INSTRUCTIONS
============
This page contains detailed instructions on how to backup and restore the key
sectors of a FAT32 hard disk (for any size of hard disk from 32 MB to 137 GB).
Included are instructions on how to use those backups to recover from a disk
crash, and on how to recover from a disk crash even if you do not have those
backups (a rather more difficult problem).
A great deal of information about the disk structure of a FAT32 hard disk is
included, in an attempt to provide an all-purpose DIY solution to disk repair
and data recovery.
In terms of disk repair, it tackles both repairing the data structure of a
working disk which has suffered only data corruption (due to data being written
to the system area, overwriting the MBR, Boot Sector or FAT), and fixing broken
hardware (including repairing bad sectors).
In terms of data recovery, it explains how to safely copy files from a broken
disk to a new disk (including how to install a new working hard disk): both
how to clone the entire broken disk, and how to copy individual files off a
broken disk (one-by-one or en mass).
Instructions are also included on recovering from common file system errors,
such as the "Blue Screen Of Death". Many other error messages generated by
the Windows 98/ME operating systems are also tackled.
Each section of this page includes recommendations on which software to use,
and details of how to use it most effectively. These are mostly DOS programs,
to enable you to carry out the work even where Windows can't load.
Included at the bottom of the page are download links to enable you to obtain
on-line the software referred to.
The Batch File
You do not need to be an expert on MS-DOS batch files to use the batch file.
You only need to know a little about them: for example that if you execute
(i.e. run) a batch file, it won't execute any line which begins with "rem"
or with a double colon "::" as those are used to disable ("comment out") a line.
That file contains many different solutions; so it is probably best to make a copy
of it, and delete the sections that aren't applicable to your particular problem.
Crash-course on Disk Structure
This page gives a crash-course (no pun intended!) on how to survive a disk crash.
Read it through completely, before taking any steps. Then read it AGAIN!!!
Make sure you understand what has gone wrong before you attempt any recovery
action!
You will need a basic understanding of the structure of a FAT32 disk. You may have
one which has only a single partition (e.g. Drive C:), or you may have one which
has more than one partition (e.g. Drive C: and Drive D:). This page tries to provide
the necessary basic understanding, but you will find it helpful to also read up on
the subject through Google (e.g. search for information on both FAT32 and MBR).
A disk is divided into sectors (millions of them). Each sector is usually 512 bytes
long. Two sectors thus total 1024 bytes, or 1 KB (kilobyte). Depending on the size
of the disk, usually either 32 sectors or 64 sectors make 1 cluster. The disk stores
information (files) in a cluster: so a file might only be 1 byte of information, but
will still be alloted 1 cluster all to itself (even though 1 cluster is typically
64 sectors, i.e. 64 multiplied by 512 bytes). So a cluster can contain a vast amount
of empty space, in addition to your file's data. A file is alloted as many clusters as
it needs: and ownership of each cluster is recorded in the File Allocation Table (FAT).
A disk may contain more than one Partition. Each Partition begins with a Partition
Table sector (e.g. the MBR, or Master Boot Record, the first sector on the disk);
this is typically followed 63 sectors later by the Boot Sector, which is typically
followed 32 sectors later by the first sector of the FAT (File Allocation Table). The
FAT might be 20,000 sectors (or longer), depending on the partition's size. A second
copy (i.e. a backup copy) of the FAT typically follows immediately after the first FAT.
The Root Directory sector then typically follows immediately after the second copy of
the FAT. The rest of the Partition contains your files.
This page provides routines for making a backup copy of all of these vital data
structures: MBR, Boot Sector, FAT, and Root Directory. It also explains how to
reconstruct them if you don't have a backup copy of them. And it tells you where to
find the tools to use to automate as much as possible of the recovery process if you
don't have the necessary backup copies of those key sectors.
The most useful tool for gaining a practical working understanding of disk structure
is probably Norton's DiskEdit (DISKEDIT.EXE). The 2001 and 2002 versions (or later)
are needed for a FAT32 disk (because earlier versions either don't work at all for
FAT32, or only work if the disk is smaller than 8 GB). Norton DiskEdit includes tools
which will find for you the starting sector of the various data structures: such as
the Partition Table, Boot Sector, and FATs.
CLONE the disk (carefully following the instructions below), as your first step,
before taking any recovery action. And carry out all recovery steps on the
clone disk (not on the damaged original), so that if things go wrong the original
is preserved and you can try again.
*** Set Path ***
Set DOSpath=%path%
PATH ;
SET PATH=F:\
*** Disk Cache for MS-DOS Mode ***
** To make the routines run faster **
C:\WINDOWS\SMARTDRV.EXE 8192 16>nul
** Alternative file location **
F:\SMARTDRV.EXE 8192 16>nul
Top of Page
SECTION A: DISK STRUCTURES
DISK STRUCTURE NOTES
====================
FAT32
=====
The FAT32 file system is a method for storing files on the
magnetic hard disk in a computer. The disk may contain a
single partition, or may be divided into several partitions.
A partition larger than 8GB must use the FAT32 file system,
in order to provide enough addresses for file storeage on that
partition; and a partition smaller than that may use it.
FAT32 uses 32 bits for each entry in the File Allocation Table
(i.e. 4 bytes, as there are 8 bits in a byte: 4 x 8 = 32), so
providing more addresses than FAT16 (which uses only 16 bits).
NB: In some disk utility programs, FAT32 is called "BigFAT"
and FAT16 is called "FAT".
NB: The notes in this file are for the FAT32 file system only,
on a computer running Windows ME or Windows 98/98SE.
Those Windows versions can *not* access an NTFS partition.
This section does NOT describe a system that dual-boots
(shares a partition with more than one Operating System),
nor does it describe a disk that is larger than 127.53GB.
CHS ADDRESSING
==============
CHS = Cylinder : Head : Sector
Each sector (consisting of 512 bytes) has a CHS address.
A FAT32 disk starts at Cylinder 0, Head 0, Sector 1
(CHS 0-0-1), and is typically structured as follows -
Sector : There are 63 sectors per head
(counted from 1 to 63)
Head : There are 255 heads per cylinder
(counted from 0 to 254)
Cylinder : The maximum number of Cylinders is 1024
(counted from 0 to 1023; i.e. 1023 is
the largest value in a Partition Table)
NB: The maximum number will be less than
1023 if the disk is smaller than 8GB
NB: If the disk is larger than 8GB, the
number 1024 is used: meaning use LBA
values (sectors only) instead of CHS
Where the disk is larger than 8GB, Logical Block Addressing
(LBA) is used for all critical disk functions instead of CHS,
but some key disk structures nonetheless contain CHS values
LOGICAL BLOCK ADDRESSING (LBA)
==============================
An LBA sector is the same as a CHS sector: a 512 byte block
of data.
CHS cannot provide sufficient addresses for a disk exceeding
8GB, so LBA addressing must be used instead. LBA uses sectors
only, treating the disk as a single unbroken chain of them.
NB: LBA is an alternative to C-H-S addressing, giving only
a sector number (instead of the traditional three numbers:
Cylinder, Head and Sector).
NB: In LBA the sectors begin with sector 0, whereas CHS values
begin with sector 1; thus their sector numbering is always
out-of-step with each other by 1.
Formula to convert a CHS value into an LBA value:
(Cylinders x Heads per Cylinder x Sectors per Head)
+ (Heads x Sectors per Head) + (Sectors - 1)
This formula, in practice, is usually:
(Cylinders x 255 x 63) + (Heads x 63) + (Sectors - 1)
This formula is only of use if the disk is smaller than 8GB;
a larger disk will have artificial (i.e. maximum) CHS values.
This formula can, nevertheless, calculate the number of sectors
on a disk from the CHS information printed on the disk's casing
(since the disk label does not observe the rule that Cylinder
values cannot exceed 1023, because this form of labelling is a
convenient way to record the disk's "geometry" - see below).
Convert using PT Calc:
The program PTCALC.EXE (and PT Calc for Windows) can translate
CHS values to LBA, and vice versa ("PARTITION TABLE EDITOR", below).
Sanity Check of Partition Table:
In the MBR Partition Table, the starting sector and ending sector
of each partition is described by a CHS value. These should agree
with the LBA values for "start sector" and "number of sectors",
even though those LBA values are enough to define the partition.
NB: If the partition ends beyond the 8GB boundary, the CHS value
for the ending sector will be merely the maximum permitted
(typically 1024-254-63). A Cylinder value of 1024 is a special
value, indicating that LBA values are in use instead of CHS.
The LBA start sector is stored directly in the Partition Table.
To calculate the LBA end sector: add "start sector" to "number
of sectors", then subtract 1.
DISK GEOMETRY
=============
The Disk Geometry will usually be 255 Heads per cylinder and
63 Sectors per head (255 x 63 = 16,065 sectors per Cylinder);
but don't just assume that, as other values are sometimes used.
NB: Disk Geometry (the number of Cylinders - Heads - Sectors)
can be read from the BIOS. It is also printed on a label
on the Hard Disk's casing.
To enter the BIOS, press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup.
A sector is a real disk structure: a block of 512 bytes. But the
terms 'Head' and 'Cylinder' are now mere conventionalisations;
they are no longer related to the actual engineering structures.
In a disk larger than 8GB all CHS values are unreal: CHS cannot
address a disk larger than 8GB. But CHS values must be used in
key disk structures, to ensure compatibility with the BIOS. So
the CHS values used are typically the largest allowable values,
i.e. 1023-254-63 or 1024-254-63 (or sometimes 512-254-63).
NB: The CHS values are in what is known as "L-CHS" format,
as they are CHS values that have been modified by LBA.
The disk manufacturer will still typically label the disk with
CHS values, but the values given are unreal. An 80GB hard disk
will typically be labelled CHS 9729-254-63, but it does not have
9,729 cylinders within it, nor can a CHS value greater than 1024
be used in the disk's Partition Tables: that CHS value is merely
a literal translation of the number of sectors on the disk.
CHS values remain important because key BIOS functions are based
on the Disk Geometry, by which is meant the CHS values: the
number of Cylinders, Heads per cylinder, and Sectors per head.
NB: The CHS value printed on the disk's casing, although unreal,
is a convenient means of telling the user the Head and Sector
values, which remain important (even though the figure given
for the number of Cylinders is irrelevent, except for the key
fact that the value exceeds 1,023).
If you are unsure what the correct disk geometry is, try using the
following values in the Partition Table, as one of these values is
likely to be the correct one:
(a) Sectors per Head: The most likely value is 63 (as almost all
hard disks base their CHS values on this traditional number)
(b) Heads per Cylinder: Try 255, 16, 32, 64, 128 and 240
(in that order).
NB: The number FF in Hexadecimal (base 16) represents
255 in Decimal (base 10); thus 255 is the maximum
decimal number that a 2-byte hex value can store.
(Being the maximum value possible, 255 is the value
most likely to be the correct one on a normal disk)
The equivalent LBA sector number will be 1 less than
the actual number (as LBA numbers start from 0 rather
than 1). So the maximum LBA value in a Partition Table
entry is 254 (i.e. 255 - 1 = 254).
NB: Computers use Binary storage, so any factor of two
that can be stored in a 2-byte hex value can be valid
(i.e. 4, 8, 16, 32, 64, or 128).
DISK SIZE
=========
Disk Size in Megabytes -
To calculate the size of a hard disk from its C-H-S values:
(Cylinders x Heads per Cylinder x Sectors per Head)
2,048 = MegaBytes
To calculate the size of a disk from its LBA value:
(LBA Sectors + 1) 2,048 = MegaBytes
Notes:
1. The LBA figure will be slightly greater, as the LBA calculation
gives the true number of sectors on the disk. The CHS calculation
only counts the number of sectors included in all the partitions;
a few sectors are left unused, as partitioning rules demand that a
partition MUST end on a Cylinder boundary (1 Cyl = 16,065 sectors).
2. To calculate the size of a Partition from its CHKDSK.EXE value:
Kilobytes 1,024 = MegaBytes
NB: Even if the hard disk has only a single partition,
this is NOT the size of the disk. It doesn't include
the System Area (Track 0, Boot Sector, FAT x2, etc).
3. To convert from MegaBytes to Bytes:
1 MB = 512 x 2,048 (i.e. 2,048 sectors) = 1,048,576 bytes
MegaBytes x 1,048,576 = Bytes
Bytes 1,048,576 = MegaBytes
Disk Size limitations -
In Windows 95 and 98, because the versions of SCANDISK and DEFRAG
included with the Operating System are 16-bit applications, the FAT
structure is unable to exceed approximately 4.2 million clusters,
imposing a partition size limit of 127.53 GB.
NB: ScanDisk for Win98 is a 16-bit program. Such programs have a
memory block maximum allocation size of 64 KB less than 16 MB,
so cannot process a FAT32 partition if the FAT is larger than
16 MB less 64 KB. As the File Allocation Table in FAT32 uses
4 bytes, ScanDisk cannot process a FAT that defines more than
4,177,920 clusters (including the two reserved clusters). So,
including the FATs themselves, this works out at maximums of
32KB per cluster and 127.53 GB per partition.
NB: The versions of SCANDISK and DEFRAG in Windows ME do NOT have this
limitation (and can be used with Windows 98/98SE also). As true
32-bit applications, they function on a partition of up to 512 GB.
Windows 9x and Windows ME do not support 48-bit LBA, so the maximum
possible size of a partition is 127.53 GB (i.e. the largest partition
size that's possible using 28-bit LBA).
NB: The WinME driver ESDI_506.PDR (which Windows uses for 32-bit drive
access) uses 28-bit LBA, so cannot access a partition larger than
127.53 GB.
A disk exceeding 127.53 can be partitioned as several partitions,
each smaller than 127.53 GB; then Win98/ME can access each.
NB: But only if the BIOS can recognise a disk exceeding 137 GB. If
the motherboard, i.e. the motherboard's ROM-BIOS chip, does not
support 48-bit LBA, it can't recognise a disk exceeding 137 GB!
An IDE or SATA disk can be attached to a PCI controller card that
supports 48-bit LBA. This enables a disk larger than 137 GB to be
present, even where the motherboard BIOS uses 28-bit LBA.
CLUSTER SIZE
============
On a FAT32 partition, the default cluster size is:
Partition size Cluster size
-------------- ------------
0 to 8 GB 4K
8 to 16 GB 8K
16 to 32 GB 16K
Over 32 GB 32K
1 sector is 0.5K, so if a partition has a cluster size of 16K
each cluster contains 32 sectors; but if cluster size is 32K,
then each cluster contains 64 sectors.
NB: These are the default values; but the user can override
them in the initial partitioning and formatting of the disk.
These values are thus only a guide, and will NOT be correct
in all cases.
The maximum number of Clusters in a partition:
( (No. of Sectors in Partition) - (No. of Sectors per FAT x 2) -
(No. of Reserved Sectors) ) (No. of Sectors per Cluster)
If there is any remainder in the result from that formula, it just
means there are a few unused sectors at the end of the partition
(usually not enough to make another cluster).
NB: The number of clusters can tell you the type of FAT in use, as
a FAT16 partition cannot exceed 65,517 clusters. If the number
of clusters is greater than 65,518 the partition is using FAT32.
(Note: FAT16 has a maximum cluster size of 32K [32,768 bytes])
NB: The ONLY method used by WinME to determin a partition's FAT type
is the value stored in the MBR for the total number of Clusters!
It does NOT use the size of the partition. Cluster size, which
is user-selectable, determines the number of clusters on disk,
and thus the FAT type; so partition size is an unsafe guide!
It does NOT use the ID string in the partition's Boot Sector,
e.g. "FAT16" or "FAT32", which has no significance whatever.
NB: The number of Clusters in a partition can be ascertained by
running CHKDSK.EXE which reports:
(a) The total number of clusters in the partition
(describing them as "allocation units"), and
(b) The number of bytes in each cluster.
*** Run CHKDSK.EXE ***
CHKDSK C: > CHKDSK_C.txt
CHKDSK D: > CHKDSK_D.txt
CHKDSK E: > CHKDSK_E.txt
Minimum number of Clusters:
A FAT32 partition MUST contain at least 65,527 clusters (because if it
contains fewer, Windows will treat the partition as FAT16). Therefore
the maximum cluster size possible is 32KB; a larger cluster size
(i.e. 64KB) would make it possible to have less than 65,527 clusters.
Maximum number of Clusters:
FAT32 permits the maximum number of Clusters to be several million,
by using 32-bit values in the File Allocation Table to store the
cluster addresses. However, the maximum number of addresses is only
0FFFFFFF hex (a 28-bit value), not the full 32-bit value FFFFFFFF hex.
This is to enable programs that manipulate the File Allocation Table
to use four bits as tags in their internal data structures; but it
has NO impact on the theoretical maximum FAT32 volume size, as that is
capped by the FFFFFFFF (hex) maximum sector count: which, at 512 bytes
per sector, results in a theoretical maximum volume size of 2 TeraBytes.
Cluster No.2 -
The "Data Area" starts with cluster number 2, not cluster zero,
because there are two "reserved clusters" (numbers 0 and 1).
Cluster 2 is the first sector occupied by the Root Directory Table
(i.e. the first sector used for the storage of data); and Norton's
DiskEdit identifies it as cluster 2. [Note: Cluster numbers are ONLY
assigned to the Data Area of the partition, NOT to the "system area"]
NB: To calculate the LBA location of the 1st sector occupied by
the Root Directory Table, see below under ROOT DIRECTORY.
The first sector containing an actual file is thus the first sector
in cluster 3 (bearing in mind that LBA counts from 0, not 1):
1st sector of Root Dir Table (LBA) + No. of Sectors per Cluster
NB: This is because the Root Directory Table usually occupies
1 cluster (i.e. 32 sectors if the partition's cluster size
is 16k, or 64 sectors if the partition uses 32k clusters).
NB: Cluster 3 is typically occupied by the Directory Table
for the directory RECYCLED (a hidden system directory).
Examples:
If cluster size is 16k, cluster 3 starts (in LBA sectors) at:
(1st sector of Root Directory Table) + 32
If cluster size is 32k, cluster 3 starts (in LBA sectors) at:
(1st sector of Root Directory Table) + 64
Clusters used by a File -
Norton's DiskEdit can read from the FAT the cluster numbers used
by a file, if the FAT is undamaged (see below under "FILE CLUSTERS").
FAT RANGES
==========
The following are the ranges for partition size, which overlap:
Type Min Partition Size Max Partition Size
----- ------------------ -------------------------------------
FAT12 1.5 KB 32 MB ( 33,472,512 bytes)
FAT16 16 MB 2,047 MB (2 GB) (2,147,123,200 bytes)
FAT32 ~32 MB 2,000 GB (2 TB) ( about 2^40 bytes)
Practical Limits:
The above partition sizes are the theoretical limits, but
the following practical restrictions also apply -
1. Although FAT16 cannot be used for a partition larger than 2GB,
a disk of up to 4GB can have several FAT16 partitions on it,
each not exceeding 2GB.
2. Large Disk Support (FAT32) is NOT available on disks smaller
than 510MB. A FAT32 partition smaller than 510MB can only exist
as one of several partitions on a hard disk larger than that.
3. Windows 98/ME cannot address a FAT32 partition exceeding 137GB,
and Windows XP cannot create a FAT32 partition exceeding 32GB;
so in practice those are upper limits for a FAT32 partition.
NB: For various reasons, in practice the largest partition size
that can exist on a Windows 98/ME system is 127.53 GB.
Notes:
16-bit FAT (i.e. FAT16) is commonly referred to simply as FAT
by many disk tools (including FDISK.EXE and FORMAT.COM), and
in documentation and Help files accompanying those programs.
32-bit FAT (i.e. FAT32) is sometimes referred to as "BigFAT"
by disk tools, and in documentation and Help files.
See also: http://en.wikipedia.org/wiki/File_Allocation_Table
PARTITIONS
==========
The disk space is sub-divided into one or more separate Partitions
(usually called "Drives").
The Partition Table in the MBR sector defines:
- one Primary partition (of type 0C);
- one Extended partition (of type 0F) if disk space remains.
The Partition Table begining the Extended partition defines:
- one Logical partition (of type 0B), within the Extended partition;
- one further partition (of type 05), containing a Logical partition,
if the remaining disk space within the Extended partition permits.
The Partition Table beginning a Type 05 partition defines:
- one Logical partition (of type 0B), filling the Type 05 partition;
- one further partition (of type 05), containing a Logical partition,
if the remaining disk space within the Extended partition permits.
NB: There can be up to 32 partitions in all, on a FAT32 disk,
if the disk space within the Extended partition permits.
In a WinME (or Win98/98SE) system using 32-bit FAT -
1. The Primary DOS partition will normally be type 0C (i.e. the
the 1st entry in the MBR's partition table will be type 0C).
2. The Extended partition, in which the Logical partitions
are stored, will normally be type 0F (i.e. the 2nd entry
in the MBR's partition table will normally be type 0F).
NB: If the Extended partition ends at cylinder 1024 or later
(i.e. the hard disk exceeds 8GB), the Extended partition
must be type 0F. If it is not, data damage will occur.
3. Each Logical partition (INCLUDING the first) will normally be
type 0B (i.e. the 1st entry in each E-MBR partition table, with
which the Logical partition begins, will normally be type 0B).
NB: Each partition table sector (other than the MBR sector
at CHS 0-0-1) is called an Extended MBR (E-MBR) sector,
because it's part of the Extended partition.
4. Each Logical partition (EXCEPT the first), although part
of the Extended partition, will also be in an individual
partition of its own, of type 05 (i.e. the 2nd entry, if any,
in each E-MBR partition table will normally be type 05).
If a partition table (in the MBR or any E-MBR sector) does NOT
specify the normal partition type expected, check carefully to
establish why! An abnormal partition type may cause data damage.
PARTITION TYPES
===============
ID types in Partition Tables -
FAT32 typically uses four main partition types: 05, 0B, 0C and 0F
(these are numerical values, expressed in hex: i.e. hexadecimal).
NB: The procedures set out in this page are ONLY safe to use with
a hard disk that has those partition types AND NO OTHER.
0C = FAT32 Primary DOS Partition, ending at cylinder 1024 or later
Type: FAT32X (Type 0B with Interrupt-13 extensions)
(i.e. FAT32 with LBA) ("Win95 FAT32 (LBA)") (Entry No.1 in MBR)
(NB: The normal type of FAT32 for a Primary partition larger
than 8GB; i.e. where the 1024 cylinder limit is exceeded)
Note: If the disk is bootable and contains only one partition,
that will be a Primary DOS Partition (i.e. type 0C).
0F = FAT32 Extended Partition, ending at cylinder 1024 or later
Type: Extended X (Type 05 with Interrupt-13 extensions)
(i.e. FAT32 with LBA) ("Win95 Extended") (Entry No.2 in the MBR)
(NB: The normal type of FAT32 for an Extended partition on a disk
larger than 8GB, i.e. where the 1024 cylinder limit is exceeded)
NB: This is a container of partitions (not a container of data),
as indicated by its being labelled an "Extended" partition.
Note: If there is more than one partition, an Extended partition
(i.e. type 0F) contains all of them except the first one.
Note: The 2nd partition will be a Logical partition (i.e. type 0B);
as will any further partitions (e.g. the 3rd, 4th, etc).
Note: If there are only two partitions on the disk, the 2nd partition
will normally completely fill the Extended partition. If the disk
has three or more partitions, each Logical partition will occupy
PART of the Extended partition, but without any overlapping.
0B = FAT32 Partition ("Win95 FAT32") (NB: Originated in Windows 95)
(Entry No.1 in an E-MBR)
(NB: All Logical partitions on a FAT32 disk are type 0B)
Note: If a FAT32 disk contains more than one partition, the
2nd partition (i.e. the 1st Logical partition), and any
subsequent partition(s), will each be type 0B.
05 = MS-DOS Extended Partition
(Entry No.2 in an E-MBR)
(NB: On a FAT32 disk a second or subsequent Logical partition
is contained in - and entirely fills - a partition of type 05)
NB: This is a container of partitions (not a container of data),
as indicated by its being labelled an "Extended" partition.
Note: If there are MORE than two partitions on the disk, the
3rd partition (i.e. the 2nd Logical partition), and any
subsequent one, each completely fills one type 05 partition.
Hidden Partitions:
1B = Hidden FAT32 0B Partition
1C = Hidden FAT32 0C Partition (e.g. hidden IBM rescue partition)
A hidden partition type starts with a 1, and an unhidden type
starts with a 0. To hide a partition, change leading 0 to 1.
For example: Type 0B is FAT32, and type 1B is Hidden FAT32.
Warning for Windows 95:
Types 0E and 0F can cause data loss in Win95 (but not in Win98 or
WinME), if you exit from Windows to MS-DOS mode WITHOUT rebooting
(although only if the Disk has more than one partition).
This fault can be cured by installing the updated Windows 95 file
DISKTSD.VXD v4.00.952 (dated 3/22/96), or any later version.
Note on FAT16:
If the partition type is 06 the partition is using FAT16. This also
means that the partition size cannot be larger than 2GB.
NB: A FAT16 disk cannot safely be repaired using any procedure set out
here; there are crucial differences from FAT32 in the MBR, in the
Partition Table, in the Boot Sector, in the Boot Record, in the
File Allocation Table structure, and in the Root Directory table.
PARTITIONING RULES
==================
Partitioning rules demand that a partition MUST end on a
Cylinder boundary (1 Cylinder = 255 x 63 = 16,065 sectors);
i.e. every partition *must* be a multiple of 16,065 sectors.
NB: This is a FUNDAMENTAL requirement. Data damage is a
certainty if this rule is breached!
NB: This ONLY applies to the Primary DOS partition and the
Extended Partition, not to Logical partitions within
the Extended Partition. But the 1st Logical partition
will also obey this if it's the ONLY Logical partition
and it occupies ALL the space in the Extended partition.
Partitions are thus "cylinder aligned": they invariably start
and end on a cylinder boundary (even though a Cylinder is now
only a logical, rather than a physical, disk structure).
NB: For tools to convert LBA values to CHS, and vice versa,
see below under PTCALC.EXE and CONVERSION CALCULATIONS
Therefore many partitions begin with the CHS address xxxx-0-1
(i.e. the first sector of a cylinder), and will end with the
CHS address xxxx-254-63 (i.e. the final sector of a cylinder).
NB: The Partition Table will therefore be at CHS xxxx-0-1
and the Boot Sector will therefore be at CHS xxxx-1-1
Although Logical partitions (other than the 1st Logical partition)
can begin part-way through a Cylinder, they nevertheless will NOT
begin part-way through a Head; they always start at CHS xxxx-x-1.
PARTITION STRUCTURE
===================
It may help in understanding disk structure to think of
a partition as starting with a Partition Table, followed
63 sectors later (i.e. 1 Head later) by a Boot Sector.
NB: Technically, though, the Partition Table defines
the Partition (as begining with the Boot Sector),
and is NOT treated as being part of the Partition.
The Boot Sector defines the 63 sectors containing the
Partition Table as "hidden sectors", and they are NOT
counted as part of the Partition by any disk tool.
Examples:
In the case of the Primary DOS partition, the Partition Table
is in the MBR sector, at CHS 0-0-1; and the Boot Sector is in
CHS 0-1-1 (i.e. 63 sectors later).
In the case of Logical Partitions, the relationship is clearer:
the 1st Logical partition is defined in the MBR as beginning
with its Partition Table sector (the MBR points to that sector).
NB: Technically, the MBR is defining the Extended partition, by
pointing to the first sector of it (which happens to contain
the Partition Table for the 1st Logical partition).
As with the Primary partition, the 63 sectors containing
the Partition Table are defined as NOT being a part of the
1st Logical partition and are treated as "hidden sectors".
Note on Partition Reconstruction:
The Boot Sector usually contains all the necessary information
(see below) to undelete the partition that it belongs to.
Every partition begins with a Boot Sector, immediately preceeded
by 1 Head (typically 63 sectors) containing a Partition Table.
Thus a partition ends immediately before a sector that contains
ONLY another Partition Table (not any boot code, because Logical
partitions are not bootable). The sector will be entirely BLANK
(i.e. filled with zeros), except for a 12 byte Partition Table.
NB: A Logical partition can be bootable, but only in special
circumstances not usually encountered (see below).
To be valid, a Partition Table usually must be on a cylinder boundary
(but see above, under "PARTITIONING RULES"). (NB: If it is not, it
is probably a backup copy, created by some disk recovery tool)
NON-DOS PARTITION
=================
The first 63 sectors on the Disk (CHS 0-0-1 to 0-0-63). For
historical reasons, sometimes called "Track 0".
NB: Although called the "Non-DOS Partition" this is NOT truly
a partition at all, as it does not contain any user data.
(As disks were once so small that they usually had only a
single DOS partition, the name "Non-DOS Partition" arose)
It starts at sector 1 (CHS 0-0-1) (LBA 0) and ends at sector 63
(CHS 0-0-63) (LBA 62); a hidden 63 sectors at the start of the
disk. It contains the Partition Table for the entire Disk.
NB: The LBA sector numbering starts at 0, whereas CHS sector
numbering starts at 1; hence there is a discrepancy of 1.
Sector 1 (CHS 0-0-1), the Master Boot Record (MBR), contains:
the Initial Program Loader (IPL) code, BIOS Parameter Block (BPB),
and the Partition Table.
All other sectors are usually blank; but special backup software
sometimes stores recovery data in the 62 empty sectors, so it is
prudent to make a backup copy of ALL the 63 sectors of Track 0.
Examples:
(a) Sector CHS 0-0-3 sometimes contains recovery data.
(b) Sector CHS 0-0-9 typically contains a backup copy
of the MBR sector from CHS 0-0-1.
(c) Sector CHS 0-0-62 sometimes contains recovery data.
(d) Sector CHS 0-0-63 sometimes contains recovery data.
The name "Non-DOS partition", used for historical reasons, is
misleading. This is NOT a partition: it contains NO user data.
It's actually an essential part of ALL the partitions on the
disk, because it contains the Master Partition Table.
Master Boot Record (MBR) -
The Master Boot Record is located in the first physical sector of
the disk. It contains some executable code and the Partition Table.
The executable code is loaded into RAM at boot time and executed.
Its role is to determine which partition is the bootable one,
and then to load and execute the code in the Boot Sector of that
partition (which in turn loads the Operating System, i.e. Windows).
FDISK's notorious /MBR command recreates the executable code in
the Master Boot Record (but on Disk 0 only).
NB: That command will be HARMFUL if any drive overlay software is
installed (e.g. OnTrack Disk Manager), to handle large disks,
something that is required only on a disk larger than 127.53 GB.
The loader code in the MBR on such a disk is not standard code;
the command will destroy the special loader code, so the disk
will no longer be accessible. (The Partition Table information
is also not the same on such a disk as it would be on a disk
that does not have drive overlay software.)
NB: That command will also be HARMFUL if -
(a) the Hard Disk has more than four partitions, or
(b) the Hard Disk has dual-boot capability installed, or
(c) the Hard Disk was originally partitioned using a SpeedStor
utility from Storage Dimensions, with the /BOOTALL option.
Structure of MBR Sector:
Offset Nature Size
-------- ------------------------- ---------
00(hex) Executable code 446 bytes
1BE(hex) 1st partition table entry 16 bytes
1CE(hex) 2nd partition table entry 16 bytes
1DE(hex) 3rd partition table entry 16 bytes
1EE(hex) 4th partition table entry 16 bytes
1FE(hex) Executable marker (55 AA) 2 bytes
Executable Code:
On a FAT32 hard disk, formatted by Windows 98/98SE/ME, the first 446 bytes
of the MBR Sector normally look like this (in Hex and ASCII):
<------------------- Hexadecimal --------------------> <--- ASCII ---->
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF
---------------------------------------------------------------------------
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3м |P P | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ PW ˾ ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ It 8,t N ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ < t F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -F < t < t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :u+@F% u$UP ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A Xr Uu t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ V$ f ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ 3Ƀ N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N r)F >}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ tZ څu' ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ R F V Z ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 00 00 00 00 [ Ot3 ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3VVRP SQ V ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR BV$ ZXd r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B ^tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ W ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 ... [ ]
Notes -
1. Hexadecimal: Base 16 (0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F).
2. ASCII: American Standard Code for Information Interchange
(a set of 255 characters, including A to Z and 0 to 9).
3. For each 2-digit hexadecimal number in the above table,
you can identify its (hexadecimal) address in the sector
by combining the row number (hex) in the left-hand margin
with the column number (also in hex) across the top;
e.g. the number in the 3rd column of the 3rd line is 7C
and its address is 22 hex: 0020 (left column) + 02 (top).
Examples: Copies of sector CHS 0-0-1 are set out below, saved by
the program MBRSCAN.EXE from several FAT32 disks, as examples of
the correct code for that sector (see MBRSCAN RESULTS).
CHS values in the MBR:
If the disk is larger than 8GB, the only VALID numbers in the MBR
are the LBA sector numbers (the numbers in the fields "sectors"
and "sectors before"). The CHS values in the MBR are NOT correct
as they stand: they are "L-CHS" values (see above); a conversion
factor must be applied to them to calculate the true CHS values.
Disk Serial Number:
The six bytes DA to DF (bytes 219 to 224) in the MBR sector are
a serial number, used by Windows to identify the different disks
attached to the computer. [NB: In line 14, on a standard display]
NB: Those six bytes are highlighted in green in the table above.
They are shown set to zero in this example.
If two hard disks have the same serial number, a fault will occur
during bootup (because, in effect, both have the same "address").
The fault can be prevented, or repaired, by manually zeroing these
six bytes (a.k.a. the "mystery bytes") on either disk. This forces
Windows to allocate a new serial number to the disk, on the next
bootup, thereby preventing a clash of disk addresses.
NB: This serial number must NOT be confused with -
(a) the hardware serial number, set by the disk's manufacturer
(a.k.a. the "physical serial number"), on the disk's label;
(b) the serial number that Windows allocates to each Partition
(the Volume Serial Number), to allow it to differentiate
between the different partitions [readable with CHKDSK.EXE].
This fault may cause the following errors:-
1. Windows may refuse to start.
Restart in DOS, and use a Disk Editor (below) to set the six
bytes to 00 (zero hex), on either disk.
2. Windows may WIPE the system registry.
The registry can be restored in DOS from the backups in
C:\WINDOWS\SYSBCKUP by using the following commands (and
then carrying out the on-screen instructions):
SET PATH=%path%;C:\WINDOWS\COMMAND
SCANREG /RESTORE
3. Windows may change the Volume Identifier on the affected disk,
setting it as non-bootable. If it's subsequently installed as
the Primary Master, the computer will not boot.
Use PowerQuest's Partition Table Editor to set the
Primary DOS partition on the disk to "active" (i.e. bootable).
Alternate MBR Type:
In practice, the following MBR sector is sometimes encountered.
This is (informally) the "90 E9 7D 01 FA" variant, as it always begins
with those 5 bytes. They immediately preceed the three bytes "33 C0 8E"
which typically begin a standard MBR in FAT32 (see above).
The first 446 bytes of this variant (i.e. the beginning of the sector,
prior to the Partition Table) are usually in the following form:
<------------------- Hexadecimal --------------------> <--- ASCII ---->
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF
---------------------------------------------------------------------------
0000: 90 E9 7D 01 FA 33 C0 8E-D0 8E C0 8E D8 BC 00 7C [ } 3Ўؼ | ]
0010: 8B F4 FB BF 00 06 B9 00-01 F3 A5 BB 20 06 FF E3 [ ]
0020: 90 90 BE 7D 07 81 3C AA-55 75 11 E8 58 00 73 0C [ } }Uu ]
0070: EA 00 7C 00 00 BE 6A 07-AC 0A C0 74 FE BB 07 00 [ | j t ]
0080: B4 0E CD 10 EB F2 BB 00-7E C6 07 13 C6 47 01 00 [ ~ G ]
0090: B2 80 B8 00 E0 CD 13 C3-BF 00 7E BA F0 01 B3 A0 [ ÿ ~ ]
00A0: E8 84 00 72 0C B1 01 E8-48 00 72 05 E8 19 00 73 [ r H r s ]
00B0: 16 F6 C3 10 75 05 80 CB-10 EB E5 81 FA 70 01 74 [ u p t ]
00C0: 05 BA 70 01 EB D8 F9 C3-81 BD FE 01 55 AA 75 17 [ p Á Uu ]
00D0: 8B 75 02 81 FE BE 01 77-0E 03 F7 81 3C AA 55 75 [ u w 00 00 00 00 00 00 ... [ ]
Notes -
1. Excludes the final 66 bytes of the sector, which are unique to
each disk (because they contain the Partition Table).
2. I have come across this variant of the MBR sector so infrequently
that I can't be certain whether it is always in this exact form!
3. I have, in fact, come across variations in bytes 1B8 to 1BD (hex);
so those, at least, are not always in the form set out above.
But this might only be the case on an NTFS disk, not FAT32.
[NB: Bytes 1B8 to 1BD are highlighted in green in the above table]
4. The final two bytes of the sector are always "55 AA".
5. As the MBR is non-standard, the Boot Sector is likely to be so too.
NB: I have seen this variant with FAT32 hard disks and with NTFS disks.
Partition Table
The Partition Table is located in the MBR Sector (CHS 0-0-1)
at offset 1BE hex (byte 447).
The Partition Table (64 bytes) contains four 16-byte entries.
(NB: Any not in use will be empty, i.e. filled with zero's)
The format of each 16-byte entry (see PTEDIT.EXE, below):
- Boot indicator (00h = Not active; 80h = Bootable) (1 byte)
- Starting Head number (0 to 254) (1 byte)
- Starting Cylinder number (0 to 1023) (10 bits)
and starting Sector number (1 to 63) (6 bits) (2 bytes)
- Partition Type (FAT32: Type 0C, 0F, 0B or 05) (1 byte)
- Ending Head number (0 to 255) (1 byte)
- Ending Cylinder number (0 to 1023) (10 bits)
and ending Sector number (1 to 63) (6 bits) (2 bytes)
- Relative sectors (see note, below) (4 bytes)
- Number of sectors in the partition (4 bytes)
This data in the Partition Table tells the Operating System where
each partition starts and ends on the disk, how big that partition
is, whether it's bootable, and the type of filesystem it contains.
The 'Ending cylinder number' is meaningless. 'Starting sector'
and 'Number of sectors in the partition' are enough to identify
the partition in FAT32: Partition type 0F uses INT 13 Extensions
that use those two numbers as LBA addresses, and does not use
the 'Ending cylinder number'.
NB: Where a CHS value is meaningless, it might be not fatal if
that value is incorrect!
CHS values in the Partition Table:
A single byte can hold a number up to 255 (FF hex). On this basis,
a disk would have a limit of 255 cylinders, 255 heads & 255 sectors.
For the Heads byte, this is in fact the case; but the other two
bytes are manipulated to allow for larger numbers.
Thus the Sector number is stored as a 6 digit binary number, and
the Cylinders as a 10 digit binary number. To fit the byte structure
of 8 bits to a byte, the first two digits of the Cylinder number
are chopped off and put on the front of the Sector number. It gives
a limit of 1023 cylinders, 255 heads, and 63 sectors (i.e. 8GB).
16 Bits (numbered 0 to 15) [Cylinder = 10 bits, Sector = 6 bits]:
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Cylinder bits 7 to 0 Cyl bits 9 & 8 Sector bits 5 to 0
Example: The number 957F(hex) -
Hex values : Byte #1 = 95(hex)
Byte #2 = 7F(hex)
Step 1: Convert those Hex numbers to Binary.
Step 2: Assign the resulting two 8-bit binary numbers to
two 8-bit registers (8 bits in a byte) as follows -
Bit # 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Binary 1 0 0 1 0 1 0 1 0 1 1 1 1 1 1 1
Step 3: The Cylinder value is derived from reading the Bits
in the following order (i.e. the "Cylinder bits"):
7, 6, 15, 14, 13, 12, 11, 10, 9, 8
In this example, doing so gives the Binary number
0110010101 which is 405 in decimal (Cylinder 405)
Step 4: The Sector value is derived from reading the remaining
Bits in the following order (i.e. the "Sector bits"):
5, 4, 3, 2, 1, 0
In this example, doing so gives the Binary number
111111 which is 63 in decimal (Sector 63)
4-Entry Structure:
The fact that the Partition Table has four entries imposed a limit
of four partitions on FAT16 disks, as each partition required one
of the Partition Table entries.
This four-entry structure is retained on FAT32 disks for backward
compatibility with FAT16-based Operating Systems and disk tools;
but FAT32 can have an unlimited number of partitions.
FAT32 uses only the first two entries in the Partition Table. The
1st entry defines the current partition (start sector and length),
and the 2nd entry points to the start of the next partition.
FAT32 partitions are thus linked together ("chained") by a series
of Partition Table sectors, starting with the MBR.
NB: A partition table sector at a location other than CHS 0-0-1
(i.e. located within the Extended partition) is known as an
Extended MBR (EMBR).
Relative Sectors:
In the MBR (sector CHS 0-0-1), the column "Relative Sectors"
holds the starting sector of each partition (i.e. usually
the Primary and Extended partitions), in LBA format.
Thus, in the MBR, "relative sectors" means the number of sectors
from the 1st sector of the disk.
EMBR "Relative Sectors":
In an EMBR partition table, the field "relative sectors" means the
number of sectors from the 1st sector of that Logical partition
(except in links to the next Partition Table sector).
In links to the next Partition Table sector, "relative sectors"
means relative to the start of the entire Extended partition.
NB: What this means in practice is that the "relative sectors"
field in Entry No.1 in an EMBR Partition Table is relative to
the first sector of the current partition; but that this
field in Entry No.2 in an EMBR Partition Table is relative to
the first sector of the entire Extended Partition.
NB: The Extended Partition is defined in the MBR (sector 0-0-1),
i.e. in Entry No.2 of the MBR's Partition Table. Each of the
subsequent Partition Tables defines only a Logical partition.
