Have you ever had a situation in which a hard disk crash caused you to lose everything on the entire drive? If so, there’s a good chance your data might have survived. Often the cause of the problem is a corrupted or missing master boot record (MBR). If you can repair the MBR, it’s often possible to recover the rest of your data. In this Daily Drill Down, I’ll discuss some techniques for recovering a failed MBR.

Before I begin
Before I get started, it’s important to point out that the MBR isn’t something that you should just play around with for kicks. Tampering with the MBR on a functional machine can often render the machine unusable. Therefore, I strongly recommend not trying any of these techniques unless your computer’s already broken.

I should also point out that none of these techniques is absolutely guaranteed to work. If your lost data is critical to the survival of your business, I recommend taking the failed hard disk to a reputable data recovery center rather than trying the techniques I offer here. Remember that as you make a change to the MBR or to another area of the hard disk, the change replaces the existing data. Doing so can make it much more difficult—if not impossible—to recover your hard disk if it turns out that the MBR turns isn’t the problem.

Anatomy of a master boot record
The MBR consists of the code that’s located on the first physical sector of a hard disk. It tells the computer how to work with the hard disk. For example, it tells the computer which partition is active, the type of partition, and the starting location on the hard disk.

The MBR is divided into five basic sections, which I’ll outline below. Each of these sections contains specific information.

The first 139 bytes are known as the jump code. The code loads the MBR into memory. This section also performs such tasks as enabling the necessary interrupts, locating the C drive, and loading the boot sector from the C drive.

The next section contains some error messages. These error messages are crammed into the next 80 bytes and indicate such conditions as an invalid partition table or a bad (or missing) operating system.

The next 227 bytes are empty. The 64 bytes that follow outline the physical characteristics of the drive. This area is known as the partition table. The partition table defines such characteristics as the:

  • Active partition
  • Starting head
  • Starting sector
  • Starting cylinder
  • Partition type
  • Ending head
  • Ending sector
  • Ending cylinder
  • Total number of sectors on the partition

Keep in mind that the partition table varies widely among different size drives, partitions, and file systems. For example, a FAT16 partition table is much different from a FAT32 partition table.

The last two bytes of the MBR indicate the MBR’s boundaries. They are essentially nothing more than an end-of-file marker.

Some basic repair information
You need to be aware of a few important rules before jumping in with both feet. I mentioned the dangers of corruption, but you should know a few other rules as well. First, don’t try any of these techniques if you’re using sector-mapping software. Sector-mapping software makes larger capacity hard drives accessible to older systems. Since this technique requires the sector-mapping software to control the MBR, you’ll make the drive totally inaccessible if you overwrite the MBR. Many of the sector-mapping programs come with special repair utilities that you can use to fix the MBR if necessary.

Another thing that you should know is that MBRs are unique. If you’re rewriting one manually, you should copy the information from a computer running the same operating system on the same size hard disk, with the same partition structure and file system.

Windows 98
Repairing a Windows 98 MBR is less complicated than repairing the MBR of some other types of operating systems. One way of making the repair is to find a disk editor program that runs from a bootable floppy disk and manually rewrite the MBR. You can use the MBR description in the previous section to get the job done if you’re using a FAT partition, or you can look up one of the many MBR charts that are floating around on the Internet.

Wherever you get your information, that’s actually the hard way of doing things. The easy way has more steps, but the steps are much simpler. Begin by going to a functional computer that’s running Windows 98 and open an MS-DOS prompt window. Next, insert a blank floppy disk in drive A and enter the following commands in the MS-DOS prompt window:

Once you’ve entered all the commands, remove the floppy disk from the drive and place it in the drive of the computer that’s not functioning. Now, reboot the computer. The computer should boot off the floppy and take you to an MS-DOS prompt. Now, enter this command:

The command will execute the FDISK command in a special access mode. As you may know, FDISK normally creates or deletes hard disk partitions. However, when run with the /MBR switch, the FDISK command merely updates the MBR. In this particular case, the MBR is updated based on the contents of the floppy disk.

Windows NT
If you are using Windows NT, you can still use the FDISK /MBR method that I discussed earlier. However, this isn’t the case if you’re using a stripe set or mirror set. If you’re using a stripe set or mirror set, you’ll have to use either the DiskSave or the DiskProbe utility. You can find both of these utilities in the Windows NT Resource Kit.

DiskProbe (Windows) and DiskSave (DOS) are utilities that allow you to directly edit the contents of your hard disk. If you use these tools carefully, you can correct such problems as a corrupted MBR. Of course, these tools will write any content that you specify to the hard disk. They don’t check to see whether the content makes sense. Therefore, you should use extreme caution when using these utilities. It’s possible to really mess up your hard disk if you aren’t careful. For example, you can corrupt the MBR (if it isn’t already corrupted), make the operating system inaccessible, or make a volume, stripe set, mirror set, and so forth inaccessible.

