Troubleshooting hard disk problems in Windows 2000

If your hard disk fails, you can lose data or your entire system can fail. In this Daily Drill Down, Brien Posey gives you techniques for troubleshooting and repairing hard disk problems in Windows 2000.

In the world of computers, disk problems are a serious issue. A failing hard disk can mean loss of data and/or failure of an entire system. Numerous documents have been written about solving disk problems on other operating systems. However, in Windows 2000, the rules have changed. In this Daily Drill Down, I’ll examine several techniques you can use to troubleshoot and repair hard disk problems in Windows 2000.

The basics
As you probably know, many different things can cause hard disk failure. When you’re troubleshooting such a problem, it’s usually best to start with the simple and work toward the more complex techniques—unless you happen to know exactly what the problem is. The first thing you should do is disconnect the power from the computer and open the case. Check to make sure that all of the internal cables are connected tightly. You might also try reseating your expansion cards and memory modules because sometimes they can vibrate loose.

If the hard disk has never worked before, you might try double-checking the jumper settings if you’re using IDE drives. If you happen to be using SCSI drives, be sure that each drive is set to a unique identifier and that proper termination has been applied. If your SCSI drives still don’t work, try disabling the sync negotiation in the SCSI BIOS.

If your computer’s hardware seems to be configured correctly, you might try checking the BIOS. The BIOS is a small area of memory designed to store settings such as memory size and hard disk type. A dead, weak, or loose CMOS battery can cause your computer’s BIOS to lose the hard drive settings. To check this, you need to enter Setup during the early phases of power-up. On most computers, you can do this by pressing [F1], [Delete], [F10], or another key before the operating system begins loading. Once the system configuration window appears, verify that the system is set to use the correct hard disk type. If you’re in doubt, most computers are capable of auto-detecting hard drives. Simply tell the computer to redetect the hard disk.

Checking for disk corruption
If all of the hardware looks good, there’s a good chance that you may have some disk corruption. For example, it’s possible that the boot sector, master boot record, or key operating system files may be damaged.

Perhaps the easiest way to test for and repair milder cases of disk corruption is through a simple utility. To access this utility, go to Start | Programs | Administrative Tools | Computer Management. The Microsoft Management Console will load with the Computer Management snap-in. The Computer Management tool is organized into a tree structure similar to that of Windows Explorer. Navigate the tree to Computer Management (Local) | Storage | Disk Management. When you do, you’ll see a display similar to the one shown in Figure A. As you can see, the Disk Management tool resembles the Windows NT Disk Administrator program.

Figure A
You can use the Disk Management tool to perform a variety of hard disk maintenance chores.

At this point, right-click on the volume that’s giving you trouble and select the Properties command from the context menu. When you do, you’ll see the partition’s properties sheet. Begin by going to the Hardware tab. Select the physical drive that’s giving you problems and click the Troubleshoot button. Doing so will launch a wizard that’s designed to help you troubleshoot your disk problem.

If you prefer to take the direct approach, select the Tools tab. Click the Check Now button in the Tools tab’s Error Checking section to launch a graphical version of Check Disk. This program contains two check boxes. One allows you to automatically fix system errors; the other allows you to test for and automatically try to recover bad sectors. Selecting both options is a good idea, but scanning for bad sectors can take a long time.

If the Check Disk program won’t complete because of open files, or if Windows 2000 is unbootable, try running the low-level version. To do so, open a command prompt and enter
CHKDSK /r /f

This command will attempt to run Check Disk. If Check Disk doesn’t complete, Windows 2000 will run it before the full operating system loads during your next boot-up. If Windows 2000 is unbootable, the Check Disk command will still run, but you must enter it at the Recovery Console prompt.

Once the Check Disk program has run, return to the volume’s properties sheet and select the Tools tab. Then, click the Defragment Now button. Running the defragmentation utility is never a bad idea. A severely fragmented hard disk can give the illusion that it is failing, while in reality it’s just running extremely slowly.

There are some errors that are too severe for Check Disk to correct. If you had such an error and it involved the master boot record or the boot sector, relax. Later in this Daily Drill Down, I’ll show you some techniques for rebuilding these key file system components. If the master boot record and the boot sector were okay but you had a lot of corrupted files, your best bet is to format the hard disk, reload Windows 2000, and restore a backup. You can try simply reloading Windows 2000 on top of the corrupted copy. Often, you’ll recover your system and preserve your programs and settings. However, there’s no guarantee that this technique will work in all situations. Many times it will only temporarily recover the system but leave portions of the hard disk damaged and prone to a future failure.

