-Does your computer fail to bootup?
-Does your computer freeze and reboot?
-Cannot access your data due to the lost password?
-Does your computer contain critical data?
-Don't have a recent backup?
-Reformatted your harddrive?
-Accidentally deleted files?

Our blog will provide the relevant information on free tools, techniques, and approaches to recover your computer and get your valuable data back.

Showing posts with label recover hard drive. Show all posts
Showing posts with label recover hard drive. Show all posts

Computer Repair with Free Back Track Linux Boot CD

BackTrack is one of the best loved Linux live distribution focused on penetration testing. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes.

Back Track evolved from the merge of the two wide spread distributions - Whax and Auditor Security Collection. By joining forces and replacing these distributions, BackTrack has gained massive popularity and was voted in 2006 as the #1 Security Live Distribution by insecure.org. Security professionals as well as new comers are using BackTrack as their favorite toolset all over the globe.

BackTrack has a long history and was based on many different Linux distributions until it is now based on a Slackware Linux distribution and the corresponding live-CD scripts by Tomas M. (www.slax.org). Every package, kernel configuration and script is optimized to be used by security penetration testers. Patches and automation have been added, applied or developed to provide a neat and ready-to-go environment.

After coming into a stable development procedure during the last releases and consolidating feedbacks and addition, the team was focused to support more and newer hardware as well as provide more flexibility and modularity by restructuring the build and maintenance processes. With the current version, most applications are built as individual modules which help to speed up the maintenance releases and fixes.

Currently BackTrack consists of more than 300 different up-to-date tools which are logically structured according to the work flow of security professionals. This structure allows even newcomers to find the related tools to a certain task to be accomplished. New technologies and testing techniques are merged into BackTrack as soon as possible to keep it up-to-date.

No other commercial or freely available analysis platform offers an equivalent level of usability with automatic configuration and focus on penetration testing.

The tools are arranged in 12 categories, such as vulnerability identification, penetration, privilege escalation, radio network analysis, and reverse engineering. Among the more than 300 security tools you'll find such familiar names as the Metasploit Framework, Kismet, Nmap, Ettercap, and Wireshark (previously known as Ethereal).

Developers Website: http://www.remote-exploit.org/

Announcement on the BackTrack 4 Beta release: http://backtrack4.blogspot.com/2009/02/backtrack-4-beta-shmoo-release.html

Download Page: http://www.remote-exploit.org/backtrack_download.html

Bootzilla - Free Computer Repair Boot CD

BootZilla is a set of utilities to aid in removing and cleaning up virus and spyware infections. It is geared to be very portable, and offers a boot function for hardware diagnostics, while providing a set of useful utilities to help I.T. professionals in doing their jobs. The disk has the ability to test memory and hard drives through the use of a BootCD function called CGT. CGT is based on the official bootCD functionality, reducing it to the very essential list of necessary tools. The end result is a small, under 10MB, BootCD, with all the functionality needed on a daily basis.

The toolkit provides common windows troubleshooting utilities into an easy to use package with bootable functionality and can come in handy while your computer is screwed up because of some malware, virus or hardware issue.

Software utilities included in the pack:

Installable Apps

  • AIM Ad Hack v5.52 With this small file you can effectively remove all the ads from AIM v6.x
  • Belarc Advisor Free Utility that can catalog an entire system into a single HTML file. Can grab many serial numbers and keys.
  • CCleaner 2.03 Free Utility for cleaning up temporary files. Also has a decent Registry cleaner.
  • ERuNT/NTRegOpt Registry Backup and Restore for Windows NT/2000/2003/XP/Vista
  • Firefox 2.0.0.x Free, Alternative web browser
  • Java Runtime 1.6u3 Official Java Runtime Environment for Windows
  • KLCodec Pack v3.6.2 Free Codec pack for audio and video playback
  • Microsoft Installer Cleanup Utility Free Utility to repair broken MSI installations
  • Prime95 Free burn-in Utility designed to calculate the next mersenne prime number; offers a torture test for CPU and RAM testing.
  • PCI FileRecovery Free File Recovery utility
  • DVD Decrypter Free DVD Ripping tool. Burning functionality by ImgBurn.
  • ImgBurn Free CD/DVD/BluRay/HD-DVD burning software. Highly Recommended.
  • Unlocker Utility that can unlock files that are in-use, and rename/delete/move them.
  • Victoria for Windows Free hard drive testing utility. Can report SMART data, and remap failing sectors. Highly recommended.
Anti-Malware Tools
  • AIMFix Simple Instant-Messenger virus removal tool. Detects several different variants of viruses and rootkits. Highly Recommended.
  • Combofix Free utility that detects several different variants of malware, viruses, and rootkits. Highly recommended.
  • NOD32 AntiVirus 3.0 Trial 30-Day Trial of one of the best Antivirus products available for Windows. HIGHLY Recommended.
  • HijackThis 2.01 Free utility designed to allow reading of hidden startup programs, and Browser Helper Objects. A well-known tool, highly recommended.
  • RogueRemover Free SFX Free utility that can detect and remove rogue anti-spyware programs and traces in the registry. Highly Recommended.
  • RogueRemover Free Installer If the SFX fails to launch for you, use this to install RogueRemover onto your system.
  • Spybot Search & Destroy v1.5.1.18 Beta Free tool that can scan and remove thousands of spyware threats. Can also immunize a system against over 100-thousand threats.
  • Spybot Definitions Update Latest definitions for Spybot
  • Spybot Search & Destroy SFX Don’t want to install Spybot? Run this fully updated SFX.
  • VundoFix Free utility designed with one thing in mind - erradicating Trojan.Vundo infections.
Runnable Utilities
  • ATF-Cleaner Utility designed to quickly remove temporary files from a system.
  • FAB’s AutoBackup Free utility designed to quickly backup and restore a user profile and all data under a user profile. Highly Recommended.
  • CCleaner SFX Portable version of CCleaner application. Designed to remove temporary junk files. Also offers a decent registry cleaner.
  • CPU-Z Utility designed to detect the current CPU, and various aspects of the system. Can detect frequencies of cpu/memory. Highly Recommended.
  • Dial-a-Fix Utility that offers several repair functions for Windows-internals. Can detect and remove local policies, as well as several other tools. Highly Recommended.
  • Drive Dismounter Script, designed to quickly dismount an NTFS drive or volume from a Windows XP system. For Technician use only.
  • ERUNT Emergency Registry Backup Utility. Recommended.
  • EZPCFix Free utility designed to read and write remote registries off of hard drives. Can also be used to recover corrupted registry keys. Recommended.
  • FSOptimizer SFX Free disk defragment utility based on JKDefrag. Optimizes boot files to promote a faster boot time. Highly Recommended.
  • HostsXpert Free utility designed to manage the HOSTS file. Can also be used to restore a default HOSTS file or import known-good HOSTS files from the internet. Highly Recommended.
  • JKDefrag GUI Free disk defragment program, based on JkDefrag, with a GUI. Offers customizabilty of the defragmentation process. Highly Recommended.
  • KeyFinder Free program serial-number retriever.
  • LSPFix Free utility designed to allow access to the Layered Service Providers in the registry. Can detect improper settings and remove them.
  • McAfee Product Removal Tool Official McAfee Removal tool designed to remove all McAfee security products.
  • Norton Removal Tool Official Norton-branded product removal tool. Recommended.
  • PC-Decrapifier Free utility designed to detect and remove junk-ware pre-installed on Dell and other OEMs Systems. Highly Recommended. Technicians must purchase a license.
  • RegScanner Free utility designed to allow quick-searching through the registry. Can also create deletion registry files. A life-saver if you are manually removing symantec products.
  • Silent Runners SFX VBS script designed to find all applications that startup with Windows. Can detect hidden applications as well. Log file is placed in %Temp%/7z*.tmp folder.
  • System Information Viewer Utility designed to quickly and efficiently display all information about a system.
  • System Info for Windows Free utility that can display secrets such as passwords and network keys. Offers full system information gathering as well.
  • StartUpLite Free utility that detects and prompts the user about several un-needed startup programs. Can either disable, delete, or ignore the choices it auto-selects as un-needed. Highly recommended.
  • Sysinternals Tools Suite The entire Sysinternals Technician Tools Suite. Highly Recommended. Select utilities listed below:
  • AutoRuns - Free utility designed to allow viewing and deleting auto-running applications on system bootup, including services and drivers.
  • Process Explorer - Free task manager-like application. Can replace task manager, and displays much more information than task manager.
  • RootkitRevealer - Free utility designed to detect and show rootkits found on a system.
  • TCPView - Free utility to monitor TCP/IP connections incoming and outgoing from the local machine.
  • SysVolInfoUnlock Script designed to take ownership of the System Volume Information (System Restore) folder on a user-input drive letter. Only works on XP Pro.
  • Undead Pixel Utility designed to test LCD monitors and repair stuck pixels.
  • UnknownDevices Utility designed to detect and report hardware that is missing drivers. Provides an easier way to search the internet for a proper driver.
  • Unstoppable Copier Free utility designed to copy files from failing media (hard drives, network drives, and optical media only)
  • ViewpointKiller Free utility designed to detect and remove Viewpoint from a system.
  • WinsockFix Utility designed to perform one function - restore the Windows TCP/IP stack to its default settings.
  • ZonedOut Utility designed to detect and manage internet zones settings.
You can customize your copy to include only those applications that you need. When your copy is prepared, you can save it into your machine for later use. It can be saved into USB disk or burn into CD-ROM. When your computer crashes, this USB disk or CD-ROM can provide important recovery tools.