Note on PTEDIT.EXE:
PowerQuest's Partition Table Editor (PTEDIT.EXE) is confusing,
in that it doesn't display the Non-DOS Partition (LBA 0 to 62)
(because that is not a real partition).
The first partition it shows is the Primary DOS partition.
NB: Beeblebrox.exe, an alternative Partition Editor, might be
easier to understand: it's a little less confusing, as
it gives additional information in its Status line.
PRIMARY DOS PARTITION
=====================
This is the first partition on the Disk that is recognised by
DOS and Windows. It starts at CHS 0-1-1 (LBA sector 63).
NB: Its correct name is the Primary DOS Partition; but it's often
referred to loosely as simply the "Primary Partition". Also,
some DOS programs call it just "Primary DOS".
It is defined in the MBR Partition Table (at CHS 0-0-1) (LBA 0),
which specifies its 1st sector (always CHS 0-1-1) (LBA 63), and
its length in sectors.
Bootable:
The Disk is bootable if the Primary DOS partition is marked as
"active" in the MBR's Partition Table (at CHS 0-0-1).
NB: Only the Primary DOS partition can normally be bootable. A
Logical partition can't be set as "active" (i.e. bootable),
unless the earlier partitions have Hidden partition types.
Boot Record -
The partition's Boot Record is comprised of 3 sectors (the first
3 sectors of the partition):
- CHS 0-1-1 (LBA 63) : Boot sector
- CHS 0-1-2 (LBA 64) : FSInfo sector
- CHS 0-1-3 (LBA 65) : Boot Code sector
NB: Sometimes called the "Extended Boot Record", because
the old FAT16 boot record had only a single sector.
Boot Sector -
Located in the 1st sector of the Partition (CHS 0-1-1) (LBA 63),
incorporating the extended BPB (BIOS Parameter Block):
Size Comment Example
------- --------------------------------------------- --------
2 bytes Jump instruction (jump to IPL boot code) EB58
1 byte NOP instruction 90
8 bytes OEM ID - Name of formatting Operating System MSWIN4.1
(start of BPB in FAT32) (53 bytes)
2 bytes Bytes per sector [200(hex) = 512] 200h
1 byte Sectors per cluster [40(hex) = 64 (i.e.32KB)] 40h
[NB: 10(hex) = 16 (8KB); 20(hex) = 32 (16KB)]
2 bytes Number of reserved sectors [NB: 20(hex) = 32] 20h
(Number of sectors before the first FAT)
(32 sectors = CHS 0-1-1 to CHS 0-1-32)
(NB: 3 sectors are used for the Boot Record,
and 3 are used for the backup Boot Record;
but the remainder are unused and blank)
1 byte Number of File Allocation Tables (always 2) 2h
2 bytes No. of Root Directory entries (N/A in FAT32) 0000
(NB: Unlike FAT16, there is NO limit to the
number of files that can be stored in Root)
2 bytes Total number of sectors (Not used in FAT32) 0000
(Small Sectors field; where disk exceeds 32MB
the Large Sectors field is used instead)
1 byte Media Descriptor (Hard Disk = F8) F8h
(NB: Normally F8 on non-removeable media)
2 bytes Number of Sectors per FAT (Not used in FAT32) 0000
2 bytes Number of Sectors per Head [3F(hex) = 63] 3Fh
2 bytes Number of Heads per Cylinder [FF(hex) = 255] FFh
4 bytes Number of Hidden sectors [3F(hex) = 63] 3Fh
(Number of sectors in the Non-DOS partition)
(i.e. sectors CHS 0-0-1 to 0-0-63: Track 0)
4 bytes Total number of sectors in this partition
(a.k.a. "Large Sectors"/"Big Total Sectors")
(NB: MUST be non-zero in a FAT32 partition!)
4 bytes Number of Sectors per FAT (FAT32 disks only)
(The number of sectors occupied by each FAT)
2 bytes FAT handling flag (Enables FAT mirroring, 0000h
if set. If mirroring is enabled, all copies
(i.e. both copies) of the FAT are updated)
[NB: If set as 0, FAT mirroring is ENABLED]
2 bytes File system version (Always zero in Win9x) 0000h
4 bytes First cluster of Root Directory (usually 2) 2h
(NB: This identifies the Cluster in which
the Root Directory Table begins)
2 bytes File system info sector (FS Info Sector) 0001h
(The number of the sector in this partition
occupied by the FS Info sector) (usually 1)
(Sector count starts at 0; so 1 = CHS 0-1-2)
2 bytes Backup Boot Sector (NB: Usually 6) 0006h
(The number of the sector in this partition
occupied by the Backup Boot Sector)
(Sector count starts at 0; so 6 = CHS 0-1-7)
12 bytes Reserved (Value is always zero) 00 (all)
(end of BPB in FAT32)
(start of Extended BPB) (26 bytes)
1 byte Disk ID (Floppy = 00h, Hard Disk = 80h) 80h
1 byte Reserved for NT (This value is always zero) 00h
1 byte Extended Boot signature (Usually 29h) 29h
(NB: If value is 29h, the Extended BPB contains
also a Volume Serial Number & a Volume Label)
4 bytes Volume Serial Number (A random serial number,
created by FORMAT.COM to differentiate Drives)
11 bytes Volume Label (Some bytes may be spaces, 20h) DRIVE C
8 bytes File System type (a.k.a. File System ID) FAT32
(This is NOT conclusive: Windows does NOT read
this value, it determines the FAT type SOLELY
from the number of clusters in the partition!)
(end of Extended BPB)
Total = 90 bytes (Address 00h to 59h, inclusive)
420 bytes The next 420 bytes are the IPL (Initial Program Loader)
boot code (which passes control to the Operating System
in the active Partition), and the Partition Table.
2 bytes The final 2 bytes are the 2 signature bytes (55AA hex),
which mark the end of the Boot Sector.
Notes -
(1) Wherever an entry comprises 2 or more bytes, as usual
these are read from right-to-left (i.e. little endian).
(2) A number followed by the letter h means a Hexadecimal number.
Examples: Copies of sector CHS 0-1-1 follow (below), saved by the
program MBRSCAN.EXE from several disks, as examples of the correct
code for that sector.
First 3 Bytes:
The MBR transfers CPU execution to the boot sector; so the first
three bytes of the boot sector must be valid executable x86-based
CPU instructions. This includes a jump instruction that skips the
next several non-executable bytes.
Following the jump instruction is the 8-byte OEM ID (MSWIN4.1),
a string of characters that identify the name and version number
of the Operating System that formatted the partition.
Jump Instruction (3 bytes):
Instructs the computer to jump over the BPB (Bios Parameter Block)
to the first byte of executable code (the first byte after the BPB
and Extended BPB). The jump is 88 bytes (58 hex), to byte 5A(hex),
which is the first byte of the Initial Program Loader (IPL) code.
NB: The first 3 bytes (EB 58 90) are called the Jump Instruction,
but only the first two bytes are the actual JMP instruction
(a two-byte SHORT jump, executing a jump to the remainder of
the executable code). The third byte (90 hex) is just a NOP
instruction [NOP = 'No Op', i.e. do nothing].
FAT Mirroring (2 bytes):
Bits 0-3 : The number of the active FAT (starting from 0, not 1).
(Only valid if mirroring disabled, i.e. if bit 7 = 1)
Bits 4-6 : Reserved (i.e. not used).
Bit 7 : A value of 0 means the FAT is mirrored into all FATs.
A value of 1 means only one FAT is active (i.e. the
one specified in bits 0-3).
Bits 8-15: Reserved (i.e. not used).
NB: There are 8 bits in a byte (usually numbered from 0 to 7)
FS Info Sector (2 bytes):
This MUST point to the FS Info Sector (which is invariably the
second sector in the partition, i.e. CHS 0-1-2). This value is
always 1 (as the LBA sector count starts at 0) (0 = CHS 0-1-1).
The only other possible value in this field is 0 (zero), which
appears to mean the FS Info Sector is to be ignored (i.e. that
it will not be used).
NB: In that situation, the O/S will recalculate the amount of
free space on the disk whenever that value is needed (a
slower procedure than simply looking it up), instead of
storing the free space value in the FS Info Sector.
Sanity Check of Boot Sector:
All the following mandatory elements must be present:-
- The jump signature must be EB or 90 or E0
- The sector size (i.e. Bytes per Sector) must be 512
- The cluster size (i.e. Sectors per Cluster) must be:
1, 2, 4, 8, 16, 32, 64 or 128
- The FAT32 version must be 0.0
- There must be 2 copies of the FAT
- The media type must be F8 (though it's an obsolete feature)
- The signature (i.e. File System ID) should be "FAT32"
(though it's meaningless)
- The sector must end with the hex value AA55 (written as 55AA)
NB: Although not strictly a sanity check, the ultimate test
of the boot sector's validity is whether it matches the
contents of the backup boot sector (usually CHS 0-1-6).
FS Info Sector -
File System Information Sector (FS Info Sector) (CHS 0-1-2)
The second sector of the partition. There is a pointer to it
in the partition's Boot Sector (at bytes 49 & 50).
The ID marker RRaA at the start of the sector marks it as an
Extended Boot Record. A similar ID, rrAa (the same letters,
but with the case of the letters inverted) marks the start of
the "Total Free Clusters" and "Next Available Cluster" data.
Offset Description Size
------ -------------------------------------------- ---------
00h ID marker (Always 52 52 61 41) (ASCII: RRaA) 4 bytes
(Lead signature; validates the sector)
04h Null (all 00h) 480 bytes
1E4h ID marker (Always 72 72 41 61) (ASCII: rrAa) 4 bytes
(Structure signature; validates the sector)
1E8h Number of Free Clusters 4 bytes
(Contains the last-known free cluster count)
(NB: The count is unknown if FFFFFFFF or -1)
1ECh Cluster # where the O/S should start looking 4 bytes
for free clusters. (If the value is FFFFFFFF
the O/S should start looking from Cluster 2)
(NB: Located at Bytes 493-496 [1ECh to 1EFh])
[Cluster 2 is written in hex as: 02 00 00 00]
1F0h Reserved (all 00) 12 bytes
1FCh Null (00 00) 2 bytes
1FEh ID marker (55AA hex) 2 bytes
(Trailing signature; validates the sector)
Both ScanDisk for DOS (SCANDISK.EXE) and ScanDisk for Windows
(SCANDSKW.EXE) check the amount of free space in the partition
(the "free cluster count"), and correct the value stored in
the FS Info Sector if it's wrong (but NOT if the Boot Sector's
pointer is 0 (i.e. zero): this prevents detection of the error).
NB: Norton's DiskEdit CANNOT detect an error in the "free cluster
count"; the only tools that can detect and fix it are ScanDisk
and Norton Disk Doctor.
NB: It appears that NO critical disk operations are dependent on
the accuracy of the "free cluster count", which seems to be
provided for information only.
WARNING:
You should not run CHKDSK or SCANDISK or any other disk scanning
program if the disk has crashed, or there is any logical error in
the MBR or Boot Record, or the FAT or Root Directory is corrupted.
It may make data information distorted, and can cause data loss.
*** Routine to view the FS Info Sector ***
View the current state of the FS Info sector to discover:-
- The number of free clusters.
- The cluster number at which the O/S will begin looking
for free clusters (those marked 0 in the FAT); usually,
but not always, this points to the first free cluster.
NB: The O/S often specifies Cluster 2 as the one to start
looking for free clusters from, since this leaves no
chance of missing any unused clusters in the search.
NB: Whenever ScanDisk corrects an error in the FSInfo Sector
it resets the "start from" value to 2.
** View FSInfo Sector of Drive C (using XVI32.EXE) **
FINDPART GETSECT 1 0 1 2 1 DISK_C.FS noheader badf6
C:\Progra~1\HexEdi~1\XVI32.exe DISK_C.FS
** View FSInfo Sector of Drive D **
FINDPART GETSECT 2 0 1 2 1 DISK_D.FS noheader badf6
C:\Progra~1\HexEdi~1\XVI32.exe DISK_D.FS
** View FSInfo Sector of Drive E **
FINDPART GETSECT 1 1275 1 2 1 DISK_E.FS noheader badf6
C:\Progra~1\HexEdi~1\XVI32.exe DISK_E.FS
Sanity Check of FSInfo Sector:
Make sure that FSInfo Sector is sector 1 or later of the partition,
counting from 0 (it's normally sector 1); and that it's within the
reserved disk area; and that its sector number is not the same as
that used for the Backup BootSector; and that its three signatures
are correct (though only the second is documented by Microsoft).
If it does not satisfy these conditions, do not use the sector;
but the file system should still be usable.
NB: The number of free clusters is normally checked only by disk
analysis programs: it is not critical to the filesystem.
Boot Code sector -
The 3rd sector of the partition (CHS 0-1-3)
It contains boot code (510 bytes of boot program code), beginning
with the ID marker "FA 66 OF" (though this is NOT a unique marker).
It ends with a two byte ID signature (55AA hex).
This sector contains NO system-specific information! It contains
only standard code that is identical on all FAT32 disks.
Executable Code:
On a FAT32 hard disk, formatted by Win98/98SE/ME, the Boot Code sector
normally looks like this (in Hex and ASCII). 32 lines of 16 bytes each:-
<------------------- Hexadecimal --------------------> <--- ASCII ---->
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF
---------------------------------------------------------------------------
0000: FA 66 0F B6 46 10 66 8B-4E 24 66 F7 E1 66 03 46 [ f.F.fN$ff.F ]
0010: 1C 66 0F B7 56 0E 66 03-C2 33 C9 66 89 46 FC 66 [ .f.V.f.3fFf ]
0020: C7 46 F8 FF FF FF FF FA-66 8B 46 2C 66 83 F8 02 [ F....fF,f. ]
0030: 0F 82 CF FC 66 3D F8 FF-FF 0F 0F 83 C5 FC 66 0F [ .f=....f. ]
0040: A4 C2 10 FB 52 50 FA 66-C1 E0 10 66 0F AC D0 10 [ .RPf.f.. ]
0050: 66 83 E8 02 66 0F B6 5E-0D 8B F3 66 F7 E3 66 03 [ f.f.^.ff. ]
0060: 46 FC 66 0F A4 C2 10 FB-BB 00 07 8B FB B9 01 00 [ Ff...... ]
0070: E8 BE FC 0F 82 AA FC 38-2D 74 1E B1 0B 56 BE D8 [ .8-t..V ]
0080: 7D F3 A6 5E 74 19 03 F9-83 C7 15 3B FB 72 E8 4E [ }^t...;rN ]
0090: 75 D6 58 5A E8 66 00 72-AB 83 C4 04 E9 64 FC 83 [ uXZf.r.d ]
00A0: C4 04 8B 75 09 8B 7D 0F-8B C6 FA 66 C1 E0 10 8B [ .u.}.f. ]
00B0: C7 66 83 F8 02 72 3B 66-3D F8 FF FF 0F 73 33 66 [ f.r;f=...s3f ]
00C0: 48 66 48 66 0F B6 4E 0D-66 F7 E1 66 03 46 FC 66 [ HfHf.N.ff.Ff ]
00D0: 0F A4 C2 10 FB BB 00 07-53 B9 04 00 E8 52 FC 5B [ ....S..R[ ]
00E0: 0F 82 3D FC 81 3F 4D 5A-75 08 81 BF 00 02 42 4A [ .=?MZu...BJ ]
00F0: 74 06 BE 80 7D E9 0E FC-EA 00 02 70 00 03 C0 13 [ t.}...p... ]
0100: D2 03 C0 13 D2 E8 18 00-FA 26 66 8B 01 66 25 FF [ ....&f.f%. ]
0110: FF FF 0F 66 0F A4 C2 10-66 3D F8 FF FF 0F FB C3 [ ...f..f=... ]
0120: BF 00 7E FA 66 C1 E0 10-66 0F AC D0 10 66 0F B7 [ .~f.f..f. ]
0130: 4E 0B 66 33 D2 66 F7 F1-66 3B 46 F8 74 44 66 89 [ N.f3ff;FtDf ]
0140: 46 F8 66 03 46 1C 66 0F-B7 4E 0E 66 03 C1 66 0F [ Ff.F.f.N.f.f. ]
0150: B7 5E 28 83 E3 0F 74 16-3A 5E 10 0F 83 A4 FB 52 [ ^(.t.:^..R ]
0160: 66 8B C8 66 8B 46 24 66-F7 E3 66 03 C1 5A 52 66 [ ffF$ff.ZRf ]
0170: 0F A4 C2 10 FB 8B DF B9-01 00 E8 B4 FB 5A 0F 82 [ ..߹..Z. ]
0180: 9F FB FB 8B DA C3 00 00-00 00 00 00 00 00 00 00 [ .......... ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ]
01C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ ..............U ]
Notes -
1. Hexadecimal: Base 16 (0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F).
2. ASCII: American Standard Code for Information Interchange
(a set of 255 characters, including A to Z and 0 to 9).
3. For each 2-digit hexadecimal number in the above table,
you can identify its (hexadecimal) address in the sector
by combining the row number (hex) in the left-hand margin
with the column number (also in hex) across the top;
e.g. the number in the 3rd column of the 3rd line is F8
and its address is 22 hex: 0020 (left column) + 02 (top).
Backup Sectors -
The 7th sector of the partition (CHS 0-1-7) (LBA 69) (at 8A00 hex)
contains a BACKUP copy of CHS 0-1-1 (LBA 63) (Boot sector).
The 8th sector of the partition (CHS 0-1-8) (LBA 70) (at 8C00 hex)
contains a BACKUP copy of CHS 0-1-2 (LBA 64) (FS Info sector).
NB: This backup of the FS Info Sector is NOT kept synchronised
with the main FS Info Sector. Its "Number of Free Clusters"
is set to -1 and its "Most Recently Allocated Cluster" is 2
(suggesting that those were the initial settings used by the
formatting program which created this partition, e.g. FDISK)
The 9th sector of the partition (CHS 0-1-9) (LBA 71) (at 8E00 hex)
contains a BACKUP copy of CHS 0-1-3 (LBA 65) (Boot Code sector).
Reserved Sectors -
As specified in the partition's Boot Sector (CHS 0-1-1) (LBA 63), the
first 32 sectors of the Partition (CHS 0-1-1 to 0-1-32) are reserved.
CHS 0-1-1 to 0-1-9 are in use, as above. The remainder of the
32 reserved sectors (CHS 0-1-10 to 0-1-32) only contain zeros; and
are immediately followed by the 1st FAT, which starts at CHS 0-1-33.
File Allocation Table -
The 1st FAT begins in the first sector after the number of
Reserved Sectors specified in the partition's Boot Record.
NB: In a FAT32 partition, the Boot Sector (CHS 0-1-1) usually
specifies 32 reserved sectors (20 hex), thus the 1st FAT
begins in CHS 0-1-33 (the 33rd sector of the Partition),
i.e. LBA 95 (a.k.a. "Absolute Sector 95").
The FAT begins with a unique marker (usually "F8 FF FF FF")
(see below).
If FAT mirroring is enabled (in the Boot Sector), a backup
copy - or "mirror" - of the FAT is kept. This second FAT
is stored immediately after the first FAT, and can be
used by the Operating System if the first FAT is damaged.
Example:
FAT size for an 80GB partition = 19,075 sectors
(according to PowerQuest's Partition Manager, PTEDIT.EXE)
so FATs 1 and 2 = 19,075 x 2 = 38,150 sectors (19,075 KB)
The 2nd FAT begins at CHS 1-49-19 (LBA 19,170) (95C400 hex)
because 95 + 19,075 = 19,170 (since there are 95 sectors
before the 1st FAT: CHS 0-0-1 to CHS 0-1-32 inclusive).
Root Directory -
The Root Directory table usually begins in the first sector after
the 2nd FAT. That sector can be calculated from the CHS address
of the starting sector of the 1st FAT, as follows:
(Cylinders x 255 x 63) + (Heads x 63) + (Sectors x 1)
+ (Big Total Sectors per FAT x 2) - 1 = LBA Sector
To convert that LBA sector number to a CHS value, see the
note "Convert from Sectors to CHS" (below); or use the
Win9x program PTcalc.exe (a CHS calculator for Windows).
NB: The root directory on a FAT32 partition can legitimately
be located anywhere in the partition! Its cluster address
is stored in the Boot Sector; this can point to any cluster
in the partition, it need not point to cluster 2.
The Root Directory table occupies 1 Cluster (64 sectors,
if cluster size is 32K). Those sectors are mostly empty;
they reserve space which the table can use if necessary.
But if that space is fully used, the Root Directory Table
(like any file) can continue in another cluster.
Note: The amount of space occupied in the table by a file's
Directory entry depends upon whether the file has a
Long File Name; so the number of files which will
fill up 64 sectors can vary.
Note: Where the cluster is full, a pointer is set indicating
the next cluster used to store the table.
Example (Hard Disk WD800JB, Drive C):-
Data for 1st FAT -
Starting sector of 1st FAT: CHS 0-1-33
Size of 1st FAT in sectors: 9,992
Step 1: Calculate in REAL sectors -
CHS 0-1-33 = (0 x 255 x 63) + (1 x 63) + (33 x 1) = 96
96 + (2 x 9,992) = 20,080
Step 2: Convert REAL sectors to CHS -
1 Cylinder = 255 heads x 63 sectors = 16,065 sectors
(i.e. Sectors / 16,065 = Cylinders)
20,080 / 16,065 = 1 cylinder (Remainder = 4,015)
1 Head = 63 sectors
(i.e. Remainder / 63 = Heads)
4,015 / 63 = 63 heads (Remainder = 46)
1 Sector = 1 sector
(i.e. Remainder = Sectors)
46 / 1 = 46 sectors
CHS = 1-63-46
Step 3: Convert REAL sectors to LBA -
Real Sectors - 1 = LBA
20,080 - 1 = 20,079
CHS address of Root Directory Table:
Western Digital WD800JB 80GB
Primary DOS Partition (Drive C:) = CHS 1-63-46 (LBA: 20,079)
1st Logical Partition (Drive E:) = CHS 1277-17-49 (LBA: 20,516,124)
Western Digital WD800JB 80GB
Primary DOS Partition (Drive D:) = CHS 2-97-9 (LBA: 38,249)
M02GB2: SeaGate ST320423A 18GB (Win98 HDD)
Primary DOS Partition (Drive D:) = CHS 1-40-39 (LBA: 18,623)
NB: CHS 0-0-1 = LBA 0 (i.e. Add 1 to convert LBA into actual sectors)
Files -
Actual files begin in the first sector after the cluster
reserved for the Root Directory Table, i.e. in cluster 3.
NB: On a WinME system, the directory table for the RECYCLE bin
(a hidden system directory) usually occupies cluster 3.
Address of cluster 3 =
(1st sector of Root Directory Table, LBA) + (Sectors per Cluster)
NB: Sectors per Cluster = Bytes in each Allocation Unit / 512
(Run CHKDSK.EXE, where "allocation unit" means a Cluster)
[Usually 64 sectors per cluster if partition exceeds 32GB]
Example (Drive D, 80GB):
LBA 38,249 + 64 = LBA 38,313 (CHS 2-98-10)
EXTENDED PARTITION
==================
A FAT32 disk typically has up to four partitions:
1 x Primary DOS Partition
1 x Extended Partition, containing up to 3 Logical Partitions
On a FAT32 disk, the second entry in the MBR Partition Table
(at CHS 0-0-1) defines the Extended Partition, specifying its
1st sector (the LBA sector number) and its length in sectors.
The first sector of the Extended Partition is called the EMBR
(Extended Master Boot Record).
The first sector of the Extended Partition reads just like
the MBR in sector CHS 0-0-1, but has blanks instead of code
in some locations. Where the Partition Table was in the MBR,
the first entry defines the 1st Logical partition.
NB: The 1st Logical Partition MUST fall entirely within
the Extended Partition.
NB: If the 1st Logical Partition does not completely fill
the Extended Partition, further Logical partitions can
exist in the remaining space.
If there are any more partitions, the second entry points to
the partition table of another Logical partition; the sector
number in this second entry is relative to the 1st sector of
the entire Extended Partition.
Thus the Extended Partition is sub-divided into one or more
Logical Partitions. In practice, there is NO limit to the
number of Logical Partitions: FAT32 is not constrained by
the fact that the Partition Table has only 4 entries, since
it never uses entries 3 or 4 (chaining the Partition Tables
instead, in a linked chain of EMBR sectors).
As the Partition Tables form a 'chain', if that chain is broken
at any point, all Logical partitions defined later in the chain
(beyond the 'breakpoint') cannot be accessed.
A Partition Table sector pointing to the next Partition Table
sector must ALWAYS point forward, never to a previous sector!
A Logical Partition is structured like the Primary Partition:-
- 63 "hidden" sectors, starting with a Partition Table
- 64th sector is the Boot sector
- 65th sector is the FS Info sector
- 66th sector is the Boot Code sector
- 96th sector is the start of the 1st FAT
Making a Logical Partition Bootable:
In theory, Logical drives are NOT bootable. In reality, this
limitation can be overcome by hiding any prior partitions;
i.e. assigning them a HIDDEN partition type.
For example, a Primary Partition of type 0C can be hidden by
changing it to type 1C. (NB: A partition type should ONLY be
changed by altering the leading 0 [zero] to a 1. It might be
unsafe to alter the partition type in any other way.)
Note on Partition Reconstruction:
Undeleting Logical partitions without causing Partition Table
errors is tricky. However, it is possible to undelete a Logical
partition as a Primary partition, in order to copy the data off
that partition (e.g. by hiding all the prior partitions).
NB: See also Pierre's Guide to Partition Table Recovery -
http://www.datarescue.com/laboratory/partition.htm
DELETING PARTITIONS
===================
Sometimes, due to a corrupt EMBR (Extended Master Boot Record)
chain, FDISK.EXE will not delete a particular partition correctly.
To delete the partition manually, change all the values in the
partition's entry in the Partition Table to 0.
PARTITION TABLE EDITOR
======================
PTEDIT.EXE
PowerQuest's Partition Table Editor for DOS, v1.0
This enables the Partition Table in the MBR sector to be edited
in a user-friendly GUI.
*** Edit the Partition Table ***
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
NB: There is also a version of the program that runs under Win9x
(PTEDIT32.EXE)
Calculate Partition:
To calculate all the CHS and LBA values in a Partition,
see below (under "CALCULATE LBA PARTITION").
Top of Page
SAVE DISK INFORMATION
=====================
CHKDSK.EXE
==========
*** Save Cluster information ***
CHKDSK C: > F:\CHKDSK_C.txt
CHKDSK D: > F:\CHKDSK_D.txt
CHKDSK E: > F:\CHKDSK_E.txt
MBRSCAN.EXE
===========
MBRSCAN v1.12
Saves MBR & Boot Sector information for any IDE, SCSI or USB
hard disk recognised by the BIOS.
Saves an exact record (as ASCII) of the disk's MBR sector
including the Partition Table, AND of each Boot Sector;
and saves partition details for each partition on the disk.
NB: The program's geometry function sometimes fails under
Windows. If so, run the program in DOS instead.
*** Save a report for Disk 1 ***
MBRSCAN 80 > F:\MBRscan.D1
*** Save a report for Disk 2 ***
MBRSCAN 81 > F:\MBRscan.D2
*** Save a report for Disk 3 ***
MBRSCAN 82 > F:\MBRscan.D3
*** Save a report for Disk 4 ***
MBRSCAN 83 > F:\MBRscan.D4
Note -
There are only four IDE channels (two per cable), so only
four IDE hard disks can be connected at any one time.
BIOS.EXE
========
BIOS.EXE v1.35
Save and Restore the computer's BIOS settings.
The program's functions:
- Save and restore the BIOS settings
- Validate actual settings to saved settings
- Delete the BIOS settings (there are some strange cases...)
- Display information about the BIOS, BIOS Extensions and
BIOS beepcodes
- Find BIOS passwords for Award, Ami, Phoenix and AST BIOS
- Find BIOS universal passwords for Award BIOS
- Dump the whole BIOS segment to disk
- Switch the 1st and 2nd level caches on/off
- Turn the PC into Standby or Suspend mode (requires APM 1.1+)
- Turn off the PC (requires APM 1.2+)
- Reboot the PC (cold/warm/int19)
- Return DOS error codes for batch processing
Syntax -
Usage: BIOS [option]
I = information on BIOS
X = information on BIOS extensions
B = information on BIOS beep codes
P = find BIOS passwords (only Award, AMI, PHOENIX and AST)
U = find BIOS universal password (only Award)
S [FILE] = save CMOS data [to FILE] (default: c:\bios.sav)
R [FILE] = restore CMOS data [from FILE] (default: c:\bios.sav)
V [FILE] = validate CMOS data [to FILE] (default: c:\bios.sav)
E = erase CMOS data
D [FILE] = dump BIOS segment [to FILE] (default: c:\bios.dmp)
A+/A- = enable/disable Advanced Power Management
L1+/L1-/L2+/L2- = enable/disable 1st/2nd level cache
Y = system information (requires LM7x/LM80/Winbond chipset)
C/W/Z = cold boot / warm boot / reset using Int 19h
M/N/O = standby / suspend / turn PC off
For updates look at http://www.geocities.com/mbockelkamp
For bug reports and improvement tips write to mbockelkamp@web.de
*** Save the BIOS ***
** Save BIOS settings to a Backup file **
BIOS S F:\CMOS.BIN
Note:
Do NOT do this in a Windows DOS box. The BIOS is divided
in two parts: the first contains procedures only needed
while booting, the second contains all other procedures.
The first part of the BIOS segment is used as conventional
memory after booting. If you try to make a BIOS dump from
within Win9x, you get a dump file with some normal memory
and the second part of the BIOS; the first part is missing.
** Compare the BIOS settings with a Backup file **
BIOS V F:\CMOS.BIN
Meaning of result codes -
000 - Everything OK
128 - V: Identical
129 - V: Not identical
130 - D: PC isn't in Real Mode
253 - Error in commandline
254 - Error in file operation
255 - Function not supported
** Restore the BIOS settings from a Backup file **
BIOS R F:\CMOS.BIN
*** Save additional BIOS information ***
BIOS I > F:\BiosInfo.txt
BIOS X > F:\BiosExtensions.txt
BIOS B > F:\BiosBeepCodes.txt
*** Save BIOS Password ***
BIOS P > F:\PASSWORD.txt
*** Save BIOS Password State ***
BIOS D BIOS.DMP
There are eight possible states -
1. No passwords, security option: setup
2. No passwords, security option: system
3. Only superviser password, security option: setup
4. Only superviser password, security option: system
5. Only user password, security option: setup
6. Only user password, security option: system
7. Both passwords, security option: setup
8. Both passwords, security option: system
*** Manage BIOS Cache from DOS ***
Enable 1st level cache:
BIOS L1+
Disable 1st level cache:
BIOS L1-
Enable 2nd level cache:
BIOS L2+
Disable 2nd level cache:
BIOS L2-
LOST BIOS PASSWORD
==================
The user can be locked out of the BIOS by a forgotten password!
A lost BIOS password usually has to be reset using a master password,
software program, or hardware jumper (to gain access to the BIOS).
A. Master Password
To bypass a BIOS password, try one of these standard manufacturer's
"backdoor" passwords.
(a) AWARD BIOS -
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256,
j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT,
SER, SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD,
ZBAAACA, ZAAADA, ZJAAADC, djonet, % p%, % p%
(NB: The last two passwords in that list are in Russian!)
(b) AMI BIOS -
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder
(c) AMI/AWARD or other BIOS -
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME,
Syxz, Wodj
Notes:
1. These passwords are Case Sensitive!
2. The key marked "_" on a US keyboard corresponds to "?" on some
European keyboards, so type AWARD?SW or AMI?SW when using one.
B. Software Solution - Reset the BIOS
To bypass the BIOS password, run the following program at startup. It
removes the password by resetting the BIOS to its default settings.
*** Clear (ERASE) BIOS settings ***
BIOS E
Alternatively, do the same manually. Use the MS-DOS tool DEBUG to
reset the BIOS to its default values: type DEBUG at the command prompt
in pure MS-DOS mode (NOT from an MS-DOS box in Windows); and then
type the following 2 line command:
For an AMI/AWARD BIOS -
O 70 17
O 71 17
Q
For a PHOENIX BIOS -
O 70 FF
O 71 17
Q
For a GENERIC BIOS -
O 70 2E
O 71 FF
Q
This invalidates the CMOS RAM, so should work on all AT motherboards;
XT motherboards don't have CMOS.
Notes: 1. The first character is the letter "O" not the number "0".
2. The numbers which follow it are two bytes in hex format.
3. The third line is Q (QUIT).
C. Hardware Solution - Reset the Jumper
On most motherboards there are not one but two sets of jumpers.
One resets the BIOS defaults (usually the one near the battery or
CMOS chip). The other resets the BIOS password (the password jumper).
NB: The motherboard's manual will identify the correct jumper!
NB: Most systems store the BIOS password in nvram (non-volitile ram),
which does NOT lose information when the power is off. Therefore
removing the CMOS battery will not reset the BIOS password!
D. Hardware Solution - Accessing the Data
To access data on a HDD, remove it from the inaccessible computer
and install it temporarily as IDE Primary Slave on another computer.
E. Other Solutions
There are other hardware solutions: e.g. short-circuiting the chip,
replacing the chip.
For these, see http://www.elfqrin.com/docs/biospw.html
The only other hardware option is to REPLACE the motherboard.
CMOS.COM
========
Save and Restore the CMOS settings.
Saves and restores all 114 bytes of CMOS memory. Many older
programs only save the first 50 bytes: this used not to matter
but many BIOS manufacturers are now using the 'high' 64 bytes.
Syntax -
CMOS /SAVE filename
Save CMOS to file "filename"
(NB: If no filename is specified, the default is CMOS.SAV)
CMOS /COMPARE filename
Verifies the contents of CMOS memory against a file
(NB: ERRORLEVEL 7 indicates a mismatch between CMOS and file)
CMOS /RESTORE filename
Load CMOS settings from file "filename" and reboot
(NB: If no filename is specified, the default is CMOS.SAV)
CMOS /DUMP
Dumps current contents of CMOS to the screen (or to STDOUT)
in hex. (NB: Useful only to hexperts)
Note:
Uses a different file format from other programs. You cannot
share data files between CMOS.COM and SAVECMOS.EXE or ROM2.EXE
as it uses a special file header to prevent the user loading
(for instance) AUTOEXEC.BAT or some other non-CMOS data into
CMOS memory, and to guarantee file integrity.
Note: Test this utility to determine whether it can correctly
save and restore your CMOS - before an emergency occurs!
*** Save the CMOS settings ***
CMOS /SAVE F:\CMOS.SAV
*** Compare the CMOS settings with Backup file ***
CMOS /COMPARE F:\CMOS.SAV
*** Restore the CMOS settings ***
CMOS /RESTORE F:\CMOS.SAV
Top of Page
SAVE A SECTOR
=============
This routine is designed to work with -
Svend's Utilities: FINDPART for DOS (version 4.72)
FINDPART for Windows (version 4.95 for FAT32)
NB: In this version of Svend's Utilities the GETSECT function is
a switch (i.e. an option) in FINDPART, not a seperate program
*** Preparation ***
1. Make an empty directory (C:\SAVED\DATA) to store output files in,
and put the Batch File in that directory.
2. Make an empty directory on a USB Disk at F:\DATA
to store a backup copy of the output files.
SYNTAX of FINDPART
==================
First is the number of the Disk (numbered from 1), e.g. 1
Next is the CHS number, e.g. 0 0 1
Next is the number of sectors to save, e.g. 1
Next specify a destination file, e.g. on Drive A: (floppy)
The option NOHEADER means only the actual data will be written,
not the identifying fileheader normally added by GETSECT
The option BADF6 means the program will write character F6 (hex)
for all bytes that can't be read (something that will only occur
if the Disk is physically damaged)
NB: The program WILL cope with bad sectors, writing the hex
character specified in place of every byte of a bad sector,
but its multiple read attempts will slow the program down
(such that to read a 19,075 sector FAT took 1.5 hours)
Note:
When examining a binary file saved by FINDPART (e.g. viewing it
with Norton's DISKEDIT), bear in mind that like any file it will
consist of 32 sectors (on a FAT32 partition with 16KB clusters),
therefore it does NOT contain only the content of the sector(s)
saved; a Disk Editor does NOT recognise the End Of File marker,
so will ALSO show the unused sectors, of those 32, containing junk
Abbreviations used in FINDPART'S output:
B Based on boot sector.
BU Based on backup boot sector (meaning that the boot sector
may be missing or damaged, or the partition is obsolete).
00 The boot sector is filled with ASCII character 0.
F6 The boot sector is filled with ASCII character 246.
R Reiser file system.
3 Ext3 file system.
H HPFS (OS/2) file system.
B5 A Linux boot sector with boot signature.
NR Boot sector not readable: bad sector, or outside disk area.
NB Nota Bene.
R0 The boot sector relative field is relative to LBA sector 0.
OK Okay.
!! An extended partition ending at cylinder 1024 or later (type 05).
* In front of ID: Active flag set.
After cylinder number: The actual entry is 1023.
After Cluster KB in FAT output: Based on boot sector.
After Root size/Cluster number in FAT output: Based on boot sector.
# After cylinder number: The actual entry is 1023/(heads-1)/sectors.
After Cluster KB in FAT output: Not confirmed in boot sector.
After Root size/Cluster number in FAT output: Not confirmed in
boot sector.
? In front of ID: Active flag not hexadecimal 00 or 80.
After partition line: Ending after end of disk.
DISK 1
======
NON-DOS PARTITION (Track Zero)
=================
*** Save Sector 0-0-1 (Master Boot Record & Partition Table) ***
FINDPART GETSECT 1 0 0 1 1 F:\0-0-1.D1 noheader badf6
*** Save Sector 0-0-9 (Sector 9 of Track 0) (Backup MBR) ***
FINDPART GETSECT 1 0 0 9 1 F:\0-0-9.D1 noheader badf6
*** Save Sector 0-0-1 to 0-0-63 (Entire Track 0) ***
FINDPART GETSECT 1 0 0 1 63 F:\0-0-1-63.D1 noheader badf6
Note:
Track 0 is usually *empty* except for CHS 0-0-1 and 0-0-9
Note: The above sectors only need to be saved ONCE,
as their values are permanent!
PRIMARY PARTITION
=================
*** Save Sector 0-1-1 (Boot Sector) ***
FINDPART GETSECT 1 0 1 1 1 F:\0-1-1.D1 noheader badf6
*** Save Sector 0-1-2 (FS Info Sector) ***
FINDPART GETSECT 1 0 1 2 1 F:\0-1-2.D1 noheader badf6
*** Save Sector 0-1-3 (Boot Data Sector) ***
FINDPART GETSECT 1 0 1 3 1 F:\0-1-3.D1 noheader badf6
*** Save Sector 0-1-1 to 0-1-32 (First 32 sectors) ***
FINDPART GETSECT 1 0 1 1 32 F:\0-1-1-32.D1 noheader badf6
*** Save Sector 0-1-1 to 0-1-63 (Entire Track 1) ***
** This includes some duplication, but is essential **
FINDPART GETSECT 1 0 1 1 63 F:\0-1-1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors Per FAT **
The value of "Big Sectors Per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 0 1 33 _____ F:\PRI_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ ___ __ _____ F:\PRI_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 1, Primary Partition) **
** A quick search, for a Disk which has only one partition **
FINDPART FINDFAT 1 0 1 F:\FAT_CHS1.TXT
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 ROOT.D1 noheader badf6
EXTENDED PARTITION
==================
1st Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 1 F:\L1_1st.D1 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 1 _____ 0 2 1 F:\L1_2nd.D1 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 1 _____ 0 3 1 F:\L1_3rd.D1 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 32 F:\L1_1-32.D1 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 63 F:\L1_1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _____ 1 33 _____ F:\L1_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _____ _ __ _____ F:\L1_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 L1_ROOT.D1 noheader badf6
2nd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 1 F:\L2_1st.D1 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 1 _____ 0 2 1 F:\L2_2nd.D1 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 1 _____ 0 3 1 F:\L2_3rd.D1 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 32 F:\L2_1-32.D1 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 63 F:\L2_1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS using PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _____ 1 33 _____ F:\L2_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _____ _ __ _____ F:\L2_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 L2_ROOT.D1 noheader badf6
3rd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 1 F:\L3_1st.D1 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 1 _____ 0 2 1 F:\L3_2nd.D1 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 1 _____ 0 3 1 F:\L3_3rd.D1 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 32 F:\L3_1-32.D1 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 63 F:\L3_1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _____ 1 33 _____ F:\L3_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _____ _ __ _____ F:\L3_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 L3_ROOT.D1 noheader badf6
DISK 2
======
NON-DOS PARTITION (Track Zero)
=================
*** Save Sector 0-0-1 (Master Boot Record & Partition Table) ***
FINDPART GETSECT 2 0 0 1 1 F:\0-0-1.D2 noheader badf6
*** Save Sector 0-0-9 (Sector 9 of Track 0) (Backup MBR) ***
FINDPART GETSECT 2 0 0 9 1 F:\0-0-9.D2 noheader badf6
*** Save Sector 0-0-1 to 0-0-63 (Entire Track 0) ***
FINDPART GETSECT 2 0 0 1 63 F:\0-0-1-63.D2 noheader badf6
Note:
Track 0 is usually *empty* except for CHS 0-0-1 and 0-0-9
Note: The above sectors only need to be saved ONCE,
as their values are permanent!
