Bad sectors on a drive are very hard to diagnose as they look like so many other problems and can be masked very easily.  One minute the drive is working and the next it is not.  This usually sends a technician into a flurry of questions as to what new software has been loaded, what websites have been visited, is the virus and malware software up to date, and on and on.  Ultimately there is really only one way to check the drive for bad sectors and that is with software.

DTI Data offers this tool to all who think they may have bad sectors.  We send it to everyone who we believe may have bad sectors to help us diagnose their problem and to give them a proper and accurate quote.  We try our best not to quote using some sort of arbitrary cost spread.  When a person is getting ready to spend a large sum of money they want the amount to be as accurate as possible.  DTI Data works closely with the prospective client to offer the best value for their dollar in addition to helping them accurately assess their data recovery situation.

One final note, while running the software if there are several bad sectors and it is taking a very long time to scan the drive then it is advisable to stop the scan.  Never brute force a drive scan as it can cause more damage to an already tenuous situation.

Download The Freeware Utility – Windows Surface Scanner here.

As you can see my external hard drive has no partition and because of this I will need to enter all of the numbers that go in the fields. Each line is equivalent to a different partition on the hard drive. For this How To I am only worried about single partition hard drives.

When I do a remote data recovery of a partition I would have WinHex available in order to have the ability to look at multiple facets of the file system. Once in WinHex with the target hard drive open I will then go to sector 0, where the Master Boot Record (MBR) resides.

This is a view of the MBR on my hard drive that has no partition record, and therefore no access to the data on that drive.

I will then go up to view and then choose the template manager. In here I will chose Master Boot Record template and apply it.

As you can see there is no information in the partition. Everything is zeroed out. This can be seen a lot with viruses and also with accidentally deleting the partition from the hard drive in the Windows Installer program.

From here I will go up to position and then go to sector. I will input sector 63 and I am now at the NTFS Boot Sector.

Here you can see the NTFS file system and this will help you to know you are in the proper place. I can now go back up to View and then to the Template Manage and apply the Boot Sector NTFS template to this sector.

Now that I have the template open I can look to see what the total sectors of the hard drive are. Now generally speaking for most single partition NTFS hard drives whatever you see in the total sectors in the template plus 1 is what the total sectors of the hard drive are.

With my hard drive, the total sectors are 39086081 add 1 to that and we have 39086082. Now I need to go back to sector 0 and open the MBR template again.

Now that I know what the total sectors are, the other settings are easy enough and pretty standard. They should be as follows. The active partition field is 80 and will l mark the partition as “active”. The next field is the Start Head which should equal one (1). Next we have Start Sector which is also one (1). The starting Cylinder will be left at 0. Partition Type for NTFS is 07. End head is 254 End Sector is 63 and end Cylinder is 1023. The sectors Preceding the Partition is 63. All of these fields are in most cases always the same. Sectors in Partition is equal to the total sectors as reflected in the boot sector plus 1, so for this hard drive it will be the number from above we already figured out, 39086082.

Now we want to close this window and click yes when it asks if we would like to write the MBR. Then we want to close WinHex. It is going to give us a warning about writing to the drive. I would have to say here that if you are not SURE these are the proper settings for your drive, it is not a good idea to be writing them down. You can cause damage to data, and also make it harder for a hard drive recovery technician to fix it later.

Also if you used WinHex to look at the total sectors of the drive and would like to use the Free Partition Recovery Tool to put the partition down to the drive you can do that also. It very simple as the fields from WinHex and from the partition recovery tool coincide with each other. WinHex has a demo view version you can use to find the total sectors and then you can use the free partition tool to write the information down to the drive without having to spend any cash. You should be able to reboot the machine now and have full access to your data. As always if you have any questions please feel free to give me a call. 727-345-9665 and ask for software support. You may also ask questions by leaving a comment below. We try to answer all questions within 24 hours. By asking question in the comments on this page we will be able to help other users that have similar questions.

For more information visit these pages:
Freeware Data Recovery

This first area I am going to cover is the partition area of the hard drive. It is also sometime referred to as the MBR (master boot record) which can be confusing because it is NOT the boot sector. It is also often called the partition table. For the purpose of this article I will call it the partition sector. The Partition sector is what handles the “logical” drives in “physical” drive. So that is to say just because you have a C and D drive does not mean you have 2 hard drives. It more then likely means you have one physical hard drive with two logical drives contained inside of it.

