master boot record | DataRecoveryUnion.com

Sometimes, the master boot record(MBR) on a hard disk may become corrupted as a result of installing other operating systems or through infection by a boot-block virus. When this happens, you can boot from a floppy (you must have the necessary files) and attempt to re-write the Master Boot Record (Microsoft Windows 95/98/Me/2000/XP only) by typing “FDISK /MBR” (leave out the quotes). If that doesn’t work, there are other ways to purge the MBR through the use of debug routines, SCSI low-level format routines, or the zero-fill utility in your SCSI controller BIOS. Consult your operating system vendor for assistance with this to determine if this is an operating system issue.

Or try these troubleshooting steps:

Check all cable connections.
Verify twisted-pair cable on any LVD SCSI drives.
Test the data cable by trying a different cable.
Try the cable on a known working drive.
Check the jumper settings.
Check the SCSI bus termination.
Check the host adapter card default settings.
Test the card by either trying a known good card or a known working drive.
Check host adapter settings.
Set the SCSI transfer mode to asynchronous negotiation and the transfer rate to 10MB/s (or the slowest setting).
Make the offending drive the only device in the system and re-test.
Run the “low-level” format (SCSI Format) routine if it’s provided by the host adapter manufacturer (data destructive).
Try drive in a different system to see if the same results follow.

Hard Disk Repair

Boot Sector Viruses

DATARECOVERYUNION.COM15 years ago4 years ago08 mins

Before discussing what a boot sector virus does, let’s first take a look at what a boot sector is. A floppy disk or hard drive is comprised of many segments and clusters of segments, which (in the case of a hard drive) may be separate by partitions. There has to be a way to find all the data spread across these segments, hence the boot sector operates as a virtual rendition of a library’s Dewey Decimal system. Each disk also has a Master Boot Record or (MBR) that locates and runs the first of any necessary operating system files needed to facilitate operation of the disk. When a disk is read, it first seeks the MBR, which then passes control to the boot sector, which in turn provides pertinent information regarding what is located on the disk and where it is located. The boot sector also maintains the information that identifies the type and version of the operating system the disk was formatted with.

This is a highly simplistic overview of the boot sector function, but it serves our purpose well as it underscores the critical nature of the MBR and boot sector.

Obviously, a boot sector or MBR virus that invades this space on the disk puts the entire operation of that disk at risk.

A boot sector virus is spread via infected floppy disks. This typically occurs when users inadvertently leave a floppy disk in drive A. When the system is next started, the PC will attempt to boot from the floppy. If the disk is infected with a boot sector virus, that virus will infect the boot sector of the user’s local drive (C). Unless the floppy disk happens to be a bootable system disk, the user will simply see a standard warning that the drive contains a “non-system disk or disk error” and the user will be prompted to “replace the disk and press any key when ready”.

This is a standard error message and is not in and of itself indicative of a boot sector infection. All it means is that a non-bootable disk is contained in the drive the computer is first trying to boot from.

Most users will realize a floppy has been left in the drive, remove it, and reboot the system, unaware they may have just infected their system with a boot sector virus. Of course, if the disk was bootable, they would not receive the error noted above, but will simply be booted to a DOS screen.

Care should be taken to ensure that any bootable floppies have been checked for the presence of boot sector viruses and these disks should be write-protected to ensure no future infection takes place.

Even non-bootable disks can spread a boot sector infection when they are accessed. Further, a boot sector infected hard drive will also infect any floppies used in the system. Where applicable, use write-protected floppies to protect against this.

To write-protect a floppy disk, hold it so that the metal plate is facing downwards. Along the top edge there may be an “open” square. Look closely and you will find a small cover that can be pushed back and forth over the open square. If the cover is closed, i.e. the square is covered, the disk can be written to. If the cover is open, i.e. the square is not covered, the disk cannot be written to and is considered write-protected.

Of course, you would not want to write-protect floppies you use to copy files to, as you would receive a write protection error the next time you attempted the copy.

Most of today’s PCs no longer seek out the floppy drive during bootup, instead using the CD-ROM drive as the first boot device. This can be configured via the system CMOS screen to change the boot sequence to check the hard drive first, the CD-ROM drive second, and the floppy drive third, if at all.

Changing settings in CMOS incorrectly can result in system failure and should not be attempted by inexperienced users. Instructions for accessing the CMOS configuration screen for your PC can generally be found in the motherboard manual.

The first boot sector virus was discovered in 1986. Dubbed Brain, the virus originated in Pakistan and operated in full-stealth mode, infecting 360Kb floppies.

Perhaps the most infamous of this class of viruses was the Michelangelo virus discovered in March 1991. Michelangelo was a MBR and boot sector infector with a March 6th payload overwriting critical drive sectors. Michelangelo was the first virus to attract a large amount of media focus.