PRIMARY PARTITION
=================
*** Save Sector 0-1-1 (Boot Sector) ***
FINDPART GETSECT 2 0 1 1 1 F:\0-1-1.D2 noheader badf6
*** Save Sector 0-1-2 (FS Info Sector) ***
FINDPART GETSECT 2 0 1 2 1 F:\0-1-2.D2 noheader badf6
*** Save Sector 0-1-3 (Boot Data Sector) ***
FINDPART GETSECT 2 0 1 3 1 F:\0-1-3.D2 noheader badf6
*** Save Sector 0-1-1 to 0-1-32 (First 32 sectors) ***
FINDPART GETSECT 2 0 1 1 32 F:\0-1-1-32.D2 noheader badf6
*** Save Sector 0-1-1 to 0-1-63 (Entire Track 1) ***
** This includes some duplication, but is essential **
FINDPART GETSECT 2 0 1 1 63 F:\0-1-1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 0 1 33 _____ F:\PRI_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 0 ___ __ _____ F:\PRI_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 2, Primary Partition) **
** A quick search, for a Disk which has only one partition **
FINDPART FINDFAT 2 0 1 F:\FAT_CHS2.TXT
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 ROOT.D2 noheader badf6
EXTENDED PARTITION
==================
1st Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 1 F:\L1_1st.D2 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 2 _____ 0 2 1 F:\L1_2nd.D2 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 2 _____ 0 3 1 F:\L1_3rd.D2 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 32 F:\L1_1-32.D2 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 63 F:\L1_1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _____ 1 33 _____ F:\L1_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _____ _ __ _____ F:\L1_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 L1_ROOT.D2 noheader badf6
2nd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 1 F:\L2_1st.D2 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 2 _____ 0 2 1 F:\L2_2nd.D2 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 2 _____ 0 3 1 F:\L2_3rd.D2 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 32 F:\L2_1-32.D2 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 63 F:\L2_1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _____ 1 33 _____ F:\L2_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _____ _ __ _____ F:\L2_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 L2_ROOT.D2 noheader badf6
3rd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 1 F:\L3_1st.D2 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 2 _____ 0 2 1 F:\L3_2nd.D2 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 2 _____ 0 3 1 F:\L3_3rd.D2 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 32 F:\L3_1-32.D2 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 63 F:\L3_1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note: FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _____ 1 33 _____ F:\L3_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _____ _ __ _____ F:\L3_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Svend's FINDPART: FindFAT Option ***
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
*** See also SRCFAT, below ***
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
*** Save the Root Directory table ***
NB: The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 L3_ROOT.D2 noheader badf6
Top of Page
RESTORE A SECTOR
================
Svend's Utilities: FINDPART for DOS (version 4.72)
NB: In this version of Svend's Utilities the PUTSECT function is
a switch (i.e. an option) in FINDPART, not a seperate program
RECOVERY PROCEDURE
==================
The quickest way to recover is -
1) Boot to the DOS prompt (with a bootable floppy disk)
2) Rebuild the hard disk's MBR (CHS 0-0-1) (from backup)
3) Rebuild the hard disk's Boot Sector (CHS 0-1-1) (from backup)
4) Restore hard disk's File Allocation Table (FAT1) (from backup)
NB: The floppy disk must contain the version of DOS required by
the version of Windows that's on the hard disk being fixed
NB: This will only repair the Primary DOS partition; but that is
the partition most likely to be damaged if the disk won't boot
Note: If the 2nd (backup) FAT is undamaged, set the first 4 bytes
of the 1st FAT to 00000000 so Windows will detect that it's
corrupt, therefore will automagically use the 2nd FAT
SYNTAX of PUTSECT
=================
Writes a 512 byte file to a (512 byte) disk sector
(NB: The PUTSECT function will only write a 512 byte file!)
First is the number of the Disk (numbered from 1), e.g. 1
(NB: Valid disk numbers are from 1 to 8)
Next is the sector's CHS number: e.g. 0 0 1
Next is the FILENAME of the source file
Next is the number of cylinders on the disk, a 4-digit number
(NB: Get this number [a DECIMAL number] with PARTINFO.EXE)
(NB: Or get this number with the command FINDPART TABLES)
Next is the hash number of the source file, an 8-digit number
(To find this number: FINDPART PUTSECT GETHASH FILENAME.TYP)
(Or HASH can be entered as 00000000 if FORCE added to command)
*** Identify the number of Cylinders on the Disk ***
** Identifies CHS values for ALL disks present **
Display result on screen -
PARTINFO
FINDPART TABLES
Save result to file -
PARTINFO > F:\PARTINFO.txt
FINDPART TABLES > F:\TABLES.txt
Notes:
The PUTSECT function can only write a 512 byte file, but -
1. The program MBRutilD.exe can save and restore the entire
TRACK 0 (CHS 0-0-1 to 0-0-63), but ONLY for Disk 1
2. The program SRCFAT.COM can save and restore an entire FAT
*** Display the Help screen ***
FINDPART PUTSECT /?
*** Save the Help screen to a file ***
FINDPART PUTSECT /? > F:\PUTSECT.TXT
*** Set Environment Variable ***
NB: All PUTSECT operations will FAIL if this is not set!
SET FINDPART=EDIT
DISK 1
======
[____ cylinders (decimal)]
NON-DOS PARTITION (Track Zero)
=================
*** Write Sector 0-0-1 (MBR Sector) ***
FINDPART PUTSECT 1 0 0 1 F:\0-0-1.D1 ____ 00000000 FORCE
*** Write Sector 0-0-9 (Backup MBR Sector) ***
NB: Write this to CHS 0-0-1 instead if MBR is corrupted
FINDPART PUTSECT 1 0 0 9 F:\0-0-9.D1 ____ 00000000 FORCE
Note:
Track 0 is usually empty except for CHS 0-0-1 and 0-0-9
MBRUtil Copyright (c) 2002 PowerQuest Corporation
MBRutilD.exe [/?] [/S[H]=filename] [/R[H]=filename]
/S Save MBR (sector 1 only) to filename
/SH Save entire first head to filename
/R Restore MBR (sector 1 only) from filename
/RH Restore entire first head from filename
MBRUtilD.exe /RH=F:\0-0-1-63.D1
PRIMARY PARTITION
=================
*** Write Sector 0-1-1 (Boot Sector) ***
FINDPART PUTSECT 1 0 1 1 F:\0-1-1.D1 ____ 00000000 FORCE
*** Write Sector 0-1-2 (FS Info Sector) ***
FINDPART PUTSECT 1 0 1 2 F:\0-1-2.D1 ____ 00000000 FORCE
*** Write Sector 0-1-3 (Boot Data Sector) ***
FINDPART PUTSECT 1 0 1 3 F:\0-1-3.D1 ____ 00000000 FORCE
*** Write Sector 0-1-7 (Backup Boot Sector) ***
FINDPART PUTSECT 1 0 1 7 F:\0-1-1.D1 ____ 00000000 FORCE
*** Write Sector 0-1-8 (Backup FS Info Sector) ***
FINDPART PUTSECT 1 0 1 8 F:\0-1-2.D1 ____ 00000000 FORCE
*** Write Sector 0-1-9 (Backup Boot Data Sector) ***
FINDPART PUTSECT 1 0 1 9 F:\0-1-3.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
Most other sectors in Track 0 and in the first 33 sectors
of each Partition are empty, i.e. filled with zero's, and may
need to be set to zero if overwritten with garbage by a crash
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
EXTENDED PARTITION
==================
1st Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 1 _____ 1 1 F:\L1_1st.D1 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 2 F:\L1_2nd.D1 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 3 F:\L1_3rd.D1 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 7 F:\L1_1st.D1 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 8 F:\L1_2nd.D1 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 9 F:\L1_3rd.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
2nd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 1 _____ 1 1 F:\L2_1st.D1 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 2 F:\L2_2nd.D1 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 3 F:\L2_3rd.D1 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 7 F:\L2_1st.D1 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 8 F:\L2_2nd.D1 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 9 F:\L2_3rd.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
3rd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 1 _____ 1 1 F:\L3_1st.D1 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 2 F:\L3_2nd.D1 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 3 F:\L3_3rd.D1 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 7 F:\L3_1st.D1 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 8 F:\L3_2nd.D1 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 9 F:\L3_3rd.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
DISK 2
======
[____ cylinders (decimal)]
NON-DOS PARTITION (Track Zero)
=================
*** Write Sector 0-0-1 (MBR Sector) ***
FINDPART PUTSECT 2 0 0 1 F:\0-0-1.D2 ____ 00000000 FORCE
*** Write Sector 0-0-9 (Backup MBR Sector) ***
NB: Write this to CHS 0-0-1 instead if MBR is corrupted
FINDPART PUTSECT 2 0 0 9 F:\0-0-9.D2 ____ 00000000 FORCE
Note:
Track 0 is usually empty except for CHS 0-0-1 and 0-0-9
PRIMARY PARTITION
=================
*** Write Sector 0-1-1 (Boot Sector) ***
FINDPART PUTSECT 2 0 1 1 F:\0-1-1.D2 ____ 00000000 FORCE
*** Write Sector 0-1-2 (FS Info Sector) ***
FINDPART PUTSECT 2 0 1 2 F:\0-1-2.D2 ____ 00000000 FORCE
*** Write Sector 0-1-3 (Boot Data Sector) ***
FINDPART PUTSECT 2 0 1 3 F:\0-1-3.D2 ____ 00000000 FORCE
*** Write Sector 0-1-7 (Backup Boot Sector) ***
FINDPART PUTSECT 2 0 1 7 F:\0-1-1.D2 ____ 00000000 FORCE
*** Write Sector 0-1-8 (Backup FS Info Sector) ***
FINDPART PUTSECT 2 0 1 8 F:\0-1-2.D2 ____ 00000000 FORCE
*** Write Sector 0-1-9 (Backup Boot Data Sector) ***
FINDPART PUTSECT 2 0 1 9 F:\0-1-3.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
Most other sectors in Track 0 and in the first 33 sectors
of each Partition are empty, i.e. filled with zero's, and may
need to be set to zero if overwritten with garbage by a crash
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
EXTENDED PARTITION
==================
1st Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 2 _____ 1 1 F:\L1_1st.D2 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 2 F:\L1_2nd.D2 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 3 F:\L1_3rd.D2 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 7 F:\L1_1st.D2 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 8 F:\L1_2nd.D2 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 9 F:\L1_3rd.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
2nd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 2 _____ 1 1 F:\L2_1st.D2 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 2 F:\L2_2nd.D2 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 3 F:\L2_3rd.D2 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 7 F:\L2_1st.D2 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 8 F:\L2_2nd.D2 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 9 F:\L2_3rd.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
3rd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 2 _____ 1 1 F:\L3_1st.D2 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 2 F:\L3_2nd.D2 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 3 F:\L3_3rd.D2 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 7 F:\L3_1st.D2 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 8 F:\L3_2nd.D2 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 9 F:\L3_3rd.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
UTILITIES FOR WRITING MULTIPLE SECTORS
======================================
SYNTAX of MBRUTILD -
PowerQuest's MBR Utility for DOS
Backup and restore MBR Sector & Track 0 on Disk 1
The program only works on Disk 1, not on Disks 2 or 3.
Saves and restores the entire Track 0 (CHS 0-0-1 to 0-0-63)
(i.e. all 63 sectors at once). This is the DOS version of
the MBR manager program: MBRutil.exe.
It might be made to work on any Hard Disk, by setting the
disk as Primary Master on the IDE cables. But that might be
impractical because the disk to be restored will inevitably
be damaged and not bootable.
** Save the MBR (Sector 0-0-1) to a file **
MBRutilD /S=F:\MBR_MBR.D1
** Restore the MBR (Sector 0-0-1) from a file **
MBRutilD /R=F:\MBR_MBR.D1
** Save the entire first Track to a file **
(Save sectors 0-0-1 to 0-0-63: all 63 sectors of Track 0)
MBRutilD /SH=F:\MBR_TRK1.D1
** Restore the entire first Track from a file **
(Restore sectors 0-0-1 to 0-0-63 from a backup file)
MBRutilD /RH=F:\MBR_TRK1.D1
Top of Page
MBRSCAN RESULTS
===============
A damaged MBR sector might be repaired manually from these various examples,
using a DISK SECTOR EDITOR (below). A lot of the information in these scans
(except for the Partition Table data) is common to most FAT32 hard disks.
NB: The MBR sector of a HDD is unique, so CANNOT be copied to any other!
(See http://thestarman.pcministry.com/asm/mbr/mystery.htm#COPY)
[But see "Mystery Bytes" section (below), for further information]
Note:
In addition to the MBR, this program also saves a copy of the boot sector
from every partition on the disk; but not the other sectors making up the
FAT32 boot record (i.e. not the FS Info sector, nor the Boot Code sector)
DISK No.1:-
Western Digital 80GB WD800JB
2 partitions: 1 = Primary DOS (1 x 10 GB) (Drive C:) (Bootable: WinME)
2 = Logical (1 x 66 GB) (Drive E:) (Data)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) (C:) begins at CHS 0-1-1 (LBA 63)
Partition 2: (1st Logical) (E:) begins at CHS 1275-1-1 (LBA 20,482,938)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3м |P P | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ PW ˾ ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ It 8,t N ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ < t F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -F < t < t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :u+@F% u$UP ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A Xr Uu t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ V$ f ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ 3Ƀ N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N r)F >}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ tZ څu' ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ R F V Z ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 00 00 00 00 [ Ot3 ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3VVRP SQ V ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR BV$ ZXd r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B ^tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ W ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ ]
01C0: 01 00 0C FE 3F FA 3F 00-00 00 FC 8A 38 01 00 00 [ ?? 8 ]
01D0: 01 FB 0F FE BF 00 3B 8B-38 01 86 59 18 08 00 00 [ ;8 Y ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE 3F FA-3F 00 00 00 FC 8A 38 01 [ ?? 8 ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE 3F FA END CYL-HEAD-SECTOR: 0FAh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 01388AFC NUMBER OF SECTORS: 20482812
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: FC 8A 38 01 08 27 00 00-00 00 00 00 02 00 00 00 [ 8 ' ]
0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 DF 0D 00 00 44-52 49 56 45 20 43 20 20 [ ) DRIVE C ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
1 - Partition table entry = 1 << Win95 Extended >>
01CE: 00 00 01 FB 0F FE BF 00-3B 8B 38 01 86 59 18 08 [ ;8 Y ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 FB START CYL-HEAD-SECTOR: 0FBh-00h-01h
+4 0F PARTITION ID: Win95 Extended
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 01388B3B START SECTOR: 20482875
+C 08185986 NUMBER OF SECTORS: 135813510
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Win95 Extended (01388B3Bh) (Partition Table Entry: 1-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 FB 0B FE BF 00 3F 00-00 00 47 59 18 08 00 00 [ ? GY ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
2 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 FB 0B FE BF 00-3F 00 00 00 47 59 18 08 [ ? GY ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 FB START CYL-HEAD-SECTOR: 0FBh-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 08185947 NUMBER OF SECTORS: 135813447
2-0 Win95 FAT32 Boot Record (01388B7Ah) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ XMSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 7A 8B 38 01 [ ? z8 ]
0020: 47 59 18 08 C1 40 00 00-00 00 00 00 02 00 00 00 [ GY @ ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 FC 15 58 23 44-41 54 41 20 20 20 20 20 [ ) X#DATA ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
2 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 01388B3A 0000003F 01388AFC Win95 FAT32 (LBA)
1-1 : 01388B3B 0950E4C0 01388B3B 08185986 Win95 Extended
2-0 : 01388B7A 0950E4C0 0000003F 08185947 Win95 FAT32
DISK No.2:-
Western Digital 80GB (Drive D:)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) (D:) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3м |P P | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ PW ˾ ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ It 8,t N ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ < t F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -F < t < t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :u+@F% u$UP ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A Xr Uu t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ V$ f ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ 3Ƀ N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N r)F >}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ tZ څu' ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ R F V Z ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 81 25 16 04 [ Ot3 % ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3VVRP SQ V ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR BV$ ZXd r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B ^tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ W ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ ]
01C0: 01 00 0C FE BF 00 3F 00-00 00 82 E4 50 09 00 00 [ ? P ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE BF 00-3F 00 00 00 82 E4 50 09 [ ? P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ XMSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: 82 E4 50 09 85 4A 00 00-00 00 00 00 02 00 00 00 [ P J ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 10 0B 5C 35 4E-4F 20 4E 41 4D 45 20 20 [ ) \5NO NAME ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
DISK No.3:-
External USB Backup
Western Digital 120GB - External Enclosure USB
4 partitions: 1 = Primary DOS; 2,3,4 = Logical (Bootable: WinME)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) (G:) begins at CHS 0-1-1 (LBA 63)
Partition 2: (1st Logical) (H:) begins at CHS ____-1-1 (LBA __________)
Partition 3: (2nd Logical) (I:) begins at CHS ____-1-1 (LBA __________)
Partition 4: (3rd Logical) (J:) begins at CHS ____-1-1 (LBA __________)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3м |P P | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ PW ˾ ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ It 8,t N ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ < t F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -F < t < t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :u+@F% u$UP ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A Xr Uu t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ V$ f ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ 3Ƀ N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N r)F >}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ tZ څu' ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ R F V Z ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 80 09 53 08 [ Ot3 S ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3VVRP SQ V ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR BV$ ZXd r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B ^tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ W ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-66 1F 67 1F 00 00 80 01 [ f g ]
01C0: 01 00 0C FE 3F 0E 3F 00-00 00 10 B5 F9 01 00 00 [ ? ? ]
01D0: 01 0F 0F FE 7F 00 4F B5-F9 01 72 82 FF 0B 00 00 [ O r ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE 3F 0E-3F 00 00 00 10 B5 F9 01 [ ? ? ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE 3F 0E END CYL-HEAD-SECTOR: 00Eh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 01F9B510 NUMBER OF SECTORS: 33142032
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: 10 B5 F9 01 27 3F 00 00-00 00 00 00 02 00 00 00 [ '? ]
0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 17 0E 00 00 31-32 30 47 42 20 44 49 53 [ ) 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
1 - Partition table entry = 1 << Win95 Extended >>
01CE: 00 00 01 0F 0F FE 7F 00-4F B5 F9 01 72 82 FF 0B [ O r ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 0F START CYL-HEAD-SECTOR: 00Fh-00h-01h
+4 0F PARTITION ID: Win95 Extended
+5 FE 7F 00 END CYL-HEAD-SECTOR: 100h-FEh-3Fh
+8 01F9B54F START SECTOR: 33142095
+C 0BFF8272 NUMBER OF SECTORS: 201294450
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Win95 Extended (01F9B54Fh) (Partition Table Entry: 1-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 0F 0B FE 3F 5F 3F 00-00 00 D2 EA FF 03 00 00 [ ?_? ]
01D0: 01 60 05 FE 3F B0 11 EB-FF 03 11 EB FF 03 00 00 [ ` ? ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
2 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 0F 0B FE 3F 5F-3F 00 00 00 D2 EA FF 03 [ ?_? ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 0F START CYL-HEAD-SECTOR: 00Fh-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE 3F 5F END CYL-HEAD-SECTOR: 05Fh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 03FFEAD2 NUMBER OF SECTORS: 67103442
2-0 Win95 FAT32 Boot Record (01F9B58Eh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 8E B5 F9 01 [ ? ]
0020: D2 EA FF 03 FB 3F 00 00-00 00 00 00 02 00 00 00 [ ? ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 E3 11 22 07 31-32 30 47 42 20 44 49 53 [ ) " 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
2 - Partition table entry = 1 << Extended >>
01CE: 00 00 01 60 05 FE 3F B0-11 EB FF 03 11 EB FF 03 [ ` ? ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 60 START CYL-HEAD-SECTOR: 060h-00h-01h
+4 05 PARTITION ID: Extended
+5 FE 3F B0 END CYL-HEAD-SECTOR: 0B0h-FEh-3Fh
+8 03FFEB11 START SECTOR: 67103505
+C 03FFEB11 NUMBER OF SECTORS: 67103505
2 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
3 - Extended (05F9A060h) (Partition Table Entry: 2-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 60 0B FE 3F B0 3F 00-00 00 D2 EA FF 03 00 00 [ ` ?? ]
01D0: 01 B1 05 FE 7F 00 22 D6-FF 07 50 AC FF 03 00 00 [ " P ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
3 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 60 0B FE 3F B0-3F 00 00 00 D2 EA FF 03 [ ` ?? ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 60 START CYL-HEAD-SECTOR: 060h-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE 3F B0 END CYL-HEAD-SECTOR: 0B0h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 03FFEAD2 NUMBER OF SECTORS: 67103442
3-0 Win95 FAT32 Boot Record (05F9A09Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 9F A0 F9 05 [ ? ]
0020: D2 EA FF 03 FB 3F 00 00-00 00 00 00 02 00 00 00 [ ? ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 EE 11 36 07 31-32 30 47 42 20 44 49 53 [ ) 6 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
3 - Partition table entry = 1 << Extended >>
01CE: 00 00 01 B1 05 FE 7F 00-22 D6 FF 07 50 AC FF 03 [ " P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 B1 START CYL-HEAD-SECTOR: 0B1h-00h-01h
+4 05 PARTITION ID: Extended
+5 FE 7F 00 END CYL-HEAD-SECTOR: 100h-FEh-3Fh
+8 07FFD622 START SECTOR: 134207010
+C 03FFAC50 NUMBER OF SECTORS: 67087440
3 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
3 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
4 - Extended (09F98B71h) (Partition Table Entry: 3-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 B1 0B FE 7F 00 3F 00-00 00 11 AC FF 03 00 00 [ ? ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
4 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 B1 0B FE 7F 00-3F 00 00 00 11 AC FF 03 [ ? ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 B1 START CYL-HEAD-SECTOR: 0B1h-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE 7F 00 END CYL-HEAD-SECTOR: 100h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 03FFAC11 NUMBER OF SECTORS: 67087377
4-0 Win95 FAT32 Boot Record (09F98BB0h) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 B0 8B F9 09 [ ? ]
0020: 11 AC FF 03 F7 3F 00 00-00 00 00 00 02 00 00 00 [ ? ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 F8 11 22 06 31-32 30 47 42 20 44 49 53 [ ) " 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
4 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
4 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
4 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 01F9B54E 0000003F 01F9B510 Win95 FAT32 (LBA)
1-1 : 01F9B54F 0DF937C0 01F9B54F 0BFF8272 Win95 Extended
2-0 : 01F9B58E 05F9A05F 0000003F 03FFEAD2 Win95 FAT32
2-1 : 05F9A060 09F98B70 03FFEB11 03FFEB11 Extended
3-0 : 05F9A09F 09F98B70 0000003F 03FFEAD2 Win95 FAT32
3-1 : 09F98B71 0DF937C0 07FFD622 03FFAC50 Extended
4-0 : 09F98BB0 0DF937C0 0000003F 03FFAC11 Win95 FAT32
Notes:
1. Western Digital HDD, 120GB (111GB formatted)
2. 4 drives (1 x 15GB, 3 x 32GB) (Total = 111GB):
- Primary DOS Partition (Active) (15GB)
- Extended: Logical Partition (32GB)
Logical Partition (32GB)
Logical Partition (32GB)
DISK No.4:-
Fujitsu 10GB
1 partition: Primary DOS (Bootable: WinME)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) (C:) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3м |P P | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ PW ˾ ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ It 8,t N ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ < t F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ F < t < t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :u+@F% u$UP ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A Xr Uu t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ V$ f ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ 3Ƀ N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 75 07 81 3E FE 7D 55 [ % N r)u >}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 3F 07 EB [ tZ څu? ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ R F V Z ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 80 18 26 12 [ Ot3 & ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3VVRP SQ V ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR BV$ ZXd r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B ^tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 2E 20-53 65 74 75 70 20 63 61 [ table. Setup ca ]
0130: 6E 6E 6F 74 20 63 6F 6E-74 69 6E 75 65 2E 00 45 [ nnot continue. E ]
0140: 72 72 6F 72 20 6C 6F 61-64 69 6E 67 20 6F 70 65 [ rror loading ope ]
0150: 72 61 74 69 6E 67 20 73-79 73 74 65 6D 2E 20 53 [ rating system. S ]
0160: 65 74 75 70 20 63 61 6E-6E 6F 74 20 63 6F 6E 74 [ etup cannot cont ]
0170: 69 6E 75 65 2E 00 00 00-00 00 00 00 00 00 00 00 [ inue. ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ W ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ ]
01C0: 01 00 0C FE 3F DC 3F 00-00 00 5E 30 31 01 00 00 [ ?? ^01 ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE 3F DC-3F 00 00 00 5E 30 31 01 [ ?? ^01 ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE 3F DC END CYL-HEAD-SECTOR: 0DCh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0131305E NUMBER OF SECTORS: 20000862
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: 5E 30 31 01 22 26 00 00-00 00 00 00 02 00 00 00 [ ^01 "& ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 DB 13 66 27 4D-50 46 33 31 30 32 41 54 [ ) f'MPF3102AT ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
1 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 0131309C 0000003F 0131305E Win95 FAT32 (LBA)
DISK No.5:-
Seagate 18GB, ST320423A (Previous Drive C:) (Bootable: Win98SE)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) (C:) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3м |P P | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ PW ˾ ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ It 8,t N ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ < t F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -F < t < t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :u+@F% u$UP ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A Xr Uu t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ V$ f ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ 3Ƀ N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 75 07 81 3E FE 7D 55 [ % N r)u >}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 3F 07 EB [ tZ څu? ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ R F V Z ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 80 24 13 09 [ Ot3 $ ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3VVRP SQ V ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR BV$ ZXd r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B ^tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 2E 20-53 65 74 75 70 20 63 61 [ table. Setup ca ]
0130: 6E 6E 6F 74 20 63 6F 6E-74 69 6E 75 65 2E 00 45 [ nnot continue. E ]
0140: 72 72 6F 72 20 6C 6F 61-64 69 6E 67 20 6F 70 65 [ rror loading ope ]
0150: 72 61 74 69 6E 67 20 73-79 73 74 65 6D 2E 20 53 [ rating system. S ]
0160: 65 74 75 70 20 63 61 6E-6E 6F 74 20 63 6F 6E 74 [ etup cannot cont ]
0170: 69 6E 75 65 2E 00 00 00-00 00 00 00 00 00 00 00 [ inue. ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ W ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ ]
01C0: 01 00 0C FE FF FE 3F 00-00 00 3C 3F 43 02 00 00 [ ? ?C ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE FF FE-3F 00 00 00 3C 3F 43 02 [ ? ?C ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE FF FE END CYL-HEAD-SECTOR: 3FEh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 02433F3C NUMBER OF SECTORS: 37961532
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ XMSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: 3C 3F 43 02 30 24 00 00-00 00 00 00 02 00 00 00 [ ?C 0$ ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 F0 11 3F 18 4D-30 32 47 42 32 20 20 20 [ ) ? M02GB2 ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
1 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
MBRS011 Geometry was not saved. Assuming HH = FF, SS = 3F
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 02433F7A 0000003F 02433F3C Win95 FAT32 (LBA)
DISK No.6:-
Previous Drive C: (NB: Faulty disk)
Seagate 80GB, ST380011A (Bootable: WinME)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) (C:) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 90 E9 7D 01 FA 33 C0 8E-D0 8E C0 8E D8 BC 00 7C [ } 3Ўؼ | ]
0010: 8B F4 FB BF 00 06 B9 00-01 F3 A5 BB 20 06 FF E3 [ ]
0020: 90 90 BE 7D 07 81 3C AA-55 75 11 E8 58 00 73 0C [ } }Uu ]
0070: EA 00 7C 00 00 BE 6A 07-AC 0A C0 74 FE BB 07 00 [ | j t ]
0080: B4 0E CD 10 EB F2 BB 00-7E C6 07 13 C6 47 01 00 [ ~ G ]
0090: B2 80 B8 00 E0 CD 13 C3-BF 00 7E BA F0 01 B3 A0 [ ÿ ~ ]
00A0: E8 84 00 72 0C B1 01 E8-48 00 72 05 E8 19 00 73 [ r H r s ]
00B0: 16 F6 C3 10 75 05 80 CB-10 EB E5 81 FA 70 01 74 [ u p t ]
00C0: 05 BA 70 01 EB D8 F9 C3-81 BD FE 01 55 AA 75 17 [ p Á Uu ]
00D0: 8B 75 02 81 FE BE 01 77-0E 03 F7 81 3C AA 55 75 [ u w Note -
There may be a fault in the above MBR sector. The bytes "90 E9 7D 01 FA"
preceed the three bytes which ought to begin the sector (i.e. "33 C0 8E"),
and the rest of the sector does not look like any other MBR sector above.
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE FF FF-3F 00 00 00 82 E4 50 09 [ ? P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB FE 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ MSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: 82 E4 50 09 83 4A 00 00-00 00 00 00 02 00 00 00 [ P J ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 C9 09 14 75 53-54 33 38 30 30 31 31 41 [ ) uST380011A ]
0050: 20 20 46 41 54 33 32 20-20 20 00 00 00 00 00 00 [ FAT32 ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U ]
Note -
There may be a fault in the above Boot sector. The bytes "EB 58 90",
which ought to begin the sector, are not present; and the rest of the
sector does not look like any other Boot sector above.
1 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
MBRS011 Geometry was not saved. Assuming HH = FF, SS = 3F
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 0950E4C0 0000003F 0950E482 Win95 FAT32 (LBA)
*** Note on Ending CHS Values ***
A second use of the MBRSCAN program 4 months later showed a strangely
different result in the Primary DOS Partition for the *ending* CHS values;
and the contents of the Partition boot sector (sector 3F hex) (CHS 0-1-1)
are VERY different to their previous state -
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE BF 00-3F 00 00 00 82 E4 50 09 [ ? P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ XMSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ ? ? ]
0020: 82 E4 50 09 83 4A 00 00-00 00 00 00 02 00 00 00 [ P J ]
0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 E5 0E 00 00 53-54 33 38 30 30 31 31 41 [ ) ST380011A ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ {x v V U" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ ~ N ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |E F E8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ - r :f ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; Wu V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ s ~ uEF ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ V I@u B ~ ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&Ot F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;w v ;s + F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V s '~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ ~} t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ t } ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ } ^ f ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ ~ u B 3v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ v Bv ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ ̸ V@ ad ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U ]
SATA 500GB Hard Disk
====================
SATA DRV C -
Partition sector = CHS 0-0-1 (LBA 0) (MBR)
Boot sector = CHS 0-1-1 (LBA 63)
SATA DRV D -
Partition sector = CHS 1275-0-1 (LBA 20482875) (EMBR 1)
Boot sector = CHS 1275-1-1 (LBA 20482938)
SATA DRV E -
Partition sector = CHS 11004-0-1 (LBA 176779260) (EMBR 2)
Boot sector = CHS 11004-1-1 (LBA 176779323)
LOGICAL 3 (125.5 MB) -
Partition sector = CHS 19458-0-1 (LBA 312592770) (EMBR 3)
Boot sector = CHS 19458-1-1 (LBA 312592833)
LOGICAL 4 (7,648.1 MB) -
Partition sector = CHS 19474-0-1 (LBA 312849810) (EMBR 4)
Boot sector = CHS 19474-1-1 (LBA 312849873)
LOGICAL 5 (18,535.9 MB) -
Partition sector = CHS 20449-0-1 (LBA 328513185) (EMBR 5)
Boot sector = CHS 20449-1-1 (LBA 328513248)
LOGICAL 6 (16,182.6 MB) -
Partition sector = CHS 22812-0-1 (LBA 366474780) (EMBR 6)
Boot sector = CHS 22812-1-1 (LBA 366474843)
LOGICAL 7 (32,765.4 MB) -
Partition sector = CHS 24875-0-1 (LBA 399616875) (EMBR 7)
Boot sector = CHS 24875-1-1 (LBA 399616938)
LOGICAL 8 (32,765.4 MB) -
Partition sector = CHS 29052-0-1 (LBA 466720380) (EMBR 8)
Boot sector = CHS 29052-1-1 (LBA 466720443)
LOGICAL 9 (32,757.5 MB) -
Partition sector = CHS 33229-0-1 (LBA 533823885) (EMBR 9)
Boot sector = CHS 33229-1-1 (LBA 533823948)
LOGICAL 10 (83,509.7 MB) -
Partition sector = CHS 37405-0-1 (LBA 600911325) (EMBR 10)
Boot sector = CHS 37405-1-1 (LBA 600911388)
LOGICAL 11 (100,006.2 MB) -
Partition sector = CHS 48051-0-1 (LBA 771939315) (EMBR 11)
Boot sector = CHS 48051-1-1 (LBA 771939378)
DISK INVESTIGATOR
=================
Disk Investigator v1.31
This program can display the following data structures in a
partition, and in doing so also shows the LBA sector number:
- Boot Sector (NB: Partition's Boot Sector, NOT the MBR!)
- FAT 1
- FAT 2
- Root Directory
To display the relevent data structure -
1. Run the program
2. Go to the VIEW menu and select DISK
3. Go to the VIEW menu, and select the desired option
*** Run Disk Investigator ***
SET PATH=%path%;F:\HARDWARE\DI
DI
Examples of Disk Investigator's summary of HDD structure -
DISK 1, PARTITION 1
Western Digital WD800JB, 80GB, Primary DOS partition
Volume Label: DRIVE C
Logical drive: C
Physical drive: 128
Total logical sectors: 20482812
Cylinders: 1275
Sectors per cylinder: 63
Heads: 255
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 16
Number of copies of FAT: 2
Sectors per FAT: 9992
Start sector for FAT1: 32
Start sector for FAT2: 10024
Root DIR Sector: 20016
Root DIR Cluster: 2
2nd Cluster Start Sector: 20016
Ending Cluster: 1278925
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 63
Backup boot sector: 6
Reserved sectors: 32
FS Info sector: 0
Sectors per track: 63
File system version: 0
SerialVolumeID: 00000DDF
DISK 1, PARTITION 2
Western Digital WD800JB, 80GB, Logical 1 partition
Volume Label: DATA
Logical drive: E
Physical drive: 0
Total logical sectors: 135813447
Cylinders: 8454
Sectors per cylinder: 63
Heads: 255
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 64
Number of copies of FAT: 2
Sectors per FAT: 16577
Start sector for FAT1: 32
Start sector for FAT2: 16609
Root DIR Sector: 33186
Root DIR Cluster: 2
2nd Cluster Start Sector: 33186
Ending Cluster: 2121567
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 35706
Backup boot sector: 6
Reserved sectors: 32
FS Info sector: 1
Sectors per track: 63
File system version: 0
SerialVolumeID: 235815FC
DISK 2, PARTITION 1
SeaGate, 18GB, Primary DOS partition
Volume Label: M02GB2
Logical drive: D
Physical drive: 129
Total logical sectors: 37961532
Cylinders: 2363
Sectors per cylinder: 63
Heads: 255
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 32
Number of copies of FAT: 2
Sectors per FAT: 9264
Start sector for FAT1: 32
Start sector for FAT2: 9296
Root DIR Sector: 18560
Root DIR Cluster: 2
2nd Cluster Start Sector: 18560
Ending Cluster: 1185718
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 63
Backup boot sector: 6
Reserved sectors: 32
FS Info sector: 1
Sectors per track: 63
File system version: 0
SerialVolumeID: 183F11F0
DISK 3, PARTITION 1
USB Pen Drive, 8GB, Primary DOS partition
Volume Label: USBDISKPRO
Logical drive: G
Physical drive: 130
Total logical sectors: 15658976
Cylinders: 975
Sectors per cylinder: 63
Heads: 16
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 8
Number of copies of FAT: 2
Sectors per FAT: 15264
Start sector for FAT1: 64
Start sector for FAT2: 15328
Root DIR Sector: 30592
Root DIR Cluster: 2
2nd Cluster Start Sector: 30592
Ending Cluster: 1953549
Media Descriptor: 248
Root Entries: 0
Heads: 16
Hidden sectors: 32
Backup boot sector: 8
Reserved sectors: 64
FS Info sector: 1
Sectors per track: 32
File system version: 0
SerialVolumeID: F713BD59
Top of Page
FILE ALLOCATION TABLE
=====================
CONTENTS OF THE FAT
===================
A cluster is a group of sectors containing user data.
Examples:
A 4K cluster has 8 sectors in it ( 8 x 512 = 4,096 bytes)
A 16K cluster has 32 sectors in it (32 x 512 = 16,384 bytes)
A 32K cluster has 64 sectors in it (64 x 512 = 32,768 bytes)
The data area in a Partition starts at cluster 2. The first
two entries in the FAT (4 bytes each) are therefore not needed,
so are used to identify the FAT itself (i.e. 8 "admin" bytes).
In the first entry, the first byte is the media descriptor (F8),
& the other 3 bytes are 0F FF FF (written backwards as FF FF 0F).
The second entry is the end-of-cluster-chain marker (0F FF FF FF,
written backwards as FF FF FF 0F). This is the Dirty Shutdown
flag: its value changes if the last shutdown was not clean,
or if a disk I/O error was detected last session.
Note: In many FAT32 disks, the second entry in the FAT
is actually 07 FF FF FF (written as FF FF FF 07)!
Viewed while the disk was in use: so this is probably
the value of the "dirty shutdown" flag! If this value
is set on bootup, then NOT reset to FF FF FF 0F on
shutdown, it shows Windows on the next bootup that
the computer was not properly shut down last time.
Each cluster has a 4-byte entry in the FAT. The entry tells you
whether the cluster has data in it (if the entry is 0 there is
no data in the cluster, otherwise the entry is a cluster number
or a special function); and whether it's the end of the data in
the file (the entry 0F FF FF FF is the final entry in the chain).
NB: On disk the 4 bytes are (as always) written BACKWARDS,
so for instance 0F FF FF FF reads on disk as FF FF FF 0F
Value Description
----- -----------
00000000 Free cluster (No data in it)
00000001 Reserved cluster, do not use
(NB: Written 01 00 00 00)
00000002 - 0FFFFFEF Number of the next cluster
(NB: Written 02 00 00 00 to EF FF FF 0F)
0FFFFFF0 - 0FFFFFF6 Reserved cluster, do not use
(NB: Written F0 FF FF 0F to F6 FF FF 0F)
0FFFFFF7 Bad sector in cluster or reserved cluster
(NB: Written F7 FF FF 0F)
0FFFFFF8 - 0FFFFFFF Last cluster in file (written FF FF FF 0F)
NB: Any entry which (on disk) begins with F has a SPECIAL function,
i.e. if it starts with F it's a Function, NOT a cluster number!
The FAT stores the starting location of the file and each additional
cluster used to store the file.
NB: See also http://en.wikipedia.org/wiki/File_Allocation_Table
FINDFAT
=======
Svend's Utilities: FINDPART for DOS (version 4.72)
NB: In this version of Svend's Utilities the FINDFAT function is
a switch (i.e. an option) in FINDPART, not a seperate program
The FINDFAT function can be used for two purposes:
1. To identify the starting sector of the 1st and 2nd FAT
on a working Disk, so as to BACKUP the FAT.
2. To locate a lost or damaged FAT on a damaged Disk.
SYNTAX of FINDFAT -
Usage:
FINDPART FINDFAT {disk} [comprehensive | {cyl} {cyl}] {file}
Specify the number of the Disk to search, e.g. 1
[NB: Valid numbers are 1, 2, 3 or 4]
(Alternatively, to search all Disks specify ALL)
To search the entire Disk (i.e. all partitions) specify
COMPREHENSIVE
(Alternatively, to do a quicker search, specify cylinder
number to begin the search from and to end the search at)
Specify the name of the file to save the search results in
(which MUST have the filetype .TXT)
*** Search Primary Partition only ***
** Find FAT on Disk 1 **
** Save the report to a file **
FINDPART FINDFAT 1 0 1 F:\FAT_DSK1.TXT
** Find FAT on Disk 2 **
** Save the report to a file **
FINDPART FINDFAT 2 0 1 F:\FAT_DSK2.TXT
** Find FAT on ALL Disks **
** Save the report to a file **
FINDPART FINDFAT ALL 0 1 F:\FAT_ALL.TXT
*** Search Primary & Extended Partitions ***
** Find FAT on Disk 1 **
** Save the report to a file **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1_.TXT
** Find FAT on Disk 2 **
** Save the report to a file **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2_.TXT
** Find FAT on ALL Disks **
** Save the report to a file **
FINDPART FINDFAT ALL comprehensive F:\FAT_ALL_.TXT
NORTON DISKEDIT
===============
Norton's DiskEdit (2002) can identify all File Allocation Tables
on the hard disk (and so help build up a picture of the disk's
structure), by searching for the unique markers F8 FF FF 0F and
F8 FF FF 07 (one of which is in the first sector of every FAT).
When the program starts, in "Type" select "Physical disks"; then
choose the damaged disk, then click "OK". To open the search tool:
TOOLS > FIND... (or press CTRL + S)
Type the text to search for (the unique marker) into the box
marked "Hex", then select "Ignore Case", then click on "Find".
NB: Note that this unique signature is also present in every
backup copy of the FAT stored on the disk.
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
NORTON DISKEDIT
===============
Norton's DiskEdit (2002) can show the sector numbers assigned
to the 1st FAT and 2nd FAT in the selected partition.
When the program starts, in "Type" select "Logical disks"; then
choose a partition, then click "OK". When the program has finished
scanning that partition, go to:
OBJECT > SECTOR (or press ALT + S)
The sector number displayed is NOT the LBA sector! It's only the
sector's number within the selected partition. To convert it to
the LBA number, add the number of sectors before this partition,
from the "Sectors Before" field in the MBR.
NB: If this is the Primary DOS partition, the number of sectors
to add is (always) 63.
*** Run PowerQuest's Partition Table Editor ***
** (Displays the MBR partition table) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
CLUSTERS USED BY A FILE
=======================
Norton's DiskEdit (2002) can view the cluster information in the FAT
that identifies the clusters used by a file (below: "FILE CLUSTERS")
SIZE OF FAT
===========
FAT32 uses 4 bytes of the FAT to record each data cluster. So
1 sector in the FAT (512 bytes) records 128 clusters (512 4).
