FREE NTFS Partition Repair Data Recovery Software

Hey Everyone! Thanks for all the positive emails and phone calls. One email from Jim L in Dallas Texas asks: “you talk about partition repair, but the software doesn’t actually repair the partition, it recovers files from it. Is there anything out there that does repair partitions?” Well Jim while most people are happy to just get their data back from a damaged partition, we do have a tool for those brave souls that want to actually REPAIR a partition.

Dick Correa our chief programmer was kind enough to release a tool he created that does in fact REPAIR NTFS partitions. This software is free to our readers and can be gotten off of our website. The link is at the bottom of this post. Keep in mind that DTI is not responsible for any data lost from misuse of this tool. It is extremely powerful. Now that the lawers are happy, here is Dick’s post:

NTFS Partition Recovery with Free Partition RecoveryAll things must start somewhere, when it comes to operating systems’; the partition sector is the single most important component in the boot sequence. When the partition sector is missing, corrupt, or set up improperly it can wreak havoc with the booting of your operating system. The partition sector is vulnerable to virus attacks, operating system anomalies, bad sector reads, and an ever increasing set of tools, fdisk included, that when used incorrectly can and will totally destroy an operating systems boot sequence.

In order to more clearly understand how the partition sector fits into the boot sequence, the following is a standard garden variety boot up.

When you turn on your computer several things happen. The first of which is the BIOS (Basic Input Output System) is executed by the CPU (Central Processing Unit). The CPU knows to load the BIOS on power up as there is a flag set at power on. The BIOS then jumps to a set of routines that will execute the POST (Power On Self Test). The POST will look at memory, some peripheral devices, and do some other house keeping procedures. The most important of these is determining the boot device. The boot device is stored in non-volatile read/write memory. If the boot device is set to a hard drive, then an industry standard interrupt 0×19 is called. This routine loads the first 512 bytes of the boot device, which in this case the hard drive, into memory location 0×7C00. The 512 bytes is a standard sector size. It then jumps to that address (0×7C00) and executes whatever it finds there.

If all goes well, the set of instructions executed will look at the partition entry data. The partition entry data is used to determine which partition is the boot partition. If it finds a boot partition in the partition entry list the instructions will then load a secondary set of instructions which the partition entry has pointed to. In the case of Windows the OS (Operating System) pre loader is now loading itself into memory. This type of OS loader is called a two phase loader and is very common. Take a look at the table below to help better understand the role of the partition sector entry data.

The format of a partition sector entry is as follows:
1.) Byte 1 Boot Partition Indicator (0×80 is bootable, 0×00 is not)

2.) Byte 2 Starting Head of the partition (255 or less)

3.) Byte 3-4 Starting Sector and Cylinder of the partition
This is set up as 10 bits for the Cylinder and
6 bits for the Sector (Sector Max 63, Cylinders Max 1024)

4.) Byte 5 File System Type (NTFS, FAT32 etc)

5.) Byte 6 Ending Head of the partition (255 or less)

6.) Byte 7-8 Ending Sector and Cylinder of the partition
This is set up as 10 bits for the Cylinder and
6 bits for the Sector (Sector Max 63, Cylinders Max 1024)

7.) Bytes 9 -12 Relative Sector to the partition sector. In other
words, where the actual partition starts.

8.) Bytes 13-16 Total sectors for this partition.

If any of this data is outside the stated parameters the partition will fail and consequently the boot sequence will stop. In order to clearly understand what happens when the partition sector is corrupt or damaged, the following is a list of scenarios.1. Boot Failure: System Halted
An error message that comes from the BIOS. Certain BIOS versions, especially the most recent revisions, take a look at the partition sector. The BIOS will perform some preliminary tests and one of the tests is the Partition Identifier. At the end of every partition sector is the value 0xAA55. If this indicator is missing then the BIOS assumes that this is not a partition sector and the aforementioned error message will be issued.

2. System reboots over and over
Although this is not an error message, it can happen if the relative sectors point to an invalid OS pre loader. A trap is set and if the data that is loaded is not executable machine most BIOS’s will reboot.

3. Invalid Partition Table
This error message comes from the partition boot code. If there are no boot devices then the boot code will enter an infinite loop after this message is displayed.

4. Error Loading Operating System
After a valid partition is found the LBA sector pointed to by the partition entry table will be loaded using INT 13. This is the operating system loader. If the code cannot be loaded into memory then the above message is normally displayed.

5. Missing Operating System
Once the operating system boot code is loaded it is checked for the 0xAA55 identifier in the same manner that the partition sector is tested. If this test fails, then the above message will be displayed.

