NTFS Backup Boot Sector Recovery

[pmjboyle]

Hello ZAS community,

I recently did the following:

1. Purchased a shiny new 60 GB SSD.
2. Transferred all large files (let's call them DATA) to a new 1.5 TB drive
3. Installed Windows on the SSD.
4. Copied DATA to 1 TB drive, quick formatted 1.5 TB drive.
5. Used Windows 7 partition management to create mirror of 1 TB drive onto 1.5 TB drive.
6. It started to synch, when I realized realized I wanted to mirror the SSD into sector 0 of the 1.5 TB drive.
7. Clicked "remove volume" in the 1.5 TB mirror portion.

This is when things went wrong. The Windows tool interpreted that command as "remove the mirror and the original volume." No warning, it just nuked the boot sectors on both disks and I am left with a bunch of orphaned DATA.

My thought it that I can recover the NTFS Backup Boot Sector from the 1TB disk. I did not format the disk, but I did "Convert to Dynamic Disk" and assign a drive letter from Disk Management -- this may have been my biggest mistake, I'm not sure. The disk now shows up as RAW and Windows Explorer says "requires formatting," as expected.

SO, currently I am running ZAS on the disk (identifying data - 50%). When I got to step 4 of this tutorial, there were TWO volumes. From memory, one of them was FAT 16 large and said "dynamic" under origin and the other was NTFS with "MBR/primary" under origin. I chose the dynamic one... not sure what to think of that decision; we'll see what the scan turns up.

Here's my question: I originally wanted to simply recover the backup boot sector. I followed the steps quite judiciously in this tutorial and I ran into a few hiccups:

1. The data at sector 63 (my boot sector, according to the partition table) were all zeros. This is not entirely unexpected as I imagine that is Disk Management way of removing a volume.
2. The data at the section where my backup sector should be were also all zeros. However, I did a "find next NTFS boot sector" and came upon a valid boot sector at 12293276.
3. I grabbed a copy of dskprobe from an XP notebook I had sitting around (is this OK? I couldn't find a 64-bit version for Windows 7) and read that sector -- it does indeed look like an NTFS boot sector.
4. I tried to write the data from that sector to sector 63 and I got: "incomplete data write" and "error writing sectors" popups from dskprobe; when I checked sector 63, it was still all zeros.

Can anyone think of other options I may have in terms of backup boot sector recovery? Like I said, I am still running the scan but I think boot sector recovery is probably the less time-consuming route.

Warm regards,
Patrick

PS: To the admins, thanks for all the excellent tutorials on this site. I am very impressed with the software thus far and even if I manage to recover the backup boot sector without buying a license, I think I will buy one to sniff around some old hard drives at work that I assumed were completely bricked.

PPS: This is the worst way to spend one's birthday...

[Alexey V. Gubin]

1. Re: dskprobe. You may be better off running dskprobe from XP. Either get a BartPE boot CD or use an USB enclosure to attach the drive to the XP machine and run from there.

If this is not an option, try right-clicking the DskProbe and using "Run as administrator" if you do not do that already. If that does not help, try disabling UAC completely.

2. NTFS backup boot sector is stored at the very end of a volume. So what you have in 12293276 does not look like the boot sector you need. Considering 1MB = 2048 sectors, 12293276 sectors = offset ~6GB into the disk. You actually need ~1000GB. If you use ZAR disk viewer, you should get the drive size as indicated by ZAR (in GBs), multiply by 1024 to get MBs, then multiply by 2048 to get sectors, then multiply by 0.95 and you arrive at the start of your search area. On the "Navigate" menu select "Go to LBA", enter that value you calculated, and start searching from there.

Once you see the boot sector, switch the View to "NTFS boot sector" if it does not switch automatically, and verify that at least the volume size looks reasonable.


3. FAT16 Large is an unformatted dynamic volume. If you create a dynamic volume but do not format it, or if there is a leftover from a deleted volume in the LDM database, the filesystem type field has to contain something anyway anyway. The value Windows uses to fill this field happens to match "Large FAT16".

[Alexey V. Gubin]

And, btw, regardless of all that technical stuff, happy birthday!