One big source of hard disk failure is viruses. There are many different kinds of viruses that do a zillion different things. From the standpoint of hard disk failure, three types of viruses exist that you need to be aware of: executable file viruses, master boot record viruses, and boot sector viruses.

File viruses attack specific files on your hard disk. A virus that attaches itself to an executable file may prevent that file from running. However, it may also unleash a boot sector or master boot record virus along the way. Think of it as a virus within a virus.

When your computer boots up, the first thing that it accesses on the hard disk is the master boot record. A master boot record virus overwrites the original master boot record with its own code. There are several types of master boot record viruses. One kind simply destroys the master boot record, thus giving the illusion of a massive hard disk failure. Other viruses relocate the original master boot record. When the computer boots, the first thing that’s read into memory is the virus. The virus then transfers control of the computer to the original boot sector code, which has been relocated. The computer will then boot normally, giving the illusion that nothing is wrong. While the computer is running, the virus code is still in memory and is spread to any disks that come into contact with the computer.

Unfortunately, although the original master boot record code is still on the hard disk, it’s stored in a different manner from a normal file. Many viruses report the sectors that contain the original master boot record as free space. This means that eventually, the original master boot record will be overwritten during routine use, thus making the computer unbootable. Often the user assumes that the hard disk has crashed.

The boot sector is the next portion of the hard disk that’s accessed during boot-up. It contains information about your partition structure. A boot sector virus either overwrites the boot sector to make the system unbootable or moves the boot sector and leaves it unprotected and vulnerable to being overwritten, thus making the system unbootable.

When you’re treating a virus, it’s especially important to use a Windows 2000 antivirus program. Antivirus programs written for other operating systems may destroy your file system or may not know to scan files such as Bootsect.dos for boot sector viruses. As you may know, the BOOTSECT.DOS file contains a copy of the DOS boot sector and is used to boot to your previous operating system. Suppose that a system became infected while you were using your previous operating system. When you booted back to Windows 2000, an antivirus program that was intended to run under Windows NT would probably catch the virus. However, unless that program knew that Bootsect.dos was a copy of the DOS boot sector, it would never scan it for boot sector viruses, leaving the system vulnerable to re-infection the next time the old operating system was booted.

Your best bet for protecting your system against viruses is to have an antivirus program that always runs in the background on your system. I recommend Symantec’s Norton AntiVirus. However, if you’re looking for a freebie, there’s a free antivirus program on the Windows 2000 CD called AVBoot. You can find AVBoot in the \Valueadd\3rdparty\Ca_anti folder of your installation CD. Whatever antivirus program you use, just be sure to keep it updated since new viruses come out every day.

Corrupted master boot records
Whether your master boot record has been destroyed by a virus or by general corruption, you can use the same method to rebuild it. In the past, you could get rid of a master boot record virus by running the FDISK /MBR command at the command prompt. However, this command is unreliable since many viruses are smart enough to infect the FDISK.EXE file and effectively disable this command.

If you have the Recovery Console loaded, try booting to it and running the FIXMBR command. This command will rebuild a damaged master boot record. Unfortunately, the command works similarly to FDISK /MBR, so the chances of it curing a viral infection are slim. If the Recovery Console isn’t loaded on your computer, boot from the four floppies that came with Windows 2000 and use the R option to enter Repair mode followed by C to enter the Recovery Console.

If the FIXMBR command doesn’t work, you’ll have to manually reconstruct the boot sector. If your system won’t boot, you’ll have to do this through a boot disk of some sort. Once you’ve booted to a command prompt, use a tool such as Disk Probe. (I’ll talk more about Disk Probe later on.) However, since the boot sector is unique for each computer, you must have created a backup of your boot sector through Disk Probe (or a tool like it) before you can use Disk Probe to restore it. If you have a similar computer, you can always try using Disk Probe to copy the master boot record from it onto the damaged machine. There’s a very slim chance that the technique will work.