Over the years the BIOS writers have gotten smarter, personal computer as well as operating system standards have been set and are normally followed. So many of the messages, as well as error checking is now handled by the BIOS. The messages I have mentioned are just a few, but, are very common; however, from BIOS to BIOS the messages as well as the error handling can differ greatly.

As you can clearly see the partition sector is of primary importance in the boot sequence. Without it nothing happens. In the future there may be ways to overcome the use of a partition sector, one would be to store the partition entry data in the BIOS, this would eliminate boot sector viruses as well as the possibility that the boot sector goes bad and becomes unreadable. However for now, we will work with what we have. The next segment will discuss how to do partition recovery using a simple piece of software.

How To Use The Software

Free Partition Recovery is an extremely powerful tool for anyone to use but this statement must be caveated with the fact that with power comes a degree of responsibility. In other words, use this tool with extreme caution as it can destroy your file system to the point of massive and possibly permanent data loss. That being said lets take a look at how we can put this tool to good use.

First, the software should be run from a master drive. There should be two drives in the system, your boot drive from where the software is executed, and the damaged drive. The damaged drive being the one with the corrupt or missing partition. Free Partition Recovery is designed to work on Windows XP type operating systems, so make sure that you have unzipped the file onto that type of operating system.

Once the Free Partition Recovery has been executed you will see in Figure 1.

Figure 1

The top row displays all the physical drives currently active in your system. This will also include any external devices that can be mounted as a physical block device. An example of this would be the 80 GB Maxtor USB device. Once you choose a physical drive all partition entry data will be displayed as in Figure 2.

Figure 2

The partition entry data for this particular drive gives us a clear example of a drive that has been configured with one NTFS logical drive with the standard offset of 63 sectors, start head and sector of 1 and ending cylinder of 1023. These are classic values for a normal single logical drive setup.
The other three entries are clear and not in use. These entries will be ignored by the OS loader. There is one other important item in this configuration. On the far left of Figure 2 of the first partition entry is the boot flag “No”. This indicates that this partition is ‘Not Bootable’. You can change that value buy using the drop down list (Figure 3)

Figure 3

 

Once you have configured all of the partition entries to reflect the correct values all you need do is press the “Write” button. You will be presented with the following message box in Figure 4. A word of caution, once you write the data down to the partition sector, you must live with it. Please exhibit extreme caution.

Figure 4

Hopefully this information as well as the software will help you recover your data. If you have any questions email support@dtidata.com or call 727-345-9665 Ext 236.

You can download the free NTFS partition repair software here. For more info about data recovery visit our home page.

Data Recovery Truth And Consequence

I have been getting a lot of emails about my recent post: Data Recovery Experts: Why Use Them? Most people want to know how to tell if a data recovery company is a “real” company with a clean room, or a reseller, that is going to look at the drive, see if it is a Fed-Ex fix, then up sell it to one of their vendors.

I would get into serious trouble if I were to list the all the BS companies out there, that is a fact. However; I can tell you about some real companies and how they differ to us. I am not going to sit here and go on and on about how rocking DTI is. We are a real data recovery company, we have a class 100 clean room, and we develop all our software in house. We don’t outsource ANYTHING, EVER! We answer our own phones as much as humanly possible. Here is a link to my data recovery software blog, with pictures of everyone. We are a relatively small (24 employees) company that does a big job.

Now on to the stuff that is going to get me in trouble : )

If you look at the top tier data recovery companies, and we all know who they are, they are what some believe to be the cream of the crop. They run a factory line recovery shop. They bait you with a range of prices, and if it is at all a difficult recovery, they are going to call you and bump the price up to 3 or 4 GRAND. I know this, since we have a bunch of their drives in the lab, and almost always have 1 or 2 sent in from people unwilling to pay. I am not saying they stink or are ripping you off, they just play the numbers game. (I recall one time being told “that if enough crap was thrown against the wall, some of it will stick” by the owner of a prominent data recovery company whose model is to charge a $150.00 per drive, “bench” or “evaluation” fee. Type my name into Google and you will see me referenced as their CIO. This is a common attitude out there.)

Now when you look at one of the oldest data recovery companies, they used to be the best, they were the creme de la creme, what everyone strived to be. Once they were bought out, their recovery rate dwindled. The drop off was so significant, that a lot of the top people left that company, I know because we are partnered with some of them that went off and started their own thing.

Now on to another front, recently one hard drive maker acquired another major hard drive maker. OK I can relate, maybe now their drives will actually get even better; however now they go out and buy a data recovery company. Huh? OK say I am a customer that just bought some drives, they fail, now I have to pay 3 grand to get my data back? That seems fishy to me.

The thing about these “big boys” is name recognition. Are Calvin Klines better than Wrangler? No, but they sure cost twice as much. You are paying for the name, nothing more, nothing less. There are no magical machines or proprietary technologies that one company has over the other. Data recovery is not rocket science, but it is all about research and development.

