Using Chkdsk for Hard Drive Repair and Integrity Verification

What is Chkdsk

CHKDSK (CheckDisk) is a Microsoft disk utility that verifies the integrity of your file system and the hard disk drive blocks. The default mode scans the file system for logical errors but it will not fix any of the problems it finds.

Every Microsoft operating system since DOS has contained a tool for repairing corrupted file or folder structures and checking for bad disk sectors. In DOS it was called Chkdsk, in Windows 9X/Me it was called Scandisk, and in Windows XP (and Vista) we are back to the name Chkdsk.

What Chkdsk does and why it should be used

Chkdsk inspects the physical structure of a disk to make sure that it is healthy. It can repair problems related to bad sectors, lost clusters, cross-linked files, and directory errors. These types of problems can arise in a variety of ways. System crashes or freezes, power glitches, incorrectly turning off a computer can all cause corruption in the file or folder structure. Physically bumping or jarring a computer can cause the head that reads disks to hit the surface and damage sectors. Once some sort of error occurs it can propagate to create more errors so a regularly scheduled disk checkup is part of good system maintenance.

Chkdsk can also serve as an early warning that a hard drive is deteriorating. Disks gradually wear out and sectors may become bad. If  Chkdsk starts finding bad sectors, that is a sign that a drive may need replacing. Unfortunately, many hard drive failures are sudden and cannot be foreseen, but nonetheless Chkdsk is an important line of defense.

How to run Chkdsk - Graphical interface

Chkdsk can be run as a command-line application or it can be run with a graphical user interface. Typical home PC users will probably use the latter so I will discuss it first. Chkdsk is not normally listed in the All Programs menu but is reached by the following steps:

1. Open "My Computer" and right-click on the icon for the drive that is to be checked.
2. In the context menu that opens, choose "Properties".
3. Click the "Tools" tab at the top of the Properties window.
4. In the "Error-checking" section, click the button "Check now".
5. A box showing the options for running Chkdsk is then available as shown in the figure below.

Generally, the option "Automatically fix file system errors" should be chosen for routine checks. If serious disk problems are suspected, the option "Scan and attempt recovery of bad sectors" should also be checked. However, this may involve a period of many hours.

How to run Chkdsk - Command line

Chkdsk.exe is actually a command-line application and can be run from the command shell. There are a number of switches that can be used to modify its functions. The syntax of a command is

Chkdsk [volume[[path]filename]]] [/F] [/V] [/R] [/X] [/I] [/C] [/L[:size]]

Table I give a description of the various terms and switches in the command.

Table I. Description of Windows XP Chkdsk command items
Switch	Description
[volume]	Specifies the drive letter (followed by a colon), mount point, or volume name.
[filename]	FAT/FAT32 only: Specifies the files to check for fragmentation.
/F	Fixes errors on the disk. Does not scan for bad sectors.
/V	On FAT/FAT32: Displays the full path and name of every file on the disk. On NTFS: Displays cleanup messages if any.
/R	Locates bad sectors and recovers readable information (implies /F).
/X	NTFS only. Forces the volume to dismount first if necessary.
/I	NTFS only: Performs a less vigorous check of index entries.
/C	NTFS only: Skips checking of cycles within the folder structure.
/L[:size]	NTFS only: Changes the log file size to the specified number of kilobytes.

(Windows Vista also has a switch /B for re-evaluating bad clusters on a volume.)

Although Chkdsk can be run with no switches, the most useful application is to use either the /F or /R switches. This corresponds to the two options in the graphical interface discussed above. Note that running with the /R option can be quite lengthy. If there are unusually large numbers of files, the /F option can also take many hours. The /R switch includes the functions of the /F switch.

Running after a reboot

Chkdsk cannot carry out repair functions if any of the files on a disk are locked or in use. So it generally requires a reboot to run a check on any active volume with files in use. Chkdsk then runs before the full system is loaded and files become locked.

If you turn off your computer incorrectly, you may find that Chkdsk will run when you reboot. This is a safety feature to make sure that no file or folder corruption occurred.

Understanding how Chkdsk works

Chkdsk tests both FAT and NTFS systems but NTFS is now the most common file system. Here is a brief description of what Chkdsk does when it runs on an NTFS system. Chkdsk's activity is divided into three major passes plus an optional fourth and fifth pass. During each pass a message and a progress report is displayed.

Phase 1: Checking files

During its first pass, Chkdsk examines each file record segment in the volume's master file table (MFT) and examines it for internal consistency. At the end of this phase, Chkdsk has identified the space that is in use and the space that is available, both within the MFT and on the volume as a whole.

Phase 2: Checking indexes (directories)

During this pass, Chkdsk examines each directory that is on the volume, checking for internal consistency and verifying that every file and directory that is represented by a file record segment in the MFT is referenced by at least one directory. Chkdsk confirms that every file or subdirectory that is referenced in a directory actually exists as a valid file record segment in the MFT and also checks for circular directory references. Finally, Chkdsk confirms that the time stamps and file size information for the files are up-to-date in the directory listings for those files.