Website: http://www.bootzilla.org/

Download: http://www.ziddu.com/download/4408664/bz5release.zip.html

Screenshot - Click to Enlarge:

Free Undelete Utility from OfficeRecovery

FreeUndelete restores deleted files, including those removed from Windows Recycle Bin. In case of accidental removal of files on a NTFS (default for Windows Vista, XP, 2000 and NT), FAT32 or FAT16 file systems this is the utility to help.

Supported file systems: NTFS, FAT32 and FAT16

The recovered files are saved into a new location to prevent overwriting the deleted files on the original media.

FreeUndelete is free for personal use. There is no charge, direct or hidden, to download and use a fully functional copy of the program. The program does not install any spyware or adware along with it. It does not populate user’s desktop with pop-up ads or forcefully subscribe user to mailing lists.



A deleted file is essentially an area on disk designated as free and ready to accept data (such as contents of some other file). Luckily, unless the area has already been overwritten, it still holds the contents of the deleted file. Due to this fact it is possible to undelete files.

This fact also dictates the following procedure for using FreeUndelete:

  1. Stop any activity on the disk you are going to undelete files from! Remember that writing to that disk can damage the contents of the deleted files. Examples of disastrous activity include: copying files to the disk, installing programs there or running programs that use the disk as their swap media.
  2. Download and install FreeUndelete. Whenever possible, save the setup executable and install the program to a disk that does not hold files you need to undelete.
  3. Run and use FreeUndelete.
Tip: It is common that the only drive user has is C: and this is also the drive from where files need to be undeleted. In that case a good solution is using a USB flash drive as FreeUndelete download and install destination.

Features
  • File systems supported: NTFS 1.0, NTFS 2.0, FAT32, FAT16
  • Operating systems supported: Windows XP, 2000, NT 4 (SP2 or higher required), Windows 2003 Server
  • Easy to use, no special user skills required
  • Full install/uninstall support
Limitations
  • Does not support Windows 98, Windows 98SE and Windows ME
  • Utility is not portable, and should be installed on any of your disks.
System Requirements
  • Operating system: Windows 2000, XP, Vista or 2003 Server
  • RAM: 128 MB
  • Hard Disk: minimum 10 MB of free space required for installation
  • Display: 640 x 480 or higher resolution, 256 colors
Developers website: http://officerecovery.com/freeundelete/

How to Optimize Computer Performance with Hard Drive Defragmentation?

