Partition Table and Boot Sector repair with ByteBack D.R.I.S.^TM

Repairing the MBR, partition Tables and Boot Sectors.

By repairing disk structures such as the MBR, partition tables and boot sectors ByteBack D.R.I.S.^TM can help restore access to data that you have lost access to, due to damage to those disk structures. Data loss due to damaged partition tables and boot sectors is very common. Since ByteBack D.R.I.S.^TM will modify (patch) your disk's contents it is more then convenient to be able to undo modifications made by ByteBack D.R.I.S.^TM. ByteBack D.R.I.S.^TM provides an advanced undo feature allowing you to 'roll back' modifications that were made during the automatic recovery. To create undo files, no user intervention is required. The only prerequisite is that ByteBack D.R.I.S.^TM needs write access to a drive to store the undo files on; this is usually the ByteBack D.R.I.S.^TM Bootdiskette. For restoring undo files follow the instructions here.

Important! If there are indications that the disk is physically failing or if bad sectors are preventing repairs, you're advised to clone the disk prior to making any repairs. For example, if the MBR is bad and can not written to it is impossible to repair the primary partition tables (who's description is located in the MBR). After you have cloned the disk, partition table repair can be performed on the clone.

Performing Data Recovery by repairing damaged MBR, Partition Table and Boot Sector structures is a straightforward, 4 step process:

1. Select the physical disk (Select the disk that should be scanned)
2. Disk Analysis (No user intervention required)
3. Partition Selection (Select the partitions that should be recovered)
4. Repair phase (No user intervention required)

Disk Analysis

During the disk analysis ByteBack D.R.I.S.^TM will scan the disk for 'significant sectors'; sectors containing information or patterns that can be used to detect partitions, and that can be used to rebuild damaged disk structures during the repair phase. Intelligent search techniques and heuristics are applied to scan the disk in the fastest and most effective manner possible. 

To start scanning the selected disk select [Analyze Disk & Repair] from the main menu. You must now define the area that ByteBack D.R.I.S.^TM will scan: by leaving the default values as they are, ByteBack D.R.I.S.^TM will scan the entire hard disk (recommended).

The disk scan can be aborted at any time by pressing the <ESC> key, no other user intervention is required during the actual disk scan. During the scan the following information display items are updated at regular intervals:

1. ItemsFound (status window): the number of significant sectors found so far.
2. The Progress Bar (bottom screen).
3. TimeRemain (status window): the estimated time remaining needed to complete the disk scan in minutes:seconds.

It is advised to complete the entire scan! Making repairs on a disk that was only partially scanned can lead to undesired results.


Partition Selection

Important! If the disk is a Windows XP/2000 Dynamic disk continue here.

ByteBack D.R.I.S.^TM will now display a list of partitions that were found. To identify the partitions you want to recover it is important you have some idea of the file system, the starting position and the size of the partition(s). Often only the partitions you expect to be present will be listed, but it is possible that more partitions than expected are displayed. 

For each partition the following information is listed:

Note: Please note that even when ByteBack D.R.I.S.^TM estimates it can recover a partition (fair/good), this is not a guarantee that the partition can be accessed after recovery. Corruption of file system components that are not examined or fixed by ByteBack D.R.I.S.^TM may prevent the partition from being accessible.

Use the [UP] and [DOWN] Arrow keys to move up and down through the partition list. 

Press [ENTER] to display the submenu which can be used to select the partition, or to view more information about the selected partition. The following options are available:

[Select Partition] to select a partition for recovery. The partition is now added to the list below the partition list ('Selected Partition' List). Please note that the sequence number ('SEQ') that identifies the partition in the top window, stays the same as the partition is displayed in the lower window: the sequence number always identifies partitions based on the main list in the top window.

Important! Select ALL partitions that you want to be present after the recovery: so, also select those that you currently have access to; ByteBack D.R.I.S.^TM always rebuilds the entire partition table chain.

[Deselect Partition] will remove the selected partition from the Selected Partition section.

[Show Info] will show additional information on the selected partition. 

Hint: Volume labels can help you identify partitions. Also, if ByteBack D.R.I.S.^TM is able to display the Volume Label for an NTFS partition than this is a good indication that the file system is intact. To determine the volume label for an NTFS partition, ByteBack D.R.I.S.^TM must interpret the boot sector and the MFT entry for the meta file "$Volume". Being able to display the volume label indicates that the boot sector and the location and start of the MFT are correct and intact!

[View Associated Sectors] will display HEX dumps of all significant sectors that ByteBack D.R.I.S.^TM linked to this specific partition. The number of items found is related to the recovery possibilities for a partition; the more items were found for a partition, the more accurate the data, the better the recovery results may be. The item numbers displayed in the top right corner of the hex dump windows, correspond with the item numbers as they are displayed in the Disk Editor.

The line at the top of the 'view associated sectors' screens contains extra information about the sectors you are viewing:
 [ View sector 0 on disk 0 (128), itemtype PTE, itemno. 1 ] 

• Sector number: the LBA location on the disk of the sector that is displayed.
• Itemtype: the type of sector found; PTE for partition Table / BS for BootSector / BBS for Backup BootSector / F8FF for FAT sector.
• Itemno: the number of the item in the list of found sectors. This number corresponds to the number used in the DiskEditor when the the "[" and "]" keys are used to browse through the list of sectors found.