Phase 3: Checking security descriptors

During this phase, Chkdsk examines each security descriptor that is associated with files or directories on the volume. Security descriptors contain information about ownership of a file or directory, about NTFS permissions for the file or directory, and about auditing for the file or directory.

Phases 4 and 5: Checking sectors (optional)

If the /R switch is in effect, Chkdsk runs two more passes to look for bad sectors. During stage 4, Chkdsk verifies all clusters in use; during stage 5, Chkdsk verifies unused clusters. Note that this process can be quite lengthy. taking many hours.

Caution

Interrupting the Chkdsk process when it is used with the /F or the /R switch is not recommended. The integrity of the disk can be compromised by stopping the process. Do not start a scan if a thunderstorm is expected and you are subject to power failures. I also strongly advise an uninterruptible power supply to guard against short-term power outages or fluctuations.

Running Chkdsk from the Recovery Console

Chkdsk is available from the Windows Recovery Console and can be a very valuable tool in dealing with a system that does not boot properly. Note that many systems have been rescued by the Recovery Console command chkdsk C: /R Switches for the Chkdsk command in the Recovery Console are not the same as those in Table I. There are only two:

• /P : Does an exhaustive check of the drive and corrects any errors. Does not check for bad sectors
• /R : Locates bad sectors and recovers readable information. Includes functions of /P

Autochk.exe

The chkdsk command requires the file Autochk.exe. If it cannot find it in the startup directory (\%systemroot%\System32, by default), it will attempt to locate it on the Windows Installation CD.  

For Win 2000, XP, or Vista, autochk.exe is the chkdsk program that gets run at boot time specifically for the boot hard drive. If you try to run chkdsk on the boot drive, your job will be scheduled to run when Windows boots because chkdsk cannot work when any files on the disk are open.

The 'dirty bit' on the file system is used to trigger autochk.exe at startup. While Windows is running, you can check the status of the dirty bit by entering this fsutil command into the cmd window (start >> Run >> cmd.exe):

fsutil dirty query C:

If autochk runs at boot time but you did not schedule it to do so, then some file system error event must have set the dirty bit. This should be a one time event because Autochk will clear the dirty bit when it completes successfully.

If autochk continues to run every time you boot your computer then you likely have a hardware problem. You can verify the problem by running a hard drive manufacturer's diagnostics on the drive. If there is any indication of a hard drive problem, consider yourself lucky that you can still read your data, and run out to buy that bigger hard drive you've been looking at.

Repair using boot up disks

1. Boot your computer from your Windows XP CD or from your 6-disk XP/2000 Boot Disk Set. To do this, insert your CD or Floppy #1 and turn your computer on. When the menu comes up, select boot from CD or boot from floppy (do not select boot from hard drive).
2. Your computer will begin to boot. Eventually, you will see a screen asking you what you would like to do. Press the letter R on your keyboard to proceed to the Windows Recovery Console.
3. As you progress to the Recovery Console you may be asked which partition you would like to boot into. Type the number associated with the partition containing your NTFS partition (usually 1 or 2) and then press enter to continue. You may be asked for your administrator password. If you have one, type it in and press enter. If you do not have a password to boot your computer into Windows, simply press enter.
4. Now you should be at a command prompt. from here, type the following command without the quotes and press enter: "chkdsk /p"
5. This is a short test that will tell you whether or not a longer test is needed. If after the test completes, the message "One or more errors detected on the volume" appears, then proceed to step 6. If no errors are reported, then your drive can not be repaired using chkdsk.
6. Now you should be back at the command prompt. Type the following command without the quotes and press enter: "chkdsk /r"
7. This test will take a while depending on the size of your drive. It will look for the errors on your drive and repair them. When it completes, you will be back at a command prompt.
8. Now type "chkdsk /p" again and press enter. If no errors are reported, your drive has been successfully repaired and is safe to use again temporarily. If errors are still reported, then your drive is on its last leg. You may be able to boot it now though.
9. Remove the floppy disk or CD from your system and restart the PC. Take a moment now to back up your important data.

Additional Syntax for Experienced Users

• /F Automatically Fix file system errors on the disk.
• /X Fix file system errors on the disk, (Win2003 and above)
  dismounts the volume first, closing all open file handles.
• /R Scan for and attempt Recovery of bad sectors.
• /V Display the full path and name of every file on the disk.
• /L:size NTFS only: change the log file size to the specified number of kilobytes. If size is not specified, displays the current log size and the drive type
  (FAT or NTFS).
• /C Skip directory corruption checks.
• /I Skip corruption checks that compare directory entries to the
  file record segment (FRS) in the volume's master file table (MFT)

Sources and Additional Information

http://vlaurie.com/computers2/Articles/chkdsk.htm

http://www.updatexp.com/windows-xp-chkdsk.html

http://support.microsoft.com/kb/315265

http://www.hard-drive-help.com/chkdsk.html

http://www.schrockinnovations.com/chkdsk.php

Auslogics Disk Defrag

Disk Defrag Overview

Auslogics Disk Defrag is a free compact defragmentation tool that supports FAT 16/32, and NTFS (with compressed and encrypted files). For the individual and corporate user Disk Defrag is perfect for maintaining high-level disk performance.