EXAMPLE: Take a piece of Tupperware and 2 apples. We will consider the Tupperware the “PHYSICAL” hard drive. Now take the 2 apples and put them in the Tupperware and close it up. The 2 Apples inside are the “LOGICAL” drives or the partitions.

You can see how many physical hard drives you have under the Disk Management Utility. Also in this utility you can see how many logical drives are contained in each physical hard drive.

NOTE: You can get to Disk Management by right clicking on “My Computer” and going to manage. From there you will see Disk Management please see screen grab below.

When the partition sector of a hard drive is wrong or gone you can usually still see it in Windows Explorer with a drive letter assigned to it. Unfortunately when you click the drive you will get an error like “the drive is not formatted would you like to format it now?”. This is a problem that can in most cases be easily fixed if I were to remote in to the computer. Follow the link for more information on Remote Logical Hard Drive Recovery and how we can remote into your computer and recover your data.

Now, the cool part about the partition sector is that it has a back up in a different area of the hard drive for recovery. So if it is just an issue of a deleted partition, or some kind of very nasty virus, recovery of the partition becomes very simple with the use of free utilities like our Free Partition Repair Software. In the event on of the free utilities did not work to recover the partition there could be a deeper issue with the hard drive in which case a sector editor may need to be called upon to diagnose and fix the problem. Below is some pictures of a healthy partition in sector editing software.

This is what I see when I go to sector 0 in WinHex as you can see there is even “Invalid partition table. Error loading operating system. Missing Operating system.” Now we know where we get those errors from. If the partition is intact but one of the other system areas is not then it will revert back to one of these errors depending on which area seems to be having the problem.

Now I apply a template to the partition sector so that I can look at it “decoded”. In here we see that the partition sector says I have only 1 partition on the drive (this is correct). In the one partition it is not active (this is correct since it is an external USB drive). The start head, start sector, and start cylinder will read 1,1,0 in MOST cases. The Partition Type Indicator tells us what kind of partition we have, in my case 07 which means NTFS. If You have0b in there is means you have a FAT32 partition, which we are seeing a lot of on the external USB/FireWire drives. Next you have the end head, end sector, end cylinder and again in MOST cases it is going to be 254,63,1023. The next field is Sectors proceeding partition, this means how many sectors is it until this partition starts. You will sometimes hear this referred to as the logical off set. Again in MOST cases this is going to be 63, which means that if we go to sector 63 we should find the “boot sector” (I will go over the boot sector at a later date). Sectors in Partition is the last thing in the list, and it is exactly what it says, the total sectors in that partition. Now how do we figure out if that number is correct? You can go to the blog I wrote Building Partition Record with Recover It All.

For more information about hard drive recovery or our freeware data recovery.

Dick Correa our chief programmer was kind enough to release a tool he created that does in fact REPAIR NTFS partitions. This software is free to our readers and can be gotten off of our website. The link is at the bottom of this post. Keep in mind that DTI is not responsible for any data lost from misuse of this tool. It is extremely powerful. Now that the lawers are happy, here is Dick’s post:

NTFS Partition Recovery with Free Partition RecoveryAll things must start somewhere, when it comes to operating systems’; the partition sector is the single most important component in the boot sequence. When the partition sector is missing, corrupt, or set up improperly it can wreak havoc with the booting of your operating system. The partition sector is vulnerable to virus attacks, operating system anomalies, bad sector reads, and an ever increasing set of tools, fdisk included, that when used incorrectly can and will totally destroy an operating systems boot sequence.

In order to more clearly understand how the partition sector fits into the boot sequence, the following is a standard garden variety boot up.

When you turn on your computer several things happen. The first of which is the BIOS (Basic Input Output System) is executed by the CPU (Central Processing Unit). The CPU knows to load the BIOS on power up as there is a flag set at power on. The BIOS then jumps to a set of routines that will execute the POST (Power On Self Test). The POST will look at memory, some peripheral devices, and do some other house keeping procedures. The most important of these is determining the boot device. The boot device is stored in non-volatile read/write memory. If the boot device is set to a hard drive, then an industry standard interrupt 0×19 is called. This routine loads the first 512 bytes of the boot device, which in this case the hard drive, into memory location 0×7C00. The 512 bytes is a standard sector size. It then jumps to that address (0×7C00) and executes whatever it finds there.