NB: If cluster size is 8KB (i.e. 1 cluster = 16 sectors), then
128 clusters = 128 x 16 = 2,048 sectors
NB: If cluster size is 16KB (i.e. 1 cluster = 32 sectors), then
128 clusters = 128 x 32 = 4,096 sectors
NB: If cluster size is 32KB (i.e. 1 cluster = 64 sectors), then
128 clusters = 128 x 64 = 8,192 sectors [HDD exceeding 32GB]
In each case, this is cluster size (in KB) multiplied by 256.
To calculate the maximum size of the FAT (in sectors):
Take the number of sectors in the Partition and subtract 32
(the number of Reserved Sectors); then divide that result by
cluster size multiplied by 256 (i.e. 2,048 or 4,096 or 8,192)
NB: Be aware that this might result in a FAT size slightly
larger than on the actual disk, since in actuality no FAT
entries are needed for the space occupied by the FAT itself
(so the calculated value should be checked, by a physical
examination of the disk to see where Root Directory begins)
NB: The size of a FAT can be calculated from the filesize (in KB)
of any backup copy of it, as the size of a FAT in sectors is
equal to its file size (in KB) x 2 (since 1 sector = 0.5 KB)
Calculation based on Allocation Units:
To calculate the size of the FAT (in bytes), multiply the number of
Allocation Units in the partition (i.e. the number of Clusters) by 4
(because the FAT uses 4 bytes to record the address of each Cluster)
Then add 8 bytes, as the FAT allocates 8 bytes for "admin" purposes.
Divide the result by 512 to calculate the size of the FAT in sectors
(because there are 512 bytes in a sector)
Size of FAT (in sectors) = ( ( Number of Clusters x 4 ) + 8 ) / 512
NB: Round up the result to the next whole number of sectors -
INT ( Result + 0.99 )
Calculate the size of the FAT in KB:
(a) Divide the size of the FAT in sectors by 2
(because 1 sector = 0.5 KB)
(b) Divide the size of the FAT in bytes by 1,024
NB: Round-up the result to the next whole KB
Size of System Area:
To calculate the total size of the System Area, add together:-
1. The 63 "Hidden sectors" (starting with the Partition Table)
2. The 32 "Reserved sectors" (starting with the Boot Sector)
3. The size of the FAT, multiplied by 2 (there are 2 copies)
NB: The "Data Area" begins with the cluster containing the
start of the Root Directory Table (a.k.a. Cluster no.2)
SRCFAT
======
SRCFat v1.3(c)2001 - The W0rm
Usage: SRCFat {drive:} {filename} {switch}
Program to BACKUP and RESTORE the 1st or 2nd FAT
SRCFat.com can save, restore and check the FAT on a FAT32 Disk
(NB: Replaces older utilities that don't support FAT32)
The program can save and restore the first or second FAT,
or both; and can restore the 2nd FAT over a damaged 1st FAT
(i.e. restore the second FAT to the first), or vice versa.
Switches:
/S - Save FAT table to file
/R - Restore FAT table from file
/C - Compare FAT table to file
/2 - Use the second FAT copy
Note:
This program can also restore a FAT which was saved by
another program, e.g. by FINDPART.EXE (provided no header
or other extra data was saved along with the sector data).
Notes:
1. This program can compare a backup file with the on-disk FAT.
2. Norton's DiskEdit has a function which can compare two backup
files: split the window (View > Split Window), load both files
(Object > File), then compare them (Tools > Compare Windows).
The program halts at the first difference between the files.
NB: It can find subsequent differences by moving the cursor to
the next line, then restarting (Tools > Compare Windows).
BACKUP THE FAT
==============
** Save 1st FAT **
SRCFAT C: F:\SRC_FAT1.C /S
SRCFAT D: F:\SRC_FAT1.D /S
SRCFAT E: F:\SRC_FAT1.E /S
** Save 2nd FAT **
SRCFAT C: F:\SRC_FAT2.C /S /2
SRCFAT D: F:\SRC_FAT2.D /S /2
SRCFAT E: F:\SRC_FAT2.E /S /2
*** Alternative Backup Routine ***
** In practice, the following Backup routine is preferable **
** This saves 4 backup copies instead of only a single one **
** (so guards against overwriting with a *faulty* backup) **
[NB: SERCOPY will *not* save to Root, only to a Subdirectory]
** Save 1st FAT, Drive C: **
SRCFAT C: C:\SAVED\C_FAT1.BIN /S
SERCOPY C:\SAVED\C_FAT1.BIN F:\SAVED /L:4 /D:2 /Q
** Save 1st FAT, Drive D: **
SRCFAT D: D:\SAVED\D_FAT1.BIN /S
SERCOPY D:\SAVED\D_FAT1.BIN F:\SAVED /L:4 /D:2 /Q
** Save 1st FAT, Drive E: **
SRCFAT E: E:\SAVED\E_FAT1.BIN /S
SERCOPY E:\SAVED\E_FAT1.BIN F:\SAVED /L:4 /D:2 /Q
** Save 2nd FAT, Drives C:, D: & E: **
SRCFAT C: F:\C_FAT2.BIN /S /2
SRCFAT D: F:\D_FAT2.BIN /S /2
SRCFAT E: F:\E_FAT2.BIN /S /2
RESTORE THE FAT
===============
*** Help Screen Operations ***
** Display Help screen **
SRCFAT /?
** Save Help screen to file **
SRCFAT /? > F:\SRCFAT.txt
*** Disk Operations in DOS under Win 98/ME ***
** Enable direct disk access **
LOCK C:
LOCK D:
LOCK E:
Note:
In MS-DOS v8.0 the HDD is protected (the default state) by an internal
COMMAND.COM function that prevents direct disk access by any program
other than DOS itself. The HDD must be locked - NOT unlocked! - to
enable SRCFAT to write to the disk. [NB: DOS v8.0 comes with Win98/ME]
*** Operations on 1st FAT ***
** Compare 1st FAT to Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /C
SRCFAT D: F:\D_FAT1.000 /C
SRCFAT E: F:\E_FAT1.000 /C
** Compare 1st FAT to Backup File of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /C
SRCFAT D: F:\D_FAT2.BIN /C
SRCFAT E: F:\E_FAT2.BIN /C
** Save a backup of damaged 1st FAT **
(May give error: "Error, could not read sector")
SRCFAT C: F:\BAD_FAT1.C /S
SRCFAT D: F:\BAD_FAT1.D /S
SRCFAT E: F:\BAD_FAT1.E /S
** Restore 1st FAT from Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /R
SRCFAT D: F:\D_FAT1.000 /R
SRCFAT E: F:\E_FAT1.000 /R
** Restore 1st FAT from Backup file of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /R
SRCFAT D: F:\D_FAT2.BIN /R
SRCFAT E: F:\E_FAT2.BIN /R
Note:
If the first 8 bytes of the 1st FAT are replaced with 00000000
Win9x will automatically default to using the 2nd FAT instead
(i.e. treats the 1st FAT as corrupt). This might be tried
*before* attempting to replace the 1st FAT with the 2nd!
*** Operations on 2nd FAT ***
** Compare 2nd FAT to Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /C /2
SRCFAT D: F:\D_FAT1.000 /C /2
SRCFAT E: F:\E_FAT1.000 /C /2
** Compare 2nd FAT to Backup File of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /C /2
SRCFAT D: F:\D_FAT2.BIN /C /2
SRCFAT E: F:\E_FAT2.BIN /C /2
** Save a backup of damaged 2nd FAT **
(May give error: "Error, could not read sector")
SRCFAT C: F:\BAD_FAT2.C /S /2
SRCFAT D: F:\BAD_FAT2.D /S /2
SRCFAT E: F:\BAD_FAT2.E /S /2
** Restore 2nd FAT from Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /R /2
SRCFAT D: F:\D_FAT1.000 /R /2
SRCFAT E: F:\E_FAT1.000 /R /2
** Restore 2nd FAT from Backup file of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /R /2
SRCFAT D: F:\D_FAT2.BIN /R /2
SRCFAT E: F:\E_FAT2.BIN /R /2
Note:
This procedure should normally only be necessary if
BOTH copies of the FAT are corrupted on a damaged Disk
and the backup copy of the 1st FAT is ALSO corrupted.
In theory, that situation can never arise! The backup copy
should be on a different Disk (i.e. at F:\).
USING THE 2ND FAT
=================
On a FAT32 partition, FAT mirroring can be disabled, allowing
a copy of the FAT (instead of the first FAT) to be active.
NB: To disable FAT mirroring, edit the appropriate byte in the
Boot Record of the Partition in question (see above).
Top of Page
ROOT DIRECTORY
==============
ROOT DIRECTORY TABLE
====================
The Root Directory table usually immediately follows the 2nd FAT
(i.e. begins in the first sector after the 2nd FAT).
NB: Its location is specified by an entry in the Partition's
Boot Sector at offset 44, i.e. in bytes 45-48.
This makes the Root Directory very vulnerable: anything which
damages the 2nd FAT might also wipe out the Root Directory table!
This table MUST be backed up!
In a FAT32 partition there is NO limit to the number of entries
(i.e. files) in the Root Directory. If the cluster size is 32K,
a block of 64 sectors (i.e. 1 cluster) is reserved for the Root
Directory table: the first 64 sectors after the 2nd FAT. When
this is full, the table can continue anywhere in the partition
(just like any other file); a pointer is set to the next cluster
it occupies.
NB: If all the entries have only a Short Name (so no Long File Name
entries are required), a maximum of 1,024 files and directories
can be stored in a directory table occupying 64 sectors.
Address of Root Directory Table (Examples) -
Western Digital WD800JB 80GB (New bootable HDD)
Primary DOS Partition (Drive C:) = CHS 1-63-46 (LBA: 20,079)
1st Logical Partition (Drive E:) = CHS 1277-17-49 (LBA: 20,516,124)
Western Digital WD800JB 80GB (Drive D: HDD)
Primary DOS Partition (Drive D:) = CHS 2-97-9 (LBA: 38,249)
M02GB2: SeaGate ST320423A 18GB (Win98 HDD)
Primary DOS Partition (Drive D:) = CHS 1-40-39 (LBA: 18,623)
Seagate ST380011A 80GB (Broken HDD)
Primary DOS Partition (Drive C:) = CHS 2-97-5
NB: CHS 0-0-1 = LBA 0 (i.e. Add 1 to convert LBA into actual sectors)
Finding the Root Directory Table:
The Root Directory Table contains the Volume label (i.e. name)
of the partition. Norton's DiskEdit can find the Table by
searching for that name (if it's a unique name).
The Root Directory Table on a Windows system also contains the
(possibly) unique directory entry RECYCLED (unique at least in
its Hex form: followed by 3 spaces and a unique file attribute).
That string can be searched for, using Norton's DiskEdit.
Hex characters for "RECYCLED" (8.3 filename + file attribute):
52 45 43 59 43 4C 45 44 20 20 20 16
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
NORTON DISKEDIT
===============
Norton's DiskEdit (2002) can show the sector number assigned to
the Root Directory table in the selected partition. Go to:
OBJECT > SECTOR (or press ALT + S)
NB: To enable this option, "Logical Disks" must be selected in
DiskEdit's opening screen (in order to display the Disk's
partition structure, rather than its physical structure).
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
The sector number displayed is NOT the LBA sector, but only the
sector's number within the selected partition. To convert it to
the LBA number, add the number of sectors before this partition
from the partition table (the "Sectors Before" field).
NB: If this is the Primary DOS partition, the number of sectors
to add is invariably 63.
*** Run PowerQuest's Partition Table Editor ***
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
CONVERT FROM CHS TO SECTORS
===========================
The utilities which can identify the location of the FAT
give the result by specifying: (a) its starting sector
(a CHS value), and (b) its size (in sectors).
The following calculation uses that information to calculate
the location of the Root Directory Table (giving the result
as a CHS value, needed to make a backup copy of that Table) -
Step 1: Convert the CHS value of the 1st sector of the FAT
from CHS to sectors:
Cylinders x 255 x 63 = ______
Heads x 63 = ______
Sectors x 1 = ______
Total = ______ sectors
Step 2: Multiply the size of the FAT (in sectors) by two,
as the FAT32 file system uses two FATs (main and backup).
Step 3: Add the result from Step 1 and the result from Step 2
together. The total is the sector number of the start of the
Root Directory Table.
Step 4: Convert the total into a CHS value:
(a) 1 cylinder = 255 heads x 63 sectors = 16,065 sectors
So total from Step 3 16,065 = cylinders
NB: Carry any remainder to (b) below
(b) 1 Head = 63 sectors
So remainder from (a) 63 = heads
NB: Carry any remainder to (c) below
(c) 1 sector = 1 sector
So remainder from (b) 1 = sectors
Examples -
Disk 1: WD800JB 80GB (Drive C: & E:)
*** Find the starting sector of all FATs on Disk 1 ***
FINDPART FINDFAT 1 comprehensive FAT_DSK1.TXT
Result for Disk 1:
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 9992 8 2 9992 0 0 0 001203 5060
1275 1 33 16577 32 2 16577 0 0 0 081104 13704
Partition No.1 (Drive C:) -
Step 1:
Convert the CHS value of the 1st sector of the FAT to sectors
CHS 0-1-33 = (0 x 255 x 63) + (1 x 63) + (33 x 1) = 96
Step 2:
Multiply the size of the FAT (in sectors) by 2
2 x 9,992 = 19,984
Step 3:
Add the result of the first and second calculations
96 + 19,984 = 20,080
Step 4:
Convert the result to CHS
20,080 16,065 = 1 cylinder (Remainder = 4,015)
4,015 63 = 63 heads (Remainder = 46)
46 1 = 46 sectors
So Root Directory Table starts at address CHS 1-63-46
Partition No.2 (Drive E:) -
Step 1:
Convert the CHS value of the 1st sector of the FAT to sectors
CHS 1275-1-33 = (1275 x 255 x 63) + (1 x 63) + (33 x 1) = 20,482,971
Step 2:
Multiply the size of the FAT (in sectors) by 2
2 x 16,577 = 33,154
Step 3:
Add the result of the first and second calculations
20,482,971 + 33,154 = 20,516,125
Step 4:
Convert the result to CHS
20,516,125 16,065 = 1,277 cylinder (Remainder = 1,120)
1,120 63 = 17 heads (Remainder = 49)
49 1 = 49 sectors
So Root Directory Table starts at address CHS 1277-17-49
** Save Root Directory of Disk 1, Primary Partition **
FINDPART GETSECT 1 1 63 46 64 ROOT_D1.PRI noheader badf6
** Save Root Directory of Disk 1, 1st Logical Partition **
FINDPART GETSECT 1 1277 17 49 64 ROOT_D1.L1 noheader badf6
** Save Root Directory of Disk 1, 2nd Logical Partition **
FINDPART GETSECT 1 ____ __ __ 64 ROOT_D1.L2 noheader badf6
** Save Root Directory of Disk 1, 3rd Logical Partition **
FINDPART GETSECT 1 ____ __ __ 64 ROOT_D1.L3 noheader badf6
Disk 2: WD800JB 80GB (Drive D:)
*** Find the starting sector of *all* FATs on Disk 2 ***
FINDPART FINDFAT 2 comprehensive FAT_DSK2.TXT
Result for Disk 2:
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 19077 32 2 19077 0 0 0 070225 56668
Partition No.1 (Drive D:) -
Step 1:
Convert the CHS value of the 1st sector of the FAT to sectors
CHS 0-1-33 = (0 x 255 x 63) + (1 x 63) + (33 x 1) = 96
Step 2:
Multiply the size of the FAT (in sectors) by 2
2 x 19,077 = 38,154
Step 3:
Add the result of the first and second calculations
96 + 38,154 = 38,250
Step 4:
Convert the result to CHS
38,250 16,065 = 2 cylinder (Remainder = 6,120)
6,120 63 = 97 heads (Remainder = 9)
9 1 = 9 sectors
So Root Directory Table starts at address CHS 2-97-9
** Save Root Directory of Disk 2, Primary Partition **
FINDPART GETSECT 2 2 97 9 64 ROOT_D2.PRI noheader badf6
** Save Root Directory of Disk 2, 1st Logical Partition **
FINDPART GETSECT 2 ____ __ __ 64 ROOT_D2.L1 noheader badf6
** Save Root Directory of Disk 2, 2nd Logical Partition **
FINDPART GETSECT 2 ____ __ __ 64 ROOT_D2.L2 noheader badf6
** Save Root Directory of Disk 2, 3rd Logical Partition **
FINDPART GETSECT 2 ____ __ __ 64 ROOT_D2.L3 noheader badf6
CALCULATE THE STARTING SECTOR
=============================
RootStart = Sectors Before + Hidden Sectors + Reserved Sectors
+ (Number of FATs x SectorsPerFAT)
Some of these values are in the MBR / EMBR sector & Boot Record,
which are most easily read using PowerQuest's Partition Table Editor.
*** Run PowerQuest's Partition Table Editor ***
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
To calculate the RootStart sector of the Primary DOS partition,
"Sectors Before" is nil, "Hidden Sectors" is usually 63 sectors
(the entire Non-DOS partition), and "Reserved Sectors" normally
comprises the first 32 sectors of the Primary DOS partition;
so there are typically 95 sectors (LBA 0 to 94) prior to the FAT.
Top of Page
FILES
=====
FILE NAMES
==========
Under FAT32, a file typically has TWO names:
1. A Short name, used by MS-DOS to access the file.
2. A Long File Name (LFN), used by Windows to access
the file. An LFN is optional; if one is not present,
Windows uses the Short name instead.
Short name -
All files have a short filename, comprising 11 characters
(also known as an 8.3 name). This is the ONLY name by which
the file can be accessed under MS-DOS.
It consists of an 8 character name, followed by a dot,
followed by 3 more characters (known as the Extension).
The name can have fewer than 8 characters; and the Extension
can have fewer than 3 characters, or can be omitted entirely.
Only letters of the alphabet (uppercase only), numbers 0 to 9,
and the underscore character, can be used in a Short name.
The Short name is the name displayed by the command DIR when
the computer is booted to DOS.
Long File Name -
A file can, optionally, also have a Long File Name (or LFN),
comprising up to 256 characters, by which Windows (but not DOS)
can access the file.
An LFN can contain any character on the keyboard, except the
reserved characters (i.e. colon, question mark, quotation mark,
forward slash, backslash, asterisk, angle-brackets).
The LFN overcomes the many drawbacks of the Short name system
inherited from MS-DOS; but not even the FAT32 version of MS-DOS,
which underlies Windows 98/ME, can recognise an LFN.
NB: Some third-party (i.e. non-Microsoft) tools can enable DOS
to access a file using the Long File Name - see below.
DIRECTORY TABLE
===============
The Directory Table is not stored in a fixed location, nor does
it have a fixed size. Each directory (folder) has such a table:
which is just a file, but with a special (Directory) attribute.
NB: Norton's DiskEdit can be used to locate the Directory Table,
by searching the disk for the first 8 characters of the
file's 8.3 file name.
Filenames are stored in the Directory Table (not in the FAT).
Each 8.3 file entry is 32 bytes long. LFNs are also stored in
the Directory Table, alongside the 8.3 filename.
The LFN (if any) is stored as one or more separate directory
entries, immediately before the 8.3 filename. The LFN is stored
first because the 8.3 filename is derived from it, not vice versa!
Length of Directory Entry:
If a file has no LFN, the directory table entry will be 32 bytes
(i.e. that's the minimum length).
Up to 640 bytes are occupied by the Long File Name (LFN); thus an
entry can be a maximum of 672 bytes (32 bytes + 640 bytes).
NB: Each directory entry can store up to 13 characters of an LFN,
so several entries may be needed. Since an LFN can consist of
up to 255 characters, the maximum size is 20 entries.
Directory Table format (8.3 filename entry):
Size Description
---- -----------
8 bytes Filename
3 bytes Extension
1 byte Attribute: 0 = normal (00h); D = directory (10h)
A = archive (20h); R = read-only (01h)
H = hidden (02h); S = system (04h)
[NB: These hex values are NOT certain!]
1 byte Reserved (00h)
1 byte Time Created (Seconds) } If zero, might be
2 bytes Time Created (Hour & Minute) } a Directory entry
2 bytes Date Created
2 bytes Date Last Accessed
2 bytes Reserved (0Fh 00h or 0Ch 00h) (or 0Eh 00h)
2 bytes Time Modified
2 bytes Date Modified
2 bytes Cluster Number (Location of beginning of file)
4 bytes File Size (If zero, might be a Directory entry)
Total = 32 bytes
Attributes:
Attrib Meaning Notes
------ ------- -----
0 Unused No attributes set
A Archive File needs Archiving (i.e. backing-up), as it
has been modified since BACKUP.EXE was last run
R Read-only File is Read-only
S System File is a System file (i.e. part of Windows)
H Hidden File is a Hidden file (i.e. part of Windows)
D Directory The "file" is actually a Directory Table
V Volume The attribute for a Long File Name entry
Only 1 byte is allocated to store a file's Attributes, even though
a file can have 4 different attributes set at once: i.e. R,A,S,H
But the total value of the combined attributes is always unique;
e.g. if a file is marked Archive and Read-only it has a hex value
of 21 hex (i.e. 20 hex + 01 hex) [see Attribute description above]
Identifying the File sectors:
The file is stored in clusters of sectors. If cluster size is
32K, each cluster contains 64 sectors (as sector size is 0.5K).
The Directory Table contains the location of the first cluster
used by the file. Each sector of a file contains a pointer to
the next sector used by that file, so if the file occupies
more than 64 sectors the next cluster can be identified.
That information is also stored in the File Allocation Table
(FAT). If the FAT is undamaged, Norton's DiskEdit can read
from it all the cluster numbers used by a file (see above).
NB: The 11 character filename is in this format:
- 8 characters, padded with spaces (20h) if not all are
used. If the Long File Name exceeds 8 characters, the
name is truncated to ~1 (or ~2, etc) for the last two.
- 3 character filetype, but NO dot preceeding it.
NB: A ~1 (or ~2, etc) is also used if the short name contains
whitespace - even if, including the space(s), the short
name does not exceed 8 characters!
NB: A file will have a Long File Name (LFN) entry if the short
name contains lowercase characters, even if the short name
does not exceed 8 characters and contains no spaces!
Sector Level Access:
In operating systems which use FAT32, DOS is locked out of
sector-level access to the disk, to prevent it damaging the
LFN entries when performing directory operations. (NB: Use
the DOS internal command UNLOCK to enable read/write access)
INVALID LFN ENTRY
=================
ScanDisk for Windows, Norton DiskEdit, and Norton Disk Doctor
(if its option to test Date and Time is set), will wrongly
report that a disk error exists if a file's Directory Table
entry includes any of the following:
(a) if the Created or Last Modified date is in the future; or
(b) if the Last Modified time ends in "00" (zero) seconds.
Actually, there is NO disk error - nor any damage to the file!
And the "error" can be cured by editing the Date or Time stamp
in Windows, using a program such as AttributeMagic v1.0.4:
- To cure a Future date, change the date to any date BEFORE
the current date
- To cure a "Last Modified" time which ends in zero seconds,
change the seconds to any OTHER value that's an even number
[Note: ScanDisk's cure is to reduce the value by 2 seconds]
NB: The "Last Modified" time is stored as a 2-byte value,
which is not enough space to store the actual number
of seconds, so they're stored in 2-second increments.
When that field holds a value of 30, Windows doubles
the value (i.e. to 60), reports "seconds" as 00, and
increases the "minutes" field by 1; but the disk tools
are programmed to reject any value for "seconds" that
exceeds 59, and so report the value of 60 as an error.
LONG FILE NAMES IN DOS
======================
The following tools utilise Long File Names in DOS -
1. Odi's LFN tools:
These include: LDIR.EXE, LCOPY.EXE, LDEL.EXE, LREN.EXE, LMD.EXE
NB: See below ("Recover Individual Files") for syntax and use.
2. Henrik Haftmann's DOSLFN.COM:
This has the advantage of being a driver, which can be loaded at
boot time, that performs ALL functions in LFN format! But it's
complicated to use, compared with the simplicity of Odi's tools.
FILE CLUSTERS
=============
If a partition's File Allocation Table is damaged, to recover
a file the first thing that must be done is to establish how
many clusters the file occupies.
To establish the cluster size, run CHKDSK.EXE to display the
partition's "allocation unit size" (i.e. cluster size):
*** Find the Cluster Size ***
CHKDSK C:
CHKDSK D:
CHKDSK E:
SYNTAX -
chkdsk [drive:][[path]filename] [/F] [/V]
[drive:][path] Specifies the drive and directory to check
filename Specifies the file(s) to check for fragmentation
/F Fixes errors on the disk
/V Displays the full path and name of every file on
the disk
NB: Do NOT use the /F switch! That switch causes the program to
try to Fix errors, but disk activity will damage data and
reduce the changes of recovering the files in the partition!
Note:
For the default cluster size (which depends on the size of the
partition), see above. Since a partition does NOT have to use
the default size it is prudent to establish the actual value by
using CHKDSK.EXE (or from byte 14 in the Boot Record: see above).
Calculation -
To calculate how many clusters a file occupies: divide the file size
(in bytes) by the cluster size (in bytes), and round the result up
(to the next whole number).
Cluster size, in bytes: 8KB cluster = 1,024 x 8 = 8,192 bytes
16KB cluster = 1,024 x 16 = 16,384 bytes
32KB cluster = 1,024 x 32 = 32,768 bytes
File Storage -
If the file is larger than a single cluster, the Operating System
stores the excess data in the next available cluster; and repeats
this until all the data in the file is stored.
Clusters used by a File -
The Directory Table records the "starting cluster number", i.e. the
address of the first cluster used by the file. Each cluster contains
a pointer to the next cluster in the file (i.e. the cluster number),
or (if it's the last one in the file) an end-of-file marker (FFFF).
In addition, the File Allocation Table (FAT) contains a record of
all the clusters used by the file. (This is of more practical use
than the Directory Table, because a BACKUP can be made of the FAT!)
NB: There are therefore TWO ways of identifying the clusters occupied
by a file!
NB: Programs such as Tiramisu (a.k.a. Easy Recovery), Lost & Found,
and Active Partition Recovery make use of this redundancy.
They scan the disk, sector by sector, to rebuild an undamaged
File Allocation Table in RAM memory.
Viewing the FAT -
Norton's DiskEdit (see below) can display the cluster numbers stored
in the FAT:
1. To display the Directory Tree, go to: OBJECT > DIRECTORY
2. Select the directory the file is stored in, then click "OK"
3. Go to: VIEW > AS DIRECTORY (or press F4)
4. Move the cursor onto the filename
5. On the LINK menu, select "Cluster chain (FAT)" (or press Ctrl+T)
NB: Alternatively, display the Root Directory (go to OBJECT > DRIVE)
and select Directory view (go to VIEW > AS DIRECTORY). From that,
double-clicking on the name of a sub-directory will change to
that directory. In this way, navigate to the file in question.
NB: If the Directory structure is inaccessible (due to a disk crash),
to find the sector containing the directory table use DiskEdit
to search for the first 8 characters of the file's 8.3 filename.
(Note: The Long File Name CANNOT be used, as the characters in it
are NOT stored consecutively on disk, but mixed with other data)
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
The contents of the FAT, as displayed by Norton's DiskEdit, are:
0 (Zero) : This represents a disk cluster that is not in use.
It may, for example, have been part of an erased file.
NB: The sector is NOT necessarily empty of data; zero is
merely a marker, indicating the cluster is available
to store new data in. Data in it will be overwritten.
A decimal number, greater than 1 : This entry represents a
cluster containing data belonging to a file. The number is
the number of the NEXT cluster in the chain for that file.
EOF ("End Of File") : This entry, too, represents a cluster
containing data belonging to a file. This is the last cluster
in the chain. Part of this cluster will thus be slack space
(i.e. wasted space), possibly containing data from an old file.
BAD : An unusable cluster. Often only one sector is actually
bad (of the 32 or 64 sectors a cluster usually contains). Even
a bad sector can get fixed; to try reading it, press ALT+L,F.
Thus a cluster number that is NOT zero contains a file.
The STATUS line (at the foot of the screen) gives the cluster
number of the cluster the cursor is on. The number HIGHLIGHTED
by the cursor is the number of the next cluster in the file!
Navigating a File:
In FAT view, select a cluster (i.e. click on one). If it belongs
to a file (i.e. its value is neither "0" nor "BAD"):-
- to view the contents of that File, press Ctrl + F (or ALT+L,F)
(or go to: LINK > FILE)
- to view the Directory entry for that file, press Ctrl + D
(or go to: LINK > DIRECTORY)
- to view the FAT entries for that file, press Ctrl + T
(or go to: LINK > FAT)
NB: If an entry goes RED when selected, it belongs to a file.
The on-screen status line will show the file's name.
Other entries highlighted in RED are other clusters in the same
file ("allocation chain") as the selected cluster; but they might
not be the only other clusters for that file.
NB: To change the format of the display, go to the VIEW menu
- To view sector as Hex, go to: VIEW > HEX
- To view sector as Text, go to: VIEW > TEXT
- To view sector as a Directory, go to: VIEW > DIRECTORY
Top of Page
SECTION B: DISK REPAIR
IDENTIFYING THE PARTITION STRUCTURE
===================================
Step 1: Discover the Disk's Geometry -
Norton's DiskEdit can display the disk's geometry (i.e. the CHS
information for the disk). Start DISKEDIT.EXE then go to:
Tools > Advanced
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Alternatively, the information can be viewed in the BIOS (run
the routine "Auto-Detect Hard Disks"); or read the information
from the label on the disk's casing.
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup.
Step 2: Search for possible Partition Boot Sectors -
Norton's DiskEdit can help to build up a picture of all possible
boot/partition sectors on the hard disk, and hence of the disk's
structure, by searching for the "55AA" marker (or the signature
"FAT32") (or the signature "MSWIN4.1") present in such sectors.
NB: To search, display the target HDD as a physical disk; then
go to sector LBA 0; then press CTRL + S simultaneously.
A partition begins with a Boot Sector, and ends immediately before
another Boot Sector (provided the disk has more than one partition).
Therefore locating all boot sectors on the disk will reveal a lot
about the partition structure.
NB: The CHS address of the boot sector of a partition is the first
sector of that partition. It is preceeded by 63 hidden sectors,
the first of which contains the Partition Table for that partition.
The Boot Sector of a partition will normally have the CHS address
xxxx-1-1 (i.e. head 1 sector 1) (except for the 2nd or subsequent
Logical partitions). If the Boot Sector for the Primary DOS or the
1st Logical partition does not have that address, it is NOT genuine!
It is essential to visually confirm whether a possible boot sector
is actually a boot sector, by using Norton's DiskEdit to view it.
(NB: Compare it against sample MBR sectors in this file - see above)
The most likely cause of false positives is backups:
(a) The FAT32 structure includes a backup boot sector in every
partition, so every boot sector on the disk will potentially
show up twice (i.e. if the disk data has not been corrupted).
(b) Many utilities exist that can save a copy of the MBR or
the Boot Sector of a partition, as a backup file. Being
ordinary files, these can be stored anywhere on the disk.
Note: The partition Boot Sector contains a text-string identifying
the type of partition (e.g. "FAT16" or "FAT32"). Although it
is not used by the O/S in managing the partition, this is
nonetheless a helpful clue to the structure of the partition.
Note: The first place to look for a partition Boot Sector is in
sector CHS 0-1-1 (its almost invariable location in FAT32).
Step 3: Search for possible FS Info Sectors -
Norton's DiskEdit can also search the hard disk for the unique
signatures of an FS Info Sector ("RRaA" and "rrAa").
The most likely cause of false positives is backups. Many utilities
exist that can save a copy of this sector as a backup; being
ordinary files, these backups can be stored anywhere on the disk.
Step 4: Search for possible FATs -
Norton's DiskEdit can also search the hard disk for the unique
signature of a File Allocation Table (F8 FF FF 0F) (see above).
NB: That signature can (in some circumstances) be F8 FF FF 07
(since this is used as a "flag" to record a bad shutdown).
Svend's FINDPART program can also search the disk for FATs,
with the option FINDPART FINDFAT (see above).
FATs come in pairs: a mirror copy (FAT2) immediately follows the FAT
(FAT1). The first of the pair will normally begin within 33 sectors
after the start of the partition (i.e. of its boot sector); so the
presence of a FAT within 33 sectors of a boot sector indicates the
boot sector is the genuine article (i.e. the start of a partition).
The most likely cause of false positives is backups:
(a) The FAT32 structure includes a backup FAT in every partition,
so every FAT on the disk will potentially show up twice
(i.e. if the disk data has not been corrupted).
(b) Many utilities exist that can save a copy of the FAT as a backup.
Being ordinary files, these can be stored anywhere on the disk.
Step 5: Rebuild the Partition Table entry -
To recover a partition, all that is needed is to recreate a correct
pointer in the MBR (at CHS 0-0-1).
If that pointer points to a partition table, not to a boot sector,
the pointer must be an Extended Partition entry. In any event,
that partition begins at the sector which it points to.
NB: The Primary DOS partition on a FAT32 disk will invariably
begin at CHS 0-1-1 (i.e. LBA sector 63), the 64th sector.
The last sector at which the partition can end is the final
sector of the Extended partition (an address which might be
revealled by one of the other partition table entries in the MBR).
The VERY last sector at which the partition can end is the last
sector of the disk; but it will probably have to end before that,
as partitions MUST end on a Cylinder boundary.
NB: Calculate the total number of disk sectors, and from that
the CHS address of the final sector of the final Cylinder.
(See "Step 1: Discover the Disk's Geometry", above)
A FAT32 partition MUST be a multiple of 16,065 sectors, as it
must end in the last sector (63) of the last head (254) in a
cylinder; so it MUST end with the CHS address xxxx-254-63.
NB: This applies ONLY to the Primary DOS and Extended partitions,
not to any Logical partition(s) - although it will apply to
the 1st Logical partition if it's the only Logical partition
and occupies the entire Extended partition.
Another clue is the size of the FAT, since the number of sectors
it occupies ("Big Total Sectors per FAT" in the partition's boot
record) is directly related to the size of the partition (as the
FAT allows 4 bytes per Cluster, and the default Cluster size is
32KB [i.e. 64 sectors] if the partition exceeds 32GB).
NB: For the default cluster size of smaller partitions, see above.
(The default is the logical starting point, as few users will
be capable of changing it)
NB: The number of sectors between the first sector of FAT1 and the
first sector of FAT2 discloses the size of FAT1; this can be
established with Norton's DiskEdit, by searching for FATs
(see above) or by viewing the disk sectors.
The Ending Location for ANY partition exceeding 8GB is meaningless,
since by definition its CHS address MUST be 1023-254-63 (regardless
of the true size of the partition); but the numbers for the entries
"Relative Sectors" and "Number of Sectors" are correct.
OUTLINE OF PARTITION STRUCTURE
==============================
No. Partition CHS Address Notes
-- --------- ----------- -----
1 Primary 0-0-1 Partition Table (MBR)
0-1-1 Boot Sector (MBR + 1 Head)
2 1st Logical xxxx-0-1 Partition Table
xxxx-1-1 Boot Sector (P.Table + 1 Head)
3 2nd Logical xxxx-x-1 Partition Table
xxxx-x-1 Boot Sector (P.Table + 1 Head)
4 3rd Logical xxxx-x-1 Partition Table
xxxx-x-1 Boot Sector (P.Table + 1 Head)
NB: The Extended partition is defined in the MBR (CHS 0-0-1) and
comprises all of the Logical partitions.
The first sector of the Extended partition is the Partition
Table sector of the 1st Logical partition.
The last sector of the Extended partition is the end sector
of the final Logical partition (unless there is unallocated
space in the Extended partition). [NB: Partitioning utilities
can only leave unallocated space AFTER all Logical partitions]
NB: Since the Primary partition and the Extended partition MUST end
on a Cylinder boundary, partitions (except Logical partitions)
will inevitably begin in the FIRST sector of a Cylinder!
[i.e. The value for HEAD is 0 and the value for SECTOR is 1]
For backwards compatibility, this is so even on a HDD larger
than 8 GB (i.e. one which uses LBA addressing instead of CHS).
Note: Although the rule applies only to the Primary and Extended
partitions, not to Logical partitions within the Extended partition,
it must inevitably apply to the FIRST Logical partition.
NB: You normally only need to discover the starting Sector
for each partition to have a clear picture of the Disk,
since there is rarely free space between partitions.
Size of a Partition:
A partition is a multiple of 16,065 sectors, inclusive of the Track
containing its Partition Table (if the HDD uses standard geometry,
i.e. 255 Heads per Cylinder, 63 sectors per Head).
This is because 1 Cylinder = 16,065 sectors (i.e. 255 x 63 = 16,065)
and because a partition is always a whole number of Cylinders.
NB: This does NOT apply to Logical partitions, only to the
Primary DOS partition and the Extended partition.
NB: To calculate the value of "Big Total Sectors" in the MBR or EMBR,
subtract 63 (the first 63 sectors containing the Partition Table)
as they are counted under "Hidden Sectors" not "Big Total Sectors".
Top of Page
PARTITION TABLE ERRORS
======================
FDISK.EXE
=========
*** View the Partition information for ALL the Disks ***
FDISK /status
Warning:
If partitions are lost or damaged, do NOT enter the FDISK "create
partition" screen. Just entering that screen will write sectors
containing ASCII character 246 (hex F6) to large areas at the
beginning of the free partition space.
Warning:
Do NOT attempt to recover a partition by creating a new one using
standard partitioning tools, such as FDISK. To do so will cause
additional damage, as FAT and other data structures will be created
along with the partition table entries, deleting the previous data.
SUMMARY OF POSSIBLE ERRORS
==========================
The following are possible errors which could occur in a corrupted
Partition Table or EMBR (Extended Master Boot Record) chain:
- Partition overlaps end of disk (see below)
- Partition does not begin on Cylinder Boundary
- Partition does not end on Cylinder Boundary
- Partition has inconsistent length
- Partition has inconsistent start sector
- Partitions overlap
- Partition has zero length
- EMBR points to sector with no partition table
- EMBR pointing backward
- Circular EMBR chain
- EMBR overlaps
- Extended partition table entries in wrong order
Notes:
1. Only the Primary DOS and Extended partitions must begin and end
on a cylinder boundary (i.e. must comprise an exact multiple of
16,065 sectors), beginning with CHS 0-0-1.
2. A partition is inconsistent if its LBA values do not match its
CHS values (where both LBA and CHS values are used).
3. If a partition is the wrong size, partitions might overlap,
or one might be of zero length.
4. An EMBR (Extended Master Boot Record) chain might be corrupt.
Partition Overlaps End of Disk
==============================
This problem occurs when the ending cylinder value is bigger than
the total number of cylinders on the disk. In some cases, the end
cylinder value can be too large by one or two cylinders.
You can check the ending cylinder value using BEEBLEBROX.EXE
For hard disks larger than 8GB the Partition Table stores a maximum
ending cylinder value of 1024, but the disk has more than 1024 cyls.
Use a CHS/LBA Calculator to convert the LBA values ("Start Sector"
and "Number of Sectors") to the true CHS value: if this is greater
than the value reported by Beeblebrox for the disk's Geometry, that
is the problem.
It may be possible to "truncate" the partition to solve the problem.
To do this, you have to modify the length of the partition.
NB: Using Partition Magic, start the program with the /IPE option,
then resize the partition. That option causes Partition Magic
to ignore partition table errors. This might cause data loss:
it isn't likely, but back up all important data first.
To truncate a partition using Beeblebrox:-
Firstly, make a backup copy of the Partition Table.
Secondly, if the new ending cylinder of the partition is greater than
1024, you only have to change the "NumSectors" value. Use a CHS to LBA
Calculator (below) to find the correct NumSector value (the Number of
Sectors in the partition). Type this number in the NumSectors field for
the partition, then save the changes. Verify that the fix was successful.
If not, restore the partition table from the backup file and try to see
what went wrong.
If the new cylinder value is less than 1024, see whether changing
the translation mode to LBA (in the BIOS) fixes the problem. If the
partition definitely needs to be truncated, the process is the same
as for partitions that cross cylinder 1024 except that you must
also change the ending cylinder, head and sector values (to those
desired). And you still need to figure out what the correct NumSectors
value should be, using a CHS to LBA calculator.
Top of Page
DISK SECTOR EDITORS
===================
A Disk Sector Editor allows the user to manually edit the disk,
to correct errors in the data which define the disk's structure.
It can be used to manually repair a Partition which has been
corrupted by any cause other than physical damage.
NB: The notes on Disk Structures (above) can assist with this.
NB: The utilities in UTILS TO REPAIR DISK STRUCTURES
automate some parts of the repair process.
INTEL BYTE ORDER
================
When editing disk sectors, there is one important convention to
be aware of: Intel Byte order (a.k.a. "little endian").
When a value exceeds 255 (decimal), more than one byte is needed
to store that value. And these bytes are stored in reverse order!
To store a decimal number greater than 255, first convert it to hex,
then write the bytes to the disk in reverse order.
NB: Windows 98/98SE/ME comes with a Calculator program which can
convert numbers from decimal to hex (and vice versa). Go to
START > RUN and type CALC in the box, then click on "OK".
Then on the Calculator's VIEW menu, select "Scientific".
Example: The decimal value 41393, which is A1B1 in hex, is written
to disk as B1A1 (so B1A1 is what you'd actually see in a disk editor).
NORTON DISK EDITOR
==================
Edit the damaged HDD manually with Norton's DiskEdit
(e.g. to correct a damaged MBR, Partition Table, etc).
The only version of Norton's DiskEdit which will ALWAYS run in
DOS is version 7.0 (1993). Later versions are too large to run
in Conventional memory ("low DOS" memory) if ANY devices other
than the Mouse are loaded (such as CD-ROM or USB drivers).
NB: Not even the DOS internal command LOADHIGH can load
later versions of the program under such conditions!
[PTS Disk Editor can run: see "PTS DISK EDITOR" below]
NB: Being a FAT16 program, none of v7.0's Tools functions are
useable with a FAT32 disk, but the editing function works
(though not for sector addresses beyond the 8GB boundary:
but the MBR, Boot Sector, FAT etc are accessible with it)
There is notionally 640K of Conventional memory; but it is
partly used by DOS itself and by any device drivers loaded.