Here you can select from the drop down list of hard disk drives. You can also defragment removable drives such as USB keys, Flash Memory Cards and other removable drives by enabling the "Display removable drives" option in the program settings.

Disk Fragmentation Map

You can watch Disk Defrag optimizing your disk on the disk fragmentation map. The map shows you disk clusters, each cluster being red (still fragmented), blue or green (already optimized), gray (free space) or yellow for clusters occupied by the MFT (Master File Table).

How Disk Defragmentation Works

Files on disk are often split into two or more pieces. In order to read these files, the disk reading heads have to frequently move which slows down disk access and causes wear and tear to the disk drive. Defragmetation consolidates such files to speed up disk access and prolong the disk life.

Defragmentation Results

After the disk defragmentation is complete you will be presented with a summary of the process. You can click the "Display Report" button to open a comprehensive defragmentation report with all defragmented files listed in it.

System Requirements

The following minimal configuration is recommended to run this product.

• 7/Vista/2008/XP/2000/2003 (32-bit and 64-bit supported)

• 64 Mb of RAM 
• 10 Mb of available disk space

Portable Version

The defragmenter can be used without need to be installed on the hard drive as portable utility. To convert the regular version to portable one perform the follows:

• Download the installer and install to the default folder.
• Copy all files (except unins000.exe and unins000.dat) to a folder of your choice.
• Finally, uninstall the program.
• Launch diskdefrag.exe.

Website: http://www.auslogics.com/en/software/disk-defrag

Freeware Portable Defragmenter JkDefrag and its Clones

About JkDefrag

JkDefrag is a disk defragmenter and optimizer for Windows 2000/2003/XP/Vista/2008/X64. Completely automatic and very easy to use, fast, low overhead, with several optimization strategies, and can handle floppies, USB disks, memory sticks, and anything else that looks like a disk to Windows. The presented Windows version is intended for Harddrives only. For defragmentation of floppy disk and removable media you need use command line version that can be downloaded from the author’s website. Add the appropriate drive letter to the end of the command path or else JkDefrag automatically will skip these.

Note: Just a side note that there is no big advantage in defragmenting USB drives due to the random data access. Furthermore, there were several warnings from the USB drives manufacturers, that the defragmentation process might harm the USB drive structure.

Cost

JkDefrag is completely free, no cost, no time limit. The executables are released under the GNU General Public License.

Installation

There is no "setup" or "install" and no configuration file. All you have to do is download the zip and unpack anywhere you like. The program is ready to run and will automatically process all the mounted, writable, fixed volumes on your computer. It is correct - you just start the program, and it will proceed with disks defragmentation even without pressing start button.

Permissions

JkDefrag needs "full control" permissions to all files and disks that it must defragment/optimize. On a default Windows system the "administrator" userid has full permissions to all files and disks. Users with no administrator privileges can also run JkDefrag, but then it can only defragment/optimize the files and disks for which the user has "full control".
Note: On Vista right-click the JkDefrag program and select "run as administrator".

Stopping

JkDefrag can be stopped safely at any time, there is no risk of losing data or corrupting your disk. You can use all the usual ways to stop a Windows program, such as pressing ALT-F4, clicking the ’x’ in the top-right corner, via the pull-down menu in the taskbar, or by killing the program via the task manager or another utility. It may take a bit of time for the program to actually stop, JkDefrag will finish the current file in the background.

Logfile

JkDefrag writes all messages to a logfile called "JkDefrag.log". You can inspect the logfile if you want, it’s a flat-text file. The logfile is automatically cleared when the program starts, it does not grow to infinity.

Tips:

1. Cleanup old junk from your harddisk before running JkDefrag, for example with "Start -> Programs -> Accessories -> System Tools -> Disk Cleanup", or with some freeware program.

2. Reboot before running JkDefrag. This will release files that are in use, so they can be defragmented. You can also run JkDefrag in Windows safe mode (press F8 while booting) to defrag even more files.

3. Stop your real time virus scanner before running JkDefrag. Virus scanners check all disk activity, making defragmentation and optimization very slow.

4. Move the swap file to another volume, reboot, defragment, and move the swap file back. If you don’t have a second volume then temporarily make the swap file small, for example 100Mb.

5. If an application (for example a database) prevents certain files from being defragmented then stop the application, run JkDefrag for the particular data directory only, and restart the application.

6. Package unused files with any packager. The package-file not only takes less harddisk space, but will also defragment and optimize much faster than the individual files. This does not apply to Windows NTFS compression, which will actually make defragmentation and optimization a lot slower.

7. Buy the biggest harddisk you can afford. Investing in a bigger harddisk gives more speed-per-dollar than investing in a faster CPU or more memory.

8. The first partition on a harddisk is significantly faster than other partitions. Try to use other partitions only for "SpaceHog" data.

9. If you have 2 physical harddisks (of the same speed), then place the pagefile on the first partition of the second harddisk.