If all goes well, the set of instructions executed will look at the partition entry data. The partition entry data is used to determine which partition is the boot partition. If it finds a boot partition in the partition entry list the instructions will then load a secondary set of instructions which the partition entry has pointed to. In the case of Windows the OS (Operating System) pre loader is now loading itself into memory. This type of OS loader is called a two phase loader and is very common. Take a look at the table below to help better understand the role of the partition sector entry data.

The format of a partition sector entry is as follows:
1.) Byte 1 Boot Partition Indicator (0×80 is bootable, 0×00 is not)

2.) Byte 2 Starting Head of the partition (255 or less)

3.) Byte 3-4 Starting Sector and Cylinder of the partition
This is set up as 10 bits for the Cylinder and
6 bits for the Sector (Sector Max 63, Cylinders Max 1024)

4.) Byte 5 File System Type (NTFS, FAT32 etc)

5.) Byte 6 Ending Head of the partition (255 or less)

6.) Byte 7-8 Ending Sector and Cylinder of the partition
This is set up as 10 bits for the Cylinder and
6 bits for the Sector (Sector Max 63, Cylinders Max 1024)

7.) Bytes 9 -12 Relative Sector to the partition sector. In other
words, where the actual partition starts.

8.) Bytes 13-16 Total sectors for this partition.

If any of this data is outside the stated parameters the partition will fail and consequently the boot sequence will stop. In order to clearly understand what happens when the partition sector is corrupt or damaged, the following is a list of scenarios.1. Boot Failure: System Halted
An error message that comes from the BIOS. Certain BIOS versions, especially the most recent revisions, take a look at the partition sector. The BIOS will perform some preliminary tests and one of the tests is the Partition Identifier. At the end of every partition sector is the value 0xAA55. If this indicator is missing then the BIOS assumes that this is not a partition sector and the aforementioned error message will be issued.

2. System reboots over and over
Although this is not an error message, it can happen if the relative sectors point to an invalid OS pre loader. A trap is set and if the data that is loaded is not executable machine most BIOS’s will reboot.

3. Invalid Partition Table
This error message comes from the partition boot code. If there are no boot devices then the boot code will enter an infinite loop after this message is displayed.

4. Error Loading Operating System
After a valid partition is found the LBA sector pointed to by the partition entry table will be loaded using INT 13. This is the operating system loader. If the code cannot be loaded into memory then the above message is normally displayed.

5. Missing Operating System
Once the operating system boot code is loaded it is checked for the 0xAA55 identifier in the same manner that the partition sector is tested. If this test fails, then the above message will be displayed.

Over the years the BIOS writers have gotten smarter, personal computer as well as operating system standards have been set and are normally followed. So many of the messages, as well as error checking is now handled by the BIOS. The messages I have mentioned are just a few, but, are very common; however, from BIOS to BIOS the messages as well as the error handling can differ greatly.

As you can clearly see the partition sector is of primary importance in the boot sequence. Without it nothing happens. In the future there may be ways to overcome the use of a partition sector, one would be to store the partition entry data in the BIOS, this would eliminate boot sector viruses as well as the possibility that the boot sector goes bad and becomes unreadable. However for now, we will work with what we have. The next segment will discuss how to do partition recovery using a simple piece of software.

How To Use The Software

Free Partition Recovery is an extremely powerful tool for anyone to use but this statement must be caveated with the fact that with power comes a degree of responsibility. In other words, use this tool with extreme caution as it can destroy your file system to the point of massive and possibly permanent data loss. That being said lets take a look at how we can put this tool to good use.

First, the software should be run from a master drive. There should be two drives in the system, your boot drive from where the software is executed, and the damaged drive. The damaged drive being the one with the corrupt or missing partition. Free Partition Recovery is designed to work on Windows XP type operating systems, so make sure that you have unzipped the file onto that type of operating system.

Once the Free Partition Recovery has been executed you will see in Figure 1.