Therefore to run later versions of DiskEdit in DOS, bootup
using a bootable floppy disk that loads NO other devices!
NB: The program MI.COM (below) displays a map of Conventional
memory, showing the amount of free memory and the drivers
loaded at bootup (together with how much memory each uses).
To increase the amount of free memory, edit AUTOEXEC.BAT
and CONFIG.SYS (on the floppy boot disk) to stop all other
drivers from loading!
*** Load a Mouse driver before running Norton's DiskEdit ***
SET PATH=%path%;F:\RECOVERY
MOUSE
*** Run Norton DiskEdit v7.0 (1993): FAT16 only, 8GB limit ***
** This runs under almost ANY conditions (essential tool) **
SET PATH=%path%;F:\NORTON\1993
DISKEDIT
*** Run Norton DiskEdit 2001: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2001) **
SET PATH=%path%;F:\NORTON\2001
DISKEDIT
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Note:
Alternatively, to run DiskEdit 2001 or 2002, boot to Windows
(using an undamaged bootable HDD as the IDE Primary Master).
Solutions if DiskEdit Crashes -
Norton's DiskEdit 2001 and 2002 scans the target Partition's
directory structure while loading.
If that Partition contains a large number of directories
(e.g. if the Partition is larger than about 60GB), DiskEdit
will run out of memory and crash while loading.
There are two solutions for this fault:
1. Abort the directory scan, by clicking the mouse, before
DiskEdit has scanned all of the Partition in question.
NB: The problem with this is that the unscanned part of
the partition will then be *invisible* to DiskEdit.
2. Use an alternative Disk Sector Editor. For instance, use
the PTS Disk Editor (DE.EXE) as that program does NOT scan
the partition when loading).
Identifying Disk Errors -
When Norton DiskEdit 2002 first opens a disk in "Logical Disks"
view, it spends 5 minutes scanning that disk. When the scanning
completes, if any disk errors were found it displays the details.
NB: The errors found can thereafter be viewed at any time. Go to:
INFO > ERROR INFO
NB: Its use can be confusing, in that if NO errors are found it
does NOT say so, nor does it make any entry under ERROR INFO
that the disk was found to have no errors.
Repairing LFN errors -
Norton's DiskEdit 2002 can fix the fault, if a Long File Name (LFN)
becomes dis-associated from a file's 11 character short name:
1. Go to: INFO > ERROR INFO then click on one of the errors found
(which will jump to the disk Cluster containing that error).
2. Select Directory view (press F4 or go to: VIEW > AS DIRECTORY).
3. With the cursor, select the first line of the Long File Name
(LFN); then go to: TOOLS > ATTACH LFN and click "OK".
4. Repeat step 3 for every line of the LFN.
This procedure will re-attach the Long File Name to the file's
short name, thus repairing the error.
NB: The HDD must not be 'Read Only'. Go to: TOOLS > CONFIGURATION
and uncheck "Read Only". (If the disk is "Read Only" the option
ATTACH LFN will be unavailable, i.e. greyed-out).
Copying Sectors -
Norton's DiskEdit 2002 can copy up to 8 sectors at a time.
Firstly, mark the section to be copied:
1. Move the cursor to the start of the first sector to copy,
then in the menu go to: EDIT > MARK
2. Move the cursor to the end of the final sector to copy,
then in the menu go to: EDIT > MARK
NB: The marked section should appear highlighted!
Secondly, press Ctrl & C to copy the marked section into memory.
The program only allocates 4K of RAM; enough to store 8 sectors.
NB: An instruction like this means press both the indicated keys
simultaneously. "Ctrl" indicates the Control key (typically
abbreviated to Ctrl on the keyboard).
Thirdly, move the cursor to the 1st byte of the first sector to be
over-written, then press Ctrl & V to paste the information in memory
to the disk.
File Attributes -
Norton's DiskEdit 2002 can display the Attributes of a file,
in Directory view (go to VIEW > AS DIRECTORY):
A (Archive), R (Read Only), S (System), H (Hidden), D (Directory),
and V (Volume Label).
NB: An LFN entry = RSHV (i.e. a unique combination of attributes)
PTS DISK EDITOR
===============
An excellent alternative is PTS Disk Editor, version 1.04
The program recognises a FAT32 hard disk larger than 32GB,
and is small enough to load into conventional DOS memory
even if devices other than the Mouse are loaded.
NB: No version of Norton's DiskEdit can match this!
If all that's needed is the ability to edit disk sectors,
the PTS Disk Editor (DE.EXE) will be the best option. The
drawback is that it doesn't have any of the sophisticated
additional functions of Norton's DiskEdit.
** Load a Mouse driver before running PTS Disk Editor **
SET PATH=%path%;F:\RECOVERY
MOUSE
*** Run the PTS Disk Editor ***
SET PATH=%path%;F:\PTS
DE
Top of Page
UTILS TO REPAIR DISK STRUCTURES
===============================
These utilities can repair a Partition if it has been corrupted
by any cause other than physical disk damage.
NB: These are alternatives to repairing the damage manually with
a Disk Sector Editor (above), since these utilities automate
some parts of the repair process.
TESTDISK.EXE
============
TestDisk v6.10
The program can recover the Partition, Boot Sector, & FAT
On a FAT32 hard disk: TestDisk can run under DOS, after booting
from a Win9x boot disk and loading the DPMI program CWSDPMI.EXE
NB: To run the program in DOS, CWSDPMI.EXE must be run first
(but to run it in Windows, CWSDPMI.EXE must not be run)
*** Run TestDisk in DOS ***
CWSDPMI
TESTDISK
*** Test Partition Structure of all disks in DOS ***
CWSDPMI
TESTDISK /LIST
TESTDISK /LIST > PRT_LIST.TXT
Examples of TestDisk Scan Results -
Disk 80 - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512
Disk 81 - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512
NB: Disk 80 = IDE 0 : Drive C (10GB) and Drive E (66GB)
Disk 81 = IDE 1 : Drive D (76GB)
Disk 80 - 80 GB / 74 GiB - CHS 9729 255 63
Partition Start End Size in sectors
1 * FAT32 LBA 0 1 1 1274 254 63 20482812 [DRIVE C]
2 E extended LBA 1275 0 1 9728 254 63 135813510
5 L FAT32 1275 1 1 9728 254 63 135813447 [DRIVE E]
Disk 81 - 80 GB / 74 GiB - CHS 9729 255 63
Partition Start End Size in sectors
1 P FAT32 LBA 0 1 1 9728 254 63 156296322 [DRIVE D]
No partition is bootable
NB: * = Asterix indicates the active (bootable) partition
P = Primary DOS partition
E = Extended partition
L = Logical partition
Notes -
If one of the disk's Partitions is accidentally deleted, e.g. by
faulty software (or any cause other than physical disk damage),
you can get it back using TESTDISK.
TestDisk can also COPY any file (or entire subdirectories) from a
lost partition WITHOUT having to first restore the partition or
reboot. Ideal if you can't access the partition any other way!
Display the Geometry (Cylinders, Heads, Sectors) -
Under DOS, TestDisk gets the disk size using an extended BIOS
function (ah=0x48, int 0x13), and the geometry (number of heads
and sectors) using a standard BIOS function (ah=0x08, int 0x13).
TestDisk uses the default sector size of 512 bytes.
NB: Partitioning programs (such as FDISK.EXE) make the Primary
DOS Partition and the Extended Partition end on a cylinder
boundary. This is a MANDATORY requirement!
Recover the Boot Sector -
TestDisk can fix a corrupted FAT32 Boot Sector, using the backup
Boot Sector. The Boot Sector is the first sector of the Partition,
and a backup copy of the Boot Sector is located at the 6th sector
of the Partition.
TestDisk checks the Boot Sector and the backup Boot Sector:
if the Boot Sector and backup Boot Sector mismatch, you can
overwrite the Boot Sector (Org BS) [Original BootSector] with
the backup Boot Sector (Backup BS), or vice versa.
The option "Dump" can used to display the sector content in both
hexadecimal (hex) and ascii (plain text).
Rebuild a valid Boot Sector -
If a FAT32 boot sector is corrupted, TestDisk can rebuild that
boot sector: choose the option "RebuildBS" in the menu.
To rebuild a FAT boot sector, TestDisk requires that:
(1) filesystem size is equal to partition size, and
(2) fragmentation is low.
[NB: The second condition is highly unlikely in reality!]
Recover the Partition -
This option can find lost FAT32 partitions and restore them. It
finds deleted partitions, then allows you to write the necessary
data into the Partition Table.
NB: It can COPY any file (or recurse through whole subdirectories)
from within a lost partition without having to first restore
that partition.
Repair the FAT -
File Allocation Tables are maps of the data region, indicating
which clusters are used by files and directories. To repair FAT,
(menu: "Repair FAT") TestDisk compares the two FAT copies. If FAT
mismatches (sector by sector check) or contains errors, TestDisk
uses the FAT copy with less errors and removes the obvious errors.
This function must ONLY be used on a filesystem with correct
values in the boot sector! It has been used with success when
SCANDISK or CHKDSK refused to repair the filesystem or crashed.
Make Backups of Essential Sectors -
The "Dump" option can be used to dump a backup copy of essential
sectors to disk (i.e. save them to another disk).
Undelete FILES -
1. Select "Advanced".
2. Select the partition containing the lost files and choose "Undelete".
3. To undelete a file, select the file to recover and press "c" to copy
the file to another disk. To recover a deleted directory, select the
directory and press "c" to undelete the directory and its contents.
4. Select the destination disk.
5. When you have recovered all the lost files, press "Q" to Quit.
Undelete PARTITION -
Step 1: Disk selection
Run TestDisk. All hard drives should automatically be detected,
and listed with the correct size.
1. Use the up/down arrow keys to select the hard drive with the lost
partition(s).
2. Press "Enter" to proceed.
Step 2: Partition table selection
TestDisk displays the partition types.
1. Select the partition type. Usually the default value will be the
correct one, because TestDisk auto-detects the partition type.
2. Press "Enter" to proceed.
Step 3: Current partition table status
1. Select "Analyse" to check the current partition structure
(i.e. a sanity check: see below) & search for lost partitions.
2. Press "Enter" to proceed.
The current partition structure is displayed. Examine it for missing
partitions and errors:
- e.g. The first partition is listed twice: this indicates a
corrupted partition or an invalid partition table entry.
- e.g. "Invalid boot": this indicates a faulty boot sector.
- e.g. Only one logical partition (labelled "Partition 2") is shown
in the Extended partition, so one logical partition is missing.
Step 4: Quick Search for partitions
1. If there are missing partitions or errors, select the O/S
(Operating System) and partitions to proceed.
e.g. TestDisk finds two partitions, including a missing
logical partition labelled "Partition 3".
2. Highlight the partition found, then press "P" to list its files.
3. If all directories and data are correctly shown, press "Enter"
to proceed. To go back to the previous display, press "Q" to Quit.
Step 5: Save the partition table, or search for more partitions
1. If all partitions are shown and all files correctly listed:
Select "Write" to save the partition structure.
NB: The option "Extd Part" gives you the choice whether the
Extended partition will use ALL the available disk space
or only the MINIMUM required space.
2. If a partition is still missing, go to Step 6:
Select "Deeper Search", then press "Enter" to proceed.
Step 6: If a partition is still missing, do a Deeper Search
A Deeper Search will search for FAT32 backup boot sectors; and to detect
more partitions it will scan each cylinder (click on the thumbnail).
The results are displayed as follows -
If a partition is found by its backup boot sector, on the last line
of the display you'll see the message "found using backup sector!"
and the size of the partition.
NB: You might get a false result, if there were backup copies stored
on the damaged disk of the Boot Sector for this or any other disk
(i.e. backups made by a data backup or data rescue program).
If a partition is displayed twice, with different sizes, both will be
listed with status D (i.e. deleted) because they overlap each other:
1. Highlight the first, then press "P" to list its files. If the
file system of this partition is damaged (click on thumbnail
to check), press "Q" for Quit to go back to the previous display.
2. Highlight the second, then press "P" to list its files. If it works,
you've found the correct partition! Use the left/right arrows to
navigate into the directories: examine the files in them for more
verification. Press "Q" (Quit) to go back to the previous display.
NB: The FAT directory listing is limited to 10 clusters, so some
files may not appear; but this doesn't affect recovery.
3. The status options are: Primary, *bootable, Logical, and Deleted.
Using the left/right arrow keys, change the status of the selected
partition to L (Logical).
Note: The primary partition starts at cylinder 0, head 1, sector 1;
additional partitions usually start at head 0 sector 1,
(e.g. C-H-S 2231-0-1).
Note: If a partition is listed as * (bootable), but you don't
boot from that partition, you can change it to Primary.
4. Press "Enter" to proceed.
Step 7: Partition table recovery
Write the new partition structure to disk.
1. At "Write" select 'Enter', 'y' or 'Ok', to save all partitions
to the partition table.
2. TestDisk displays the message "You have to restart your Computer
to access your data"; so press 'Enter', then reboot the computer.
*** Test the Partition Structure ***
** Display the result on screen **
CWSDPMI
TESTDISK /list
** Alternatively, save result to a file ***
CWSDPMI
TESTDISK /list > testdisk.txt
** Alternatively, save result to a file ***
CWSDPMI
TESTDISK /list /log
Sanity Checks -
TestDisk's analysis includes a "sanity" check of the partition
structures (in the partition tables: the MBR and Extended MBR):-
The MBR partition table is limited to 4 entries (one of which can
be an Extended partition containing several logical partitions).
Every partition table (in the MBR and in each Logical partition)
must end with the two bytes 55 AA (hex).
A partition entry must contain the following fields:
- beginning of partition (C-H-S)
- end of partition (C-H-S)
- partition type
- beginning of partition (LBA)
- size in sectors
- boot flag
Only the Primary partition can have the bootable flag set.
NB: This might not be so if the Primary partition is a
hidden partition (i.e. if the partition type is 1C).
CHS data storeage is limited to a maximum of 1,024 cylinders:
0 to 1023 (the 8GB limit, 1024 x 255 x 63 = 16,450,560 sectors).
A modern BIOS uses LBA mode to address disk data, not CHS; but
FAT32 boot sectors still include the CHS geometry.
Each CHS value must be within the valid range, so Testdisk checks
that CHS sector 0 is not used (the first valid CHS sector is 1),
and checks the CHS sector number is less than the number of sectors
per head. It also checks: whether the LBA address values match the
CHS address values; whether the partition ends after the end of the
disk; and whether any partitions are overlapping each other.
Further Information -
See also: http://en.wikipedia.org/wiki/TestDisk
SCANDISK.EXE
============
It's safe to run Microsoft SCANDISK to check a hard disk for errors,
but do NOT allow it to make any changes to the disk!
It gives priority to file system integrity, discarding user data
to do so, thus it CANNOT be trusted in a data recovery situation.
UNFORMAT.EXE
============
Norton's UNFORMAT for DOS -
Recovers files and directories after an accidental format,
and can rebuild disks corrupted by a virus or power failure.
The program can recover all the files on a partition which has
been accidentally formatted by the DOS program FORMAT.COM (if
no new files have been written to the disk afterward).
NB: Where files have been written to the disk after it was
formatted, the program might still recover some files; but
this will depend on how much data has been over-written.
Norton's UNFORMAT for DOS (UNFORMAT.EXE) is one of the rescue
tools included in -
(a) Norton Utilities 2001
(b) Norton Utilities 2002
(c) Disk 1 of the Norton Emergency Disks (a set of 4 floppy disks)
Syntax:
UNFORMAT [drive:] [/IMAGE|/MIRROR] [/G0] [/BW|/LCD]
drive Drive letter of disk to unformat.
/IMAGE Uses Image recovery info (excludes Mirror info).
/MIRROR Uses Mirror recovery info (excludes Image info).
/G0 Disable graphical mouse and all graphical characters.
/BW, /LCD Improve display on monochrome or LCD monitors.
PARTITION LOGIC
===============
Partition Logic is a hard disk partitioning tool.
It can create, delete, format, defragment, resize and move partitions
and modify their attributes. It can copy entire hard disks.
Partition Logic is based on the Visopsys operating system. It boots
from a CD or floppy disk, and runs as a standalone system independent
of your regular operating system. It is a free alternative to such
commercial programs as Partition Magic, Drive Image, and Norton.
The bootable floppy disk IMG file includes a minimal distribution. It
must be written to a 1.44MB floppy disk. Windows users will need a
program such as RawWrite (RAWWRITEWIN.EXE) to create the disk.
Under Windows 95, 98 and ME the file DISKIO.DLL (included with RawWrite)
must be present in the same directory as RAWWRITEWIN.EXE.
Installation note:
Partition Logic is a self-contained disk image with its own operating
system (Visopsys) included on the disc. It is not installed as a Windows
program as such. Instead it is written to a blank floppy disk from which
the computer can be booted to perform the desired partitioning, resizing,
etc.
Help Commands:
HELP Show summary of help entries
NB: Type 'help ' for specific help
Data Recovery commands:
BOOTMENU Edit the boot loader menu
CHKDISK Check a filesystem for errors
DISKS Show the disk volumes in the system
FDISK Manage (i.e. partition) hard disks
FORMAT Create a new (empty) filesystem
LSDEV Display devices
MEM Show system memory usage
MOUNT Mount a filesystem
SYNC Synchronize all filesystems on disk
UMOUNT Unmount a filesystem
UNAME Print system information
File Commands:
CAT (or TYPE) Print a file's contents on the screen
CP (or COPY) Copy a file
FILE Show the type of a file
MORE Display file's contents, one screenful at a time
MV (or MOVE) Move a file (ren or rename have the same effect)
RM (or DEL) Delete a file
TOUCH Update a file or create a new (empty) file
Directory Commands:
CD Change the current directory
FIND Traverse directory hierarchies
LS (or DIR) Show the files in a directory
MKDIR Create one or more new directories
PWD Show the current directory
RMDIR Remove a directory
Manage Processes:
KILL Kill a running process
PS Show list of current processes
NM Show symbol information for a dynamic program or library
RENICE Change the priority of a running process
Miscellaneous Commands:
DEFRAG Defragment a filesystem
IMGBOOT The program launched at first system boot
KEYMAP View or change the current keyboard mapping
LOGOUT (or EXIT) End the current session
REBOOT Exit to real mode and reboot the computer
SHUTDOWN Turn off the computer
VSH Start a new command shell
Commands for Graphic Mode only:
COMPUTER Navigate the resources of the computer
CONFEDIT Edit Visopsys configuration files
CONSOLE Show the console window
DISPROPS View or change the display settings
FILEBROWSE Navigate the file system
PROGMAN View and manage programs and processes
SCREENSHOT Take a screenshot
VIEW Display a file in a new window
WINDOW Open a new command window
Top of Page
RECOVER INDIVIDUAL FILES
========================
This procedure is for situations where the disk cannot be repaired,
e.g. due to a hardware fault, and the best that can be achieved is
to copy the files to an undamaged disk.
This is for cases where cloning the disk will not solve the problem,
because the actual structure of the file system itself is damaged.
This class of utilities typically work by re-building a facsimilie,
in RAM memory, of the hard disk's file structures (e.g. its File
Allocation Table and Directory Tree), after scanning the disk. It
can be an effective solution; but a full scan is a long process.
NB: Some of the utilities included can recover files deleted from
an undamaged disk (e.g. deleted by a virus, by a software bug,
or by accident).
TIRAMISU EASY RECOVERY
======================
Easy Recovery v6.10 -
This program works with ANY size of FAT32 hard disk up to 137GB
(the largest hard disk possible with 28-bit BIOS).
NB: Easy Recovery was known as Tiramisu in versions 1 to 5.
NB: Tiramisu version 3 (a.k.a. "Tiramisu for 32-bit FAT v3")
does not work on a hard disk larger than 8GB.
NB: Tiramisu version 5 does not work on a hard disk larger than
32GB, because it can NOT recognise a cluster size of 32k
(i.e. the maximum cluster size it can recognise is 16k).
Easy Recovery uses information held in the BIOS to identify the
file system. If that information is faulty, or not available, it
reports the File System Type as "Unknown": in that case, before
the program can analyze the partition for recoverable data, the
user must manually select the correct file system (i.e. FAT32).
Once the file system has been correctly identified, the program
is ready to begin the scan (at the 'Recovery Scan' screen).
On a FAT32 disk, data is stored in clusters. The Operating System
creates a table (the File Allocation Table, or FAT) to keep track
of the cluster(s) in which each file is stored. It also makes a
backup copy of the FAT, in case the original is damaged.
By default, Easy Recovery compares the two copies of the FAT
and uses the best information from each. If that default action
fails to locate all the files, there is an option to select one
FAT only instead (either FAT1 or FAT2).
If BOTH copies of the FAT are damaged, the option "Ignore FAT"
forces the program to rely solely on information in the files,
without refering to either copy of the FAT.
If none of the above actions recovers all the files, the option
"RAW" causes all the sectors on the disk to be read sequentially,
i.e. sector by sector. This will ONLY recover files which are
stored contiguously on the disk, or which occupy only one sector.
NB: A better option in this last event might be to try restoring a
backup copy of FAT1 or FAT2 (ideally on a clone of the disk).
LOST AND FOUND
==============
Lost and Found, v1.31
Lost & Found lets you recover and restore data after accidental
data loss, or from corrupted media caused by a disk crash or a
logical system failure. It will even recover data if the partition
has been reformatted or if the FAT tables have been destroyed!
As long as the disk is still spinning, Lost & Found can locate and
recover almost any file, anywhere on the disk.
NB: Other users have reported exceptional results! The program
recovered data in situations where Norton Disk Doctor and
ScanDisk.exe refused even to run.
*** Run Lost and Found ***
SET PATH=%path%;F:\LOSTFND
LF
LOADER LF
ACTIVE PARTITION RECOVERY
=========================
Active Partition Recovery, v3.0
SYNTAX -
-lba : Force LBA mode for access to all detected HDDs
-lba=N : Force LBA mode for access to particular HDD,
where N=[80h,81h,82h,83h]
-restoreMBR=N : Restore MBR sector from a backup file,
where N=[80h,81h,82h,83h]
-ignoreMBR=N : Do not load MBR information for this drive,
where N=[80h,81h,82h,83h]
NB: Allows you to scan a damaged partition
-imageN=PATH : Create an image of the physical drive,
where N=[80h,81h,82h,83h]
and PATH={drive}:\\{PATH}\\ (i.e. destination)
The IDE cables will accept up to four hard disks, two on each
cable: named Primary Master, Primary Slave, Secondary Master
and Secondary Slave; numbered respectively 80, 81, 82 & 83.
The program cannot handle a damaged partition of type "Unknown".
In that situation, start the program with the parameter
"-ignoreMBR", to force program to ignore the default partitions.
*** Set the PATH ***
SET PATH=%path%;A:\;F:\ACTPARTR
*** Read the Help file ***
EDIT APR.TXT
*** Run the Program ***
APR
*** Run the Program: Force LBA mode ***
APR -lba=80
APR -lba=81
APR -lba=82
APR -lba=83
*** Scan Disk #1 (Drive C:) ignoring its MBR ***
APR.EXE -ignoreMBR=80
*** Scan Disk #2 (Drive D:) ignoring its MBR ***
APR.EXE -ignoreMBR=81
NB: Press [TAB] key to switch to Long File Name view
MEDIA TOOLS
===========
Media Tools Professional, v5.0
In access mode "IDE DRIVE" the program has direct access to any IDE
drive on the system, and does not rely on the system BIOS. This
means you can see the entire capacity of any IDE drive, regardless
of whether the system BIOS has the ability to see the entire drive.
File Recovery Tree - Rebuilds FAT32 file system automatically
for hard drives and removable media. Recovers from accidental
format or deletion, corrupt or missing file system, virus or worm,
or files located in slack space from previous formats. Allows you
to recover data to another drive.
Boot Partition Repair - Rebuilds FAT boot sector and partition table
automatically from an IDE or SCSI hard drive and removable media,
giving you access to all files and directories.
Media Editor - Mounts DOS and Windows file systems (easy step-by-step
screenshots and directions). Then, once the file system is mounted,
the file system can be rebuilt automatically. (Note: Use this option
if "File Recovery Tree" does not produce the results you expect).
NB: Media Editor also lets you view, search for, and edit anything
within the file system on any media or operating system, without
any knowledge of Hex, through custom designed editing templates.
*** Run Media Tools ***
SET PATH=%path%;F:\M_TOOLS
MTL
GET DATA BACK FOR FAT
=====================
The program GetDataBack for FAT can succeed in recovering data
where other attempts fail.
GetDataBack includes a drive-imaging tool, which makes a replica
of the drive on a second hard disk. The recovery portion of the
program scans the image far more quickly than it could possibly
work through damaged sectors on a disk, resulting in a solid
solution for getting back all the missing data.
SVEND'S UTILITIES: FP.SYS
=========================
FP.SYS (Find Partition), v1.5
Copyright Svend Olaf Mikkelsen, 2001
A device driver for DOS or Windows (Win95/98/ME) that adds
read-only drive letters for lost partitions.
SYNTAX -
Put this line in config.sys:
device=fp.sys [disk number]
Disks are numbered from 1. Default is disk 1.
If FP.SYS is not in the root of the boot drive, you must
add the full path to FP.SYS.
To abort loading, press ESC.
If a FAT32 partition is lost, you MUST boot with a DOS version
that recognises FAT32 (e.g. MS-DOS v8.0 [the WinME version]).
Notes:
1. To speed up disk access in pure DOS, Smartdrive (SMARTDRV.exe)
can be used. However, Smartdrive does not like it if write
attempts are made to read-only partitions.
2. If you use FP.SYS with Windows 95/98/ME, add the following
entry in the C:\WINDOWS\IOS.ini file:
[SafeList]
fp.sys
NB: If this is not done, all partitions will be in MS-DOS
compatibility mode. In some cases where a disk is not
read correctly in DOS or Windows, Windows will see the
disk differently in compatibility mode.
RECOMMENDATIONS -
Backup important data that you currently can access, to an
external disk, before recovery attempts are made.
Use FP.SYS when booting from floppy disk.
WARNINGS -
1. If partitions are overlapping, file copying can damage data.
If you are in doubt, only copy to an undamaged disk.
2. The target partition must NOT contain old deleted copies of
the lost files.
3. If you do not know the nature of the problem, do not write
to the damaged disk at all; and do not use FDISK on it!
*** Run DIR command after loading fp.sys ***
** (FP.SYS must be loaded in CONFIG.SYS) **
C:
DIR /W
D:
DIR /W
SVEND'S UTILITIES: FINDDIR
==========================
FINDPART for DOS, v4.72 (FINDPART FINDDIR)
Searches for sub-directories; and calculates the estimated
location of cluster number two, and cluster size.
NB: In this version of Svend's Utilities the FINDDIR function is
a switch (i.e. an option) in FINDPART, not a seperate program
SYNTAX -
Disks are numbered from 1.
The report can be written to a file. File extension must be .txt
Note: This program is NOT the best means of recovering files. It
FAILS if the file to be copied is not contiguous on the disk!
There are much BETTER recovery tools available (see above).
** Display the Help screen **
FINDPART FINDDIR
** Save the Help screen to a file **
FINDPART FINDDIR > F:\FINDDIR.TXT
** Search Disk 1 for Subdirectories **
** Saves report to a file **
FINDPART FINDDIR 1 F:\FINDDIR1.txt
** Search Disk 2 for Subdirectories **
** Saves report to a file **
FINDPART FINDDIR 2 F:\FINDDIR2.txt
SVEND'S UTILITIES: CYLDIR
=========================
CYLDIR, v5.5 (CYLDIR.EXE)
Lists lost directories in a FAT32 partition, and displays the
file names.
The correct DOS codepage must be loaded, before searching for
or copying files. [NB: DOS codepage for UK (country 044) is 850]
SET CODEPAGE=850
Copying speed is enhanced if himem.sys or smartdrv.exe are loaded
(in CONFIG.SYS and AUTOEXEC.BAT respectively).
Note: This program is NOT the best means of recovering files. It
FAILS if the file to be copied is not contiguous on the disk!
There are much BETTER recovery tools available (see above).
SYNTAX -
Cyldir {disk number} {cylinder} {head} {sector} {FAT size}
{cluster size} {root} [copyfiles {Directory cluster}] [{logfile}]
- FAT size in sectors (from Ranish Partition Manager: PART.exe)
- Cluster size in KB (NB: If disk exceeds 32GB, must be 32KB)
- Root = Root cluster number (NB: Usually cluster 2)
- Logfile's extension must be .TXT
(a) LIST THE LOST FILES:
** Find the size of the FAT with FINDPART **
FINDPART FINDFAT ALL comprehensive F:\FAT_ALL.TXT
** Find the size of the FAT with Ranish Partition Manager **
SET PATH=%path%;F:\RANISH
PART.exe
To list lost (or deleted) files in Partition 1 on Disk 1
where the Partition uses 32K clusters (i.e. exceeds 32GB):
CYLDIR 1 0 1 1 ____ 32 2 F:\CDIR.TXT
Example -
From FINDPART FINDFAT you have this result for Disk 1:
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
260 0 33 1204 4 2 1204 0 0 0 981124 516
The CYLDIR command line is the disk number, followed by the first
6 numbers in the above line, followed by the file name CDIR.TXT:
CYLDIR 1 260 0 33 1204 4 2 F:\CDIR.TXT
(b) COPY THE LOST FILES:
Run CYLDIR.EXE from a floppy disk or an undamaged partition.
If the option COPYFILES is used, it copies files from a lost
directory. The cluster numbers are saved in the log file.
The current directory must be empty, unless it's the Root
directory. NB: Copied files cannot be expected to be okay!
To speed up file copying, load HIMEM.SYS and SMARTDRV.EXE:
1: Load HIMEM.SYS in CONFIG.SYS
Syntax: device=himem.sys
2: Load SMARTDRV.EXE before running CYLDIR -
SMARTDRV.EXE 4096 16>nul
CYLDIR 1 0 1 1 ____ 32 2 COPYFILES ____ F:\CDIR.TXT
Note: Files are copied using their SHORT file names. A file,
LONGNAME.BAT, for renaming them to their Long File Names,
will automatically be created. A file named CYLDIR.LOG
records the names of files that are not readable or are
FDISK damaged. Files bigger than 2 GB cannot be copied.
Alternate usage: Cyldir {directory cluster} dir [{copy logfile}]
Cyldir {directory cluster} tree [{copy logfile}]
This is two additional ways to copy files from a lost partition.
Directories are relative to the current directory.
If 'tree' is specified, files in any subdirectories are copied.
If the target subdirectories already exist, they must be empty.
The main thing is to be certain that no copy of the lost files
is on the target partition. This could occur if partitions
overlap, or if old deleted copies of the lost files exist.
The logfile CDIR.TXT must exist in the current directory, or
in the Root of current partition. (Suggestion: Put CDIR.TXT
and CYLDIR.EXE in an empty directory and work from there.)
Up to ten {directory cluster}'s can be entered. If the Root
directory cluster number is entered with the 'tree' option, you
can add '+lost' to the command line to include lost directories,
i.e. those beginning with ? in CDIR.TXT
CYLDIR ____ tree +lost F:\COPYLOG.TXT
To stop the copy after the current directory, press ESC.
If run in pure DOS, a file LONGNAME.BAT for recreating long file
names is created in each directory, if there is enough free space.
To write a directory listing to CDIR.LST, use:
CYLDIR LIST
Choose directory cluster numbers in CDIR.TXT; or execute the
command 'cyldir list' and find the numbers in CDIR.LST.
*** Copy a single directory ***
(e.g. If the cluster number is 117: cyldir 117 dir)
CYLDIR ___ DIR
*** Copy an entire directory tree ***
(e.g. If the cluster number is 117: cyldir 117 tree)
CYLDIR ___ TREE
Example -
Disk: 1 Cylinders: 9729 Heads: 255 Sectors: 63 MB: 76317
-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 42973812 20983 0 1 1 2674 254 63 B OK
2675 1 0B 63113322447 55333 2675 1 1 9728 254 63 R0 OK
0 - 0B 42973938113322447 55333 2675 1 1 9728 254 63 B OK
6200 1 0B 63 56661192 27666 6200 1 1 9726 254 63 R0 OK
0 - 0B 99603063 56661192 27666 6200 1 1 9726 254 63 B OK
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
2675 1 33 13832 32 2 13832 0 0 0 080206 11160
6200 1 33 13830 16* 2*13830 0 0 0 2
Syntax:
CYLDIR + Disk number + first 6 numbers from lower table + F:\CDIR.txt
** Disk 1, Partition 2 **
cyldir 1 2675 1 33 13832 32 2 F:\cdir.txt
** Disk 1, Partition 4 **
cyldir 1 6200 1 33 13830 16 2 F:\cdir.txt
Note:
To speed up file copying, load HIMEM.SYS and SMARTDRV.EXE
1: Load HIMEM.SYS in CONFIG.SYS -
DEVICE=HIMEM.SYS
2: Load SMARTDRV.EXE before running CYLDIR -
SMARTDRV.EXE 4096 16>nul
ODI'S LFN TOOLS
===============
Odi's LFN Tools: LDIR.EXE v1.75
LCOPY.EXE v1.75
This is a means of copying files off a damaged HDD (one which,
although Windows will not run, is accessible in DOS) to a safe
destination (i.e. an undamaged disk), in DOS, while preserving
the Long File Names.
*** Set PATH to include LFN tools ***
SET PATH=%path%;F:\LFN
*** Directory Listing with Long File Names ***
** Pauses after each screen **
LDIR.EXE /P
NB: A damaged disk will crash the system if the DOS command DIR
is used, because the computer cannot determine the amount of
free disk space. LDIR can obtain a directory listing in that
situation, as it does NOT display the amount of free space!
*** LCOPY.EXE: Long filename version of COPY.EXE ***
** Copy file in DOS preserving its Long File Name **
SYNTAX -
LCOPY "[Source]" "[Destination]"
Example:
LCOPY "C:\PROGRA~1\MISC" "F:\DATA"
1. The file LCOPY.EXE must be located in the DOS path.
(Set the PATH in autoexec.bat, e.g. SET PATH=A:\;F:\)
2. The destination directory must already exist, and
must be a valid DOS directory name (i.e. in 8.3 format).
3. It is NOT necessary to define a name for the file in the
destination instruction.
4. If the long file name contains spaces, the source and the
destination must BOTH be enclosed in quotation marks.
5. The DOS wildcard *.* is not valid. The wildcard * must be
used instead.
6. The wildcard * must come BEFORE the first space in the long
file name for the source to be valid.
7. The switch /A copies ALL files, including HIDDEN files.
8. To copy only directory structure use: LCOPY . {dest} /S
NB: The destination {dest} must be a valid path, e.g. F:\
*** COPY all files in current directory to Floppy Disk in A: ***
** Use of LCOPY.EXE preserves the Long File Names **
*** Copy ALL files in current directory ***
LCOPY.EXE "*" A:\ /A
*** Include all SUBDIRECTORIES of current (the /S switch) ***
LCOPY.EXE "*" A:\ /A /S
*** COPY all files in current directory to RAM disk in F: ***
** Use of LCOPY.EXE preserves the Long File Names **
*** Copy ALL files in current directory ***
LCOPY.EXE "*" F:\ /A
*** Include all SUBDIRECTORIES of current (the /S switch) ***
LCOPY.EXE "*" F:\ /A /S
Note:
To provide a RAM disk in DOS, add this to CONFIG.SYS:
device=ramdrive.sys /E 28672
NB: RAMDRIVE.SYS is included on WinME's Emergency Boot Disk
*** COPY all files in current directory to USB disk in F: ***
** Use of LCOPY.EXE preserves the Long File Names **
*** Copy ALL files in current directory ***
LCOPY.EXE "*" F:\ /A
*** Include all SUBDIRECTORIES of current (the /S switch) ***
LCOPY.EXE "*" F:\ /A /S
Note: USB 1.1 drivers for DOS
To provide USB access in DOS, add these lines to CONFIG.SYS:
device=USBASPI.SYS
device=DI1000DD.SYS
To connect both a USB 2.0 CD drive AND external USB 2.0 hard disk
simultaneously -
(a) Include the following lines, in this order, in CONFIG.SYS:
device=HIMEM.SYS
device=USBASPI.SYS /e
device=USBCD.SYS /d:USBCD001
device=DI1000DD.SYS
(b) Include the following line in AUTOEXEC.BAT:
MSCDEX /d:USBCD001
Driver #1: USBASPI.SYS
ASPI Manager for USB mass-storage v2.24
Panasonic Communications Co 2000-2007
Syntax:
device=USBASPI.SYS [/e] [/o] [/u] [/v] [/w] [/r] [/l[#]]
[/slow] [/nocbc]
/e EHCI, for enabling EHCI add-on USB 2.0 controller
/o OHCI, for enabling OHCI add-on/onboard USB 1.1 controller
/u UHCI, for enabling UHCI onboard USB 1.1 controller
/v Verbose mode, useful for troubleshooting
/w Wait, displays message to prompt attaching of USB device
/r Resident, load as memory resident if USB floppy detected
/l# Luns, specify highest number of LUN assigned: default /L0
/slow Use SLOW mode, gives longer delays on scanning USB ports
/nocbc No CardBus Controller, disable detection on CardBus slots
You can specify more than one controller type (e.g. /o /e). Use
this feature to specify which port types to enable: limiting
the port types that are scanned for results in a faster startup.
These options work on Tiny Computers PC (Intel Celeron chipset):
device=USBASPI.SYS /v
device=USBASPI.SYS /o /v
device=USBASPI.SYS /e /v
device=USBASPI.SYS /o /e /v
Driver #2: DI1000DD.SYS
ASPI Disk Driver v2.00
(c) 2001 NOVAC Co Ltd
USBASPI.SYS merely maps USB devices to an ASPI device. An
additional driver, DI1000DD.SYS, is needed to map the ASPI
mass storage to a DOS drive letter.
NB: DI1000DD.SYS version 1 only supported FAT16, but FAT32
support was added to version 2
Notes:
1. If the files to be recovered are too large for a floppy,
or a USB pen drive, attach a second HDD to an IDE cable
2. LCOPY.EXE and other LFN utils could be held on Drive E:
(a RAM disk where rescue utils are stored for carrying
out data recovery on an IDE Hard Disk)
3. For other methods of providing USB access in DOS, see:
http://www.computing.net/answers/dos/usb-20-drivers-for-dos/13447.html
http://www.unet.univie.ac.at/~a0503736/php/drdoswiki/index.php?n=Main.USB
UNDELETE
========
This is a means of recovering files accidentally deleted.
A. Undelete files in DOS -
1. NORTON'S UNERASE FOR DOS
Recover deleted files using Norton's UNERASE for DOS (UNERASE.EXE)
which is one of the rescue tools included in -
(a) Norton Utilities 2001
(b) Norton Utilities 2002
(c) Disk 1 of the Norton Emergency Disks (a set of 4 floppy disks)
Syntax:
UNERASE [pathname] [/IMAGE|/MIRROR|/NOINFO] [/NOTRACK]
[/PROTECTED|/NOPROTECTED] [/LIST] [/G0] [/BW|/LCD]
pathname Name of file to recover.
/IMAGE Use Image recovery info (excludes Mirror info).
/MIRROR Use Mirror recovery info (excludes Image info).
/NOINFO Exclude both Image and Mirror recover info.
/NOTRACK Exclude Delete Tracking information.
/PROTECTED Only recover files protected by SmartCan,
Norton Protection, or Delete Sentry.
/NOPROTECTED Exclude files protected by SmartCan,
Norton Protection, or Delete Sentry.
/LIST List the erased files available for recovery.
/G0 Disable graphical mouse and all graphical characters.
/BW, /LCD Improve display on monochrome or LCD monitors.
NB: SmartCan, Norton Protection and Delete Sentry provide a type of
Recycle Bin for exclusively DOS-based systems; but it's one that
can't be used on a Windows 9x system.
Unless SmartCan, Norton Protection or Delete Sentry is installed,
the /LIST option will show only those files that can be recovered
using ordinary DOS methods.
*** Run Norton Unerase for DOS ***
UNERASE
*** List all Recoverable Files ***
UNERASE /LIST
*** Undelete a Specific file ***
NB: Insert the actual Path and Filename
UNERASE C:\RECOVER.ME
2. TESTDISK
Alternatively, recover deleted files using TestDisk:
See above, under heading TESTDISK.EXE
Alternatively, do a Google search for other DOS undelete programs:
http://www.google.com/search?btnG=Google+Search&as_epq=DOS+unerase
http://www.google.com/search?btnG=Google+Search&as_epq=DOS+undelete
B. Undelete files in Windows -
Restoration v2.5.14
File undelete utility for Win98/ME/2000/XP (FAT/FAT32/NTFS partitions)
Restoration is a tool to undelete files. You can scan for all files
that may be recoverable, and limit the results by entering a search
term or extension. The program is small and standalone; it does NOT
require installation, and can run from a Floppy disk.
WINDOWS UTILITIES
=================
Boot from Hard Disk:
To use Windows tools to recover files from a damaged hard disk,
attach the damaged disk as the PRIMARY SLAVE on the IDE cable
and boot from an undamaged hard disk as the IDE Primary Master.
Boot from CD:
Load Windows from a rescue CD.
An alternative to booting from a hard disk is to boot from a CD
(one which has all the necessary Operating System components to
be bootable), e.g. the Ultimate Boot CD burned to a CD-RW disc.
NB: Creating a bootable CD to run BartPE is NOT an option, as it
requires Windows XP.
Top of Page
SECTION C: ERROR MESSAGES
BLUE SCREEN OF DEATH
====================
BLUE SCREEN OF DEATH (BSOD)
===========================
A Blue Screen error does NOT usually indicate a fatal problem.