Website: http://www.kessels.com/JkDefrag/

As you might notice, the interface is simple and basic. There are power users, who prefer having more power of using the program, while having the Windows interface instead of command line. For them, I can offer JkDefragGUI freeware utilities.

JkDefragGUI is a Graphical User Interface which allows you to easily select all the features JkDefrag. But is can do a lot more. JkDefragGUI can schedule a defragmentation, install JkDefrag or it’s screensaver but can also do some small maintenance to your computer. It can be used to schedule a defragmentation of your system files like pagefile and registry files. JkDefragGUI also supports CCleaner which can be used instead of the internal cleaning function. It can also erase any information which is left behind on your hard disk after erasing files. JkDefragGUI was created for people who don’t have the skills of an advanced user but still want to use the powerful features JkDefrag has to offer or for those people who like a GUI instead of using the command line. JkDefragGUI is compatible with Windows 2000, Windows XP, Windows Vista, Windows 2008, U3 capable flash memory and with BartPE pre-installed environment.

Website: http://www.emro.nl/freeware/

Author: Emiel Wieldraaijer

There is one more utility with the same name JkDefragGUI, resolving the task to bring more visibility to multiple options of the basic JkDefrag. This utility is portable as well and supports many languages. Standard package include 10 languages, but you can download extra multi-language packages for additional 40 languages.

Website: http://jkdefrag.8qm.de/english.php#1

Author: Markus Hörl

And for the users, who are in favor of the AIO (all-in-one) bundles, there is another utility, combining all vital system management utilities under one roof. ScanDefrag is a small windows application that configures Microsoft’s, Norton’s, or JKessel’s disk utilities as part of the next Windows’ startup process. This can result in less restarts and cleaner runs of these programs. ScanDefrag Standard allows performing scheduled system maintenance using:

• Microsoft’s Disk Cleanup
• Microsoft’s ScanDisk/ChkDsk or Norton’s Disk Doctor
• Microsoft’s Defragmenter, Norton’s SpeedDisk, or Jeoren Kessels’ Defragmenter

Note that this software is not portable, and requires installation on your PC. However, it is packed with several utilities, which are considered the best in their categories, so for many users it might be considered as comprehensive preferable solution.

Website: http://www.blueorbsoft.com/scandefrag/

How to revive your dead Hard Drive?

If you have intermittently failing Hard Drive, your first step would be to backup all the important data you have there. Mechanical failures are often deadly, and the drive cannot be recovered without professional tools and facilities (clean room, for starter). But if it looks like dead, it does not mean that you cannot revive it, at least temporary. All you need just half an hour of temporary recovery to save all your valuable data. The article “200 Ways to Revive a Hard Drive” has been written long ago (in 2000) by TechRepublic specialists. Unfortunately, the eBook is not available from their web site any more. Still, it can help you in fatal failures, even thou some methods might look funny and unprofessional.

All solutions are divided into four categories:

• Freeze it
• Drop it
• Hit it
• The rest of the solutions

You can find different approaches and ways, and sometimes you can try several methods to get positive results. I have personally recovered several customer’s dead hard drives, using these “funny” techniques, and the last case was just two weeks ago.

Just remembers that by using these methods you might not reach any success at all, or even make things worse. So, apply them only when you have nothing to loose.

Smart Freeware Portable Defragmentation Utility - Defraggler

Defraggler is a defragmentation program developed by Piriform Ltd. Defraggler is different from any other similar tools on the market allows users to defragment individual files on their computer system. Defraggler is offered free of charge to anyone, though Piriform accepts donations for the program.

Defraggler can defragment individual files, groups of files, or free space on any FAT32 or NTFS partition. It also displays the location of these files on the specified partition. Defraggler is also a portable program that can be used from a USB flash drive. The current version of Defraggler takes a low amount of disk memory.

Main Features:

1. Piriform Defraggler shows your disk layout in the traditional "large mosaic of colored squares" fashion, and the colors leap and bounce around as various sectors are read from or written to. This offers no improvement in functionality over Windows line graph style, but I find it more interesting to watch.

2. Most defragmentation tools only let you defrag the whole drive. Defraggler gives you the power to select individual files and folders to defrag. So you can get the job done in seconds, rather than waiting for the whole drive to complete. Of course if you want to defrag the whole drive Defraggler will let you do that too.

3. Defraggler was written in the same compact architecture as other award-winning freeware Piriform products (CCleaner and Recuva). This results in a compact single EXE application, which can be copied to a thumbdrive and then used whenever you need it, without a complex installation process. The EXE itself is less than 1MB!

4. Defraggler supports all OSs released since Windows 2000, this includes Windows 2000, 2003, XP and Vista. 64-bit support has also just been added! Additionally Defraggler supports both NTFS and FAT32 file systems.

5. After analysis Defraggler lists all the fragmented files on the drive. Selecting one or many will highlight their location on the disk. Allowing you to visually see the location of files on the disk.

How to extract: Download the ZIP package and extract to a folder of your choice. Launch Defraggler.exe.