Figure 1

The top row displays all the physical drives currently active in your system. This will also include any external devices that can be mounted as a physical block device. An example of this would be the 80 GB Maxtor USB device. Once you choose a physical drive all partition entry data will be displayed as in Figure 2.

Figure 2

The partition entry data for this particular drive gives us a clear example of a drive that has been configured with one NTFS logical drive with the standard offset of 63 sectors, start head and sector of 1 and ending cylinder of 1023. These are classic values for a normal single logical drive setup.
The other three entries are clear and not in use. These entries will be ignored by the OS loader. There is one other important item in this configuration. On the far left of Figure 2 of the first partition entry is the boot flag “No”. This indicates that this partition is ‘Not Bootable’. You can change that value buy using the drop down list (Figure 3)

Figure 3

Once you have configured all of the partition entries to reflect the correct values all you need do is press the “Write” button. You will be presented with the following message box in Figure 4. A word of caution, once you write the data down to the partition sector, you must live with it. Please exhibit extreme caution.

Figure 4

Hopefully this information as well as the software will help you recover your data. If you have any questions email support@dtidata.com or call 727-345-9665 Ext 236.

You can download the free NTFS partition repair software here. For more info about freeware data recovery visit our free data recovery software page.

We have also just released a FREEWARE solution that will save your NTFS master file table to our secure servers for possible data recovery. It acts as a remote restore point and MFT backup.

NOTE: This function of Recover It All Partition Repair Data Recovery Software will WRITE data to sectors of the hard drive. Anytime that a write is performed there is a possibility for more corruption, so use this function only in emergencies. You may also want to clone the hard drive first with something like Speed Clone, so that you always have a back up of your data in its current state.

Rebuild Partition Record For Data Recovery

Under the ‘Utilities’ menu option click on the menu item which displays ‘Build Partition Record’. You will be presented with a dialog box, similar to the one you are viewing now.

There are several fields that need some explanation. They are as follows.

• Start Head, Start Sector, Start Cylinder:
  These three fields are the starting delimiter for the partition. On a single partitioned drive the normal parameters are 0, 1, 0 respectively. That is, start head 0, start sector 1, and start cylinder 0. You will use this most of the time unless you have some type of diagnostic partition, or boot handler.
• End Head, End Sector, End Cylinder:
  These three fields are the other side of the coin, or the ending delimiter for the partition. On a single partitioned drive the normal parameters are 254, 63, 1023 respectively. That is, end head 254, end sector 63, end cylinder 1023. Once again you will use these most of the time unless you have some type of weird inverted, upside down sideways configuration which would change the sector, or head count.
  One note here, the ending head will never exceed 254, the ending sector will never exceed 63, and the ending cylinder will almost never exceed 1023.
• Reserved Sectors:
  This field’s value is the total sectors from the partition record to the boot record, where the boot record is considered the actual beginning of the partition, otherwise known as the logical drive. On a single partitioned drive this is normally 63 sectors. If you have a multiple partition hard drive this value will vary greatly.
• Total Sectors:
  In order to figure out if you have the correct total sectors you will need to get out your trusty calculator and do a little math. To properly report the total sectors on a drive partition you multiply the heads, times the sectors, times the cylinders minus the reserved sectors. You can find this information but clicking the little plus sign next to physical data and then the plus sign next to geometry.

I am running the software on a Maxtor 6Y120P0 (120 gigabyte) hard drive the heads are 255, the sectors are 63 and the cylinders are 14946. That gives you 240107490 sectors, minus the 63 reserved sectors for a final tally of 240107426 sectors for a single partitioned drive.

• LBA Sector:
  This field connotes where to place you newly configured partition. On a single partitioned drive the LBA sector will be 0.
• Bootable:
  This little check box is very important. Without marking the partition as bootable the boot code will not execute, and your computer will just hang. However, only mark the partition bootable if it is the primary, and boot partition.

Now that we have all of the fields filled in, we can send our partition sector to the hard drive. Just click on the ‘Write’ button.

You will receive a warning telling you that you are writing to the hard. Ignore said warning if you TRULY want to write the boot record. If you have any questions, please feel free to call technical support:

Toll Free 1-866-438-6932 or direct 1-727-345-9665.