The Blue Screen of Death (also known as a STOP error) is the error
screen which is displayed by the Operating System on encountering
a system error during startup.
Although it's called the "screen of death", the system has been
halted to PREVENT damage occuring; a blue screen does not of
itself cause any damage.
It does NOT indicate a disk fault, as Windows was able to get
far enough along in the startup process to encounter a startup
error. The blue screen is in fact supplied by Windows.
In Windows 9x, a blue screen is the main way the Operating System
has of notifying the user of the presence of an incompatible
device driver. Fixing this is only a minor problem.
Alternatively, the blue screen might be caused by a hardware fault.
If so, it can be fixed by installing a repacement for the faulty
RAM, PSU or fan (all inexpensive items), as the case may be.
SAFE MODE -
It may be possible to start Windows, by booting into Safe Mode.
To do this, restart the computer, and repeatedly press F5 or F8
or CTRL (it varies, depending on the make and model of computer)
at intervals of one second during the initial loading process.
This starts Windows without loading any device drivers (i.e. it
by-passes any faulty drivers present), so enabling you to use
Windows (rather than DOS) to fix the fault which is causing the
blue screen error and the inability to start normally.
DIAGNOSING THE CAUSE -
A blue screen can be caused by (1) incompatible device drivers,
(2) poorly written device drivers, (3) bugs in the kernel of the
Operating System, or (4) faulty hardware.
The most common cause is faulty or incompatible device drivers
(.DLL and .VXD files). At bootup, Windows tries to load all
the .DLL and .VXD files in the computer; if it encounters one
it can't load, the system is halted and the blue screen shown.
Review any recently installed software, which may have installed
incompatible driver files, e.g. files that were written for WinXP.
Try uninstalling the software in question; or manually remove
the files it added to the disk: i.e. physically delete those files
from the disk, and remove all references to those files from the
Windows Registry (or replace the Registry with a backup copy).
Manually Removing the Files:
The usual cause of the Blue Screen is simply installing the wrong
device driver. Typically it will be caused by a WinXP file being
installed in a Win9x system. Delete or rename that file, in DOS,
using the following procedure.
NB: A driver file is one with the file extension .DLL or .VXD;
and just deleting or renaming the file(s) causing the problem
(and then rebooting) will normally cure it.
The computer can usually be restored to normal working by deleting
the faulty or incompatible file(s) from the hard disk (or renaming
the file(s), e.g. from .DLL to .DL_), without having to make any
changes in the Registry. This should be tried first.
NB: It is poor tactics to delete a file physically, in case it turns
out to be the WRONG file. It is safer to merely rename it.
It may mean spending a lot of time in a trial-and-error process
of renaming one file at a time (in the directories C:\WINDOWS and
C:\WINDOWS\SYSTEM and C:\WINDOWS\SYSTEM32\DRIVERS), to establish
the identity of the faulty file(s).
A directory listing, at the DOS prompt, will list the files by date
(displaying a date for each file). The newest files are the ones
to suspect first!
It may be prudent to rename all files bearing the date that the
fault arose, in all three directories, then restart normally.
*** Directory Listing sorted by Date ***
DIR *.DLL /-W /P
DIR *.VXD /-W /P
NB: Working in DOS, the date you see in a Directory listing is the
"Modified" date (the date on which the file was last modified).
This is NOT its "Created" date (the date it was added to the
disk); so the files with the latest dates are NOT necessarily
the ones added by the suspect installation program.
Windows ME records a Bootup Log (as C:\BOOTLOG.TXT), on startup, if
the options BootMenu=1 and DisableLog=0 are set in the C:\MSDOS.SYS
file; so set those options and then restart the computer. This log
might record the last step taken before the STOP error occurs. If so,
the log may tell you which file the system was trying to load that
caused the fault: it will be the last entry in the log.
*** Routine to Edit MSDOS.SYS ***
C:
CD \WINDOWS\COMMAND
ATTRIB -R -H -S C:\MSDOS.SYS
EDIT C:\MSDOS.SYS
*** Routine to View the Boot Log ***
C:
CD \WINDOWS\COMMAND
ATTRIB -R -H C:\BOOTLOG.TXT
EDIT C:\BOOTLOG.TXT
Additionally, Windows ME keeps a copy of the previous bootup log,
in the file C:\BOOTLOG.PRV, which, being from before the Blue Screen
error, will be a complete startup log. A comparison with the latest
(partial) log might show which file the boot process crashed at.
*** Routine to View the Previous Boot Log ***
C:
CD \WINDOWS\COMMAND
ATTRIB -R -H C:\BOOTLOG.PRV
EDIT C:\BOOTLOG.PRV
Replacing the Windows Registry:
If it's necessary to make a change in the Registry, one way to
do so is to restore a known good working backup of the Registry
(i.e. replace the whole Registry). This can only be done in DOS.
By default, Windows 98/ME keeps up to 5 backup copies of the
Registry in the hidden directory C:\WINDOWS\SYSBCKUP
Every day, the first time Windows loads successfully a copy of
that valid Registry is saved there as a compressed .CAB file.
*** View details of the backups available ***
DIR C:\WINDOWS\SYSBCKUP\*.CAB /P /-W /OGD
*** Routine to restore the Windows Registry ***
NB: Follow the on-screen instructions in SCANREG
SET PATH=%path%;C:\WINDOWS\COMMAND
SCANREG /RESTORE
NB: It is NOT desirable to backup the current registry first,
because that would overwrite (i.e. destroy) one of the
existing backups: perhaps the very one that's needed!
It is also possible to manually extract a Registry backup
from a .CAB file, and copy it to the correct locations.
*** Routine to manually extract Registry from .CAB file ***
NB: Rename the .CAB file below to match the actual name
SET PATH=%path%;C:\WINDOWS\COMMAND
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.BAT /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.SYS /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.DAT /L C:\WINDOWS /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.INI /L C:\WINDOWS /Y
Blue Screen Error Number:
The Blue Screen usually displays a message and an error number,
like this:
number of error (parameter strings) name of error
All of this information is important in understanding the cause of
the fault. Dependant on the value of "number of error", all or some
of those parameters might contain information as to what went wrong.
List of STOP errors:
http://pcsupport.about.com/od/findbyerrormessage/tp/stop_error_list.htm
Hardware Faults:
Hardware faults can include faulty RAM memory, power supply issues,
overheating of components (e.g. due to failure of the cooling fan
on the CPU, or another fan inside the computer), hardware running
beyond specification limits, or other hardware faults.
If you have just made some hardware changes inside the computer,
the most likely cause is an insufficiently tightened cable, an
unattached cable, or some other fault related to the changes made.
Perhaps you failed to correctly attach a device, or inadvertently
loosened another cable while you were working. Perhaps you failed
to seat the new PCI Card or RAM module firmly enough in its slot!
Obviously you will only encounter hardware running beyond its
specification if you have been over-clocking the CPU. If so,
undo the changes you made.
If the cause is NOT a faulty installation of the new hardware,
the next step is to disable or remove the newly installed hardware
(and any accompanying software), as doing so may be a complete cure.
In the case of a fault in existing hardware, to cure the STOP error
fix the hardware fault: fit a replacement RAM memory module of the
same type, or a replacement Power Supply Unit (PSU) of the same type,
or a replacement for the faulty fan (as the case may be). Fan failure
will be obvious; if it is NOT a fan failure, suspect the RAM module
and the Power Supply Unit.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
USB Disk can cause Blue Screen:
A blue screen can also occur during a Windows session; e.g. if the
user ejects removable media (i.e. unplugs a USB device) while it is
being read from or written to, without following the correct
procedure.
NB: This commonly occurs with Microsoft Office, if the program is
not closed properly before unplugging a USB disk containing
dependent files.
Further Information:
For further information about STOP errors, read the following article:
http://en.wikipedia.org/wiki/Blue_Screen_of_Death
Suggestions for additional troubleshooting steps:
http://pcsupport.about.com/od/fixtheproblem/ht/stoperrors.htm
Top of Page
OTHER ERROR MESSAGES
====================
ERROR MESSAGE : "Disk / Partition Not Recognised"
=============
A possible cause might be the BIOS setting changing from LBA to
CHS, if it was previously set to AUTO, as a result of something
being altered in the first sector of the hard disk.
It's safer to set the BIOS to LBA before setting-up the disk,
which prevents this problem occuring. But even then, if the BIOS
is reset for any reason it will default to AUTO.
The change will confuse Windows; and where a switch between LBA
and CHS occurs, DOS programs (such as Partition Magic) may not
be able to see the Partitions.
Solution: Enter the BIOS screen, and set the hard disk option
to LBA (Logical Block Addressing).
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup.
NB: This is usually a non-fatal error message!
ERROR MESSAGE : "No boot device available" (or similar)
=============
The following errors all mean that none of the bootable devices,
specified in the bootable sequence set in the BIOS, contains the
signature bytes indicating a valid MBR in its 1st physical sector:-
"No ROM Basic - System Halted"; or "No boot device available, strike
F1 to retry, F2 for setup utility"; or "No boot sector on fixed disk,
strike F1 to retry boot, F2 for setup utility"; or "Non-System disk
or disk error, replace and strike any key when ready"; or "Disk Boot
Failure, Insert System Disk and Press Enter".
NB: This is usually a non-fatal error message!
Each partition table entry includes a Boot Indicator byte: these bytes
are at offset 446 (partition table entry #1 (01BE hex)), at offset 462
(partition table entry #2 (01CE hex)), at offset 478 (partition table
entry #3 (01DE hex)), and at offset 494 (partition table entry #4
(01EE hex)). These Boot Indicators are used to determine which partition
is active (i.e. bootable), by checking for the hex value 80; the other
Boot Indicators should all have a value of 00 (zero). If all four entries
are (for instance) 00 hex, bootup will fail.
Solution: Restore a backup copy of the boot disk's MBR sector guided by
the section "RESTORE A SECTOR" above.
Alternative Solution: Set the Primary partition of the boot disk to
"active" in the MBR, guided by the section "DISK STRUCTURE NOTES"
above, using a Disk Sector Editor.
Alternative Solution: Set the Primary partition of the boot disk to
"active" in the MBR, guided by the section "INSTALLING A HARD DISK"
below, using the FDISK.EXE program. WARNING: Careless use of the
FDISK program can cause fatal and irreversible damage to your files!
The Last Resort: Partition the hard disk (thereby DESTROYING all
files on it) guided by the section "INSTALLING A HARD DISK" below.
This should automatically set the Primary partition to "active".
ERROR MESSAGE : "Invalid partition table"
=============
The source of the error message is the MBR. More than one of the
Partition Table entries has its Boot Indicator byte set to a value
of 80 (hex); i.e. more than one partition is marked "active".
Solution: Set all but one of the boot disk's partitions as "inactive"
(i.e. non-bootable) guided by the section "DISK STRUCTURE NOTES" above,
using a Disk Sector Editor.
However, a thorough investigation of the MBR's partition table may
be necessary, guided by the section "DISK STRUCTURE NOTES" above,
as the actual problem may be more complex.
NB: This is usually a non-fatal error message!
ERROR MESSAGE : "Drive X is not formatted" (or similar)
=============
Windows typically reports that "Drive X is not formatted", or that
"The type of the file system is RAW".
This means the Boot Sector of the specified partition is damaged.
Replace the Boot Sector from a backup copy, guided by the section
"RESTORE A SECTOR" above; or repair it manually, guided by the
section "DISK STRUCTURE NOTES" above, using a Disk Sector Editor.
ERROR MESSAGE : "Error Loading Operating System"
=============
The source of the error message is the MBR. An error was returned
from the BIOS when the boot loader attempted to read the active
partition's Boot Sector into memory.
Solution: In many cases this will be due to a "soft" ECC error,
and can be repaired by re-writing the Boot Sector.
Replace the Boot Sector from a backup copy, guided by the section
"RESTORE A SECTOR" above; or re-write it manually, guided by the
section "DISK STRUCTURE NOTES" above, using a Disk Sector Editor.
ERROR MESSAGE : "Operating System Not Found" (or similar)
=============
Typically, you see the message "Operating system not found"
or "Missing operating system".
This error means the BIOS could not find an Operating System to
transfer control to. There are two possible causes.
The Type #1 error -
The translation setting in BIOS has changed from LBA to CHS,
causing the bootstrap loader to translate sector addresses
differently (i.e. incorrectly). As a result, the location
of the Boot Sector is not where it is expected to be.
For disks of 528MB (504MiB) to 8.4GB (7.9GiB), reverse the
translation mode (i.e. set it to LBA again).
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup.
In other cases, rebuild the MBR's partition table (e.g. from
backups). Note: The command FDISK /MBR (the "fixmbr" command)
will rebuild a standard MBR, except the Partition Table bytes.
If there then is a remaining boot problem, it can be corrected
by rebuilding the Boot Sector (e.g. from a backup, guided by the
section "RESTORE A SECTOR" above; or re-write it manually, guided
by the section "DISK STRUCTURE NOTES", using a Disk Sector Editor).
NB: In WinXP, that error on a FAT32 disk (not an NTFS disk)
can be fixed with the "fixboot" command; e.g. FIXBOOT C:
The Type #2 error -
On startup, the BIOS (Basic Input Output Self-test) sends a signal
to anything with a ROM chip to make sure it's there.
Once that hardware check is complete, the boot process is handed over
to the bootstrap loader (for Win9x the loader is IO.SYS), which finds
the Master Boot Record (MBR) and tries to load the Operating System;
but the latter is not found.
Boot from a bootdisk: but only use a bootdisk which matches your
Operating System (i.e. if you have WinME on the hard disk, you
must use a WinME bootdisk); otherwise the fault will not be cured.
Once booted to a DOS prompt -
1. Use FDISK.EXE to check that the partitions are intact:
FDISK /STATUS
NB: Do NOT use any other FDISK command in this situation!
All other FDISK commands are dangerous to your files.
2. Then run SCANDISK.EXE (Scandisk for DOS) to check the disk:
SCANDISK C: /CHECKONLY /SURFACE
NB: Do NOT allow SCANDISK to make any changes to the disk!
3. If all seems well, at the A: prompt type SYS C: to make the drive
bootable (this copies key Operating System files to Drive C):
A:
CD \
SYS C:
You should then be able to boot into Windows. (If not, you may have
faulty hardware: see HARDWARE FAULTS.)
ERROR MESSAGE : Hangs at "Verifying DMI Pool Data"
=============
The Desktop Management Interface (DMI) is a method of managing
Windows 9x computers. The main component of DMI is the Management
Information Format Database or MIFD (the DMI Pool Data): this
contains all the information about the computer and its components.
Any changes to the motherboard BIOS settings, the hard disks, or
the hard disk settings will all alter this pool data: the message
"Verifying DMI Pool Data" will appear. If the system then hangs
(a condition which can persist even if you remove the new hardware
in question!) try this:
1. Switch on mains power and start the computer.
2. Access the BIOS screen. [Press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup]
3. Disable both the Internal and External CPU Caches: these are
in either the "BIOS Features" or "Advanced Settings" options
of the BIOS screen.
4. Save the BIOS changes, then restart the PC with a bootable
floppy disk. On startup, the screen should read -
Verifying DMI Pool Data
Update Successful
and the system should then continue loading normally.
5. After the system successfully loads, re-start the PC and
access the BIOS screen.
6. Enable the External CPU Cache in the BIOS.
Note: For optimal system performance, this feature
MUST be enabled!
7. Save the BIOS changes, then restart the PC with a bootable
floppy disk. On startup, the screen should read -
Verifying DMI Pool Data
Update Successful
and the system should then continue loading normally.
Alternatively:
1. Switch off the mains power (but do NOT unplug the PC from
the wall socket). Then disconnect the power connector and
the IDE cable from each hard disk.
2. Switch on at the mains, then start the computer.
3. Access the BIOS [Press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup]:
then set each hard disk's type as "None" or "Not Installed";
then load the BIOS defaults; then load the SETUP defaults.
4. Save the BIOS changes, then restart using a bootable floppy.
5. Shutdown the PC after the memory count is displayed.
6. Reconnect the power connector and IDE cable to each hard disk.
7. Restart the PC and enter the BIOS (as described above);
then use the BIOS to Auto-Detect the hard disk(s).
Ensure that LBA Mode is enabled for EVERY hard disk.
8. Save the BIOS changes, then reboot using a bootable floppy.
9. Restart the system. On startup, the screen should read -
Verifying DMI Pool Data
Update Successful
and the system should then continue starting normally.
If the above fails to solve the problem, reset the system BIOS
by removing the motherboard's battery for a few seconds (or by
opening the "Clear CMOS" Jumper on the motherboard for a few
seconds), to clear the stored contents in the CMOS chip.
As a last resort, reset the system BIOS by doing a flash-upgrade
of the BIOS firmware settings (in the motherboard's EEPROM chip),
by downloading a BIOS Upgrade program from the motherboard
manufacturer's website and running it at the DOS prompt.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
ERROR MESSAGE : "Invalid system disk"
=============
This message means there are no startup files on the active
partition (i.e. C:). Either the startup files are corrupt,
or the drive has bad sectors.
A. Corrupt Startup Files -
To repair corrupt startup files, start the computer using
a bootable floppy disk (e.g. from http://www.bootdisk.com).
NB: The floppy disk MUST contain the same version of DOS that is
installed on the PC being repaired. So to repair a PC running
Windows ME, the boot floppy MUST be a Windows ME boot disk
(e.g. the Windows ME Emergency Boot Disk).
Install the System Files on Drive C:-
1. Use FDISK.EXE to make sure the partitions are intact:
FDISK /STATUS
2. Then run SCANDISK.EXE (Scandisk for DOS) to check the disk:
(NB: Do NOT allow SCANDISK to make any changes to the disk)
SCANDISK C: /CHECKONLY /SURFACE
3. If all seems well, at the A: prompt type SYS C: (to install
the system files on Drive C):
A:
CD \
SYS C:
B. Bad Sectors -
Methods of recovering from bad sectors (a.k.a. "bad blocks")
(1) Clone the Disk:
Copy the affected disk to a new hard disk using a disk cloning
program that can tolerate bad sectors, e.g. Norton's GHOST.
[Note: Most cloning programs CANNOT cope with bad sectors!]
Norton's GHOST for DOS v8.3 (GHOST.EXE) can clone an entire disk
(but it only works with IDE disks, not SATA or SCSI or USB).
NB: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
To run GHOST for DOS v8.3 with the option to ignore bad sectors,
use the option -FRO
Note: Norton Ghost 2003 is notorious for creating corrupt image
files, due to faulty compression, although it's okay for
normal (i.e. uncompressed) disk-to-disk direct cloning.
(Norton's Ghost for DOS v8.3 does NOT have this fault!)
It can clone a disk to a smaller one, provided the contents
(i.e. data) on the source disk do not exceed the capacity of
the destination disk: i.e. if the difference is just free space.
Syntax -
MODE=COPY
Copies the contents of one disk to another (file-by-file)
MODE=PCOPY
Clones a partition to another partition (byte-by-byte)
SRC=Source
Drive number, or Drive number and Partition number
DST=Destination
Drive number, or Drive number and Partition number
SRC and DST examples in PCOPY mode:-
1:2 means the 2nd partition on the 1st disk
2:1 means the 1st partition on the 2nd disk
Examples -
1. Copy disk 1 to disk 2:
GHOST.EXE -clone,mode=copy,src=1,dst=2
2. Clone the 2nd partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=pcopy,src=1:2,dst=2:1
*** To clone a bootable Hard Disk on a new Hard Disk ***
** Copy Partition 1 of Disk 1 to Partition 1 of Disk 2 **
GHOST.EXE -clone,mode=pcopy,src=1:1,dst=2:1 -FRO -PMBR
Alternative, if Disks 1 and 2 each have only 1 partition:
GHOST.EXE -clone,mode=copy,src=1,dst=2 -FRO -PMBR
Options that may be useful for troubleshooting:
-FRO : Forces Ghost to continue cloning even if the
source contains bad sectors
-FX : Forces Ghost to eXit to DOS after the operation
is complete
-FFATID : Changes the partition ID of the DESTINATION to the
recommended partition ID for that FAT32 partition
[The partition ID is stored in the partition table]
-PMBR : Specifies that the Master Boot Record of the
DESTINATION disk be preserved when performing
a Disk-to-Disk or Image-to-Disk operation
Other command line options are summarised at:
http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082612540625
http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082413392025
*** Display Ghost's help screen ***
GHOST /?
GHOST -?
*** Display details of all Drives detected ***
GHOST -dd
*** Save details of all Drives detected ***
GHOST -dd > drives.txt
WARNING -
Never start Windows with BOTH source and clone attached
to the IDE cables, as that will cause a fault! The clone
must NOT be attached to the same computer, except in DOS.
See: http://thestarman.pcministry.com/asm/mbr/mystery.htm
NB: It may be okay if one of them is attached through a USB
port (i.e. as an external disk), or attached through a
SATA controller (i.e. as either an internal or external
SATA disk); but not if both are on the IDE cables!
The fault can be prevented by manually zeroing the six bytes
DA to DF (bytes 218 to 223) in sector CHS 0-0-1 (LBA sector 0)
[the MBR sector], the "mystery bytes", before starting Windows.
NB: It is believed these bytes are a serial number, that
Windows uses to identify the different IDE disks; so
it can't cope if two IDE disks have the same number.
Zeroing these bytes forces Windows to re-allocate a
new serial number to the disk, on the next bootup,
thereby preventing a clash of disk addresses.
Alternatively, when the cloning is completed do NOT let Ghost
"reset" the computer. Rebooting to Windows will CAUSE the fault!
Instead, shutdown the computer, then remove the source disk; then
install the CLONE as IDE Primary Master BEFORE booting to Windows.
The fault may cause the following errors:
1. Windows may refuse to start.
Restart in DOS, and use Norton's Disk Editor (above) to
set all six of the "mystery bytes" to 00 (zero hex), in
sector CHS 0-0-1 (LBA sector 0) of the destination disk.
2. Windows may WIPE the system registry.
The registry can be restored in DOS from the backups in
C:\WINDOWS\SYSBCKUP by using the following commands (and
then carrying out the on-screen instructions):
SET PATH=%path%;C:\WINDOWS\COMMAND
SCANREG /RESTORE
3. Windows may change the Volume Identifier on the destination
disk, setting it as non-bootable (as it's not the IDE Primary
Master). When installed as Primary Master, it then can't boot.
Use PowerQuest's Partition Table Editor (above) to set the
Primary DOS partition on the disk to "active" (i.e. bootable).
Note: If the hard disk does NOT have bad sectors, the cloning
program DiscWizard (below) is easier to use than Ghost.
DiscWizard, from Seagate, is for setting up a new Seagate
disk; but the cloning utility (called 'Copy a Partition')
works with ANY make of disk: it was designed to copy
whatever existing disk the user had, onto his new Seagate
disk, as a byte-by-byte copy (in order that the copy would
be bootable if the original was, by preserving all settings).
The program Data Lifeguard Tools for DOS v11.2, from
Western Digital, can also clone a hard disk (below).
The program Media Tools Professional v5.0 can also clone
a hard disk (below).
The program HDClone v3.6 can also clone a hard disk (below).
(2) HDD Regenerator:
HDD Regenerator, v1.31
This utility repairs bad sectors on a HDD. It can
regenerate the magnetic surface, at least temporarily.
*** Create bootable floppy containing DOS version ***
** Requires one 1.44MB floppy disk in Drive A: **
SET PATH=%path%;F:\HARDWARE\REGEN
REGEN.EXE
Clone the repaired HDD immediately, because this
type of repair is only a temporary solution!
NB: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
(3) The Norton DiskEdit method (in Windows):
Step 1: Edit the registry to make Scandisk check bad clusters
(a) START > RUN > REGEDIT
(b) Go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Applets\Check Drive
(c) Double click on "Settings" in the right-hand pane
(d) There are four pairs of digits: change last pair to 04
Step 2: Go to START > RUN and type SCANDSKW then click on "Thorough"
and uncheck "Automatically Fix Errors"
Step 3: Wait while it slowly goes through the surface scan. When it
finds bad clusters, it will test them; if it cannot find a
problem with them, it will tell you so, and tell you the
cluster number. Write down the number of each bad cluster,
but select "Leave the cluster marked bad".
NB: Microsoft says that if you select "Clear the Bad
Cluster" it will remove the "bad" marker. It doesn't!
NB: If there are any clusters that Scandisk sees as bad,
and agrees that they are bad, it's time to back up your
files and buy a new disk.
Step 4: Exit to DOS, and run Norton's DISKEDIT
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Step 5: Press the ALT and T keys simultaneously, then select
"configuration...", then uncheck the Read-Only box,
then click "OK"
Step 6: Press the ALT and F1 keys simultaneously, to view
the first FAT (there are 2 FATs)
Step 7: Using the cluster numbers you wrote down, page down to
find them (using the PgDn key); they'll be marked {Bad}
Step 8: Select the word "Bad" by using Tab and arrow keys,
then enter "0" (zero)
Step 9: Press the CTRL and W keys simultaneously, to write
the changes to disk, then press ESC to exit
Step 10: Run CHKDSK.EXE to check that the system no longer
shows any bad clusters
This method of repairing bad sectors is, of course, unsafe
if the sector(s) are GENUINELY bad! Do NOT use this repair
if SCANDISK tells you, in Step 3, that any sector is bad!
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
(4) Use ScanDisk for DOS to fix the bad sectors (in DOS):
SET PATH=%path%;%RAMD%:\;E:\;C:\WINDOWS\COMMAND
SCANDISK C: /SURFACE
SCANDISK D: /SURFACE
NB: Not practical if the bad sector is in the System Area!
NB: This "solution" will result in data loss, as ScanDisk
will make changes to the disk in remapping bad sectors
or marking damaged sectors as bad. Try this only AFTER
recovering all recoverable data using other tools.
(5) Format the Hard Disk:
As a last resort, start the computer using a bootable floppy disk
containing FORMAT.COM and then at the A: prompt type FORMAT C:
(if Drive C: is the damaged partition).
NB: ALL DATA ON THE DISK WILL BE DESTROYED!! Copy all files
on the damaged disk to another disk first, to save them!
(Use the procedures at RECOVER INDIVIDUAL FILES, above)
FORMAT.COM will display a warning when it finds bad sectors.
It will try to re-map them (i.e. swap them for valid sectors
from the reserve sector pool); if it cannot re-map them,
it will mark them as bad so that they cannot be used.
Note: See also SPINRITE v6.0, below
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
CMOS BATTERY DEAD
=================
The CMOS battery on the motherboard maintains the BIOS settings
while the computer is disconnected from mains power.
It's typically a lithium/manganese-dioxide battery of type CR2032
that looks like a one-inch silver coin.
When the battery fails: the computer loses its BIOS settings, so
it will not boot. At startup it displays a blank screen with the
cursor in the top left-hand corner, flashing.
Solution: Fit a new battery on the motherboard, then enter the
BIOS setup program and manually input the correct BIOS settings
(which are hardware-dependent, so vary from one PC to another).
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
See: anti-static precautions
Backing up the BIOS -
Before the battery fails, make a backup copy of the BIOS settings
by entering the BIOS setup program and writing down the settings
you see in the various setup menus.
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(or, on some systems, F1 or F2) repeatedly at startup.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
See: anti-static precautions
Top of Page
SECTION D: DISK HARDWARE
Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics
DISK SURFACE FAULTS
===================
SPINRITE v6.0
=============
SpinRite tests and repairs a hard disk, byte by byte. It tests whether
data can be read from and written to each sector on the disk; and then
tries to recover data from any unreadable sectors.
Similar to ScanDisk, but much more thorough.
It has 5 levels, level 2 (for routine maintenance) being quite fast,
and level 5 (for data recovery from a damaged disk) being very slow.
Serial number: WS2YNDQ4VNW2M-C
Note:
In my tests, SpinRite v6.0 could NOT recover data from a damaged FAT
on a crashed hard disk, nor could it access the affected sectors!
NORTON'S DISK EDITOR
====================
It is possible to manually recondition ALL the affected sectors
using Norton's DiskEdit. Like SpinRite, it CANNOT read 99% of
affected sectors; but DiskEdit successfully reconditions them,
i.e. restores them ALL to normal use, which SpinRite cannot do.
NB: This solution works if the fault is a "soft" ECC error, but
NOT if the fault is physical damage to the magnetic surface.
The trick is to have DiskEdit access each affected sector (i.e. each
inaccessible sector), one by one; and you manually write a pattern of
512 bytes of new data (ANY data!) to the affected sector. This new
data, once written, makes the sector accessible normally again.
NB: Although "accessing" an inaccessible sector sounds impossible,
DiskEdit will go to such a sector (e.g. if you scroll down the
screen using the PgDn key), and try to read it; but will report
that it can't be read, and will display 512 zeros (00 hex).
If you then type 512 random characters (or even just 1 character)
into the sector, then try to leave the sector, DiskEdit will (if
the sector is not physically damaged!) save those new characters
to that sector, which will then be accessible normally.
All the data which was originally in the sector is lost, but you
have restored the sector to normal use. It now contains the data
you typed in (e.g. 1 character and 511 zero's) in its 512 bytes.
With a damaged FAT, once every sector of the entire FAT has been
repaired in this way it is then possible to copy a backup of the FAT
to those sectors (successfully), and so copy files off the disk!
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
NORTON'S DISK DOCTOR
====================
NDD.EXE from Norton Utilities 2001 (v5.0)
Diagnoses (and repairs) damaged disks.
(NB: Norton Utilities 2001 recognises FAT32 and disks exceeding 32GB)
SYNTAX -
NDD [d:][d:]... [/C|/Q|/DT] [/R[A]:pathname] [/X:drives] [/FIXSPACES]
[/NOCOMP] [/NOHOST] [/G0] [/BW|/LCD]
NDD [d:][d:]... /REBUILD [/G0] [/BW|/LCD]
NDD [d:][d:]... /UNDELETE [/G0] [/BW|/LCD]
NDD /UNDO [/G0] [/BW|/LCD]
/C Complete test, including surface test.
/Q All tests except surface test.
/DT Only perform the surface test.
/R[A]:pathname Write (or Append) report to pathname.
/X:drives Exclude drives from testing.
/FIXSPACES Repair filenames with embedded spaces.
/NOCOMP Do not test compression structures.
/NOHOST Do not test host drive of compressed volumes.
/REBUILD Rebuild an entire disk that has been destroyed.
/UNDELETE Undelete a partition that was previously skipped.
/UNDO Undo repairs made in a prior session.
/G0 Disable graphical mouse and all graphical characters.
/BW, /LCD Improve display on monochrome or LCD monitors.
*** Run Norton Disk Doctor: ALL disks ***
SET PATH=%path%;F:\NDD
NDD.EXE
*** Complete test, including Surface scan: Specified Disk only ***
SET PATH=%path%;F:\NDD
NDD C: /C
NDD D: /C
NDD E: /C
*** Test, excluding Surface scan: Specified Disk only ***
SET PATH=%path%;F:\NDD
NDD C: /Q
NDD D: /Q
NDD E: /Q
WARNING: Do not allow Disk Doctor to make any changes to the disk
(unless you use its UNDO function to enable you to reverse
all changes), because Disk Doctor is not 100% reliable!
It is a useful tool for diagnosing what the fault(s) are; but
its repair functions make too many (unwarranted) assumptions,
so treat it with caution.
SEATOOLS DESKTOP
================
SeaTools Desktop v3.02 (a.k.a. SeaTools Disc Diagnostic, Desktop Edition)
The setup program SEATOOLD_EN.EXE creates a bootable floppy disk
in Drive A. The disk loads its own operating system instead of DOS or
Windows, so will always work, regardless of the Operating System in
your computer.
The program can repair bad sectors. It achieves results that no other
program can match, and fixes faults where "SeaTools for DOS" fails.
SeaTools Desktop v3 has the following drawbacks -
(1) It hogs 100% of the system's resources. Therefore, moving from one
on-screen button to another (e.g. from Help to Cancel), while the
program is running, is VERY difficult.
(2) It stops after finding 250 bad sectors. If there are more than this,
it will have to be run more than once (perhaps many times); and
every time it can take up to half an hour to reach the damaged area
on the hard disk, if it's a large disk.
(3) It automatically proceeds (having found bad sectors) to identify
which file they belong to. If there are more than 250 bad sectors
from a single file, this wastes much time; but there's no option
to make it ASK before proceeding to identify the affected file.
SCANDISK.EXE
============
Run the DOS utility ScanDisk, with Surface Scan option enabled,
to fix the disk faults.
This is a last resort. It makes changes to the disk surface,
by re-mapping or marking "bad" the bad sectors, which reduce
the chance of recovering lost data from the disk!
NB: Do not do this until AFTER recovering all recoverable data
using other tools!
*** Display ScanDisk's options ***
SCANDISK /?
*** Run ScanDisk with Surface scan ***
SCANDISK /SURFACE
NB: ScanDisk will default to the settings in SCANDISK.INI
(if present), unless other options are explicitly set!
(The INI file is at C:\WINDOWS\COMMAND\SCANDISK.INI)
HARDWARE INFORMATION DATABASE
=============================
The files DRVIDX.BIN and DRVDATA.BIN in C:\WINDOWS\INF contain
the Driver Information Database.
At system startup, each hardware device attached to the computer
reports a hardware ID to Windows, which checks to see whether
that ID is recorded in those two files. If it is not, Windows
rebuilds those two files. It also records the ID details in the
Windows Registry, but it is those two files which contain the
pointers to the location (on the hard disk) of the driver files
used by each hardware device.
Those two files can contain incorrect information. For example,
when the software for a device is upgraded, if the new driver
files are installed to a different location, or have different
names to the older ones, the two files will continue to point
to the old drivers. This can be cured by deleting the two files,
to force Windows to rebuild them on the next bootup.
*** Examine Hardware Information Database for changes ***
Check whether the file dates have changed recently!
DIR /-W C:\WINDOWS\INF\DRVIDX.BIN
DIR /-W C:\WINDOWS\INF\DRVDATA.BIN
*** Make backup of Hardware Information Database ***
REN C:\WINDOWS\INF\DRVIDX.BIN DRVIDX.BI_
REN C:\WINDOWS\INF\DRVDATA.BIN DRVDATA.BI_
*** Rebuild the Hardware Information Database ***
DEL C:\WINDOWS\INF\DRVIDX.BIN
DEL C:\WINDOWS\INF\DRVDATA.BIN
REBOOT COLD
Top of Page
INSTALLING A HARD DISK
======================
Where the disk has hardware faults it is essential to replace it,
which means installing a new hard disk.
For data recovery, install an undamaged hard disk on the IDE cables
to store recovered data on (e.g. to clone a damaged disk). This may
involve buying, and setting up, a new hard disk for that purpose.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
CONNECTING THE HARD DISK
========================
You must disconnect all the hard disks except the new one, so
that you don't accidentally partition or format the WRONG disk:
doing so would DESTROY all your files on the disk in question!
NB: Disconnecting all the hard disks except the new one ensures
that the new disk will be identified as Drive C.
If you create more than one partition, with all other disks
disconnected, the second partition will be Drive D (and any
further partitions will be Drive E, Drive F, Drive G, etc).
An IDE (or E-IDE) hard disk has two cables attached to it:
- A 40-pin data cable, or ribbon cable, called the IDE cable.
- A 4-pin power cable.
The new disk MUST be attached to the primary IDE cable (the one
plugged into the primary IDE connector, which typically has the
words "PRIMARY IDE" printed beside it on the motherboard).
The secondary IDE cable will typically be connected to a CD
or DVD drive. It is NOT necessary to disconnect this.
The new disk MUST be attached to the IDE cable as Master. The
Master connector on the cable is coloured black, and is at
the END of the cable: plug this connector into the new disk.
There is usually a Slave connector on the IDE cable too: the
Slave is coloured grey, and is in the middle of the cable.
Do NOT attach any disk to it while setting up the new disk.
A power connector must also be plugged into the new disk. This
is typically a 4-pin connector (called a Molex connector), and
is attached at its other end to the Power Supply Unit (PSU).
Hardware Jumpers -
An IDE hard disk also has a jumper "block", typically comprising
5 paired sets of two pins each. A tiny connector (or jumper) is
used to connect two of these pins together, depending whether the
disk is functioning as a single disk, as a master, or as a slave.
The hard disk will have a printed label attached to it, setting
out diagrams that show which two pins to attach the connector to
for each setting.
While setting up the disk, with no other IDE hard disks attached,
the new disk will function as a SINGLE (sometimes this setting is
called SINGLE OR MASTER). Quite often, this setting conveniently
happens to be the one setting in which the connector is not used!
PARTITIONING AND FORMATTING
===========================
The following procedure will (a) partition and (b) format a
hard disk. This will DESTROY all data on the disk, so is only
suitable for initially setting-up a new (blank) disk.
NB: You must NOT create any partition larger than 127.53 GB
as Windows 95/98/ME will malfunction on such a partition.
The hard disk manufacturer will typically provide a setup program
to use instead of DOS tools FDISK.EXE & FORMAT.COM [Steps 1 & 2
below], and which includes a disk cloning utility [Step 3 below]:
- Seagate provides DiscWizard Starter Edition
- Western Digital provides Data Lifeguard Tools v11.2 for DOS
If you CANNOT use such a setup program, proceed as follows.
STEP 1: Partition the hard disk
To use a hard disk, it must first be partitioned. This is done
by the DOS program FDISK.EXE (the Fixed Disk partitioning tool).
For a hard disk to be accessible in Windows ME, which uses the
FAT32 file system, the partitioning MUST be done using a FAT32
version of FDISK (i.e. the version that comes with Windows ME).
Firstly, create a bootable Windows ME floppy disk:
1. Go to: START > SETTINGS > CONTROL PANEL > ADD/REMOVE PROGRAMS
2. Select the STARTUP DISK tab, put a blank 3.5 inch floppy disk
in Drive A, then follow the on-screen instructions.
NB: This is also known as a "Windows ME Emergency Boot Disk".
NB: If you intend to use the hard disk with Windows 98, or
with Windows 98 Second Edition, you MUST use a bootable
floppy disk from *that* version of Windows instead.
To run the FDISK program, insert the bootable floppy disk into
Drive A, then start the computer. (If necessary, enter the BIOS
screen to set the boot-up sequence to boot first from Drive A.)
At the DOS prompt, type FDISK then press the ENTER key. This
will start the FDISK program.
To create a single partition occupying the entire disk:
At the first screen, answer YES when asked if you wish to enable
large disk support; you MUST answer [Y] on that screen, in order
for FDISK to create a FAT32 partition structure.
At the next screen, select: "Create DOS Partition or Logical DOS
Drive".
At the next screen, select: "Create Primary DOS Partition".
At the next screen, FDISK asks how large you want the partition
to be. If you do not enter a number, it will make the partition
as large as it can; so to make the partition fill the entire disk,
just press ENTER to continue.
NB: As well as creating the partition, FDISK will make it Active
(i.e. bootable).
The partitioning process will take a few minutes, but you'll see a
visual display of progress on screen.
And that's all you need to do to create a single partition that uses
all the space on the hard disk; so once the partitioning process has
finished successfully, press ESC to exit FDISK.
The Rules of FDISK -
The first physical disk must be the boot disk. And that disk
must contain a Primary DOS partition, which must be the first
partition on the disk (apart from the "Non-DOS partition").
A disk must have only one Primary DOS partition (i.e. type 0C).
That partition must be set as "active", if it is to be capable
of booting (i.e. starting) the computer; but only a partition on
the first physical disk is allowed to be active (i.e. set to 80).
NB: In practice, FDISK will therefore not permit a disk to be
set "active" (bootable) unless it is the IDE primary master
In addition to one Primary partition, a disk may also have one
Extended partition (i.e. type 0F).
The Extended partition can comprise a single partition, or can
be divided into several partitions. In either case, a partition
which is contained within an Extended partition is called a
Logical partition (i.e. type 0B).
Only the FIRST physical disk must have a Primary DOS partition.
Second or subsequent IDE disks can have either a Primary DOS
partition or an Extended partition, i.e. as the first partition.
DOS (and Windows) assign drive letters in the following order,
beginning with the IDE disks, starting with drive letter C -
- First, all Primary partitions (each disk has at most one)
- Second, all Logical partitions (each disk can have many).
NB: Thus *all* Primary DOS partitions will be assigned a drive
letter before *any* Logical partitions!
NB: Drive letters A and B are reserved for floppy drives.
The IDE disks are treated in the following order -
- IDE disk 0 (IDE Primary Master)
- IDE disk 1 (IDE Primary Slave)
- IDE disk 2 (IDE Secondary Master)
- IDE disk 3 (IDE Secondary Slave)
If there are any non-IDE hard disks present (e.g. SATA disks
or external USB disks), they are assigned drive letters AFTER
letters have been allocated to ALL the partitions on all the
IDE disks; and typically in this order -
- Disk(s) attached to PCI slot 1
- Disk(s) attached to PCI slot 2
- Disk(s) attached to PCI slot 3
Settings -
Settings used to partition Western Digital WD800JB 80GB HDD
using Microsoft's FDISK.EXE (1 Mbyte = 1,048,576 bytes):
Mbytes available on disk: 76,317 Mbytes [80GB]
Values entered in FDISK:
- Primary DOS Partition: 10,000 Mbytes
- Extended Partition: 66,315 Mbytes
- 1st Logical Partition: 100%
Note:
An alternative to Microsoft's FDISK is Ranish Partition Manager
v2.40 (PART.EXE) (a 32bit version for a Hard Disk exceeding 8GB).
Check the Outcome -
After you have partitioned the disk, but BEFORE you format it:
1. Run the FDISK /STATUS command, to check the result of the
partitioning; and
2. Run the FDISK program (type FDISK) to check that the Primary
partition is marked as "Active" (the letter A is displayed
against the active partition), if the disk is to be bootable.
NB: You can't install an Operating System on the disk unless
that partition is first set as "active" (i.e. bootable).