Developers’ Website: http://www.defraggler.com/

Data Recovery Basics

File Storage: Sectors and Clusters: File Recovery

When you purchase a new hard drive and before it has any data on it, it is has usually already undergone a ’low level format’. The purpose of a low level format is to divide all the magnetic space on the hard drive into small storage areas. These storage areas are known as ’sectors’, however for efficiency purposes the Operating System (e.g. Windows XP) groups sectors together into ’clusters’.

A cluster is the smallest unit of storage space with which the Operating System (e.g. Windows XP) will deal. If you save a very small file to your computer it will all fit within 1 storage cluster on the hard drive. If you save a very large file it may fill up many clusters, that is, as many clusters as it takes to hold all the content of the file.

File Allocation Table (FAT) or Master File Table (MFT): NTFS recovery and FAT recovery

On older Operating Systems such as Windows 98 there is a storage area known as the ’Root Directory’. This is the place which stores the name of a file, the location of its starting cluster, and the size of the file. In order to find a file the Operating System uses this information to get to the first storage cluster of a file. It then uses a special table at the start of the disk know as the File Allocation Table or FAT to identify the remaining clusters that are used to store the file. It is important to realize that this information is stored completely separate from your file data and is why FAT data recovery is possible.

In newer Operating Systems the FAT and Directory Entry method has been merged and replaced by a single table known as the Master File Table or MFT. Whilst an MFT is more complex, the principal of locating the start of a file and its subsequent storage clusters is essentially the same.

What happens when I delete a file?

Lets look to see what happens when you intentionally delete a file and why it may be possible to bring that file back. When you select a file and press the delete key on a Windows computer the file is sent to the Recycle Bin. You may think of the Windows Recycle Bin as just another fancy storage folder on your hard drive. The ’real’ deletion (at least as far as this article is concerned) is what happens when the Recycle Bin is emptied or the deletion bypasses the Windows Recycle Bin altogether.

When a file is deleted the Operating System marks the file name in the MFT with a special character that signifies to the computer that the file has been deleted. The computer now looks at the clusters occupied by that file as being empty and therefore available space to store a new file. What the Windows Operating System does NOT do is go out to the clusters on the hard disk where the files data is actually stored and wipe the contents of these clusters. The deleted file data is still there, but the Computer Operating System no longer knows it exists.

This in fact is the underlying principal of data recovery. It is about finding data that still exists on the hard drive but which currently can’t be located by the Operating System. If the clusters containing the data have are, corrupted or physically damaged, then recovering the data they once contained is impossible.

Ok, so my data is still there, but for how long? The answer to this question is completely up to you. The only way that your deleted MFT record or your file data itself will permanently be destroyed is if it is overwritten by other data. This means that any computer activity after the deletion has the potential to permanently erase otherwise recoverable files.

If you are attempting data recovery from your hard drive, if possible connect it to another computer as the slave drive so that the operating system wont be doing a merry dance over you deleted files when you attempt the recovery process. If you use data recovery software, don’t install it on the drive on which the files were lost. Better yet, use a floppy disk or CD version if available. If you send your hard drive to a professional data recovery service they should not be working on the original hard drive. They should take a sector copy (an exact copy including all deleted information) of your hard drive and work on this. You may consider doing this yourself. There are a number of programs that will do this, the most common being Norton GHOST. But remember, you must make a complete sector copy of your hard drive to make sure the image includes all the deleted areas of the drive.

Data Recovery by Searching for Deleted MFT Records

Most data recovery programs search for deleted MFT entries to undelete files or unformat drives. These programs usually give a give a probability or hard drive data recovery rating of ’good’, ’medium’ or ’poor’. What they are actually doing is locating the MFT record for a deleted file and then checking the rest of the MFT records to determine if the clusters that the deleted file occupied are being used by any other file stored on the computer. As only one file can occupy any one cluster on a hard drive, if other files are using your deleted files storage space then it is likely that the original data has been overwritten and permanently destroyed. This recovery technique is usually relatively fast, as all the recovery program has to do is find the deleted file entries in the MFT and then go directly to that location of the hard disk to perform the data recovery. You will see an MFT search when you execute a "Fast Search" using Recover My Files Data Recovery Software.

However, if your MFT is corrupt, defective or has itself been overwritten, this method isn’t going to help you get data back even though the file data still remains out on the disk waiting to be found. What you need to do is search unallocated clusters.

Things get a bit more complicated by the fact that a single file does not have to reside within contiguous clusters. It may be that the Operating System stores a single file in clusters on different parts of the hard disk. This is called a ’fragmented’ file. The problem with a fragmented files is that it can slow your computer down as it needs to spend time and resources sending the actuator arm to different parts of the hard disk to read the complete file. This is why many people regularly use a defragmentation program. The amount of fragmentation in a file can also reduce your ability to recover deleted files as we will explain later in this article.

So we can now think of our hard drive as being broken down into many clusters which hold the contents of our files. A cluster that is being used to store a file is called an ’allocated cluster’, and if it is not being used to store a file an ’unallocated cluster’.