Hard Drive Performance Optimization

Windows comes with a collection of house cleaning tools, including ScanDisk, Disk Defragmenter and Disk Cleanup, to help keep your disk in peak working order.

Why should you bother with the housework? A couple of reasons. First, disks are hard working, mechanical devices and, like all mechanical devices, prone to failure. A little preventative maintenance can warn you of potential problems and fix minor glitches before they can do damage to your data.

Second, the way files are organized on your drive has a perceptible impact on the performance of your computer. If your files are stored neatly, end-to-end, without fragmentation, reading and writing to the disk is speedier.

What is file fragmentation?

Sometimes when you install a program or create a data file, the file ends up chopped up into chunks and stored in multiple locations on the disk. This is called fragmentation.

What makes this happen?

When you first install your operating system and programs on your hard disk, they are written to the disk, for the most part, in one contiguous block without any gaps. The exceptions are certain system files that must be stored in specific locations. Over time, as you create and then delete documents or uninstall programs, once-filled locations are left empty and you end up with files dotted all over the disk.

Now, when Windows is writing a file to the disk, it looks for a suitable piece of free space in which to store it. What happens, then, when you copy a 40 MB database or audio file to the disk and the biggest slice of free space is only 30 MB? Or say you modify an existing file, appending a whole bunch of data so the file now takes up more space on the disk. To accommodate the files, Windows writes the first part of the file in one section of the disk and then scouts around for other places to store the rest of the file. The end result is that a single file may be stored in several chunks scattered about the disk.

Of FAT and files

Windows keeps track of each file’s location in the File Allocation Table, or FAT (Windows 98 and Me use a file system called FAT32). When your file is written to disk, FAT32 provides Windows with the address of an unoccupied disk cluster. FAT32 also tells Windows on which disk sectors it will find that cluster; that is, it provides the physical location of the cluster. This information is used by your PC’s BIOS (the Basic Input/Output System) to direct the actual disk writing operation.

If the file is too large to fit in a single cluster, Windows asks FAT32 for another vacant cluster, and another, and another until the whole file is written to disk. If you have lots of free clusters side by side, FAT32 can point Windows to an adjacent series of clusters, resulting in a file which occupies one contiguous chunk of the disk. If no adjacent cluster is available, FAT32 tracks down a space elsewhere on the disk and tells Windows to put the next bit of the file there; and so on until the full file is written to disk.

A record of the clusters used for storing the file is kept by FAT32 so Windows can find the file once more when you want to read it.

The fragmentation penalty

Although this all happens quickly, it makes a lot of work for your hard disk. Its read/write head, which moves across the drive platter from location to location transferring data, has to zip all over the place when saving or opening a single highly fragmented file. (By the way, many disks have more than one read/write head and multiple platters.) If a file is unfragmented, the disk head moves to one location, reads the file in one sequential swoop, and that’s it.

A file stored in, say, four fragments, can easily take twice as long to open as the same file unfragmented, although the actual performance hit you take is affected by other factors, including the total size of the file.

The techniques used by the Disk Defragmenter

# Moving all the index or directory information to one spot. Moving this spot into the center of the data, i.e. one third of the way in, so that average head travel to data is halved compared to having directory information at the front.
# Moving infrequently used files further from the directory area.
# Obeying a user provided table of file descriptions to emphasize or ignore.
# Making files contiguous so that they can be read without unnecessary seeking.

Windows XP Disk Defragmenter Limitations

Disk Defragmenter in Windows XP has the following MAJOR limitations:
# It does NOT defragment files residing in the Recycle Bin.
# It also cannot defragment "in-use" files.
# Does not defrag and clean the registry.
# It can defragment only local volumes.
# It can defragment only one volume at a time.
# It cannot defragment one volume while it is scanning another.
# It cannot be scheduled automatically. If you need to schedule disk defragmentation, use the Defrag.exe command line tool.