Note -
For background information on partitioning a hard disk as
FAT16 or FAT32 see: http://www.mdgx.com/secrets.htm#FDPT
(NB: Includes many partitioning tools for DOS and Win9x)
STEP 2: Format the hard disk
Use the FORMAT.COM program (which is included on the bootable
floppy disk) to format the partition you just created.
With the computer booted to DOS: to format the new partition,
Drive C, at the A: prompt type this -
FORMAT C:
The formatting process takes a few minutes, but you see a visual
display of progress on screen.
Until the FORMAT command has executed, and completed, the C: drive
does not exist. Any attempt to change directory to C: will fail, and
the command DIR C: will also fail, since no drive exists until after
the formatting process has created it.
Sometimes it is necessary to type the format command as -
FORMAT C: /S
instead of FORMAT C: so try this alternative if the other doesn't work.
This transfers System files, to make the disk bootable. (NB: This means
you are almost certainly using the WRONG type of bootable floppy disk!)
The hard disk is now partitioned as a single FAT32 partition, and is
formatted as drive C:, so it is now possible to install Windows on it.
Note: If the disk can't be successfully formated, the PC might have
a faulty motherboard (since the disk controller chip on some
boards supplements the on-disk electronics).
Options -
FORMAT /c : Causes FORMAT to retest bad Clusters; otherwise FORMAT
will mark the Clusters as bad but will NOT retest them.
FORMAT /s : Prepares a partition to make it active (bootable), by
transfering System files.
FORMAT /u : Does a unconditional format, which DESTROYS every byte
of data on the disk by overwriting it. (Afterwards do
the SYS C: command to install system files, then do a
thorough SCANDISK check to fix any disk errors.)
WARNING: You CANNOT unformat a disk formatted using the /U option!
WARNING: The use of FORMAT /S /U makes the disk UNREADABLE.
Do NOT use these two switches TOGETHER on ANY drive!
STEP 3: Install Windows 98/ME
Use a cloning program (e.g. Seagate's DiscWizard Starter Edition,
Western Digital's Data Lifeguard Tools for DOS, or Norton's GHOST)
to make a byte-by-byte copy on the new disk of a bootable partition
on another hard disk attached to the IDE cables.
NB: Norton's Ghost cannot clone its "source" partition, i.e. the
partition on which it's installed or from which it's running!
[Run it in DOS, instead of Windows, to avoid this limitation]
NB: The copying process involved in cloning a hard disk typically
takes up to 20 minutes per MegaByte (i.e. 3 hours for a 10GB
disk) if cloning from IDE Primary Master to IDE Primary Slave
The process is much faster if cloning from IDE to a SATA disk
[The fastest program, HDClone, takes only 5 minutes for 10GB]
NB: Windows ME creates a backup copy of the partition information
in the file C:\Suhdlog.dat (a hidden file) at the end of a
successful installation. Therefore, after cloning a disk NEVER
try to uninstall Windows ME from the clone! That will write the
partition information in Suhdlog.dat into the clone's MBR sector
- which will destroy the disk, because it is NOT the disk onto
which WinME was originally installed, therefore its partition
information is different from that contained in Suhdlog.dat!
Alternatively, insert a Windows installation CD in the CD-ROM drive,
and install Windows 9x from that CD.
In this latter case, you also need a valid Microsoft serial number
(called a "Product Key"). [See the Batch file]
NB: A Google search will find a serial number on the internet,
but there should be one printed on the CD's documents.
NB: Type the serial number! Do NOT copy-and-paste it, or the setup
program will reject it (a crude anti-piracy ploy).
Windows 98/ME also requires a "Product ID". This is NOT the same
thing as the "Product Key"! [See the Batch file]
The installation CD can be either a full install of Win 98/ME,
or an upgrade version. An upgrade version won't work, if there
is no existing operating system on the hard disk, unless you
insert a setup CD or floppy for an earlier version of Windows 9x
when the upgrade version asks for that.
The one other thing that FDISK can do is show you the current
partition information (i.e. the current state of the hard disk) -
FDISK /STATUS
For a more visual explanation of the FDISK program screens,
look at this site -
http://fdisk.radified.com
It explains in detail how to use the various FDISK options.
PRELIMINARY STEP: Zero-filling the hard disk
Before re-using a hard disk which was NOT previously blank, it is
prudent to delete all information from that disk, otherwise rogue
data on the disk may cause errors. The zero-filling process
eliminates any problem data, allowing normal partitioning to occur.
NB: Only an entire Disk can be zero-filled, not a Partition
NB: To save time, the Seagate program (below) has an option
to write zeros to only the first and last million bytes
First, use FDISK to delete the partition information. Run FDISK;
at stage 2 it offers the option to delete the existing partitions.
After doing so, use the command FDISK /STATUS to check that all the
partition information has been successfully deleted.
Next, use the command FDISK /MBR to wipe the master boot record clean
(or at least the part of sector CHS 0-0-1 which it does wipe clean).
Next, do a 'zero fill' of the disk: this process writes zeros to
every byte on the disk. You can get the program from the website of
the disk's manufacturer. For a Seagate disk, go to their website; etc.
It usually isn't a seperate program. Manufacturers typically offer
a disk management program with many functions, only one of which is
writing zeros to the drive, so just download whatever they offer by
way of disk tools: the zeroing option should be in there somewhere.
You will need one 3.5 inch floppy disk for this step.
NB: Seagate's DiscWizard Starter Edition includes this function,
in the "Utilities" section of the program. (That program is
NOT limited to Seagate disks! It works with Western Digital
disks, and thus may work on other manufacturers' disks too!)
If the program does not offer a zero-filling option explicitly, use
any tool that offers to blank, or fill, or low-level format the disk.
NB: It is in fact impossible to low level format a modern disk,
but most manufacturers offer tools that do something similar,
to which they like to give that description.
Once the zero-filling is complete (which can take several hours for
a large capacity disk), partition and format the disk (as above).
Top of Page
CLONING A HARD DISK
===================
CLONING A DISK
==============
Cloning is a copying routine that creates a byte-by-byte copy of the
source disk or source partition.
The copy is identical to the original in every way.
NB: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
See: http://www.annoyances.org/exec/forum/winme/1177076589
DATA LIFEGUARD
==============
Management program: Data Lifeguard Tools for DOS, v11.2
This program provides functions which replace FDISK.EXE and
FORMAT.COM and GHOST.EXE (above), for Western Digital disks.
The program creates a bootable Rescue Disk on a 3.5 inch floppy
disk in Drive A. [The program requires one 3.5 inch floppy disk]
Create the Rescue Disk, then use it to start the computer.
The Data Lifeguard program will run automatically at startup;
its menus include an option to copy (i.e. clone) a hard disk,
the option "DRIVE-TO-DRIVE COPY".
*** Create bootable Data Lifeguard rescue disk ***
SET PATH=%path%;F:\DATALI~1
DLGSET~1.EXE
Warning: The Rescue Disk can be created in a Windows session,
but must boot the system to DOS to create a clone.
Do NOT try to create a clone with Windows running!
Program options -
1. VIEW INSTALLATION TUTORIAL
Instructions on how to connect your new hard disk to the computer
2. SETUP YOUR HARD DRIVE
Setup a hard disk already connected to your computer
[NB: This is an alternative to using FDISK.EXE & FORMAT.COM]
3. DRIVE-TO-DRIVE COPY
Copy a partition from one disk to another
[NB: A cloning utility, making a byte-by-byte copy]
[NB: This is an alternative to using GHOST.EXE or HDCLONE.EXE etc]
4. HARD DRIVE INFORMATION
Jumper Settings and other technical information about your hard disk
Note:
The drawback with Data Lifeguard Tools (both the DOS and Windows version)
is that you must fully partition a disk in a single session, because it
DELETES all existing partitions (thereby destroying all data on them) if
instructed to partition any un-partitioned space.
DISK WIZARD STARTER EDITION
===========================
Disk Wizard Starter Edition (DWSE) (English version).
DiscWizard is a Seagate program, for setting up a new Seagate
IDE disk; but the cloning utility (called 'Copy a Partition')
works with ANY make of disk: it is designed to copy whatever
existing IDE disk the user has, onto his new Seagate disk, as
a byte-by-byte copy (in order that the copy will be bootable
if the original is, by preserving all settings).
The program creates a bootable Rescue Disk on one 3.5 inch
floppy disk in Drive A.
Create the Rescue Disk, then use it to start the computer. The
DiskWizard program will run automatically at startup; its
menus include an option to copy (i.e. clone) a hard disk.
*** Create DiscWizard Starter Edition v10.32 ***
SET PATH=%path%;F:\DWSE\v10_32
DWSE_EN.EXE
*** Create DiskWizard Starter Edition v10.45 ***
SET PATH=%path%;F:\DWSE\v10_45
DWSE_EN.EXE
Warning: The Rescue Disk can be created in a Windows session,
but must boot the system to DOS to create a clone.
Do NOT try to create a Clone with Windows running!
NORTON GHOST
============
Norton's GHOST for DOS v8.3 (GHOST.EXE) can clone an entire disk,
but it only works with IDE disks: not SATA or SCSI or USB.
NB: Some versions of Norton GHOST, that run under Windows, will
clone non-IDE disks. It's only GHOST for DOS that will not.
NB: To clone a non-IDE disk where Windows is inaccessible, use
HDClone Professional (see below).
It can clone a disk to a smaller one, provided the used space
(i.e. data) on the source disk does not exceed the capacity of
the destination disk: i.e. if the difference is just free space.
NB: Norton Ghost 2003 is notorious for creating corrupt image
files, due to faulty compression, although it is safe for
normal (i.e. uncompressed) disk-to-disk direct cloning.
(Norton's Ghost for DOS v8.3 does NOT have this fault!)
PCOPY mode *must* be used if the new disk is to be bootable.
Syntax -
MODE=COPY
Copies the contents of one disk to another (file-by-file)
MODE=PCOPY
Clones a partition to another partition (byte-by-byte)
SRC=Source
Drive number, or Drive number & Partition number
DST=Destination
Drive number, or Drive number & Partition number
SRC and DST examples in PCOPY mode:-
1:2 means the 2nd partition on the 1st disk
2:1 means the 1st partition on the 2nd disk
Examples -
1. Copy disk 1 to disk 2:
GHOST.EXE -clone,mode=copy,src=1,dst=2
2. Copy the 1st partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=copy,src=1,dst=2
3. Clone the 1st partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=pcopy,src=1:1,dst=2:1
4. Clone the 2nd partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=pcopy,src=1:2,dst=2:1
Options that may be useful for troubleshooting:
-FRO : Forces Ghost to continue cloning even if the
source contains bad sectors
-FX : Forces Ghost to eXit to DOS after the operation
is complete
-FFATID : Changes the partition ID of the DESTINATION to the
recommended partition ID for that FAT32 partition
[The partition ID is stored in the partition table]
-PMBR : Specifies that the Master Boot Record of the
DESTINATION disk be Preserved when performing
a Disk-to-Disk or Image-to-Disk operation
Other command line options are summarised at:
http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082612540625
http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082413392025
*** Display Ghost's help screen ***
GHOST /?
GHOST -?
UNDISKER.EXE
============
Undisker v1.2 can clone an entire IDE Hard Disk.
This is a Windows program. It cannot be used to clone the
boot drive (because Windows constantly makes random writes
to the boot partition); but it can clone any other partition.
It can create the clone on any disk attached to the system,
including a USB drive or other external disk on a USB port.
Its main purpose is to create .ISO image files (compressed or
uncompressed), including disk images, on a recordable CD/DVD.
*** Run Undisker ***
SET PATH=%path%;F:\UNDISKER
UNDISKER.EXE
MEDIA TOOLS
===========
The program Media Tools can also clone an IDE disk.
ACRONIS TRUE IMAGE
==================
The program Acronis True Image can also clone an IDE disk.
XCOPY32.EXE
===========
An alternative means of copying an existing partition (e.g. Drive C:)
to a new hard disk (e.g. Drive D:) is to use XCOPY32.EXE (a program
which is part of MS-DOS 8 included with Windows ME).
This does NOT create a true clone of the source partition; but in an
emergency it provides a reliable means of copying all the files on a
partition if no other software is available (e.g. no internet access).
*** Set Path ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Copy all files on Drive C: to Drive D: ***
C:
CD \
XCOPY32 *.* D:\ /S/E/R/C/H/K/Y
OTHER SOFTWARE
==============
Details of a number of free Cloning and Imaging programs, for
making and restoring a hard disk backup, are given on-line at
http://www.thefreecountry.com/utilities/backupandimage.shtml
NB: Some of these are NOT suitable for use with FAT32 disks,
or will NOT run on Windows 98/98SE/ME.
THE "MYSTERY BYTES"
===================
NEVER start Windows with both the source disk and clone attached
to the IDE cables. A clone disk must NOT be attached (by the IDE
interface) to the same computer as the disk of which it's a copy,
as that will cause a fault!
A full explanation of the "mystery bytes" fault, including symptoms,
is set out above, under OTHER ERROR MESSAGES ("Invalid system disk").
The fault can be cured by manually zeroing the six bytes DA to DF
(bytes 219 to 224) in sector CHS 0-0-1 (LBA sector 0) [the MBR sector]
on the CLONE disk, the "mystery bytes"; e.g. using Norton's DiskEdit.
See: http://TheStarman.pcministry.com/asm/mbr/mystery.htm
VOLUME IDENTIFIER
=================
Windows may change the Volume Identifier on the clone disk to
non-bootable, if the clone is installed as IDE Primary Slave
for the cloning operation. So when it's then installed as the
Primary Master it won't boot!
To avoid this, when cloning is complete do NOT let the cloning
program "reset" the computer, as booting immediately to Windows
is what causes this fault! Instead, shutdown the computer, then
remove the source disk and install the CLONE disk as the IDE
Primary Master, before booting to Windows.
CLONING SATA, SCSI OR USB DISK
==============================
The only program which can clone a FAT32 disk connected by a
Serial-ATA (SATA), or an SCSI, or a USB connection in Win9x is
HDClone Professional v3.6 (the Professional edition of HDClone v3.6).
NB: The program can also clone a disk connected on the IDE interface.
The bootable floppy disk version does not load DOS or Windows. It
starts the computer using its own (proprietory) Operating System.
NB: The other cloning programs can all clone a Parallel-ATA (PATA)
disk, i.e. an IDE disk, in DOS. But none of them can clone a
disk connected by a Serial-ATA (SATA) or SCSI or USB connection
in DOS, only in Windows (i.e. using a Windows 9x device driver):
which results in a file-by-file copy, not a byte-by-byte clone.
NB: On a Windows 9x computer (manufactured between c.1998 and 2001),
the motherboard will NOT have either USB 2.0 or Serial-ATA (SATA).
Those facilities can be added, by fitting a USB 2.0 and/or SATA
PCI card in an empty PCI slot on the motherboard.
HDClone can clone either an entire disk or a partition on the disk.
Note:
Detailed instructions on the use of this program are set out below
(at HARD DISK EXCEEDING 137GB: CLONING). The procedure described
there will also work for a hard disk smaller than 137GB.
Warnings:
1. HDClone can only be run safely after a COLD boot. It is
NOT safe to run the program after a warm reboot; i.e. HDClone
must NOT be run using the start option "Restart" or "Stand by".
The computer must be started from a switched-off state!
2. After cloning, the computer will malfunction if both the source
and the clone partition have the same Volume Serial Number in
their respective Boot Sectors. So it's ESSENTIAL to select the
HDClone option "Patch Boot Code", to force the program to give
the clone a different serial number (if both clone and source
will ever be conected to the same computer at the same time).
NB: The fault will occur however the partitions are attached,
i.e. even if one is on a disk connected to the IDE cables
and the other is on a disk attached to a PCI card (e.g. as
a USB or SATA device), because it's caused simply by more
than one partition having (in effect) the same address.
NB: The fault can be cured by editing either partition manually,
e.g. using DE.EXE v1.04 (PTS disk editor). Bytes 68 to 71
(4 bytes) in the partition's Boot Sector must be altered: the
new number (a hexadecimal number) can be ANY number, provided
it is not the same as the Volume Serial Number of any other
partition (i.e. "drive") attached to the computer.
You can enter a new hexadecimal number there yourself. But the
safest action is to change each of those bytes to zero; Windows
will then allocate a new number to that partition on the next
reboot, automatically (thus avoiding any possible problem).
The PTS disk editor can function even on a hard disk exceeding
137GB. I've used it successfully on a 500GB disk, while booted
to Windows (running Windows ME); so it is certainly capable of
correctly accessing any hard disk of up to 512GB.
For a detailed analysis of the contents of the Boot Sector
on a FAT32 partition, see "Disk Structures" (above).
Top of Page
HARD DISK EXCEEDING 137GB
=========================
Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics
INSTALLING A HARD DISK EXCEEDING 137GB
======================================
How to install a Serial-ATA (SATA) hard disk larger than 137GB,
for use as additional storage in Windows 9x (e.g. as Drive D):-
Step 1: Buy a SATA Hard Disk
A SATA disk not exceeding 512GB can be used as additional storeage
on a Windows 9x system (e.g. a 500GB WD Caviar Blue WD5000AAKS).
NB: It cannot be installed as Drive C (the bootable drive), because
a pre-2001 Windows 9x motherboard *cannot* boot from a SATA disk.
NB: A SATA disk is the safest choice on a Windows 9x system, because
a Win9x motherboard normally has no SATA ports! Thus there is no
possibility that the disk could ever be accidentally connected to
the motherboard (which doesn't support disks exceeding 137GB).
Step 2: Buy a PCI Card
Purchase a PCI card that has a 48-bit LBA controller, which provides
essential support for a hard disk larger than 137GB (for example a
StarTech PCI SATA Controller Card, ASIN B001ZC561U, with its 48-bit
VIA VT6421 chip).
NB: The StarTech PCI SATA Controller Card is compatible with an older
(e.g. 1998) model PC, as it uses PCI 2.2 and provides driver files
for Windows 9x; and it provides scope for future expansion, for it
includes an e-SATA port (which will accept external SATA devices).
A CD containing the essential Windows 98 driver files will typically be
included with the PCI card. This software is needed for the motherboard
to recognise the new device (i.e. the 48-bit LBA chip on the PCI Card).
NB: The CD included with the StarTech ASIN B001ZC561U PCI Card contains,
in a subdirectory, the driver files VIAMRAID.mpd and VIAMVSD.VXD
(which install in C:\WINDOWS\SYSTEM\IOSUBSYS) and VIAMRAID.INF
(which installs in C:\WINDOWS\INF\OTHER).
If the PCI card is SATA-I, but the disk is SATA-II, set the disk to run
at SATA-I speed: by using a mini jumper pin to force the disk to emulate
a SATA-I disk. On a WD5000AAKS disk, jumper pins 5 and 6 using a 2.54mm
mini jumper pin (e.g. Psylins Computer CMP-SCREWKIT10, ASIN B000JGG8ZQ).
Step 3: Buy a Drive Caddy (or Adapter Brackets) [Optional]
Purchase a Serial-ATA (SATA) Drive Drawer (e.g. StarTech caddy DRW110SAT
ASIN B0000E2Y7T), to fit into an empty 5.25 inch drive bay. It holds the
SATA hard disk, and connects to the PCI card's internal SATA port.
NB: For maximum flexibility, the StarTech DRW110SAT caddy accepts both
SATA-I and SATA-II hard disks.
NB: The StarTech ASIN B001ZC561U PCI card comes with a SATA data cable,
for connecting the PCI card to the caddy, so it is not necessary to
buy a SATA data cable separately.
Step 4: Installation Procedure
With the mains power switched OFF, plug the PCI card into a PCI socket,
but do NOT install the caddy or the hard disk. On startup, the computer
will detect the PCI card and ask for the driver CD. Insert it, then
navigate to the location of the Windows 9x drivers.
NB: For the StarTech ASIN B001ZC561U PCI card -
(a) If your CD drive is Drive D, the driver files will be at:
D:\Windows\VIAStor\driver\Raid\win9x
(b) It is NOT necessary to run the included RAID program
if your computer will only have a single SATA disk.
(NB: The RAID functions manage multiple SATA disks)
(c) In Windows 9x, it is NOT necessary to run the SETUP.EXE
program in the CD's root directory.
Then continue with a normal startup. Once the desktop appears, check
in Device Manager (Start > Settings > Control Panel > System), under
"SCSI controllers", for the entry "VIA VT6421 RAID Controller".
Then shutdown the computer normally. With the mains power turned OFF,
install the drive caddy (containing the hard disk): connect the caddy
to a 4-pin Molex power connector, and to a (red) SATA data cable;
then connect that red cable to the PCI card's internal SATA port.
NB: If you are not installing a caddy, connect the Molex conector and
the data cable directly to the hard disk.
NB: The hard disk(s) attached to the IDE interface must NOT be jumpered
to use "cable select", because that can cause a fault on bootup
when using IDE disks and SATA disks in the same computer.
Set the hardware jumper pin on the IDE boot disk (e.g. Drive C)
to SINGLE or MASTER (as appropriate to the printed instructions on
the hard disk's label) if only one IDE disk is attached. Otherwise,
set the IDE boot disk to MASTER and the other IDE disk to SLAVE,
and connect both to the Primary IDE cable; the MASTER *must* be
attached to the end of the cable, and the SLAVE to the middle.
A faulty IDE cable (40-pin ribbon connector) can cause the same
fault on bootup, even if the hardware jumper pin is correctly set.
Then start the computer normally. The hard disk is not yet partitioned,
or formatted, so Windows cannot yet "see" it. The next step therefore
is to partition and format the new hard disk.
NB: You cannot use the DOS tools FDISK.EXE or FORMAT.COM for this step,
because when a computer is booted to DOS there is no means for it
to access a SATA disk, since no DOS drivers for SATA exist.
NB: If you bought a Western Digital hard disk, their website provides a
downloadable program called "Data Lifeguard Tools for Windows". Use
it to partition and format the new disk in Windows; create *several*
120GB partitions, as Windows 9x CANNOT use one larger than 127.53GB.
NB: "Data Lifeguard Tools for Windows" can also copy files from an
existing disk to the new disk (e.g. copy the entire Drive C to
the new disk). Alternatively, you can use XCOPY32.EXE (above).
HARD DISK EXCEEDING 137GB: PARTITIONING
=======================================
The following is a more flexible, though also more complicated, method
for partitioning a hard disk larger than 137GB.
PARTITION MAGIC v8.05 -
Open Partition Magic v8.05 in Windows.
The program has an option to set existing disks (containing your data)
as READ ONLY. This is an ESSENTIAL precaution, to avoid accidentally
destroying one of your existing partitions! To do this, go to:
General > Preferences
Then create a Partition (smaller than 127.53GB) on the new hard disk.
The program allows you to specify the exact size of the partition
to be created. It also allows you to either partition all the space
on the new disk immediately, or to leave some space unpartitioned
(i.e. to be partitioned in a later session); this is more flexible
than the options in "Data Lifeguard Tools for Windows".
NB: If the new hard disk is marked as "Removeable" (in Device Manager)
Partition Magic won't recognise it!
NB: To re-use a SATA disk that has held data previously, it is prudent
to remove all traces of the old (unwanted) data by writing zeros
to the SATA disk before beginning any partitioning, e.g. with
Western Digital's program "Data Lifeguard Diagnostics for Windows".
Set Drive letter (using Device Manager), in Windows:
NB: Do so ONLY when all partitions have been created (because
if a hard disk is marked as "Removeable", in Device Manager,
Partition Magic v8.05 won't recognise it!)
NB: Set up all removable media drives (i.e. all partitions on the
SATA disk) so that they're the last drives on the system!
[This is the purpose of reserving specific drive letters for
the partitions on the SATA disk: in this way the permanent
disks (i.e. the IDE disks) will remain as drive C:, D: & E:
even when the SATA disk is connected to the computer.]
HARD DISK EXCEEDING 137GB: CLONING
==================================
The following is a more flexible, though also more complicated, method
for cloning (i.e. copying) an existing partition onto a new hard disk
larger than 137GB.
HDCLONE PROFESSIONAL v3.6 -
The setup program creates a working copy of HDClone Professional v3.6
on a blank floppy disk in Drive A.
Using HDClone Professional v3.6 in practice -
Step 1:
Insert the bootable floppy disk containing HDClone into Drive A,
then start/restart the computer.
NB: The computer must be set, in the BIOS, to boot from Drive A
(the floppy drive) before Drive C. To enter the BIOS, press
the appropriate key (e.g. DEL) (or, on some systems, F1 or F2)
repeatedly at startup.
NB: You must create the partition structure on the new disk before
running HDClone, as it has no ability to create partitions.
Step 2:
In the opening screen, select the copy method: Partition to Partition
To do so, use the mouse: select "Partition" as the source, and then
"Partition" as the target.
NB: The hard disk is not copied in its entirety. Only the contents of
one individual partition is copied.
This copy is executed sector by sector, therefore (relative to the
beginning of each partition) the individual sectors are moved to
the same address. However, in contrast to the drive-to-drive mode,
the individual sectors are not at the same absolute address in
relation to the complete (target) hard disk.
Such a copy is therefore not directly usable, but only after it has
been copied back, or been adapted to the changed absolute position
on the hard disk (as to which see "Adjust Target", below).
Step 3:
Select the Source partition (i.e. on an EXISTING disk).
NB: Copying takes about 3 minutes per 10MB
(20MB = 5 min; 80MB = 25 min)
Step 4:
Select the Target partition (i.e. on the NEW disk).
Step 5:
Select the Options (e.g. verify copy, smart copy).
NB: To do a byte-by-byte copy, set "Smart copy" to OFF.
NB: Selecting "Verify" (verifying the copy) will double
the time involved, because a 2nd pass is required.
Step 6:
Confirm the selections, and begin the copying process.
NB: For "Auto Expand" select OFF. (This option will only appear
if the Target partition is larger than the Source.)
Step 7:
Adjust the Target disk; i.e. allow HDClone to make certain
adjustments to the target disk (in the final screen).
HDClone automatically sets parameter values that are optimal.
These usually ONLY need to be confirmed; a manual change of
the preset parameters is needed only in exceptional cases.
NB: This means accepting ALL the suggested adjustments! It
is NOT necessary to change any of the proposed settings;
and in practice it's essential not to change any of them!
NB: The following notes assume that the Target disk is a 500GB
SATA disk, used in a pre-2001 Windows 9x computer, with an
older BIOS that cannot boot from a SATA disk. These notes
do NOT apply in any other case.
(a) GEOMETRY -
Geometry used : The geometry of the Target (i.e. clone) disk
*must* be set as LBA (Large Block Addressing).
NB: A FAT32 disk larger than 8GB *must* use
LBA (including a disk larger than 137GB)
(b) MBR -
Adopt partition ID : Use the same partition type as on the Source disk.
NB: This option is only offered for the Primary DOS
partition of the Target disk. In other cases it
is greyed-out.
NB: Type 0C (FAT32 LBA) is normal for a Primary DOS
partition on a FAT32 disk. Do NOT set any other
partition type for the Primary DOS partition of
the Target disk. See DISK STRUCTURE NOTES above.
Adjust partition size: Set the size of the Target partition to the
exact size of the Source partition.
NB: This guarantees that the clone (Target)
partition will be the same size as the Source
(will have the exact same number of Sectors);
so it will be as close a match as possible
to the Source partition, in every way.
NB: This will cause an option to pop-up,
offering to resize the Target to match
the size of the Source, if they differ.
Adjust CHS layout : Use the CHS values set in 'Geometry used' for
adjusting the MBR & Boot Sector of the Target.
NB: This option is normally greyed-out
(because CHS is not used if the
Target disk is larger than 8GB)
Reset disk signature : Reset the Target disk's unique media signature.
This sets bytes DA to DF [Disk Serial Number] in
the Target's MBR (see "DISK STRUCTURE NOTES" above)
to a different ID number than the Source disk.
NB: This is an ESSENTIAL step! It would be fatal
to use the unique ID signature of the Source disk
on the Target disk: they would effectively *both*
have the same "address", causing the computer to
crash on startup.
(c) BOOT SECTOR -
Adjust offset : Adjusts the partition's start address (in the
boot sector of the Target partition).
NB: This is an ESSENTIAL adjustment! The Target
partition will NOT be accessible by Windows
if this adjustment is not made.
Patch boot code : Avoids boot problems on older hardware.
NB: What this does is unclear; but there is NO
possibility of the Target (SATA) disk ever
being used to boot the system, as a pre-2001
m/board BIOS cannot boot from a SATA disk!
So it is safe to allow this: any changes
made will have NO practical consequences.
Change Volume ID : Create a new ID for the Target partition.
This is ESSENTIAL if the source and target
partitions are to be used in the same PC!
A Volume (partition) serial number is randomly
generated each time you format the partition.
(NB: A simple DIR command in DOS displays the
8 character Volume Serial Number [xxxx-xxxx])
This serial number must be different on
every partition present in the computer, as
Windows uses these ID numbers to identify
(i.e. differentiate between) the partitions.
NB: The hard disk also has a serial number,
one that is hardcoded to the hardware,
but this is NOT a reference to that.
NB: This is NOT a reference to the Volume label
(i.e. the 11 character Partition name).
Top of Page
SECTION E: RESTORING PRE-CRASH STATE
CHECKING DISK AFTER A REPAIR
============================
After repairing a Hard Disk, it is prudent to check it for Disk Errors
(to establish whether any further errors still need to be fixed)
SCANDISK
========
(a) ScanDisk for DOS
If Windows cannot load, use the DOS version of Microsoft's
ScanDisk (a.k.a. ScanDisk for DOS).
NB: The option /CUSTOM forces the program to use the settings
in the customised file SCANDISK.INI in C:\WINDOWS\COMMAND
NB: Do NOT allow SCANDISK to make any changes to the disk!
*** Set PATH ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Run ScanDisk for DOS ***
SCANDISK C: /CHECKONLY /SURFACE
SCANDISK D: /CHECKONLY /SURFACE
SCANDISK E: /CHECKONLY /SURFACE
(b) ScanDisk for Windows
If Windows can start, use the Windows version of Microsoft's
ScanDisk (a.k.a. ScanDisk for Windows) instead of, or as well as,
the DOS version.
NB: Do NOT allow SCANDISK to make any changes to the disk!
*** Set PATH ***
SET PATH=%path%;C:\WINDOWS
*** Run ScanDisk for Windows ***
SCANDISKW C:
SCANDISKW D:
SCANDISKW E:
NORTON DISKEDIT
===============
When Norton's DiskEdit 2002 first accesses a partition (i.e. drive)
it spends 2 or 3 minutes scanning that partition. When the scanning
completes, the details of any disk errors found are displayed.
NB: The errors found can thereafter be viewed by going to -
INFO > ERROR INFO
NB: If there are too many directories on the partition, then,
depending upon the amount of installed RAM memory, allowing
the scan to complete will crash DiskEdit and the computer.
(This can be avoided by aborting the scan part-way through)
NB: On scanning a partition, no error information is normally
displayed: i.e. no message pops-up saying there are NO disk
errors! Only if a fault is found does a message appear.
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Warning:
The function "Advanced Recovery Mode" in Norton DISKEDIT 2002
does not work properly.
To access that option, select "Physical disks" then go to:
Tools > Advanced Recovery Mode
The function reports an incorrect value for "Sectors per Cluster".
NORTON DISK DOCTOR
==================
Norton's Disk Doctor 2002 can scan a partition (i.e. drive), to
check it for disk errors. Five different tests are run.
NB: The option /Q causes all tests to run except surface scan.
NB: For details of all options available in this program, see
below (under "NORTON'S DISK DOCTOR").
*** Diagnose a Partition ***
SET PATH=%path%;F:\NDD
NDD C: /Q
NDD D: /Q
NDD E: /Q
Warning -
1. StarMan recommends that NDD should NOT be used on a system
with many logical drives (especially if the system dual boots
Windows NT/2000/XP and Windows 98, sharing a FAT32 drive).
2. If you run NDD, never use the option FIX unless you save
all changes to an Undo file! It is not entirely reliable.
CHK IDENTIFIER
==============
One of the problems running Scandisk is that if it finds FAT chains
without any corresponding files, it creates its own set of files:
typically in the format file0001.chk, file0002.chk, etc.
When there are only a few files it is possible to guess what they are
and rename the extension accordingly, but when there are hundreds or
thousands of these files the task becomes a nighmare.
Flobo's CHK identifier can help, as it reads each file and determines
its file type. It is able to rename the files (as e.g. File0001.xls,
File0002.doc, etc) so that you can quickly open the files and use them.
CHECK HARD DISK FOR ERRORS
==========================
1. Boot to DOS (with WinME Emergency Boot Disk)
2. Run SCANDISK for DOS:-
C:\WINDOWS\COMMAND\SCANDISK.EXE C: /CHECKONLY /SURFACE
C:\WINDOWS\COMMAND\SCANDISK.EXE D: /CHECKONLY /SURFACE
C:\WINDOWS\COMMAND\SCANDISK.EXE E: /CHECKONLY /SURFACE
3. Run Norton's DiskEdit 2002:-
F:\NORTON\DISKEDIT.EXE C:
F:\NORTON\DISKEDIT.EXE D:
F:\NORTON\DISKEDIT.EXE E:
NB: Running this program in DOS automatically causes it to
scan the Drive being loaded for faults. If it finds no
faults, it doesn't tell you; but if any faults are found
it pops up a warning message.
4. Run Norton's Disk Doctor:-
SET PATH=%path%;F:\NDD
NDD C: /Q
NDD D: /Q
NDD E: /Q
Options: /C = All tests including Surface Scan
/Q = All tests except Surface Scan
Top of Page
WINDOWS UTILS TO CLONE DIRECTORIES
==================================
XXCOPY.EXE
==========
XXCOPY v2.85.7
The Windows program XXCOPY.EXE can clone individual directories,
as part of the process of restoring a computer to its pre-crash
state.
Those utilities which can clone an entire disk (e.g. GHOST.EXE)
(see above) will only partially restore the pre-crash state:
even the most recent backup of the damaged disk will not be
entirely up-to-date!
XXCOPY can add to the cloned disk files (or entire directories)
from other backup sources, while preserving the file dates
(Created, Modified, & Accessed).
*** Clone a Directory ***
XXCOPY "D:\Misc\" "C:\Misc\" /H /KS /E /TTA0 /TCA /TCC /TCW /ZE
Note:
The only useable version of XXCOPY is v2.85.7 as it does NOT suffer
from the nag screens and restrictions that afflict other versions!
Syntax
Directory names:
The space character terminates the arguments, therefore a path with
embedded spaces must be contained within quotation marks to be valid.
The following switches check the destination directory:
/I If copying more than one file and destination does not exist,
assumes that destination must be a directory (no prompting).
Note: If the destination specifier ends with a backslash,
that declares a directory and implicitly sets the /I switch.
The following switches use file attribute bits:
/H Copies hidden and/or system files also.
/H0 Excludes hidden and/or system files (default).
/Ho Copies hidden and/or system files only.
/R Overwrites read-only files.
/K0 Keeps H-bit and S-bit, sets A-bit, clears R-bit (default).
/K Keeps the source attributes including read-only (same as /KS).
/KS Keeps the source attributes including the read-only bit.
/KD Keeps the attributes of the destination (overwritten) file.
/KN Sets the destination attributes to normal (only /A).
The following switches deal with subdirectories:
/S Copies directories and Subdirectories except empty ones.
/E Copies directories and subdirectories, including Empty ones.
/T Creates directory structure, but does not copy files: copies
all directories including empty ones (implicitly sets /E).
The following switches control timestamps:
/TTA Touches (modifies) timestamp of Last Access of source.
/TTA0 Preserves timestamp of Last Access of source (default).
/TCA Copies the timestamp of Last Access from source to dest.
/TCA0 Uses current time for destination's Last Access (default).
/TCC Copies the timestamp of Create Time from source to dest.
/TCC0 Uses current time for destination's Create time (default).
/TCW Copies the Last Write time from source to dest (default).
/TCW0 Uses current time for destination's Last Write time.
NB: In Windows 9x, this ONLY works with Files. It does
not work with Directories. To make a genuine
clone of the disk, use e.g. Norton's Ghost (above).
Batch File Options:
Source is current directory -
"."
Example:
XXCOPY "." "C:\My Documents\"
No screen output, no log file -
/oD0
CLONE Switch -
XXCOPY "C:" "D:" /CLONE /ED
/CLONE Duplicates a directory or an entire partition. This switch
is a shortcut for: /KS/H/E/R/Q/Y/BI/ZY/ZE/oD0
NB: Really, an incremental backup, not a clone. The existing
files on the target will be updated, but *only* if they
have changed; and any new files (i.e. those not present
at all on the target) will be added.
This is NOT a byte-by-byte clone of the Partition: any
new directories will have the CURRENT date. In Win9x,
the date/time stamps of a directory can NOT be recreated
(unlike those of a file).
Options:
/KS Keep attributes of Source file
/H include Hidden & system files
/E include even Empty subdirectories
/R overwrite Read-only files in the destination
/Q Quiet (no screen display, no log file)
/Y suppress the prompt before overwriting
/BI copy all files in source that are different from
files in destination in either filetime or size
/ZY delete extra files or subdirectories in destination,
with no confirmation prompt
/ZE disable all Environment variables (e.g. COPYCMD /Y)
/oD0 no screen output, no log file
The following switches control empty directories:
/ED0 Deletes an empty directory (default action).
/ED Preserves a directory even if it becomes empty.
/ED{n} Preserves only n levels of empty directories.
Note: These ONLY work in file/directory removal
operations (/Z, /RC, /RS, /RD, /RX or /CLONE)
XXCOPY cannot copy a Disk, only a Partition. And it is necessary
to first use FDISK.EXE and FORMAT.COM to create and format the
target Partition (see above).
Backup the Windows Directory
This routine backs up and restores key Operating System
directories, using an Incremental Backup to enable them
to be more easily kept up to date.
Syntax -
/BI Backup Incrementally: Only copy files which are
different, either by time or by size. It adds files
which have been altered since the last backup
(overwriting the previous backup of those files).
The option /BI compares files using both DATE and TIME
The option /Y suppresses the prompt to overwrite an
existing file
The option /ZY deletes extra files or subdirectories in the
destination (ones not in the source), with NO confirmation prompt!
Files to Exclude -
Exclusion specifier syntax (consists of up to 3 parts):
For file: [ dir_spec\ ] [ *\ ] [ ftemplate ]
For directory: [ dir_spec\ ] [ *\ ] [ dtemplate ]
NB: The option *\ specifies that the exclusion applies also
to all subdirectories of the specified directory
Create a text file named exclude.txt and copy-and-paste into it
the following:
// Excluded subdirectories:
"C:\Windows\Desktop\*\"
"C:\Windows\History\*\"
"C:\Windows\Recent\*\"
"C:\Windows\TEMP\*\"
"C:\Windows\Temporary Internet Files\*\"
// Excluded Files:
"C:\Windows\wiaservc.log"
"C:\Windows\WIN386.SWP"
"C:\Windows\Sti_Event.log"
"C:\Windows\Sti_Trace.log"
"C:\Windows\Cookies\index.dat"
Backup the Windows directory -
The following command will create a backup of the entire Windows
directory, including all sub-directories (even if empty).
The copies will retain their "Created" and "Last Modified" dates.
*** Backup the Windows directory ***
(NB: Excludes some uncopiable or undesirable files, as above)
XXCOPY /BI /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /Y "C:\WINDOWS\" "C:\WinBak\" /E /EXexclude.txt /ZY /ED
Log file
To record XXCOPY errors in a Log (and save the Log in the root
directory of Drive C:), add the following to the command line:
/on:c:\error.log
TOTAL COMMANDER
===============
Total Commander v7.04a
This program will NOT run under DOS, only under Windows.
It has two useful directory cloning tools.
1. The DirCpy Plugin
It can copy a directory, retaining the date/time stamp
of the source directory, using the DirCpy plug-in from
http://physio-a.univ-tours.fr/tcplugins/dircpy.htm
How to install DirCpy:
1. Unzip dircpy.wcx into any directory
(e.g. put it in C:\Program Files\DirCpy)
2. In Total Commander, go to: Configuration > Options
3. Click on 'Packer'
4. Click the button "Configure packer extension WCXs"
5. Type any extension (you'll never use it) into the box
at top right, e.g. DirCpy
6. Click on 'new type', and select the file dircpy.wcx
in the directory to which you unzipped it (NB: Its
address will then display in the 'Associate With' box)
7. Click OK
How to use DirCpy:
1. Start Total Commander
2. In the left-hand window, select the source directory
(by right-clicking on it so that it turns RED)
3. In the right-hand window, select the destination directory
4. Go to: Files > Pack (or press Alt & F5); then in the 'Packer'
box, select the bottom radio-button, i.e. the drop-down
combo box; then in that combo box select the option DirCpy
5. In the 'Packer' box, click the button "Configure";
then tick "Preserve Date" and "Preserve Attributes"
to preserve the date & attributes of the source directory;
then click on "OK".
6. Tick the option "Also pack path names (only recursed)"
7. Tick the option "Recursively pack subdirectories"
8. Ignore the display line that starts "DirCpy:" and ends
in a file name. That file will NOT be created at the
destination; only the Path will be used at the destination
9. Then click on OK. This starts the process of creating
the selected directory structure at the destinaton.
(NB: No files are copied, so the process takes about 1 sec)
Notes:
- Options changed in the "Pack files" DialogBox are saved
in the Windows registry.
- The "Preserve date" option is valid on Windows 9x only
in versions 1.03 and later of DirCpy.
- Under Windows 9x, the "Preserve date" option requires
the file Wc32to16.exe (installed by the Total Commander
installation routine), and you will be prompted for its
location at the first use. It is in the Total Commander
directory (e.g. C:\Program Files\Total Commander).
- XXCOPY can NOT preserve the date of a source directory
in the copy, so it is necessary to use Total Commander
to create the directory tree before copying any files.