Hard Disk Repair

How NTFS File System Works: NTFS Physical Structure (2)

DATARECOVERYUNION.COM15 years ago4 years ago07 mins

Partition Tables on MBR and GUID disks

Master boot record (MBR) disks use both basic volumes and dynamic volumes. Because partition tables on MBR disks support partition sizes only up to 2 terabytes, you must use dynamic volumes to create NTFS volumes over 2 terabytes. Windows Server 2003 manages dynamic volumes in a special database instead of in the partition table; therefore dynamic volumes are not subject to the 2-terabyte physical limit imposed by the partition table. Dynamic NTFS volumes can be as large as the maximum volume size supported by NTFS. Itanium-based computers that use GUID partition table (GPT) disks also support NTFS volumes larger than 2 terabytes.

Organization of an NTFS Volume

The figure Organization of an NTFS Volume illustrates how NTFS organizes structures on a volume.

Organization of an NTFS Volume

The following table describes each of the organizational structures on the NTFS volume.

NTFS Volume Components

Component	Description
NTFS Boot Sector	Contains the BIOS parameter block that stores information about the layout of the volume and the file system structures, as well as the boot code that loads Windows Server 2003.
Master File Table	Contains the information necessary to retrieve files from the NTFS partition, such as the attributes of a file.
File System Data	Stores data that is not contained within the Master File Table.
Master File Table Copy	Includes copies of the records essential for the recovery of the file system if there is a problem with the original copy.

Boot Sectors

On MBR disks, the boot sector, which is located at the first logical sector of each partition, is a critical disk structure for starting your computer. It contains executable code and the data required by the code, including information that the file system uses to access the volume. The boot sector is created when you format a volume. At the end of the boot sector is a 2-byte structure called a signature word or end of sector marker, which is always set to 0x55AA. On computers running Windows Server 2003, the boot sector on the active partition loads into memory and starts Ntldr, which loads the boot menu if multiple versions of Windows are installed, or loads the operating system if only one operating system is installed.

GUID partition table (GPT) disks are similar to MBR disks, except they use primary and backup partition structures to provide redundancy. These structures are located at the beginning and the end of the disk. GPT identifies these structures by their logical block address (LBA) rather than by their relative sectors.

A boot sector consists of the following elements:

An x86-based CPU jump instruction.
The original equipment manufacturer identification (OEM ID).
The BIOS parameter block (BPB), a data structure.
The extended BPB.
The executable boot code (or bootstrap code) that starts the operating system.

All Windows Server 2003 boot sectors contain the preceding elements regardless of the type of disk (basic disk or dynamic disk).

Components of a Boot Sector

The MBR transfers CPU execution to the boot sector, so the first three bytes of the boot sector must be valid, executable x86-based CPU instructions. This includes a jump instruction that skips the next several nonexecutable bytes.

Following the jump instruction is the 8-byte OEM ID, a string of characters that identifies the name and version number of the operating system that formatted the volume. To preserve compatibility with MS-DOS, Windows Server 2003 records “NTFS” in this field.

Note: You might also see the OEM ID “MSWIN4.0” on disks formatted by Windows 95 and “MSWIN4.1” on disks formatted by Windows 95 OEM Service Release 2 (OSR2), Windows 98, and Windows Millennium Edition. Windows Server 2003 does not use the OEM ID field in the boot sector except for verifying NTFS volumes.

Following the OEM ID is the BPB, which provides information that enables the executable boot code to locate Ntldr. The BPB always starts at the same offset, so standard parameters are in a known location. Disk size and geometry variables are encapsulated in the BPB. Because the first part of the boot sector is an x86 jump instruction, the BPB can be extended in the future by appending new information at the end. The jump instruction needs only a minor adjustment to accommodate this change. The BPB is stored in a packed (unaligned) format.

Hard Disk Repair

Hard drives greater than 2 TB do not work on existing operating systems

DATARECOVERYUNION.COM15 years ago4 years ago04 mins

External USB, eSATA, Firewire, and internal hard drives over 2 TB’s cannot be formatted on Windows 32-bit operating systems using the Master Boot Record (MBR) partitioning scheme. As a result, when you connect drives over 2 TB’s, depending on which interface you are using to connect them to the computer, they may not be recognized at all, they may be only partially recognized, or they may be recognized but you can’t access them. Other issues such as the system locking up or the computer not being able to boot may also occur.

Cause:
This not an external or internal hard drive issue. It is a 2 TB volume limitation caused by the Master Boot Record (MBR) partitioning scheme that has long been used by Windows 32-bit operating systems such us Windows 2000 and XP.

Solution:
In order to use a drive larger than 2 TB’s, you will need an operating system that can partition and format that drive. Windows Vista, Windows XP (64-bit), Mac 10.4, and Mac 10.5 all have this capability through the GUID Partitioning Table (GPT). The GUID partitioning scheme has the ability to partition both internal and external drives far beyond 2 TB’s in size.

