Disk Recovery

[Alan_B]

My Windows 98 computer suddenly died so now the hard disk, when installed as a slave on another computer, appears empty. I think this means the Master Boot Record has been corrupted.

Using ZAR I have been able to recover what seems to be the entire contents of the disk (obviously I cannot check that all the files are intact). I now want to try to repair the disk or create a working image on a new hard drive. How do you recommend I set about doing this? If I format a new hard drive then copy all the recovered files to it, how do I make the link between the new MBR and my old Windows 98 file system?

[Alexey V. Gubin]

Could you please do the following:

1. Start ZAR, select "Recover a simple volume" mode.
2. When prompted to select a physical disk to recover, do not continue with the recovery. Right click the physical disk, pick "Open in a disk viewer" in the pop-up menu.
3. This opens a view of the current MBR on the disk. If the MBR is reasonably intact, the structured view will be selected automatically. In any case, select "View Mode -- Parititon Table" from the top menu.
4. From the menu, select "Disk viewer -- Save current view as text" and save the file (MBR dump).
5. Select "Navigation -- Goto address (LBA)". Type in address 63, click OK. Then select "View Mode -- FAT32 boot sector" from the menu. This should be a volume boot sector (at least in a default system configuration).
6. Select "Disk viewer -- Save current view as text" and save the file (BOOT SECTOR dump).

When done with this, post both files here, so we can evaluate if the problem is limited to the MBR or not.

[Alan_B]

I'm sorry, I got a bit impatient and did not wait for your advice. I had come to the opinion my old hard disk was faulty and had not just suffered a one-off glitch. So I copied all my recovered files to a new hard drive, then installed Windows 98. I was not sure this would work but the effect was like a Windows XP repair re-install in that all my documents, programs and updates were preserved. So I'm a happy bunny and ZAR saved the day!

But out of interest, if the MBR had been found to be reasonably intact, how would you have suggested I repair it?

[Alexey V. Gubin]

1. Check if the volume BOOT SECTOR is intact. If no, do not continue.
2. Check if the partition table (in MBR) is intact (not likely).
3. Write the correct values into the partition table. Some data from the volume boot sector is needed at this point.
4. Plug the drive back into the original system, have a boot floppy or CD handy.
5. Boot with the floppy/CD, run "fdisk /mbr", restart. This step ensures the loader code (in MBR) is replaced with a known good one.
6. Boot with the floppy/CD once again, run Scandisk. If Scandisk comes out "clean" or with minor problems, the volume is repaired.

Primary risk: Failure to identify the drives properly at step (3) will result in a wrong partition table edit, rendering the second drive unusable. In such a case roll back would be relatively easy but requires third hard drive, bootable CD, and certain caution as to making the same mistake again.

[Alexey V. Gubin]

Generally, unless it is somehow known that damage is limited to MBR, we suggest the volume to be formatted and the data copied back. This brings the volume into the known good state. Otherwise we have to deal with possible complications after a failure of an unknown origin and magnitude.