2. Automates XXCOPY
It automates part of the process of running XXCOPY:
- No source directory needs to be defined
- It stores, and recalls, the latest command line
Useful XXCOPY commands:
A. Standard Command Line (to copy Files only) -
XXCOPY /H /R /KS /TTA0 /TCA /TCC /TCW /V2 "." "F:\BACKUP\"
B. Include Subdirectories -
XXCOPY /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /S "." "F:\BACKUP\"
C. Newer Files only (in Current directory only) -
XXCOPY /BN /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /Y "." "F:\BACKUP\"
D. Files only (in current directory only); prompts if OLDER file
at destination; skips files at destination that are NOT older;
automatically copies files that DON'T exist at destination -
XXCOPY /BN /H /R /KS /TTA0 /TCA /TCC /TCW /V2 "." "F:\BACKUP\"
E. Same as option D, but also DELETES files in the Destination
directory that don't exist in the Source directory -
XXCOPY /BN /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /ZY "." "F:\BACKUP\"
FILE MANAGER (WINFILE.EXE)
============
This program will NOT run under DOS, only under Windows.
Windows 98/ME comes with an alternative file manager (i.e. other
than Windows Explorer), that can manage a FAT32 disk: the 16-bit
File Manager.
It provides 16-bit disk access if EXPLORER.EXE (which provides
32-bit disk access) is unavailable. So if Windows will not start
even in Safe Mode, try replacing Explorer with File Manager.
NB: File Manager is a 16-bit program! All files are shown with
their short (8.3 format) filenames. All files copied using
it will lose their Long File Names.
To run File Manager, edit SYSTEM.INI at the DOS prompt. In the
[boot] section replace the line SHELL=EXPLORER.EXE with the line
SHELL=WINFILE.EXE then save the changes and restart the computer.
*** Edit SYSTEM.INI ***
SET PATH=%path%;A:\
EDIT C:\WINDOWS\SYSTEM.INI
*** Run 16-bit File Manager in Windows ***
C:\WINDOWS\WINFILE.EXE
Note:
The program DOS Shell (included in all versions of MS-DOS up to
MS-DOS v6.22) is very much like a DOS version of File Manager.
But to use DOS Shell it might be necessary to boot the system
using an MS-DOS v6 bootdisk (instead of a Windows 9x bootdisk).
This would NOT be wise, as MS-DOS v6 does NOT understand FAT32.
Top of Page
SECTION F: MISCELLANEOUS TOOLS
DOS UTILS
=========
DOSKEY
======
*** Set PATH to include DOSKEY ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Run DOSKEY ***
DOSKEY
Useful DOSKEY commands:
F7 : Lists command history of current session
UP / DOWN ARROW : Recall previous/next commands
Source:
DOSKEY.COM is NOT on a standard Windows ME emergency boot disk!
(NB: It is found at C:\WINDOWS\COMMAND on a WinME hard disk)
MENU GUI IN DOS
===============
A file manager program with a GUI gives a visual representation
of the file tree, simplifying finding files and recovery utils
where Windows is unavailable due to a system crash.
A. DOS NAVIGATOR (DN.EXE) -
This (open source) program is the most sophisticated GUI for DOS
in the known universe.
SET PATH=%path%;F:\DOS_NAV\DN
DN
B. DISK MANAGER (DISKMAN4.EXE)
Disk Manager v4.01 (2002)
*** Run Disk Manager ***
DISKMAN4
*** Run Disk Manager in Windows (i.e. in Console Mode) ***
DISKMAN4 CONSOLE
C. DOS file editor (EDIT.EXE) -
Recognises a hard disk of any size recognised by DOS.
*** Run the program ***
SET PATH=%path%;A:\
EDIT A:\AUTOEXEC.BAT
To see a visual representation of the Directory tree go to:
FILE > OPEN
D. LAPLINK PRO (LLPRO.EXE) -
*** Set PATH to include LLPRO ***
SET PATH=%path%;F:\LLPRO
*** Run LAPLINK PRO 16bit File Manager ***
(Program does NOT support Long File Names)
LLPRO
NB: LapLink does NOT support Disks larger than 2GB, so it is
UNSAFE to copy any files with it! ONLY use it to VIEW the
Files & Directories, to locate their whereabouts on Disk.
MEMORY USAGE
============
A. MEM.EXE -
MEM.EXE for DOS is an MS-DOS program included with Windows ME
in the directory C:\WINDOWS\COMMAND
*** Report on Conventional & Upper Memory with MEM.EXE ***
SET PATH=%path%;C:\WINDOWS\COMMAND;A:\
MEM /A /C /P
** Summary of Memory **
MEM /D /P
MEM /D /P > Memory_1.txt
** Comprehensive report on Memory **
MEM /C /P
MEM /C /P > Memory_2.txt
B. MI.COM -
*** Report on Memory Information with MI.COM ***
Syntax:
MI [parameters...]
/A - All conventional memory details listed
/C - Conventional memory only; ignore EMS and Ext.
/D - Device driver list
/E - Ignore MI*OPT=[parameters] in environment
/F - Filter (i.e. hide) unprintable characters
/H - List the EMS and XMS handles
/N - No pause at full screen
/O - Other display format
/Q - Quick summary only
/V - List the 'hooked' vectors
/? - Display this command line help
*** Memory Information ***
MI
MI /N > miReport.txt
*** Summary of Conventional memory ***
MI /C
MI /C /N > miSumary.txt
*** Comprehensive details of Conventional memory ***
MI /A
MI /A /N > miDetail.txt
EDIT THE REGISTRY
=================
Although the Registry Editor (REGEDIT.EXE) is a Windows program,
it can also run in DOS. Registry keys can be exported (e.g. for
editing), imported, deleted or read in DOS.
NB: For Windows 98/98SE/ME only!
SYNTAX -
/L:system Specify the location of the SYSTEM.DAT file
/R:user Specify the location of the USER.DAT file
/E Export to registry file [NB: Omit if importing]
filename.reg Name of file which the data will be exported to
or imported from
"registry_key" Name of registry key to be exported [NB: Omit if
importing], e.g. "HKEY_CLASSES\ROOT\*\shell"
NB: See also http://www.robvanderwoude.com/regedit.html
*** Set PATH for using Regedit.exe ***
SET PATH=%path%;C:\WINDOWS
A. Export a registry key in DOS
Export a registry key to a file:
REGEDIT.EXE [ /L:system | /R:user | /T:classes] /E filename.reg regpath
REGEDIT.EXE /L:C:\WINDOWS\SYSTEM.DAT /E F:\EXPORT.REG "HKEY_LOCAL_MACHINE\DummyTree"
REGEDIT.EXE /R:C:\WINDOWS\USER.DAT /E F:\EXPORT.REG "HKEY_USERS\DummyTree"
REGEDIT.EXE /T:C:\WINDOWS\CLASSES.DAT /E F:\EXPORT.REG "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DummyTree"
NB: Once exported the key can be edited (using any text editor
to edit the .REG file, which is a plain text file), then put
back into the registry using the import command (below).
B. Import a registry key in DOS
Import (merge) a .REG file into the registry:
REGEDIT.EXE [ /L:system | /R:user | /T:classes ] filename.reg
REGEDIT.EXE /L:C:\WINDOWS\SYSTEM.DAT F:\IMPORT.REG
REGEDIT.EXE /R:C:\WINDOWS\USER.DAT F:\IMPORT.REG
REGEDIT.EXE /T:C:\WINDOWS\CLASSES.DAT F:\IMPORT.REG
C. Delete a registry key in DOS
Option #1:
REGEDIT.EXE [ /L:system | /R:user | /T:classes ] /D regpath
REGEDIT.EXE /L:C:\WINDOWS\SYSTEM.DAT /D "HKEY_LOCAL_MACHINE\DummyTree"
REGEDIT.EXE /R:C:\WINDOWS\USER.DAT /D "HKEY_USERS\DummyTree"
REGEDIT.EXE /T:C:\WINDOWS\CLASSES.DAT /D "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DummyTree"
Option #2:
First, create a .REG file to import: containing a delete instruction,
followed by an instruction to re-create an empty key.
Example: Delete all hardware devices, to enable the Windows plug-n-play
wizard to do a complete hardware re-install on reboot -
REGEDIT4
[-HKEY_LOCAL_MACHINE\Enum]
[HKEY_LOCAL_MACHINE\Enum]
Second, import (merge) that .REG file into the registry:
[NB: Choice depends upon which file the key belongs in]
REGEDIT.EXE /L:C:\WINDOWS\SYSTEM.DAT F:\DELETE.REG
REGEDIT.EXE /R:C:\WINDOWS\USER.DAT F:\DELETE.REG
REGEDIT.EXE /T:C:\WINDOWS\CLASSES.DAT F:\DELETE.REG
D. Delete one item from a registry key in DOS
First, create a .REG file with (for example) these contents:
REGEDIT4
[HKEY_USERS\DummyTree]
"ValueToBeRemoved"=-
Second, import (merge) that .REG file into the registry,
as at C above.
E. Read a registry key in DOS
*** Step 1: Export the Registry Key to a file ***
REGEDIT.EXE /L:C:\WINDOWS\SYSTEM.DAT /E F:\EXPORT.REG "HKEY_LOCAL_MACHINE\DummyTree"
REGEDIT.EXE /R:C:\WINDOWS\USER.DAT /E F:\EXPORT.REG "HKEY_USERS\DummyTree"
REGEDIT.EXE /T:C:\WINDOWS\CLASSES.DAT /E F:\EXPORT.REG "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DummyTree"
*** Step 2: Read the file ***
EDIT F:\EXPORT.REG
REPLACE THE REGISTRY
====================
Extract the Windows Registry from a backup .CAB file, in DOS,
overwriting the current Registry.
NB: For Windows 98/98SE/ME only!
*** Set Path ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Extract all Registry files to their required locations ***
NB: Rename the .CAB file to match the actual filename!
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.BAT /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.SYS /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.DAT /L C:\WINDOWS /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.INI /L C:\WINDOWS /Y
SAVE FILES TO DRIVE F
=====================
*** Save output data to Drive F: (USB Pen Drive) ***
** NB: Check that the USB disk is Drive F: **
** STEP 1: Make a destination directory at Drive F: **
MD F:\DATA
** STEP 2: Copy all output files to Drive F: **
Options -
/V Verify file was written correctly
/Y Suppress prompt to overwrite if file already exists
COPY *.* F:\DATA /V /Y
PATH
====
*** Restore the original PATH settings ***
PATH ;
SET PATH=%DOSpath%
Top of Page
WINDOWS ME EMERGENCY BOOT DISK
==============================
This is a customised startup configuration for a Windows ME
Emergency Boot Disk (EBD): the bootable start-up floppy disk
created by Windows ME.
To create this floppy disk, start Windows ME then go to:
START > SETTINGS > CONTROL PANEL > ADD/REMOVE PROGRAMS
and click on the tab "Startup Disk".
Note:
The additional batch (.BAT) files referred to below concerning
hard disk repair or data recovery are present on a standard
Windows ME Emergency Boot Disk.
Note:
Some of the device drivers referred to below must be manually
copied to the start-up floppy disk. Sources for those files
are cited below (PROGRAM DOWNLOAD SOURCES).
Alternatively, here is a download link to an Image File which will
create this customised Windows ME Emergency Boot Disk: Click here
(NB: Use UNDISKER.EXE to create the floppy disk)
Note:
The routines below are for Disk 1 with 2 Partitions (C: and E:),
Disk 2 with 1 Partition (D:), and a USB Disk (F:). The USB Disk
(a non-bootable pendrive) contains certain program files which
are required in the routines (because an IDE disk might fail,
so all rescue programs are stored on the USB disk); but these
programs could be placed on ANY working IDE disk. Sources for
these files are cited below (PROGRAM DOWNLOAD SOURCES).
Note:
These CONFIG.SYS and AUTOEXEC.BAT files will need to be edited
in order to work, if the rescue programs are not on Drive F:
CONFIG.SYS
==========
[menu]
menuitem=QUICK, Minimal Boot (Maximum DOS Memory)
menuitem=UNDELETE, Undelete Files
menuitem=BSOD, Restore Registry
menuitem=DOSNAV, DOS Navigator GUI, with USB
menuitem=CD, DOS with RAM Disk, with CD-ROM
menuitem=USB, DOS with RAM Disk, with CD-ROM and USB
rem menuitem=NOCD, DOS with RAM Disk, without CD-ROM or USB
menuitem=HELP, Advice on running WinME, with RAM Disk and CD-ROM
menuitem=DISKEDIT, Norton's DiskEditor (Norton Utilities 2002) for FAT32
menuitem=TIRAMISU, Tiramisu Easy Recovery v6, with USB support (HDD exceeding 32GB)
menudefault=QUICK,60
menucolor=7,0
rem NB: Only the first 9 menu entries will be displayed!
[QUICK]
rem No device drivers loaded
rem Maximises the amount of free Conventional memory in DOS
[UNDELETE]
rem USB drivers for DOS:
devicehigh=USBASPI.SYS /o /e /v
devicehigh=DI1000DD.SYS
[BSOD]
[DOSNAV]
rem DOS Navigator v6.40 and USB
devicehigh=USBASPI.SYS /o /e /v
devicehigh=DI1000DD.SYS
[CD]
devicehigh=oakcdrom.sys /D:mscd001
rem device=btdosm.sys
rem device=flashpt.sys
rem device=btcdrom.sys /D:mscd001
rem device=aspi2dos.sys
rem device=aspi8dos.sys
rem device=aspi4dos.sys
rem device=aspi8u2.sys
rem device=aspicd.sys /D:mscd001
rem
rem RAM Disk driver (16MB RAMdisk):
devicehigh=ramdrive.sys /E 16384
[USB]
rem USB drivers for DOS:
rem
rem ASPI Manager for USB mass-storage v2.24
rem Panasonic Communications Co 2000-2007
devicehigh=USBASPI.SYS /o /e /v
rem
rem Syntax -
rem /u UHCI, for enabling a USB 1.0 controller (NB: Obsolete)
rem /o OHCI, for enabling a USB 1.1 controller (Motherboard and PCI Card)
rem /e EHCI, for enabling a USB 2.0 controller (PCI Card USB 2.0 ports)
rem /v Verbose mode, useful for troubleshooting
rem /w Wait, displays message to prompt attaching of USB device
rem /r Resident, load as memory resident if USB floppy detected
rem /l# LUNs, specify highest number of LUN assigned: default /L0
rem /slow Use SLOW mode, gives longer delays on scanning USB ports
rem /nocbc No CardBus Controller, disable detection on CardBus slots
rem
rem You can specify more than one controller type (e.g. /o /e). Use
rem this feature to specify which port types to enable: limiting
rem the port types that are scanned for results in a faster startup.
rem
rem These options work on my PC:
rem device=USBASPI.SYS /v
rem device=USBASPI.SYS /o /v
rem device=USBASPI.SYS /e /v
rem device=USBASPI.SYS /o /e /v
rem
rem DI1000DD ASPI Disk Driver v2.00
rem (c) 2001 NOVAC Co Ltd
devicehigh=DI1000DD.SYS
rem
rem RAM Disk driver (28MB RAMdisk):
devicehigh=ramdrive.sys /E 28672
rem NB: This driver CANNOT create a 32MB RAMdisk
rem NB: Maximum of 64 files can be placed in RAMdisk
rem
rem CD-ROM driver:
devicehigh=oakcdrom.sys /D:mscd001
[NOCD]
rem RAM Disk driver (16MB RAMdisk):
devicehigh=ramdrive.sys /E 16384
[HELP]
device=oakcdrom.sys /D:mscd001
device=btdosm.sys
device=flashpt.sys
device=btcdrom.sys /D:mscd001
REM device=aspi2dos.sys Delete these files to provide disk space
REM device=aspi4dos.sys on this floppy for essential USB drivers
device=aspi8dos.sys
device=aspi8u2.sys
device=aspicd.sys /D:mscd001
rem
rem RAM Disk driver (16MB RAMdisk):
devicehigh=ramdrive.sys /E 16384
[DISKEDIT]
rem Do NOT load HIMEM.SYS, as it will *conflict* with
rem the internal memory manager in this version of DOS
[TIRAMISU]
rem USB drivers for DOS:
devicehigh=USBASPI.SYS /o /e /v
devicehigh=DI1000DD.SYS
rem NB: Recovered files can be copied to the USB 8GB pen drive
rem
rem RAM Disk driver (28MB RAMdisk):
devicehigh=ramdrive.sys /E 28672
rem NB: This driver CANNOT create a 32MB RAMdisk
rem NB: By default, Tiramisu uses the RAMdisk as the swap area
rem
rem *** Load Tiramisu Easy Recovery v6.10 (HDD exceeding 32GB) ***
rem NB: There are NO device drivers for this version of Easy Recovery!
[COMMON]
files=40
buffers=10
stacks=9,256
lastdrive=z
dos=high,umb
device=display.sys con=(ega,,1)
rem The next four lines are country-specific settings for the United Kingdom
country=044,850,country.sys
install=mode.com con cp prepare=((850) ega.cpi)
install=mode.com con cp select=850
install=keyb.com uk,,keyboard.sys
AUTOEXEC.BAT
============
@echo off
cls
SET DIRCMD=/W/P/O
\hibinv.exe
call \checksr.bat
IF "%config%"=="QUICK" GOTO QUICK
IF "%config%"=="UNDELETE" GOTO UNDELETE
IF "%config%"=="BSOD" GOTO BSOD
IF "%config%"=="DOSNAV" GOTO DOSNAV
IF "%config%"=="DISKEDIT" GOTO DISKEDIT
::Load RAM Drive...
set EXPAND=YES
set LglDrv=27 * 26 Z 25 Y 24 X 23 W 22 V 21 U 20 T 19 S 18 R 17 Q 16 P 15
set LglDrv=%LglDrv% O 14 N 13 M 12 L 11 K 10 J 9 I 8 H 7 G 6 F 5 E 4 D 3 C
cls
call setramd.bat %LglDrv%
path=%RAMD%:\
set temp=%RAMD%:\
set tmp=%RAMD%:\
copy command.com %RAMD%:\ > NUL
set comspec=%RAMD%:\command.com
copy extract.exe %RAMD%:\ > NUL
copy readme.txt %RAMD%:\ > NUL
::
IF "%config%"=="TIRAMISU" GOTO TIRAMISU
:ERROR
IF EXIST ebd.cab GOTO EXT
echo Please insert Windows Millennium Edition Startup Disk 2
echo.
pause
GOTO ERROR
:EXT
%RAMD%:\extract /y /e /l %RAMD%: ebd.cab > NUL
echo The diagnostic tools were successfully loaded to drive %RAMD%:
echo.
IF "%config%"=="NOCD" GOTO QUIT
::
::Load CD-ROM driver...
rem Next line can be disabled to save memory
LH %ramd%:\MSCDEX.EXE /D:mscd001 /L:%CDROM%
::If MSCDEX doesn't find a drive...
rem Next line can be disabled to save memory
IF ERRORLEVEL 1 SET CDPROB=1
::
IF "%config%"=="USB" GOTO USB
IF "%config%"=="HELP" GOTO HELP
::
GOTO QUIT
:QUIT
call fixit.bat
rem clean up environment variables
set CDPROB=
set CDROM=
set LglDrv=
GOTO END
:QUICK
SET PATH=C:\WINDOWS\COMMAND
DOSKEY
GOTO END
:UNDELETE
echo.
::Load Mouse
F:\MOUSE.EXE
::Norton Unerase for Win95
F:\UNERASE.EXE
GOTO END
:BSOD
A:\BSOD.BAT Omitted: Has nothing to do with data recovery
GOTO END
:DOSNAV
echo.
::Load Mouse
F:\MOUSE.EXE
::Include USB Disk in PATH...
SET PATH=C:\;F:\;A:\
::Launch DOS Navigator v6.40
F:\DOS_NAV\DN.COM
GOTO END
:DISKEDIT
echo.
::Load Mouse
LH F:\MOUSE.EXE
::Launch Norton Disk Editor (662KB)
SET PATH=F:\NORTON\2002
LH F:\NORTON\2002\DISKEDIT.EXE
::Launch Norton Disk Doctor (642KB)
rem SET PATH=F:\NDD
rem LH NDD.EXE
GOTO END
:TIRAMISU
echo.
::Load Mouse
F:\MOUSE.EXE
echo.
path=%ramd%:\;A:\
::Load Tiramisu Easy Recovery v6.10 (HDD exceeding 32GB)
F:
CD \TIRAMISU\EASYRE~1.10
xbios /P- /Z /I /M /V=2
substtoz VDISK
echo.
echo Your RAM Disk is %ramd%
echo Copying files to RAMdisk, please wait...
copy EASYREC.EXE %ramd%:\
%ramd%:\EASYREC %ramd%:\ /y
copy ER.BAT %ramd%:\
%ramd%:
LOADASPI
RDRINT13 /V=0
call ER.BAT
GOTO END
:USB
echo.
::Load Mouse
F:\MOUSE.EXE
::Load SmartDrive
F:\SMARTDRV.EXE 4096 16>nul
::Include USB Disk in PATH...
SET PATH=%path%;C:\;F:\;A:\
GOTO END
:HELP
cls
call HELP
GOTO END
:END
Top of Page
CALCULATORS
===========
NORTON DISKEDIT
===============
Norton's DiskEdit 2002 includes a calculator with the ability
to Add, Subtract, Multiply & Divide in Decimal, Hex and Binary;
plus the ability to convert between Decimal, Hex and Binary.
In DiskEdit, go to: TOOLS > CALCULATOR
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
BATCH FILES
===========
A WinME batch file (i.e. an MS-DOS 8.0 batch file) has NO arithmetic
functions, as those were not added to the MS-DOS "SET" command until
Windows 2000.
Top of Page
CALCULATE LBA PARTITION
=======================
CALC.EXE
========
The script below will calculate the LBA sector numbers (i.e. the
disk geometry) for a FAT32 partition, on a disk larger than 8GB.
The markers /* and */ operate to comment-out whatever is enclosed
between them. Nothing between those markers will be executed when
the script is run.
The script identifies the disk location (or "field") in which a
particular value belongs. For example, the field "Sectors Before"
in Partition Table entry No.1 in the Master Boot Record (MBR) is
written as follows:
MBR: 1,"Sectors Before"
Some of the Print commands [print("")] included in the script are
only there to generate an empty line, to make the output easier to
read.
The command -q (Quit) causes the program to exit when the script
has finished running, and is case sensitive.
The script will run under either DOS or Windows. However, it can
crash Windows in some circumstances, so is safer to run under DOS.
To run it, copy-and-paste the script into a file named GEOMETRY
and then enter the following commands at the DOS prompt:
*** Display the output on Screen ***
SET PATH=%path%;F:\CALC
CALC GEOMETRY -q
*** Save the output to a file ***
[NB: Use a filename that identifies the Partition]
SET PATH=%path%;F:\CALC
CALC GEOMETRY -q >> DRIVE_C
CALC GEOMETRY -q >> DRIVE_D
CALC GEOMETRY -q >> DRIVE_E
*** View the output file ***
EDIT DRIVE_C
EDIT DRIVE_D
EDIT DRIVE_E
Extended Partition:
In an Extended partition, the value "relative sectors" in the
2nd entry of an EBPR Partition Table is relative to the start
of the entire Extended partition - NOT to the start of the
current Logical partition!
This means the 2nd and 3rd Logical partitions (if present) will
contain relative sector values in Entry No.2 that are relative to
the start (i.e. partition) sector of the 1st Logical partition.
NB: The value "relative sectors" is the number of sectors from
the Partition Table sector of the *1st* Logical partition
to the end sector of the *current* Logical partition.
Ultimate Calculator v1.8:
A similar calculation can be done using Ultimate Calculator v1.8
(UCALC.EXE) (a shareware program).
Repairing a Partition Table:
The safest way to make changes to a disk's Partition Table is
the user-friendly program PowerQuest Partition Table Editor
(PTEDIT.EXE) (see above).
The script adopts the technical expressions used in PTEDIT.EXE
so as to make it easy to insert values produced by the script
into a disk's Partition Table using PTEDIT.
Disk with Multiple Partitions:
Join together the output files for all Partitions on the disk;
because, combined, they make up the entire disk.
This is a much more flexible solution than attempting to create
a single script to calculate the values for every possible disk
configuration, as there can be an unlimited number of Partitions.
*** Merge several files into a single destination file ***
(NB: One file for each of the partitions on the hard disk)
COPY DRIVE_C+DRIVE_E DISK_1
Where a disk has *more* than one Logical partition, the value in
the MBR for the total size of the Extended partition ("Sectors")
will be the size of ALL the Logical partitions added together
(the value "Sectors" from entry 1 in *each* EMBR/EBPR).
*** Script Begins ***
/* CALCULATE GEOMETRY OF FAT32 HDD */
/* =============================== */
Note -
This script includes sample data. To demonstrate how the script
is intended to work, it shows specimen values for partition data
derived from some disks of mine. This is only for illustration -
you must use the ACTUAL values for your actual disk.
/* SAVE OUTPUT: Predefined Variables (Decimal) */
/* Calculate to 2 decimal places only */
scale = 2
/* Set Input and Output to either Decimal or Hexadecimal */
/* (NB: PTEDIT.EXE uses decimal, so set this to Decimal) */
/* Output is Decimal (base 10) */
ibase = 0xA /* Input = base 10 */
obase = 0xA /* Output = base 10 */
/* Output is Hex (base 16) */
/* ibase = 0xG */ /* Input = base 16 */
/* obase = 0xG */ /* Output = base 16 */
/* INPUT: User-entered Variables (Disk Data) */
/* *** Identification of Disk *** */
print("DISK NAME: ____________ (Drive _:)
");print("
")
/* *** Size of Disk (Sectors) (User-entered Variable) *** */
/* (From MBR: 1 "Sectors Before" + 1 "Sectors" + 2 "Sectors") */
SizeOfDisk = 00 + 00000000 + 000000000
/* WD 80GB, Drive C, E = 63 + 20482812 + 135813510 = 156296385 */
/* WD 80GB, Drive D = 63 + 156296322 = 156296385 */
/* *** Heads per Cylinder (0-254) *** */
/* (NB: A mandatory value for all FAT32 disks) */
HeadsPerCylinder = 255
/* WD 80GB, Drive C and E = 255 */
/* WD 80GB, Drive D = 255 */
/* *** Sectors per Track (1-63) *** */
/* (NB: A mandatory value for all FAT32 disks) */
SectorsPerHead = 63
/* WD 80GB, Drive C and E = 63 */
/* WD 80GB, Drive D = 63 */
/* INPUT: User-entered Variables (Partition Data) */
/* *** Start of Partition: Boot Sector *** */
/* (From Tiramisu's Easy Recovery v6) */
StartSector = 00
/* WD 80GB, Primary DOS (Drive C) (LBA) = 63 */
/* WD 80GB, Logical #1 (Drive E) (LBA) = 20482938 */
/* WD 80GB, Primary DOS (Drive D) (LBA) = 63 */
/* USB 8GB, Primary DOS (Drive G) (LBA) = 32 */
/* Note:
In a strict sense, a Logical partition starts 63 sectors
before the Boot Sector, at the Partition Table sector! */
/* *** End of Partition *** */
/* (From Tiramisu's Easy Recovery v6) */
EndSector = 00000000
/* WD 80GB, Primary DOS (Drive C) (LBA) = 20482874 */
/* WD 80GB, Logical #1 (Drive E) (LBA) = 156296384 */
/* WD 80GB, Primary DOS (Drive D) (LBA) = 156296384 */
/* USB 8GB, Primary DOS (Drive G) (LBA) = 15659007 */
/* Notes:
This could be calculated from: StartSector + SizeOfPartition */
/* *** Sectors Before Partition *** */
/* (From MBR "Sectors Before" and EBPR "Sectors Before") */
SectorsBefore = 00 + 0
/* WD 80GB, Primary DOS (Drive C) = 63 + 0 */
/* WD 80GB, Logical #1 (Drive E) = 20482875 + 63 */
/* WD 80GB, Primary DOS (Drive D) = 63 + 0 */
/* Notes:
Primary DOS = MBR, 1 "Sectors Before" + 0
Logical #1 = MBR, 2 "Sectors Before" + EBPR, 1 "Sectors Before"
(NB: Each Logical partition is preceeded by 1 Head (63 sectors)
for system data, equivalent to Track 0 prior to Primary DOS) */
/* *** Size of this Partition (sectors) *** */
/* (From MBR "Sectors" or EBPR "Sectors") */
SizeOfPartition = 00000000
/* WD 80GB, Primary DOS (Drive C) = 20482812 */
/* WD 80GB, Logical #1 (Drive E) = 135813447 */
/* WD 80GB, Primary DOS (Drive D) = 156296322 */
/* Notes:
Primary DOS = From MBR : 1,"Sectors"
Logical #1 = From EBPR: 1,"Sectors" */
/* *** Sectors per Cluster in this Partition *** */
/* (From Boot Sector: "Sectors per Cluster") */
SectorsPerCluster = 00
/* WD 80GB, Primary DOS (Drive C) = 16 */
/* WD 80GB, Logical #1 (Drive E) = 64 */
/* WD 80GB, Primary DOS (Drive D) = 64 */
/* *** Number of Reserved Sectors in this Partition *** */
/* (From Boot Sector: "Reserved Sectors") */
ReservedSectors = 00
/* WD 80GB, Primary DOS (Drive C) = 32 */
/* WD 80GB, Logical #1 (Drive E) = 32 */
/* WD 80GB, Primary DOS (Drive D) = 32 */
/* *** Number of Hidden Sectors in this Partition *** */
/* (From Boot Sector: "Hidden Sectors") */
HiddenSectors = 00 + 0
/* WD 80GB, Primary DOS (Drive C) = 63 + 0 */
/* WD 80GB, Logical #1 (Drive E) = 20482875 + 63 */
/* WD 80GB, Primary DOS (Drive D) = 63 + 0 */
/* Notes:
Primary DOS = MBR, 1 "Sectors Before"
Logical #1 = MBR, 2 "Sectors Before" + EBPR, 1 "Sectors Before"
(NB: Each Logical partition is preceeded by 1 Head (63 sectors)
for system data, equivalent to Track 0 prior to Primary DOS) */
/* *** FS Info Sector *** */
/* (From Boot Sector: "FS Info Sector") */
FSInfoSector = 1
/* WD 80GB, Primary DOS (Drive C) = 1 */
/* WD 80GB, Logical #1 (Drive E) = 1 */
/* WD 80GB, Primary DOS (Drive D) = 1 */
/* *** Backup Boot Sector *** */
/* (From Boot Sector: "Backup Boot Sector") */
BackupBootSector = 6
/* WD 80GB, Primary DOS (Drive C) = 6 */
/* WD 80GB, Logical #1 (Drive E) = 6 */
/* WD 80GB, Primary DOS (Drive D) = 6 */
/* *** Starting sector of 2nd FAT in this Partition (LBA) *** */
/* (NB: Find this sector using Norton's DISKEDIT (2002):
Object > Drive > Physical Disks > Tools > Find Object > FAT) */
StartingSectorFAT2 = 00000
/* WD 80GB, Primary DOS (Drive C): FAT2 = 10087 */
/* WD 80GB, Logical #1 (Drive E): FAT2 = 20499547 */
/* WD 80GB, Primary DOS (Drive D): FAT2 = 19172 */
/* OUTPUT: Perform Calculation */
/* *** Partition *** */
print("Partition -
")
/* *** Start of Partition *** */
print("Start of Partition: LBA ")
StartSector
/* *** End of Partition *** */
print("End of Partition : LBA ")
EndSector
/* *** Boot Sector (LBA) *** */
print("Boot Sector: LBA ")
SectorsBefore
/* *** FSInfo Sector (LBA) *** */
print("FSInfo Sector: LBA ")
SectorsBefore + FSInfoSector
/* *** Boot Code Sector (LBA) *** */
print("Boot Code Sector: LBA ")
SectorsBefore + 2
/* *** Backup Boot Sector (LBA) *** */
print("Backup Boot Sector: LBA ")
SectorsBefore + BackupBootSector
/* *** Backup FSInfo Sector (LBA) *** */
print("Backup FSInfo Sector: LBA ")
SectorsBefore + BackupBootSector + 1
/* *** Backup Boot Code Sector (LBA) *** */
print("Backup Boot Code Sector: LBA ")
SectorsBefore + BackupBootSector + 2
/* *** File Allocation Tables *** */
SizeOfFAT = StartingSectorFAT2 - (SectorsBefore + ReservedSectors)
print("Size of FAT (Big Sectors Per FAT): ")
SizeOfFAT
print("Starting sector of first FAT : LBA ")
SectorsBefore + ReservedSectors
print("Starting sector of second FAT: LBA ")
StartingSectorFAT2
/* *** Root Directory Table *** */
print("Start of Root Directory Table: LBA ")
StartingSectorFAT2 + SizeOfFAT
/* *** Data Area (User files) *** */
print("Starting sector of Data Area : LBA ")
StartingSectorFAT2 + SizeOfFAT + SectorsPerCluster
/* *** Hidden Sectors *** */
print("Hidden Sectors in this Partition : ")
HiddenSectors
/* *** Big Total Sectors *** */
print("Big Total Sectors in this Partition: ")
SizeOfPartition
/* *** Number of Clusters in this Partition *** */
print("Number of Clusters: ")
(SizeOfPartition-ReservedSectors-(SizeOfFAT*2))/SectorsPerCluster
/* *** Total Disk Space in this Partition (in KB) *** */
print("Total Disk Space in this Partition (KB): ")
((SizeOfPartition-ReservedSectors-(SizeOfFAT*2)) / SectorsPerCluster) * (SectorsPerCluster/2)
print("
");
/* *** Sanity Test of this Partition ***
(NB: Number of Cylinders in partition; MUST be a whole number) */
print("Sanity test of this partition: ")
scale = 8
SizeOfPartition / ( SectorsPerHead * HeadsPerCylinder )
print("*Test is failed if that result is not a whole number!
");print("
");
/* *** Disk size in MegaBytes *** */
print("Disk size in MegaBytes : ")
SizeOfDisk / 2048
/* *** Size of Disk: *** */
print("Total Sectors on Disk : ")
SizeOfDisk
/* *** Disk Space after this Partition *** */
print("Sectors after Partition : ")
SizeOfDisk - ( SectorsBefore + SizeOfPartition )
/* Note:
If space AFTER the partition exceeds 1 cylinder (16,065 sectors)
there is probably *another* partition present on this disk! */
print("
");
/* *** Size of Disk: C-H-S *** */
print("C-H-S values for Disk : ")
print("C - Cylinders : ")
trunc( SizeOfDisk / ( SectorsPerHead * HeadsPerCylinder ) )
print(" H - Heads : ")
HeadsPerCylinder
print(" S - Sectors : ")
SectorsPerHead
/* Note:
This does not calculate the actual values, but merely assigns
mandatory values to 'Head' and 'Sectors'. Therefore there may
be a small area of unpartitioned space at the end of the disk. */
*** Script Ends ***
Top of Page
CONVERSION CALCULATIONS
=======================
FORMULAS
========
Number of Sectors in Partition = LBA End Sector (CHS End converted to LBA)
- LBA Start Sector (CHS Start converted to LBA) + 1
End Sector = LBA Start Sector + LBA Number of Sectors - 1
CONVERT C-H-S TO LBA
====================
The following script uses CALC.EXE to convert a disk sector address
from a C-H-S value to an LBA value.
The script will run under either DOS or Windows. However, it can
crash Windows in some circumstances, so is safer to run under DOS.
To run it, copy-and-paste the script into a file named CONVERT
and then enter the following command at the DOS prompt:
*** Display the output on Screen ***
SET PATH=%path%;F:\CALC
CALC CONVERT -q
*** Save the output to a file ***
SET PATH=%path%;F:\CALC
CALC CONVERT -q >> CHStoLBA
*** View the output file ***
EDIT CHStoLBA
*** Script Begins ***
/* CONVERT C-H-S TO LBA:
*** Formula to convert any C-H-S value to LBA ***
(Cylinder x Heads per Cylinder x Sectors per Head)
+ (Head x Sectors per Head) + (Sector - 1) = LBA */
print("Enter no. of Cylinders : ")
read( Cylinder )
print("Enter no. of Heads : ")
read( Head )
print("Enter no. of Sectors : ")
read( Sector )
print("LBA = ")
(Cylinder*SectorsPerHead*HeadsPerCylinder)+(Head*SectorsPerHead)+(Sector-1)
*** Script Ends ***
CONVERT LBA TO C-H-S
====================
The following script uses UCALC.EXE to convert a disk sector address
from an LBA value to a CHS value.
The script will run under either DOS or Windows. Unlike CALC.EXE,
it does NOT crash Windows.
To run it, copy-and-paste the script into a file named LBAtoCHS
and then enter the following command at the DOS prompt:
*** Save the output to a file ***
SET PATH=%path%;F:\UCALC
UCALC /NODEF < LBATOCHS
*** View the output file ***
EDIT LBATOCHS
*** Script Begins ***
; CONVERT LBA to C-H-S:
; INPUT: Configuration
; *** Set appearance of Prompt (for Prompt and Answer) ***
PROMPT ""
PROMPTA " ="
; *** Calculate to 8 decimal places only ***
FIX = 8
; *** Set Printer to Off ***
PRINT OFF
; INPUT: User-entered Values
; *** Enter LBA Sector Number ***
LBA = 0 ; LBA Sector Number
; *** Disk Geometry ***
SectorsPerHead = 63 ; Sectors per Head
HeadsPerCylinder = 255 ; Heads per Cylinder
; OUTPUT: Calculation Begins
var_1 = LBA + 1 ; Add 1
var_2 = SectorsPerHead ; Sectors per Head
var_3 = HeadsPerCylinder ; Heads per Cylinder
var_4 = var_2 * var_3 ; Sectors per Cylinder
var_5 = INT( var_1 / var_4 )
var_6 = INT( var_5 ) ; Cylinders (Integer)
var_7 = var_1 - ( var_6 * var_4 ) ; Remainder
var_8 = var_7 / var_2
var_9 = INT( var_8 ) ; Heads (Integer)
var_10 = var_7 - ( var_9 * var_2 ) ; Sectors (Integer)
; OUTPUT: Save to File
; *** Append Output to file named CHS.TXT ***
WRITE "CHS.txt"
; LBA Sector Number:
(LBA)
; CHS Address:
; C - Cylinders :
(var_6)
; H - Heads :
(var_9)
; S - Sectors :
(var_10)
CLOSE
*** Script Ends ***
Top of Page
SECTION G: SOFTWARE SOURCES
PROGRAM DOWNLOAD SOURCES
========================
No files are hosted on this site
Note: If you can't obtain a file you need from the links below, try here
ATIS.EXE
Acronis True Image, v8.1 (ATIS.UHA) (DOS & Windows version)
Source: Hiren's Boot CD v9.6 (Hiren_s_BootCD_9.6.rar) (Hiren's.BootCD.9.6.iso)
http://www.google.com/search?btnG=Google+Search&num=20&as_epq=Hiren_s_BootCD_9.6.rar
Alternative source page: http://www.shared2u.com/index.php?do=search Search for: Hiren
(NB: The site requires you to register (free), AND log-in, in order to download files)
APR.EXE (a.k.a. PR.EXE)
Active Partition Recovery, v3.0 (ACTPARTR.CAB)
Source: Utility CD v13.00 (UTILCDv13.rar) (UTILCDv13.iso)
Source page: http://www.google.com/search?q=UTILCDv13&btnG=Search
BEEBLEBROX.EXE
Beeblebrox Partition Table Editor for Windows, v1.0 (a.k.a. beeblebrox9xsetup.zip)
Source page: http://www.mediafire.com/download.php?mtdtmxnm5by
BIOS.EXE
Matthias Bockelkamp's BIOS utility, v1.35.1
ftp://ftp.elf.stuba.sk/pub/pc/utildiag/bios1351.zip
Alternative: http://info.elf.stuba.sk/packages/pub/pc/utildiag/bios1351.zip
CALC.EXE
Timothy C Frenz's Infinite Precision Calculator, v2.2
ftp://ftp.simtel.net/pub/simtelnet/msdos/calculte/calc_v22.zip
Alternative: http://ftp.chg.ru/pub/simtelnet/msdos/calculte/calc_v22.zip
CHK IDENTIFIER
Flobo's CHK identifier (Demo version) (untested)
http://www.floborecoverysoft.com/FloboCHKIdentifierDemo.rar
Alternative (Freeware): http://www.majorgeeks.com/CHK-Mate_d4110.html
CMOS.COM
Charles Dye's CMOS save and restore program, v0.93
ftp://ftp.sac.sk/pub/sac/utilmisc/cmos93cd.zip
CYLDIR.EXE
Svend's CYLDIR, v5.5
http://www.partitionsupport.com/cyldir55.zip
DE.EXE
PTS Disk Editor for FAT32 HDD exceeding 32GB, v1.04
http://mirror.href.com/thestarman/tool/dl/PTSDE104.ZIP
DISKEDIT.EXE
Norton's Disk Editor, v7.0 (1993) (for FAT16)
Files: http://asgard.kent.edu/smallsys/Norton/diskedit.exe
http://asgard.kent.edu/smallsys/Norton/diskedit.hlp
http://asgard.kent.edu/smallsys/Norton/nlib100.rtl
DISKEDIT.EXE
Norton's Disk Editor, from Norton Utilities 2002 (for FAT32)
http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.EXE
http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.HLP
http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.ICO
http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.PID
DISKMAN4.EXE
Disk Manager, v4.01
Source: Ultimate Boot CD at http://www.UltimateBootCD.com
Download page: http://www.ultimatebootcd.com/download.html
DLGSETUP11_DOS.EXE
Western Digital's Data Lifeguard Tools for DOS, v11.2
http://www.esnips.com/nsdoc/0925669e-2d84-4fc8-8f4c-3fadba2bf836/?act