The next question is, ’how does the computer know where to look when it wants to find a specific file?’. Well, if you wanted to find a specific chapter in a book the best thing to do would be to go and look up the Table of Contents. A computer does much the same thing, which is also important if you want to recover data, recover a file, or undelete.

Data recovery software

Most data recovery program search for deleted MFT entries to undelete files. These programs usually give a give a probability of recovery rating of ’good’, ’medium’ or ’poor’. What they are actually doing is locating the MFT record for a deleted file and then checking the rest of the MFT records to determine if the clusters that the deleted file occupied are being used by any other file stored on the computer. As only one file can occupy any one cluster on a hard drive, if other files are using your deleted files storage space then it is likely that the original data has been overwritten and permanently destroyed.

This recovery technique is usually relatively fast way to get data back, as all the recovery program has to do is find the deleted file entries in the MFT and then go directly to that location of the hard disk to perform the data recovery. You will see an MFT search when you execute a "Fast Search" using Recover My Files Data Recovery Software.

However, if your MFT is corrupt, defective or has itself been overwritten, this method isn’t going to help you even though the file data still remains out on the disk waiting to be found. What you need to do is search unallocated clusters.

Searching Unallocated Clusters for Deleted Files

A good data recovery program will have the option to ignore the MFT (or lack there of) and to search all the unallocated clusters to try and find and recover files. This means we need to know what a deleted file looks like. Luckily most file types have a unique file header and footer. This means that if you look inside a Microsoft Word document for example, the first characters and the last characters of the file are always the same. So therefore a data recover program can search the entire hard drive and identify files by their unique header and footers. You will see this technique used in Recover My Files Data Recovery Software when you select a ’Complete Search’. Recover My Files recognizes more than 160 different file types using this technique.

Why are Some Files Partially Corrupt after a software File Recovery?

Remember that a computer will only use as many clusters as it needs to store a complete file. This means that your original data may only have been partially overwritten. You may still be able to retrieve some of the clusters containing the file. Unfortunately, in most cases that won’t be helpful, as most programs need a file to be complete before they will process it. Rebuilding partially damaged files is a another area of data recovery. It requires specialized knowledge about the particular file types one is dealing with. Some links to software for repairing specific file types are provided above.

Data Recovery from a Formatted Hard Drive

When you run the format command you are simply erasing the Root Directory Entries and FAT, or MFT. It is possible to run the format command and wipe the entire hard drive but format must be executed with special options. There are a number of tricks that data recovery programs use to recover from format commands. This includes searching for deleted Directory Entries which are in fact stored as files on the computer. If a directory entry is located, then we now know the name, starting cluster location, and size of the files. Of course you can also search the data area of a formatted drive for file header and footers and locate individual file types by this method.

What is the problem with File Fragmentation?

The problem of file fragmentation is that most of the data recovery techniques available must work on the assumption that all files are contiguous, that is, that they are stored in consecutive sectors one after the other from the beginning to the end of the file. The information to track fragmentation of a file is overwritten when the FAT or the MFT records are destroyed.

Source: http://www.recovermyfiles.com/data-recovery-software.php

Repair Master Boot Record (MBR)

Problems with the master boot record (MBR) of a system may prevent the system from booting. The MBR may be affected by malicious code, become corrupted by disk errors, or be overwritten by other boot loaders when experimenting with multiple operating systems on a host. When your BIOS detects a damaged MBR or boot sector, you’ll see ominous messages like Invalid partition table, Error loading operating system, or Missing operating system.

As you know, the Master Boot Record (MBR) will be created when you create the first partition on the hard disk. It is very important data structure on the disk. The Master Boot Record contains the Partition Table for the disk and a small amount of executable code for the boot start. The location is always the first sector on the disk.

The first 446 (0x1BE) bytes are MBR itself, the next 64 bytes are the Partition Table, the last two bytes in the sector are a signature word for the sector and are always 0x55AA.

The example of the NTFS MBR disk layout:

Physical Sector: Cyl 0, Side 0, Sector 1
000000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3AZ??.|uP.P.u?.|
000000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ?..PW?a.o¤E??.±.
000000020 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B 8,|.u.??.aoI.‹.‹
000000030 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC i??.It.8,to?..N¬
000000040 3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25 <.tu»..?.I.eo‰F%
000000050 96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05 -SF.?.<.t.?.<.t.
000000060 3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4 :Au+@?F%.u$»?UP?
000000070 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74 AI.Xr.?uU?u.oA.t
000000080 0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF .Sa?V$C.?.e.?f.?
000000090 0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E ..?..‹U3E?y..‹N
0000000A0 25 03 4E 02 CD 13 72 29 BE 46 07 81 3E FE 7D 55 %.N.I.r)?F.?>?}U
0000000B0 AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 27 07 EB ?tZ?i.U…ou??’.e
0000000C0 8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB S?‘R™.F..V.e..Ze
0000000D0 D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 00 00 00 00 OOta3AI.e?......
0000000E0 56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4 V3oVVRP.SQ?..V‹o
0000000F0 50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72 PR?.BSV$I.ZX?d.r
000000100 0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49 .@u.B€C.a?o^AetI
000000110 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E nvalid partition
000000120 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 table.Error loa
000000130 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 ding operating s
000000140 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 ystem.Missing op
000000150 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 erating system..
000000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000180 00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00 ...‹u.W‹oE......
000000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000001B0 00 00 00 00 00 00 00 00 A6 34 1F BA 00 00 80 01 ........¦4.?..€.
0000001C0 01 00 07 FE 7F 3E 3F 00 00 00 40 32 4E 00 00 00 ...?>?...@2N...
0000001D0 41 3F 06 FE 7F 64 7F 32 4E 00 A6 50 09 00 00 00 A?.?d2N.¦P....
0000001E0 41 65 0F FE BF 4A 25 83 57 00 66 61 38 00 00 00 Ae.??J%?W.fa8...
0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............U?