Replacing the boot sector
Replacing the boot sector is a little easier than replacing the master boot record. If you’ve used Disk Probe to back up your boot sector, just restore it. That’s the easiest method. If you haven’t backed it up, don’t give up hope. NTFS partitions maintain a backup copy of the boot sector at the end of the volume or at the center of the volume, depending on which version of Windows NT or Windows 2000 created the partition. You can use Disk Probe to locate this sector and copy it to the appropriate location on the volume. Keep in mind, though, that Disk Probe is an NT-based program. Therefore, it may be impossible to use it to cure some boot sector problems. If this is the case, you can download a DOS-based program from the Internet and use it to fix the problem.

A corrupted or missing NTLDR file can also have similar symptoms of a damaged boot sector. Therefore, before you do anything drastic, boot to the Recovery Console and check for the presence of the NTLDR file. If the file does exist, try replacing it with a known good version.

If you still have problems with the boot sector, go back to the Recovery Console and enter the command Fixboot C:, where C: is the drive with the corrupted boot sector.

Disk Probe
As you may have guessed, Disk Probe is a disk editor that’s capable of changing individual bytes of data on a hard disk. Before you attempt to use Disk Probe, there are a few things you should know. First, Disk Probe works only on basic disks, not on dynamic disks. Second, because using Disk Probe is dangerous, you should turn to it only as a last resort.
Windows 2000 supports basic and dynamic disks. Basic disks are the kind you’re probably most familiar with. A basic disk is a physical disk that contains primary partitions, extended partitions, or logical drives. Basic disks may also contain spanned volumes, mirror sets, stripe sets, and RAID-5 volumes. You should use basic disks if your computer also runs MS-DOS, Windows 9x, or Windows NT 4.0.Dynamic disks are new for Windows 2000. A dynamic disk is a physical disk that contains dynamic volumes created using Disk Management. Dynamic disks are an improvement over basic disks because they can contain an unlimited number of volumes. Basic disks are restricted to four volumes per disk. Dynamic disks don’t contain partitions or logical drives. Older Microsoft operating systems don’t support dynamic disks.
Incorrectly changing even a single value could totally disable your hard disk. Therefore, you should back up your system before attempting to use Disk Probe.

With that said—if I haven’t scared you off yet—you can install Disk Probe (which is a part of the Windows 2000 support tools) by logging on as Administrator and running the 2000RKST command from the \Support\Tools directory of your Windows 2000 CD. Doing so will launch the Windows 2000 Support Tools Setup Wizard. (There's also a Setup program in this directory, but it doesn't appear to actually do anything.) When the wizard completes, it will have installed a plethora of new tools, including Disk Probe, under the Start | Programs | Windows 2000 Support Tools | Tools menu.

Inaccessible Boot Device
Another type of hard disk problem results in a Windows 2000 Blue Screen of Death. This Blue Screen of Death error displays a stop message that indicates Inaccessible Boot Device. The error means that Windows 2000 can’t access the system partition. The error always occurs during boot-up. Unfortunately, this means that you can’t use the kernel debugger to diagnose the error, because the operating system has not yet loaded.

The most common cause of this error is installing Windows 2000 on an unsupported storage medium. If you’re upgrading from Windows NT 4, try to remember when you initially installed NT. Did you have to provide a custom disk controller driver? If so, you’ll probably also have to do so for Windows 2000. Remember that you may have to get an updated version from the hardware manufacturer.

Another common cause of this error is adding a new hard disk. In many cases, you’ll have to manually edit the Boot.ini file and point it toward the correct partition. If you have trouble doing so, remember that Boot.ini is a hidden, read-only system file that’s located in the root directory of your C drive.

Volume displays as Unknown
Occasionally, you might have a hard disk problem that causes a volume to be displayed as Unknown within the various disk management tools. Two different things can cause this: Either the master file table is corrupted or some key permissions have changed. If the master file table is corrupted, there’s probably nothing you can do to save your data.

However, if it is a permissions problem, log on locally as Administrator. Next, take ownership of all files, folders, and subfolders on the drive. Once you’ve done so, you can reset the permissions for the appropriate groups and users.

A number of different factors can cause a hard disk to fail. In this Daily Drill Down, I’ve examined some of those factors. I’ve also explained some techniques you can use to recover from the various types of hard disk failure.

Brien M. Posey is an MCSE who works as a freelance technical writer and as a network engineer for the Department of Defense. If you’d like to contact Brien, send him an e-mail. (Because of the large volume of e-mail he receives, it's impossible for him to respond to every message. However, he does read them all.)

The authors and editors have taken care in preparation of the content contained herein, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.

Editor's Picks

Free Newsletters, In your Inbox