Defragment Your Disk Drive Volumes in Windows XP

Disk Defragmenter Microsoft Management Console (MMC) is based on the full retail version of Executive Software Diskeeper. The version that is included with Windows XP and later provides limited functionality in maintaining disk performance by defragmenting volumes that use the FAT, FAT32, or NTFS file system.
To start Disk Defragmenter MMC, use one of the methods.

Method 1: Use the Properties of Your Local Disk

  1. Open My Computer.
  2. Right-click the local disk volume that you want to defragment, and then click Properties.
  3. On the Tools tab, click Defragment Now.
  4. Click Defragment.
  5. If you have more than one hard disk, repeat this process for each hard disk listed.
Method 2: Use Computer Management MMC
  1. Start Computer Management MMC (Compmgmt.msc).
  2. Click Disk Defragmenter.
  3. Click the volume that you want to defragment, and then click Defragment.
Method 3: Use Disk Defragmenter MMC.
  1. Start Disk Defragmenter MMC (Dfrg.msc).
  2. Click the volume that you want to defragment, and then click Defragment.
It May Take a While

The Disk Defragmenter tool can take anywhere from minutes to hours to run, depending on the size of your hard drive and also how fragmented the drive is. One way to run the Disk Defragmenter and not lose any computing time is to leave the system and run the Disk Defragmenter during a time when the system can be left on but is not be in use (e.g., 3 or 4 a.m.). You can simply use the steps above to launch Disk Defragmenter when your computing tasks are done for the day or you can have the Windows Task Scheduler automatically run the Disk Defragmenter on a certain day and time each week or month.

Tips for Getting the Best Results

  • Ensure you have no applications running when you start the Disk Defragmenter. If you system is accessing applications the Defragmenter will not stay running. Be sure to turn off your screensaver also.
  • Delete your Temporary Internet Files and other files you do not use. You can also uninstall unused programs. In the Properties tab of your hard drive you can access "Disk Cleanup," which will help you get rid of unused and unnecessary files.
  • Run the Disk Defragmenter at regular intervals. However you can also run the tool if you add a lot of files to the disk at one time or find you are running low on disk space.
  • The volume must have at least 15% free space for Defrag to completely and adequately defragment it. Defrag uses this space as a sorting area for file fragments. If a volume has less than 15% free space, Defrag only partially defragments it.
Automatic Defragmentation Scheduling with Task Scheduler

  1. Open Control Panel, double-click Scheduled Tasks
  2. Double-click Add Scheduled Task
  3. On the Scheduled Task Wizard dialog, click Next.
  4. Click Browse and navigate to windows’system32 folder. Select defrag.exe and click Open. In the Scheduled Task Wizard dialog, type a name for the scheduled task (for example type Disk Defrag).
  5. Under Perform this task, select how often you wish Disk Defragmenter to run. Click Next.
  6. Set the time at which you wish the Disk Defragmenter scheduled task to run. This should be a time when your computer is turned on but not under heavy use (i.e. at night time). Select the frequency at which you want the Disk Defragmenter task to run (Every Day, Weekdays, or Every <N> days, where <N> is the number of days between scheduled runs). Click Next.
  7. Enter a user name under which the Disk Defragmenter scheduled task will run. This user must be an administrator on the local machine (see note above). Enter the password for that user and confirm it. Click Next.
  8. Check Open advanced properties for this task when I click Finish, and click Finish.
  9. In the Run text box, you can see the full path and command for defrag.exe.  Add the drive letter for the drive you wish to defragment to the command in the Run text box. If you want to defragment drive C:, your Run command should look like this: C:’WINDOWS’SYSTEM32’defrag.exe C: Click OK.
  10. In the Set Account Information dialog, enter and confirm the password for the user listed in Run as and click OK.
  11. Task Scheduler will automatically run Disk Defragmenter with the settings you selected at the time you selected.
Only one instance of Disk Defragmenter can be running at any given time. If you have multiple partitions you’ll need to add a separate scheduled task for each one, and make sure you give each task a different starting time, allowing for the previous one to finish.

