Repairing Hard Disk Problems
Brien M. Posey, MCSE
In Part 1 of this article series, I explained some techniques that you could use to combat hard disk problems if the problem in question was related to a physical breakdown of the hard disk itself. However, the vast majority of hard disk failures are software related. In a software related failure situation, the techniques that I shared with you in Part 1 wouldn’t apply. You must apply a different set of techniques when attempting to recover from a software related (or logical) hard disk failure. In this article, I’ll explain some new techniques that you can use for doing so.
Before We Begin
Before I get started, I need to explain that the technique that you would use to recover from a logical hard disk problem is highly dependant on the nature of the problem. For example, if a virus were to destroy your master boot record, then you’d use a different repair technique than you’d use if you were trying to recover a lost file. Therefore, in the sections that follow, I’ll explain some techniques that you can use to recover from various types of problems.
Master Boot Record Failure
Before I can really explain how to go about fixing a master boot record failure, you need to know what the Master Boot Record does. The Master Boot Record is a specific location on the hard disk that your system’s hardware automatically reads when you boot the system. The Master Boot Record contains a pointer that directs the system to the boot sector. The reason that your system has to have a Master Boot Record is that depending on the size of your hard drive, the partition structure, and which partition is flagged as active, the boot sector can exist in a variety of places. Therefore, the system needs code that will always exist in the same place (the master boot record) to point the way to the boot sector.
There are a variety of things that can cause the Master Boot Record to fail. One of the most common causes of a Master Boot Record failure is performing a full restore on your hard disk. Some backup programs will restore the contents of the individual partitions, but won’t update the master boot record to point to the active partition. If this (or any other type of Master Boot Record failure) happens to you, there are a couple of things that you can do to recover.
Keep in mind that with the Master Boot Record out of commission, the system won’t be bootable. Therefore, you’ll have to use a boot disk to accomplish the repair. If your system is running Windows 9x, then you can use the boot disk that I showed you how to make in Part 1. Simply boot the system off of the boot disk and use the FDISK /MBR command. If on the other hand, you’re working with a Windows 2000 based system, boot the system from the Windows 2000 boot disks and enter the Recovery Console. When the Recovery Console loads, use the FIXMBR command to make the repair.
Boot Sector Failure
Another common type of failure is a boot sector failure. The boot sector is the file that tells the system which file to begin loading during the boot process. For example, in a Windows 9x environment, the boot sector tells the system to begin loading the IO.SYS file.
The most common cause of a boot sector failure is an infection from a boot sector virus. A boot sector virus replaces your normal boot sector with viral code. Some viruses make a backup copy of the original boot sector at the time of the initial infection. With such viruses, all you have to do to repair the damage is to disinfect the system using a product such as the Norton Anti Virus. Because such products know the behavior of specific viruses they know where the original boot sector was backed up to and can remove the viral code and replace it with your original boot sector (assuming that the original boot sector hasn’t been overwritten.
Of course not all virus authors are kind enough to develop viruses that backup your original boot sector before infecting the machine. With some viral infections, the original Master Boot Record is gone forever. Likewise, boot sector failures aren’t always virus related. In either case, you must reconstruct the boot sector manually, to return the system to its previous state.
There are a couple of different methods that you can use to repair the boot sector. One of the most reliable methods is to completely reinstall the operating system. Of course doing so takes some time and can get a little hairy. Therefore, I recommend trying a couple of shortcuts before you go through the trouble of reinstalling the operating system.
If you’re using a Windows 9x environment, boot the system from the floppy disk that you created in Part 1 of this article series. When the system boots, enter the command SYS C:. In many cases, entering this command will repair the problem and make your system bootable once again. If you’re using Windows 2000, boot the system to the Recovery Console and then enter the FIXBOOT command.
Accidentally Deleted Data
Another common hard disk problem is that needed files may have been accidentally deleted. Normally, when this happens, you’d simply go into the Recycle Bin and get them back. However, if the files were deleted by an application (through an automated script), or if they were deleted through the command prompt, then the files won’t be in the Recycle Bin.
What happens when files are deleted is that the file isn’t actually removed. Instead, the first character of the file name is replaced with a question mark. The question mark tells the operating system not to display the file. Unfortunately, the question mark also gives the operating system permission to use the disk space currently used by the deleted file, to store other files. Therefore, if you want to recover a deleted file that isn’t in the recycle bin, you’ll have to do so quickly, before the operating system overwrites the file.