Below are some things to keep in mind when considering the use of drives larger than 2 TB’s:

Windows 2000/XP (32-bit) has no issues with Network storage drives larger than 2 TB’s since they are accessed indirectly through the network.
Windows XP (64-bit) only recognizes external hard drives larger than 2 TB’s that are connected by USB.
You need to know in which partition scheme, MBR or GPT, your Windows Vista operating system is installed. If it’s MBR, you will still have the same issues as in Windows 2000 and XP.
Windows 2000/XP will have no problems formatting a 2 TB Raid 1 (Mirrored) drive in the MBR format. However, it will not be able to convert that 2 TB RAID 1 drive to a 4 TB RAID 0 drive.
Likewise, Windows 2000/XP will not be able to convert a 4 TB RAID 0 external drive to a 2 TB RAID 1 drive. You will need the use of a computer running Windows Vista (using a GPT partition), XP (64-bit), or Mac 10.4/10.5 to convert the drive from 4 TB RAID 0 to 2 TB RAID 1.
Windows 2000/XP will not be able to convert any 2 TB, or smaller, GUID partitioned drive to an MBR partition through Window’s Disk Management. This will require a utility, such as DLG Diagnostics, that can write zeros to the drive so it can be partitioned and formatted through Windows 2000/XP.

Hard Disk Repair

Fix MBR in Windows XP and Vista By Yourself

DATARECOVERYUNION.COM15 years ago4 years ago08 mins

What is the MBR?

A master boot record (MBR), or partition sector, is the 512-byte boot sector that is the first sector (“LBA Sector 0”) of a partitioned data storage device such as a hard disk. (The boot sector of a non-partitioned device is a Volume Boot Record. These are usually different, although it is possible to create a record that acts as both; it is called a multi boot record.) The MBR may be used for one or more of the following:

Holding a disk’s primary partition table
Bootstrapping operating systems, after the computer’s BIOS passes execution to machine code instructions contained within the MBR
Uniquely identifying individual disk media, with a 32-bit disk signature; even though it may never be used by the machine the disk is running on

If, for any reason, the MBR becomes damaged or corrupt, then the operating system will be unable to load. You will normally see error messages like:

Error loading operating system
Missing operating system
Invalid partition table

These messages are definitely not fun, especially if you are not familiar with computers. Most people would automatically assume their computers are dead! However, that’s not true. Being in IT myself, these errors are actually preferably to other types of Windows errors. Why?

Well, it’s actually fairly easy to fix the Master Boot Record in XP and Vista. All you have to do is load up the Recovery Console and run a simple command. All of your data, applications, settings, etc are still intact on the drive and once the MBR is fixed, the computer will load normally.

So how can you repair your damaged MBR?

Here are the steps to follow:

1. First, restart your computer with the Windows XP setup disk in the CD drive. If you don’t have your original disk, borrow one or download a ISO image from a torrent site.

2. When prompted, boot from the CD drive by pressing any key. If Windows loads automatically, you will first have to enter the BIOS setup and change the order of the boot devices to start with the CD drive.

3. Once the setup loads, you will see the option to press R to repair a Windows installation.

4. Once the Recovery Console loads up, you will have to type in a number that corresponds to your Windows installation. This is normally just 1. Press Enter and then type in the Administrator password.

5. Now at the prompt, type in fixmbr. Your damaged MBR will now be replaced with a new master boot record and your computer should now be able to boot properly. Note that you may also want to run the fixboot command to repair the boot sector with a new one.

Also, make sure you only use these commands on a system with one operating system installed. If you have more than one operating system installed, fixmbr and fixboot could mess up everything.

Fix MBR in Vista

In Vista, the procedure to fix the master boot record is a bit different. You have to start up Vista in the Recovery Environment and then run the bootrec command. Here’s how.

1. First, load up the Windows Vista disc in your drive and press any key to boot from the disc.

2. Choose the language, time, currency, etc and click Next. Now click on Repair Your Computer.

3. Choose the operating system to repair and click Next. When the System Recovery Options dialog comes up, choose the Command Prompt.

4. Now type bootrec.exe and press Enter. This will rebuild the boot configuration data and hopefully fix your problem. You can also run the command with switches to fix just the master boot record (/fixmbr), the boot sector (/fixboot), or rebuild the entire BCD (/rebuildbcd).

Fix MBR on Windows 7

1. Insert Win 7 installation DVD and boot from DVD drive. While in some older systems you may have to change boot order through system BIOS, most newer systems allow booting from DVD without changing boot order by simply clicking on any key when prompted to doing so.

2. Choose your default “Language”, “Time”, and “keyboard Input” on the first window and click next.

3. You’re now presented with 3 choices. Click on “Repair Your Computer” to gain access to the System Recovery window. Now choose “Command Prompt” in order to run the desired utility which is called “bootsect.exe”. Bootsect is located inside the boot folder so change your directory to boot. Now run “bootsect /nt60 C:\” if you had Win 7 initially installed in the C partition. Alternatively, you can run “bootsect /nt60 SYS” or “bootsect /nt60 ALL” to repair the system partition or all partitions. Eject the DVD, and restart computer. Your computer should now boot Win 7 again.

I can read and write from my SCSI hard disk, but I can’t boot from it