Defrag Your Boot Files

File fragmentation can happen at start-up too. A real power tip (not for beginners) is to have Windows XP automatically defragment these files, but you will have to make sure your Windows XP registry has the correct setting.

Open your Registry Editor and go to key:
HKEY_LOCAL_MACHINE’SOFTWARE’Microsoft’Dfrg’BootOptimizeFunction
Look for a VALUE in the right hand pane called BootOptimizeFunction
...if it does NOT exist, choose from the menu Edit > New > String Value and create it.
Make sure that it has the entry Y.


Sources and Additional Information:
http://www.geekgirls.com/windows_defrag.htm
http://support.microsoft.com/kb/314848
http://www.webopedia.com/DidYouKnow/Computer_Science/2008/disk_defragmentation.asp
http://www.petri.co.il/schedule_disk_defrag_to_run_automatically_in_windows_xp_2003.htm
http://www.updatexp.com/disk-defragmenter.html

MBRwizard - Free MBR Management Utility

MBRwizard is a powerful, yet flexible utility designed to assist with all types of Master Boot Record difficulties. Initially developed to overcome MBR problems introduced by disk imaging products such as Symantec Ghost and Acronis True Image, MBRwizard has become a popular utility for repairing all types of MBR problems, especially those caused by disk-2-disk (d2d) and system backup and recovery applications.

Whether you are looking to solve issues caused by experimenting with Linux, repair partition entry issues after recovering a disk image, or simply safeguarding your system by capturing a backup of the MBR before disaster strikes, you MBRWizard is the answer! MBRwizard is designed as a command line only application for flexibility and automation of tasks, therefore, there is no graphical interface for this application.

Here are some key features of "MBRWizard":

Partition Modification
- Delete Partitions
- Hide/Unhide Partitions
- Set Bootable/Active Partition
- Change Partition Type

MBR Operations
- Restore MBR, Head, or other sectors from file
- Delete MBR, or Wipe all sectors on first head
- Fix MBR due to damage or corruption
- Copy Sectors
- Clear or write a new disk signature
- Sort partition table entries. Designed to match Windows boot.ini entries

Additional Functionality
- Mount volumes within Windows
- DisMount volumes
- Modify Volume Label
- Securely wipe entire disk
- Boot Menu- Quick menu allowing user to select bootable partition
- Shutdown/Reboot the machine
- Create ini file containing the structured contents of the MBR
- Read/Write a Status byte in the MBR

The software is a free application with no limitations. It also does not require installation on your hard drive, and can be run from external device.

Developer’s website: http://mbrwizard.com/

News: Authors are planning to release a new version of the program with GUI and Vista support. The development is on the Beta stage. If you like to perform beta testing, you can announce your participation through the following link: http://mbrwizard.com/beta.shtml

Repair Master Boot Record (MBR)

Problems with the master boot record (MBR) of a system may prevent the system from booting. The MBR may be affected by malicious code, become corrupted by disk errors, or be overwritten by other boot loaders when experimenting with multiple operating systems on a host. When your BIOS detects a damaged MBR or boot sector, you’ll see ominous messages like Invalid partition table, Error loading operating system, or Missing operating system.

As you know, the Master Boot Record (MBR) will be created when you create the first partition on the hard disk. It is very important data structure on the disk. The Master Boot Record contains the Partition Table for the disk and a small amount of executable code for the boot start. The location is always the first sector on the disk.

The first 446 (0x1BE) bytes are MBR itself, the next 64 bytes are the Partition Table, the last two bytes in the sector are a signature word for the sector and are always 0x55AA.