Older operating systems, such as DOS 6.22 contained a command called UNDELETE w3hich you could use to recover lost files at the command prompt level. The utility simply asks you what the first character of the file name is supposed to be, and then recovers the file. Unfortunately, UNDELETE isn’t included with Windows 9x. However, if you have an old copy of DOS laying around, I have been able to use an old copy of UNDELETE on a DOS 6.22 boot disk to recover deleted files off of a Windows 9x machine. As I’ll explain later, there are also utilities out there that will do this for you.
Cross Linked Files and Bad Sectors
Perhaps the most common hard disk problems are also the most minor. These include things like cross linked files, lost chains, and bad sectors. Any time that you encounter such problems, they can usually be repaired through SCANDISK, assuming that you’re using a Windows 9x environment.
If you’re running Windows 2000 and have a hard disk that’s formatted as NTFS, then you’re not supposed to have these problems. NTFS uses a transaction logging system that keeps common hard disk problems to an absolute minimum. However, even NTFS isn’t perfect. It’s still possible to have hard disk problems, even in an NTFS environment. If you do have hard disk problems in Windows 2000, try using the CHKDSK command to fix the problem. CHKDSK will ask you to reboot your machine and will then correct the problem during the reboot. This process may take some time to complete though, as CHKDSK is very thorough. There’s also a less sophisticated version of CHKDSK that’s included with Windows 9x, but you’re usually better off using SCANDISK.
Of course SCANDISK and CHKDSK aren’t your only repair options. There are a plethora of third party hard disk repair tools out there. When it comes to repairing the more common hard disk problems, I prefer to use Norton’s Disk Doctor. Disk Doctor is included in Symantec’s Norton System Works 2001. In my own personal experience, Disk Doctor tends to do a little bit better of a job repairing common problems than Scan Disk does. It also offers some recovery options for bigger disasters.
The Total Recovery Solution
So far, everything that I’ve talked about has been directed at repairing minor and fairly common hard disk problems. However, you may be wondering what course of action that you should take when the big one hits. For example, what do you do if someone accidentally uses FDISK and deletes a critical partition, or formats a drive full of data.
In the past, your options in such situations have been very limited. There weren’t many tools out there that were up to tackling the task at hand. In a major hard disk crash, or accidental formatting or FDISKing, you were basically at the mercy of the few available tools and your own individual skills. I’ve personally recovered lost data the hard way, but doing so takes several hours and you usually end up losing some of the data any way.
Because of these hellish past experiences, I was very excited to discover a new tool from Winternals software (www.winternals.com). This new tool is called Disk Commander. Disk Commander is designed to help you to recover from all of the really bad types of hard disk crashes and data loss situations.
I normally shy away from whole heartedly recommending a product to my readers. However, like just about everything else that the people at Winternals Software have developed, Disk Commander is worth its weight in gold. Disk Commander does more than just salvage deleted files, it allows you to recover from many different data loss situations that you would normally not be able to recover from. What makes this utility even better is that it works on FAT 16, FAT 32, and NTFS partitions, and will recover data regardless of why it was lost.
Unlike other data recovery tools, the system doesn’t even have to acknowledge a partition’s existence for the software to work. You can literally salvage data from volumes that the operating system can’t access, even if the operating system doesn’t recognize the volume as a valid partition or can’t assign a drive letter to it. The utility also repairs volumes that have been damaged by a virus, or that have been accidentally deleted by FDISK or by the Windows 2000 / NT Disk Administrator. Of course this utility also allows you to recover deleted files that don’t appear in the Recycle Bin, and allows you to unformat a partition to recover from an accidental format. Disk Commander will work even if the system is unbootable. The only situation that Disk Commander is unequipped to deal with is hard drives that contain physical damage (such as would occur from being dropped).
Disk Commander is an absolutely amazing product. License prices start at about three hundred dollars. You can acquire Disk Commander at http://www.winternals.com
In this article, I’ve explained that the technique that you’d use to recover from a logical hard disk failure is totally dependant on the nature of the failure. I then went on to explain several different techniques that you can use to recover from various types of hard disk problems.
Entry filed under: Hard Disks.