The upside of the two utilities is that they can be used for disaster prevention. Both utilities allow you to create a backup of various portions of your hard disk. For example, you could back up the MBR. The utilities can also be used interchangeably. Therefore, if you back up a MBR with one utility, you can restore it with the other. This is especially useful if you’d backed up the MBR through DiskProbe (the Windows-based program) but something happened to the MBR and you couldn’t access Windows. In such a situation, you could use DiskSave (the DOS-based utility) to restore your backup.

You can also get MBR information through another resource kit tool called DiskMap. This tool provides valuable information on the current state of the MBR. You can acquire this information by entering the following command at the command prompt:

Dump the contents of the report to a text file by using the >filename.ext parameter at the end of the command. If you build such a text file before having problems, you could use it to help you correct the problems. The report that DiskMap produces looks something likethis sample:

Cylinders HeadsPerCylinder SectorsPerHead BytesPerSector MediaType
 1023    16    63   512  12
TrackSize = 32256, CylinderSize = 516096, DiskSize = 527966208 (503MB)
Signature = 0x14f24efd
 StartingOffset PartitionLength StartingSector PartitionNumber
*    32256   210018816    63    1
   210051072   209534976   410256    2
   472227840   10321920   922320    3
   419618304   10289664    63    4
   429940224   8225280    63    5
   438197760   12354048    63    6
   450584064   16998912    63    7
 Starting    Ending  System Relative Total
 Cylinder Head Sector Cylinder Head Sector ID  Sector Sectors
*  0 1 1   406 15 63  0x06  63  410193
  407 0 1   812 15 63  0x07 410256  409248
  813 0 1   914 15 63  0x05 819504  102816
  915 0 1   934 15 63  0x01 922320  20160
EBR: (sector 819504)
  Starting    Ending  System Relative Total
 Cylinder Head Sector Cylinder Head Sector ID  Sector Sectors
  813 1 1   832 15 63  0x87  63  20097
  833 0 1   848 15 63  0x05  20160  16128
  0 0 0   0 0 0  0x00   0   0
  0 0 0   0 0 0  0x00   0   0
EBR: (sector 839664)
  Starting    Ending  System Relative Total
 Cylinder Head Sector Cylinder Head Sector ID  Sector Sectors
  833 1 1   848 15 63  0x01  63  16065
  849 0 1   872 15 63  0x05  36288  24192
  0 0 0   0 0 0  0x00   0   0
  0 0 0   0 0 0  0x00   0   0
EBR: (sector 855792)
  Starting    Ending  System Relative Total
 Cylinder Head Sector Cylinder Head Sector ID  Sector Sectors
  849 1 1   872 15 63  0x07  63  24129
  873 0 1   905 15 63  0x05  60480  33264
  0 0 0   0 0 0  0x00   0   0
  0 0 0   0 0 0  0x00   0   0
EBR: (sector 879984)
  Starting    Ending  System Relative Total
 Cylinder Head Sector Cylinder Head Sector ID  Sector Sectors
  873 1 1   905 15 63  0x87  63  33201
  0 0 0   0 0 0  0x00   0   0
  0 0 0   0 0 0  0x00   0   0
  0 0 0   0 0 0  0x00   0

The Windows 2000 shortcut
Repairing the Windows 2000 MBR is perhaps the easiest of all. In the Recovery Console, enter the FIXMBR command. In case you’re unfamiliar with the Recovery Console, it’s a special DOS mode that you can enter by selecting a command from the Windows 2000 boot menu (if you’ve previously installed the Recovery Console).

Unfortunately, if the MBR is corrupted, you won’t be able to access the Recovery Console through the usual method. Instead, you’ll have to create a set of Windows 2000 boot disks and use them to access the Recovery Console.

To do so, boot your PC off the Windows 2000 CD if possible. If your PC can’t boot from the CD, boot from Setup Disk 1. (If you don’t have these disks, you can create them on another computer by using the disk images that are stored on the Windows 2000 CD.) As Setup launches, you’ll be asked if you want to begin installing Windows 2000. Press [Enter] to continue. Next, Setup will ask if you want to continue installing Windows 2000 or repair an existing installation. Press the [R] key to start repairing the damaged installation. When you do, you’ll be prompted as to whether you want to repair your system using the Recovery Console or the emergency repair process. From this point, follow the prompts to install the Recovery Console. Once you’re in the Recovery Console, simply use the FIXMBR command to repair the MBR.

In this Daily Drill Down, I’ve discussed several techniques for recovering a hard disk that’s suffering from a corrupted or missing MBR. Keep in mind that none of these techniques is absolutely guaranteed to work. As I mentioned earlier, if your hard disk contains extremely critical data, I recommend taking the drive to a qualified data recovery specialist rather than attempting to salvage the data yourself.

Brien M. Posey is an MCSE who works as a freelance technical writer and as a network engineer for the Department of Defense. If you’d like to contact Brien, send him an e-mail. (Because of the large volume of e-mail he receives, it’s impossible for him to respond to every message. However, he does read them all.)

The authors and editors have taken care in preparation of the content contained herein, but make no expressed or implied warranty of any kind and assume no responsibility for errors or omissions. No liability is assumed for any damages. Always have a verified backup before making any changes.