accessed as not being able to read from it. That is at Boot
time. I can boot from a floppy and have used EasyRecovery Professional
Trial to see I can "see" the data. However, the Trial does not let me do
that just analyze the drive. All the reports say it is OK with the
exception that the MBR is bad.

Does that help understand why I want to do this?

Last, how can I use "fixmbr" from a floppy? I have found reference to this,
but no specifics.

P.S. I do not want to write to the disk because it has data I need on it.
I also am trying to do all I can before resorting to sending it to a
recovery house (and the large expense of a 40G drive that was, as I recall,
over 70% full - not all data but that full).

Thanks
E
"Brandon" wrote in message
m...
I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by
the
way) without problems. Then all of a sudden it failed to be recognized.
Using some demo recovery tools to find out what was wrong, it said the
data
was there but the MBR was damaged.

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

It looks like some people have already disagreed with what I'm about
to say but...

If you are using WindowsXP, simply clearing the MBR using "fdisk /mbr"
or "fixmbr" will allow Windows to work. I know this from first hand
experience with restoring WinXP after uninstalling Linux on dual boot
systems. However, if your drive is corrupt, that might be the least
of your problems. Or maybe your software misdiagnosed the problem.
What exactly was the problem you were having?

"Zvi Netiv" wrote in message
"Folkert Rienstra" wrote:
"Zvi Netiv" wrote in message
"ep" wrote:

I have a drive that has been diagnosed as having a corrupted/missing MBR
(master boot record).

This drive was being used for about 3 months (it is a laptop drive, by the
way) without problems. Then all of a sudden it failed to be recognized.

"Failed to be recognized" means that the BIOS doesn't recognize the drive
hardware.

That is what you make of it. That is the hardware part. There
is also the content part of the bios that is looking for executable
bootsectors. If it doesn't find one, that can be construed as the
drive not being recognized when you know that there should be one.

The BIOS will recognize the presence of the drive (hardware) regardless
of whether it contains a valid / executable MBR and bootsector(s) or not.

Yes, no one contents that.
He said it failed to be recognized without saying what 'it' was or what it was
that didn't 'recognize' it. 'It' and 'not recognized' therefor can be several things.

A test for BIOS recognition is FDISK being able to see the drive.

It is stil possible that a drive is (hardware) recognized by POST but not by
FDISK but then that would be of ones own doing (bios setup).


The next part of your post suggests that the drive IS recognized, but
its content cannot be accessed normally.

This is quite different from a drive that isn't recognized anymore by the BIOS.

So obviously that wasn't the context in wich he
(meant to) say(d) that the drive wasn't recognized.

I understood what the OP meant, I was just pointing out the difference to him.

Well, "content cannot be accessed normally" is quite vague in pointing out a 'difference'.
To all intends and purposes it could actually mean the same thing as 'not recognized by bios'.


Using some demo recovery tools to find out what was wrong, it said the data
was there but the MBR was damaged.

What recovery tool did you use?

Now, can I just use fdisk /mbr to restore it? Or does NTFS and/or XP do
something different? If not, does it matter what DOS version I use fdisk
from?

FDISK is not the tool for restoring the MBR of a drive that has NTFS. If
the drive had just a single partition that occupied the entire drive capacity,
then you can try FIXMBR after having booted from the XP setup CD, into
"restore console".

What would be different if it didn't have
"a single partition that occupied the entire drive capacity"?

[...]


If only the MBR got damage then it may work.

Will that restore the partiton table too or ...?

FIXMBR works differently than 'FDISK with the /MBR argument'. FIXMBR will
write a default partition table if none exists or if the existing one is corrupted.
Unlike FDISK /MBR - the latter will write a default DOS partition only if the
boot signature is 00 00 rather than 55 AA.

Something seems amiss with that.
Presumably that is to read as :
Unlike FIXMBR, FDISK /MBR will write a default DOS par-
tition only if the boot signature is 00 00 rather than 55 AA.

What if the signature bytes are neither?


If not,

... guess not then.

FIXMBR doesn't check for actually existing partitions before rewriting the MBR.
If the partition table is good, then it will use that data, if not, then it will
write a default partition table.

Quite a good chance to fix things on first attempt, depending
on the drive configuration before the MBR was damaged.

MBR's don't get damaged, they get overwritten completely.
There are two possibilities: It gets overwritten with garbage by a programming
error, destructive virus or crash, or it gets manipulated by a virus or partitioning
software (overlays included) or fix that reads it, changes it, and writes it back.
So FIXMBR and MBR/FIX only work successfully on the latter case.

Q:How big a chance that it will overwrite the existing but slightly unconventional
partition table that nonetheless still works? Or in other words, do you know what
it checks to determine whether the table is good? Are there risks of loosing it?


Regards, Zvi

"Folkert Rienstra" wrote:
"Zvi Netiv" wrote in message

[...]
A test for BIOS recognition is FDISK being able to see the drive.

It is stil possible that a drive is (hardware) recognized by POST but not by
FDISK but then that would be of ones own doing (bios setup).

It's possible that POST (the BIOS) will appear to detect the drive but FDISK
when run will return "no hard drive found". A closer inspection of the drive
parameter in the setup will show erratic data for the drive. This is a rare
hardware mode of failure. Setting the wrong parameters in the BIOS setup will
result in FDISK finding the drive, but with erratic configuration. FDISK
finding the drive (not necessarily with correct drive parameters) is a reliable
indicator whether the BIOS "sees" the drive or not.

[...]
FIXMBR works differently than 'FDISK with the /MBR argument'. FIXMBR will
write a default partition table if none exists or if the existing one is corrupted.
Unlike FDISK /MBR - the latter will write a default DOS partition only if the
boot signature is 00 00 rather than 55 AA.

Something seems amiss with that.
Presumably that is to read as :
Unlike FIXMBR, FDISK /MBR will write a default DOS par-
tition only if the boot signature is 00 00 rather than 55 AA.

That's better, and correct.

What if the signature bytes are neither?

FDISK /MBR will then leave the partition data as is, and correct the signature
to 55 AA. The only case where FDISK will write a new partition table is when
the signature is zero.

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities

"ep" wrote:

The drive is accessed as not being able to read from it. That is at Boot
time. I can boot from a floppy and have used EasyRecovery Professional
Trial to see I can "see" the data. However, the Trial does not let me do
that just analyze the drive. All the reports say it is OK with the
exception that the MBR is bad.

So you have a positive indication that only the MBR is bad.

Does that help understand why I want to do this?

Last, how can I use "fixmbr" from a floppy? I have found reference to this,
but no specifics.

You need to boot from your XP setup CD (you may need to change the boot device
order to CDROM as first), and select "repair" mode. When at the command prompt,
simply type FIXMBR and then Enter.

P.S. I do not want to write to the disk because it has data I need on it.
I also am trying to do all I can before resorting to sending it to a
recovery house (and the large expense of a 40G drive that was, as I recall,
over 70% full - not all data but that full).

If you want to play it safe, then you may clone the entire drive to another one
and work on the clone. This way you don't ruin your chances to give it out to a
recovery house (expect at least a 1,000 $ price tag for professional recovery).
For cloning software, check CloneDisk from www.resq.co.il/resq.php

Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities