| Author | Message | ||
     gorgans hole (Gorgans) |
Hi, i have a 60gb hard drive formatted with ntfs running win xp on one partition. this hard drive stop booting up after a crash, i tried to reinstall windows but windows says that i have an unformatted partition and offered to format the hd. i have data on this drive that i need to recover. i have tried fdisk/mbr i also tried fixboot command in recovery console of win xp. i need to recover the boot sector of this hard disk. i know that windows stores a backup of the ntfs boot sector but i don't know how to do this. can winhex recover my boot sector? how do i do it? | ||
| Stefan Fleischmann (Admin) |
As far as I know, usually there is a backup of an NTFS boot sector somewhere directly after the end of the partition. So you could open the physical disk and copy it back over the actual boot sector (sector 63, if the first partition). | ||
| gorgans hole (Gorgans) |
can yu tell me how to find the backup ntfs boot sector? | ||
| Stefan Fleischmann (Admin) |
Open the physical hard disk. In the Access button menu, select "Surplus sectors". Somewhere there you should find the backup boot sector. Or look at the MBR and find out the length of the partition in sectors. That way you can find the end of the partition as well. | ||
| Stormer |
hi i read this msg because i have the same problem, but there is nothing in my surplus sectors  | ||
| ntfsguru |
It's doubtful it would be in the "surplus sectors" area. When the partition containing NTFS was made, it probably did not size the partition to extend into "surplus sectors." The partition programs from mickeysoft are conservative (or paranoid) and don't go there. NTFS since NT 4.0 writes the backup boot sector as the last sector of the partition. (NT 3.51 and before placed it at the midpoint of the partition.) The first line of the boot sector (for NTFS) should look like this: 000000000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 ëRNTFS ..... Pretty easy to identify, right? Toward the end of the sector will be readable text, similar to this (from NT 4.0 SP6) Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000130 07 00 CD 10 EB F2 C3 1D 00 41 20 64 69 73 6B 20 ..Í.ëòÃ..A disk 00000140 72 65 61 64 20 65 72 72 6F 72 20 6F 63 63 75 72 read error occur 00000150 72 65 64 2E 0D 0A 00 29 00 41 20 6B 65 72 6E 65 red....).A kerne 00000160 6C 20 66 69 6C 65 20 69 73 20 6D 69 73 73 69 6E l file is missin 00000170 67 20 66 72 6F 6D 20 74 68 65 20 64 69 73 6B 2E g from the disk. 00000180 0D 0A 00 25 00 41 20 6B 65 72 6E 65 6C 20 66 69 ...%.A kernel fi 00000190 6C 65 20 69 73 20 74 6F 6F 20 64 69 73 63 6F 6E le is too discon 000001A0 74 69 67 75 6F 75 73 2E 0D 0A 00 33 00 49 6E 73 tiguous....3.Ins 000001B0 65 72 74 20 61 20 73 79 73 74 65 6D 20 64 69 73 ert a system dis 000001C0 6B 65 74 74 65 20 61 6E 64 20 72 65 73 74 61 72 kette and restar 000001D0 74 0D 0A 74 68 65 20 73 79 73 74 65 6D 2E 0D 0A t..the system... 000001E0 00 17 00 5C 4E 54 4C 44 52 20 69 73 20 63 6F 6D ...\NTLDR is com 000001F0 70 72 65 73 73 65 64 2E 0D 0A 00 00 00 00 55 AA pressed.......Uª To find both boot sectors: 1. Open the physical hard drive 2. Press the Access button (above the ascii display of the sector) and you should see something like Partition 1 (503 MB, FAT16) > Partition 2 (36 GB, NTFS) > ... 3. Select the correct partition and choose Open. 4. The first sector of this window is the boot sector. The last should be the backup boot sector. Before copying the backup boot sector to the first, be sure the partition table wasn't corrupted. Inspection of the physical drive with the MBR template and a memory of how the drive was partitioned should be enough in most cases. If you have no idea how it was partitioned before, look carefully at the entries to be sure they don't overlap, don't extend past the end of the drive or have excessive gaps between them. It is *not* a requirement that the partition entries are in a logical order. | ||
| Stefan Fleischmann (Admin) |
> It's doubtful it would be in the "surplus > sectors" area. When the partition containing > NTFS was made, it probably did not size the > partition to extend into "surplus sectors." When you select "Surplus sectors" in the Access button menu, you get to the first surplus sector. So if the partition utilizes all disk space except the surplus sectors, the backup boot sector is somewhere around the beginning of the surplus sector area, e.g. a few sectors before. | ||
| Stormer |
(sorry for my bad english) yeah my partition table is corrupted and i have no idea how it was partitioned before the boot sector is not an important thing, we can boot up with a boot disk where is copied ntldr boot.ini and ntdetect.com ... but if the mbr is corrupted the pc won't boot even with a boot disk, that's my problem ... |