Extended Software Support:
8 AM to 11 PM EST 7days a week!

You can download the demo for Recover It All here.

Buy Recover It All Now

The boot record is one of the keys to initializing the operating system. If this cornerstone has somehow been corrupted, or you are receiving error messages such as “No operating system found.” “NTLDR is missing.” “A disk read error occurred” , then this little utility may be the answer to your problem.

NOTE: This function will WRITE data to sectors of the hard drive.

Use Data Recovery Software To Build a Boot Sector

Anytime that a write is performed there is a possibility for more corruption, so use this function only in emergencies. You can also avoid causing further damage to the hard disk by using speed clone first to be sure you have a back up of your data before you go rooting around in a system area of the hard drive. See our post: How to Slave a Hard Drive

Under the ‘Utilities’ menu option click on the menu item which displays ‘Build Boot Record’. You will be presented with a dialog box, very similar to the one below.

There are several fields that need some explanation. They are as follows.

LBA Sector:
This box contains the sector where the boot record is to reside.
On a single partitioned hard drive that is normally 63, however placement of the boot record depends upon how the drive has been partitioned.

NOTE: Diagnostic partitions are very common in all computers being built today. Because of the 2-3 gig off set due to the diagnostic partition, the actual boot sector for your primary working drive is further down the hard drive.

Total Sectors:
In order to figure out if you have the correct total sectors you will need to get out your trusty calculator and do a little math. To properly report the total sectors on a drive partition you multiply the heads, times the sectors, times the cylinders minus the reserved sectors and minus 1 sector for the Back up MBR (master boot record) You can find this information but clicking the little plus sign next to physical data and then the plus sign next to geometry.

I am running the software on a Maxtor 6Y120P0 (120 gigabyte) hard drive the heads are 255, the sectors are 63 and the cylinders are 14946. That gives you 240107490 sectors, minus the 63 reserved sectors and minus the 1 sector for the MBR for a final tally of 240107426 sectors for a single partitioned drive.

NOTE: You will notice that the software reports the total sectors with out removing the reserve sectors; you must make sure you remove the reserve sectors.

Start Cluster:
On an NTFS file system the values could either be ‘4′ or ‘786432′. With older NTFS (i.e. NT4 and Server 2000) using the 4. Newer NTFS (i.e. Windows XP Professional, Sever 2003, and Windows Vista) using 786432.

Sectors Per FAT:
You will not need to fill in this information on an NTFS file system.

Sectors Per Cluster:

Under an NTFS file system this value is almost always 8, unless the file system was converted from FAT32, then the value is usually ‘1′.

Now that we have all of the fields filled in, we can send our boot record to the hard drive. Just click on the ‘Write’ button.

You can download the demo for Recover It All here.

Buy Recover It All Now

You will receive a warning telling you that you are writing to the hard. Ignore said warning if you TRULY want to write the boot record. If you have any questions, please feel free to call technical support. Click the link if you require hard drive recovery.

Case Study: Multiple Partition Recovery with Recover It All

I recommended that he download the Recover It All Professional Demo, and let it scan the drive for all logical disks. Here is how the recovery went, for the most part.

Inside of Recover It All, double click the physical drive, you are trying to recover.

Screenshot:

A scan will start that depending on your drive size could take 2-3 hours. Please let this scan finish as at this point we are trying to find your missing partitions.

NOTE: In the lower right hand corner of the software, you should start to see partitions popping up in there. There maybe be invalid finds, data inside of a file sometimes looks very similar to a partition, and we rather list it and be wrong then not list it and be wrong. You can ignore these partitions if they are not the right size of the partition you are looking for.

After the Scan of the physical drive has completed, you can now go through the list of logical drives and try and find the partition that is eluded you thus far. Once you locate your partition, double click it, and it will do the “fast scan”. With in a few minutes you should see a tree of your hard drive in the middle box of the software. Now all that is left is selecting the data you want to retrieve and moving off the hard drive.

You can download the demo for Recover It All here.

Buy Recover It All Now

24 Hour Hard Drive Recovery & Server/RAID Recovery Hotline:
Toll Free 1-866-438-6932 or direct 1-727-345-9665.

Extended Software Support:
8 AM to 11 PM EST 7days a week!