Tips for picking the right partitions: If more partitions are displayed than you expected to show up, it is up to you to pick the right ones. More partitions being displayed than expected can be caused by the fact that a disk was re-partitioned; most partitioning tools do not 'clean up' after you used them to delete a partition, they simply remove the partition from the partition tables. The remains of these deleted partitions may be detected by ByteBack D.R.I.S.^TM even when new partitions were created later.

• Intact partitions (partitions that are linked to an intact boot sector and an intact partition table entry) are normally marked '#' in the 'RAT' column. This can help you to identify intact partitions (as those need to be selected as well if you're for example only recovering one deleted partition while the disk contained multiple partitions).
  
  
• Volume labels can help you identify partitions. Also, if ByteBack D.R.I.S.^TM is able to display the Volume Label for an NTFS partition than this is a good indication that the file system is intact. To determine the volume label for an NTFS partition, ByteBack D.R.I.S.^TM must interpret the boot sector, and access and interpret the $MFT to find the "$Volume" file. So being able to display the volume label indicates that the boot sector, implies that the location and start of the $MFT are correct and intact!
  
  
• *Normally* a partition starts where the previous partition ended. Also partitions don't overlap and there usually are no gaps in between separate partitions. By examining the start and the ending positions you can determine which is likely to be following the previous selected partition.
  
  If for example the first partition starts at 0 Gb and ends at 9.77 Gb, the next partition normally starts at the location at 9.77 Gb. Then for that partition determine the end position in Gb to find the start location in Gb for the next probable partition etc..
  
  Once you have selected a partition, ByteBack D.R.I.S.^TM will automatically identify partitions that become candidates for selection without overlaps, by putting an arrow next to the partition sequence numbers. These marked partitions are the most likely candidates for recovery, based on the assumption that the first partition that was selected, is the correct first partition. Please note that the markers are pointing out the most likely candidates, this doesn't mean that the markers are always right.
  
  ByteBack D.R.I.S.^TM will not allow you to perform the repairs as long as partitions are selected that overlap other partitions: In the 'ERR' column in the lower window the partitions affected by overlaps are marked 'YES'. If you select [Show Info] for that partition the error type will be shown.
  If you need to recover the data from the partitions that are overlapping, first recover only one partition. Then access it and salvage data by copying it to another drive. During a next repair session skip the previously selected partition and recover the one overlapping it.
  
  

• You can use the Partition Map for a visual representation of the detected partitions (max. 32). The Partition Map displays the approximate locations for the partitions on the disk. This allows you to quickly spot if partitions for example overlap each other.

  
Note that under certain circumstances partitions may appear to overlap even if they do not in reality.

Once you have selected your partitions, press <ESC> and select [Continue to Repair]. ByteBack D.R.I.S.^TM will now start the repairs. Before the repairs are performed, an Undo File will be created. If an undo archive already exists, ByteBack D.R.I.S.^TM will inform you of this. You can then abort the operation, or proceed and have ByteBack D.R.I.S.^TM create a new undo archive. At this point the previous undo information is no longer available.

Repair Phase

During the actual repairs no user intervention is required. ByteBack D.R.I.S.^TM will now create and fix:

• A primary partition table in sector 0 (the MBR). A primary partition table is always created during the repair.

• Extended Partition Boot Records (EPBR). The location varies and depends on the locations of logical partitions. EPBRs are only created when logical partitions were selected for recovery.

• Boot Sectors. Every partition's first sector contains important meta information that describes file system structures within the partition. ByteBack D.R.I.S.^TM only attempts to fix boot sectors if there are indications that an original boot sector is damaged.

After the repair

The first thing you should always do after ByteBack D.R.I.S.^TM has repaired a disk, is to verify the disk's contents using read-only methods. Under no circumstances should you write or allow other software (for example Scandisk) to write to the disk! You can not boot from the repaired disk because ByteBack D.R.I.S.^TM (purposely) does not set an active partition.

Using a boot diskette to boot the PC from is a good way to ensure that no software will automatically repair the disk. Please note that while you may be able to access both FAT(32) type and NTFS partitions from a Linux boot diskette or bootable CD-ROM (For example the Knoppix CD-ROM), DOS is limited to accessing FAT(32) partitions only. To verify the contents of an NTFS partition from DOS, we recommend the (freeware) read-only NTFS driver NTFSDOS from http://www.sysinternals.com or the read/write driver NTFS4DOS from http://www.datapol.de (also free for personal use). 

If you are accessing the disk from another Windows installation, prevent Windows from executing Scandisk or Checkdisk (if you are prompted during startup).

Verify that a normal directory structure is present. If you do not see the directories or files you expected to see, or if you see the filenames displayed as 'funny' ASCII characters, this means that the internal filesystem structures are damaged. The fact that you don't see the correct filenames could be a result of you picking the wrong partitions, so verify your choices and if necessary undo the last repairs and try again.

Additional steps

After you have verified the disk and found it to be okay, you can use ByteBack D.R.I.S.^TM to set an active partition so you can attempt to boot from the repaired disk. Select [MBR Operations] > [Change Partition Attributes] >Select the partition you want to boot from > Select [Activate].

There is a chance that apart from the partition tables, the boot code in the MBR was damaged. You can use ByteBack D.R.I.S.^TM to write a standard boot loader to the MBR that is capable of booting any Windows or DOS based operating system for the PC platform. To do so select [MBR Operations] > [Refresh BootCode]. Note: the bootcode that is saved to the MBR during this operation is not LINUX compatible or -aware.