What will happen if the first sector has been damaged (by virus, for example)?

If the first line numbers will be overwritten: the first 16 bytes are now zeros.

000000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ?..PW?a.o¤E??.±.

When you try to boot after hardware testing procedures, you will see just blank screen without any messages. It means the piece of code at the beginning of the MBR could not be executed properly. That’s why even error messages could not be displayed. However, if you boot from the floppy, you can see FAT partition, files on it and you are able to perform standard operations like file copy, program execution... It happens because in this example only part of the MBR has been damaged which does not allow the system to boot properly. However, the partition table is safe and you can access our drives when you boot from the operating system installed on the other drive.

What will happen if sector signature (last word 0x55AA) has been removed or damaged?

If there are zeros in the sector signature.

Physical Sector: Cyl 0, Side 0, Sector 1
0000001E0 41 65 0F FE BF 4A 25 83 57 00 66 61 38 00 00 00 Ae.??J%?W.fa8...
0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

When you try to boot now, you see an error message like "Operating System not found".

Fixing Master Boot Record (MBR) with standard tools

For the earlier Operating systems, as MS-DOS, Windows 95, 98, ME, the simplest way to repair or re-create MBR is to run Microsoft’s standard utility called FDISK with a parameter /MBR, like

A:’> FDISK.EXE /MBR

For the later Operating systems, like Windows NT, 2000, XP, Vista, you can repair the MBR using the Recovery Console.
1. Boot with the XP installation CD.
2. When prompted, press R to repair a Windows XP installation.
3. If repairing a host with multiple operating systems, select the appropriate one (XP) from the menu. If you have only one operating system, enter 1 to select it.
4. Enter the administrator password if prompted.
5. To fix the MBR, use the following command:

fixmbr

This assumes that your installation is on the C:’ drive. You will be presented with several scary warning lines the reading of which will make you want to say no. Microsoft is exceptionally vague regarding the conditions under which fixmbr can cause problems although they are clear about the consequences (losing all data on the hard drive), so use this at your own risk.

6. Type y and ENTER to fix the MBR.
7. Type exit to leave the recovery console and reboot.

If you do not feel comfortable enough using built-in standard tools, or the operation was not successful, you can try to use the available free and commercial software utilities from our collection.

Additional Reading:
http://www.tech-recipes.com/rx/483/xp_repair_fix_master_boot_record_recovery_console/
http://askbobrankin.com/fix_mbr.html
http://www.ntfs.com/mbr-damaged.htm

Partition Find and Mount - Painless Recovery

Partition Find & Mount implements a new concept of deleted or lost partition recovery. It works in the most convenient way possible - by locating and mounting partitions into the system, thus making those lost partitions available to you like any generic disk volume. Partition Find & Mount will also work in case any Boot Record (including the Master Boot Record) is missing, damaged or overwritten.

Main Features

* Easy to use. You do not need special knowledge to use the software.
* Safe to your data. There is no possible way you could get things worse.
* 3 modes of partition search
* Non-standard disk layouts are supported
* All versions of NTFS and FAT are supported
* Allows to create and mount images
* Free for personal use.

Master Boot Record

Master Boot Record is a hidden area on your hard drive that contains all information about disk partitions (sometimes also called volumes or logical drives). If it gets erased or damaged, you may completely lose access to your data.

Lost or deleted partitions can be found with Partition Find and Mount. In the easiest case, if MBR is the only structure that is corrupted, it will take just a second for Partitions Find & Mount to find all partitions!

After partitions are found, you can mount them to the system, making them visible as usual read-only disk volumes.

When Find & Mount tool does not work

Partition Find & Mount software is designed to find lost or deleted partitions in the most convenient way, however, it may not work if the file system on a partition or hard drive itself is severely damaged.

How to Use

Partition Find and Mount is easy to use software that locates and mounts lost partitions in read-only mode, thus allowing you to safely access them with any file manager, including Windows Explorer.

All versions of NTFS and FAT file systems are supported.

Finding partitions

Partition Find and Mount finds lost or deleted partitions by scanning the storage device and looking for specific signatures that represent the beginning of a partition.