So we are ruling out the big boys who charge the big bucks. That leaves us with the hundreds of middle ground data recovery companies out there, and a few bad apples that think they can do data recovery for $199 or $399. What garbage. One air filter for a class 100 clean room is $850 and we need 4 a month to retain class 100 status. Forget about the parts. What are they a charity? Hard drive manufacturers don’t “give” us replacement parts, we have to buy whole hard drives on the secondary market. We have 1 employee and his assistant that do NOTHING but source parts all day every day. With the advent of large capacity drives, and constant revisions, one Western Digital model had 12 revisions in 1 year. That means that the board, heads, and code on the platters are all different, and they are NOT interchangeable. OK so forget about those bargain basement companies, we all know that you get what you pay for. In fact we constantly get in drives that have already been opened somewhere else. 90% of them have been opened outside of a clean room. We had to start a new program just for clients who sent their drives to one of these bargain basement companies only to be told it was “unrecoverable”. Read more about our “Adaptive Logic” process.

That points us once again to the middle ground. I read somewhere that 60% of all data recovery companies on the Internet are resellers. I would put that number closer to 90%, hell we have thousands of resellers ourselves. So where does that leave us? If your drive crashes; do your research into where you are going to send it. Don’t bother with companies that give a range, cause it will always be the high side. Forget about diagnostic or bench fees, all the good companies are no data no charge. We have a lot of competitors, but few equals. One of our real rivals went as far as to put a webcam in their lab to prove they have a clean room. Now that is cool.

Even though we are only 1 day a way Fed-Ex most people would prefer a regional company. The problem is if you aren’t in FL, TX, or Southern CA, UT, MN, IL, upstate NY, GA, or WA, there are NO local companies. Choose wisely, mapquest them, if they are off the beaten track they are probably working out of their garage. Don’t laugh I did it myself with Data Recovery Clinic and Exchange Recovery Clinic. I got drives in and sent them to DTI, took my share and moved on to the next. It is business, we tried to start a clean room and do it right, and even with a lot of backing, my partner and I couldn’t keep up with the changes in hard drives. DTI has 3 or 4 guys that do nothing but get new drives and break them to see how to fix and recover data from them. That’s what data recovery is: research and development, every day.

The fact is hard drives fail. It isn’t because the manufacturers are trying to rip us off, it is just a fact. Dick Correa our chief data recovery software engineer recently wrote an article about “hard drive bad sectors, how to recover data from them“, which explains in detail about the challenges hard drive manufacturers face. They even have a name for it: Mean Time Before Failure. That is the “mean” not the average of when your drive WILL fail. Not IF, but WHEN. If you want to know more about what that is, here is a link to IBM’s description of MTBF on archive.org.

We’ve established that hard drives fail no matter what. What are you to do? Back up your data. Other than the fans, the hard drive is the only other item in your computer that has constantly moving parts. It is also the singular most critical device in your computer. Over the next few months I will be reviewing backup solutions and commenting on the best. If for some reason yours doesn’t work, or failed (believe me it happens, read my post: Data Recovery Case Study - My Own Machine if you don’t believe me. They are still busting my chops about having to send in my own drive for recovery) know that you can trust the guys and gals at DTI Data Recovery.

How to Stop Programs From Starting When You Boot Windows XP

We all have it. It is that program that every time we start our machine it is sitting down in the system tray.

For me it is the Quicktime viewer. We always have to right click on it and tell it to stop running. Wouldn’t it be nice if you knew how to get it to stop running every time you rebooted? I am going to show the very simple process of making sure that it only starts if you want it to start.

1. Click on the Start button and choose RUN

2. In the Run window you are going to want to type msconfig and hit enter.

3. Next the System Configuration Utility will open. You will need to look at the tabs along the top. There will be one named Start Up, click this tab. (NOTE: there are things in here that if you change you could make you system unstable.)

4. After you click Startup you will be given a list of all kinds of programs that start when you boot your machine. You are going to want to make the Command area of you window longer so that you can read more of the text. As you look through these programs you will notice that they have the names of the software in the command area. You will notice on my example that I have Spyware Doctor loading on startup. Now, it is not my regular virus scanner, but I do like to use it once a week to immunize with. I do not need it running all the time with Norton so I want to stop it from taking up more resources. I would have never known that SDtrayspp was the program I was looking for, but by extending the command area I can see that it is spyware doctor. Now all I have to do is click the check box off next to it and click ok. Windows will then want to reboot.

5. After the reboot, the configuration utility will open again. There is a check box to tell it to stop doing that. When you close the program it will ask if you want to reboot again you can say no this time.

Notice that the program is no longer in your system tray, and you have gone a long way to freeing up system resources.