Partition Find and Mount does not rely on the information stored in the Master Boot Record (MBR), thus allowing you to find partitions even in case you repartition your drive. However, Partition Find and Mount will not work if the file system on the lost partition is severely damaged or if the hard drive itself has a physical damage. There are three different methods of scanning the drive available in Partition Find & Mount:

1. Fast intellectual scan
2. Normal scan
3. Thorough scan

Fast Intellectual Scan

Fast intellectual scan works best if the drive is repartitioned or if MBR is the only structure that is damaged.

The specific of this method is the following: when a valid partition is found, the process automatically resumes from the end of the found partition. This greatly improves the speed of the process. Scanning the whole hard drive using this method takes just seconds.

We recommend using this method since it is fast and reliable enough.

Normal Scan

While scanning with Normal Scan option, Partition Find and Mount checks all areas of the disk where standard partitioning tools are allowed to place the beginning of a partition. An example of a standard partitioning tool is the Windows Disk Manager. It takes 1 to 5 minutes to complete the search. This method may not find partitions that were created using some non-standard partitioning tools.

Thorough Scan

Thorough scan will look into every sector of the drive while searching for valid partitions. This is the most complete method and it can take up to several hours to complete. It is recommended to use this method if the Normal Scan produces no usable results.

Mounting partitions

After Scan finishes, you will see the full list of found partitions. Now, you can add any found partition to the system by mounting and assigning a letter to it. All partitions are mounted in the read-only mode. You won’t be able to alter files on such partitions, but only to copy files off that partition. This guarantees that the data cannot be altered by the operating system or any software (including malware).

Creating and using disk images

Partition Find and Mount allows you to create a binary image of any partition. You can also create an image of an entire hard drive. These images can be used later for scanning and mounting the same way it is done for generic hard drives. To create an image, select a disk or partition and click "Create Image" button. To scan an image instead of a hard drive, you can click "Open Image" button. Chosen image file will be added to the list of disk drives as a separate hard drive. Now you can scan it and mount any found partition.

Why upgrade to Partition Find and Mount Pro

Partition Find and Mount is fully functional software without expiration date or trial period and can be used for as long as you like. The only limitation it has is the speed limit of the data transfer from recovered and mounted volumes. The limit is 512 KBytes per second which is enough for generic home use.

Developers Website: http://findandmount.com/ 

Advanced Video Tutorials for the HDD functionality and recovery

If you are quite serious to try repairing your Hard Drive by yourselves, you need to understand exactly, how HDD is design, how it operates, what are the possible problems, and what particular problem source you have with your unit, based on the appearance.

Video presentation by hard drives expert Scott Moulton of Forensic Strategy Services, LLC will help you understand what is going on inside the HDD, and what can go wrong there. Presentation has been prepared for TorCon conference and provides very detailed information on rebuilding hard drives and recovery of your own data.

Part 1

Hard Drive Data Recovery - 1

Part 2

Hard Drive Data Recovery - 2

Part 3

Hard Drive Data Recovery - 3

Part 4

Hard Drive Data Recovery - 4

Part 5

Hard Drive Data Recovery - 5

Part 6

Hard Drive Data Recovery - 6

Part 7

Hard Drive Data Recovery - 7

Each part is less than 10 minutes clip, and keep in mind that to review this excellent video course in full, you will have to spend about an hour of your valuable time.

Hard Drive Troubleshooting

Hard drives are complex, as you may already notice through the Hard Drives basics reviews. They have a circuit board and a number of precise mechanical moving parts. In terms of hard drive data recovery, the first thing that you must evaluate is whether it is a hardware problem that is stopping you from accessing your data. Common hardware problems include a faulty circuit board or problems with the actuator arm.

A faulty circuit board is characterize by a drive that does not ’spin up’, meaning that platters are not turning underneath the copper wire. A faulty actuator arm or more serious mechanical error is characterized by an abnormal clicking noise or a grinding noise. The best advice in determining whether you have a hardware problem is to listen to the sound of your hard drive. If you cannot hear the platters spinning (i.e. it is quiet when it is turned on) or you hear more serious noises then you should stop using the drive immediately and you will need to send your drive to a hardware data recovery service.

Note that the hardware data recovery can be expensive because technicians most likely will need to disassemble your hard drive to fix the problem. Hard drive data recovery is usually done in a ’clean room’ as hard drives are sealed to avoid errors caused by dust or other particles. Also hard drives are finely tuned machinery and it takes specialist equipment to read the platters from a physically damaged drive.

If you are sending your hard drive to a data recovery specialist then you should attempt to obtain an upfront estimate of fees (although you will rarely get one), ask that if you send your hard drive for quotation purposes will they send it back to you in the same condition if you choose not to use the service, and make sure you send it to a reputable company as you may only get one chance at hard drive data recovery.

In most cases, the hard drives do not die suddenly, but the performance degrades with time. Since the data recovery might be a complicated and expensive procedure, it is recommended to prevent the damaging results of the failure by taking prompt backups of the important data, while the drive is still accessible.

Source: http://www.recovermyfiles.com/data-recovery-software.php