The example of the NTFS MBR disk layout:

Physical Sector: Cyl 0, Side 0, Sector 1
000000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3AZ??.|uP.P.u?.|
000000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ?..PW?a.o¤E??.±.
000000020 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B 8,|.u.??.aoI.‹.‹
000000030 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC i??.It.8,to?..N¬
000000040 3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25 <.tu»..?.I.eo‰F%
000000050 96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05 -SF.?.<.t.?.<.t.
000000060 3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4 :Au+@?F%.u$»?UP?
000000070 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74 AI.Xr.?uU?u.oA.t
000000080 0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF .Sa?V$C.?.e.?f.?
000000090 0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E ..?..‹U3E?y..‹N
0000000A0 25 03 4E 02 CD 13 72 29 BE 46 07 81 3E FE 7D 55 %.N.I.r)?F.?>?}U
0000000B0 AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 27 07 EB ?tZ?i.U…ou??’.e
0000000C0 8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB S?‘R™.F..V.e..Ze
0000000D0 D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 00 00 00 00 OOta3AI.e?......
0000000E0 56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4 V3oVVRP.SQ?..V‹o
0000000F0 50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72 PR?.BSV$I.ZX?d.r
000000100 0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49 .@u.B€C.a?o^AetI
000000110 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E nvalid partition
000000120 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 table.Error loa
000000130 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 ding operating s
000000140 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 ystem.Missing op
000000150 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 erating system..
000000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000180 00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00 ...‹u.W‹oE......
000000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000001B0 00 00 00 00 00 00 00 00 A6 34 1F BA 00 00 80 01 ........¦4.?..€.
0000001C0 01 00 07 FE 7F 3E 3F 00 00 00 40 32 4E 00 00 00 ...?>?...@2N...
0000001D0 41 3F 06 FE 7F 64 7F 32 4E 00 A6 50 09 00 00 00 A?.?d2N.¦P....
0000001E0 41 65 0F FE BF 4A 25 83 57 00 66 61 38 00 00 00 Ae.??J%?W.fa8...
0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............U?

What will happen if the first sector has been damaged (by virus, for example)?

If the first line numbers will be overwritten: the first 16 bytes are now zeros.

000000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ?..PW?a.o¤E??.±.

When you try to boot after hardware testing procedures, you will see just blank screen without any messages. It means the piece of code at the beginning of the MBR could not be executed properly. That’s why even error messages could not be displayed. However, if you boot from the floppy, you can see FAT partition, files on it and you are able to perform standard operations like file copy, program execution... It happens because in this example only part of the MBR has been damaged which does not allow the system to boot properly. However, the partition table is safe and you can access our drives when you boot from the operating system installed on the other drive.

What will happen if sector signature (last word 0x55AA) has been removed or damaged?

If there are zeros in the sector signature.

Physical Sector: Cyl 0, Side 0, Sector 1
0000001E0 41 65 0F FE BF 4A 25 83 57 00 66 61 38 00 00 00 Ae.??J%?W.fa8...
0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

When you try to boot now, you see an error message like "Operating System not found".

Fixing Master Boot Record (MBR) with standard tools

For the earlier Operating systems, as MS-DOS, Windows 95, 98, ME, the simplest way to repair or re-create MBR is to run Microsoft’s standard utility called FDISK with a parameter /MBR, like

A:’> FDISK.EXE /MBR

For the later Operating systems, like Windows NT, 2000, XP, Vista, you can repair the MBR using the Recovery Console.
1. Boot with the XP installation CD.
2. When prompted, press R to repair a Windows XP installation.
3. If repairing a host with multiple operating systems, select the appropriate one (XP) from the menu. If you have only one operating system, enter 1 to select it.
4. Enter the administrator password if prompted.
5. To fix the MBR, use the following command:

fixmbr

This assumes that your installation is on the C:’ drive. You will be presented with several scary warning lines the reading of which will make you want to say no. Microsoft is exceptionally vague regarding the conditions under which fixmbr can cause problems although they are clear about the consequences (losing all data on the hard drive), so use this at your own risk.

6. Type y and ENTER to fix the MBR.
7. Type exit to leave the recovery console and reboot.

If you do not feel comfortable enough using built-in standard tools, or the operation was not successful, you can try to use the available free and commercial software utilities from our collection.

Additional Reading:
http://www.tech-recipes.com/rx/483/xp_repair_fix_master_boot_record_recovery_console/
http://askbobrankin.com/fix_mbr.html
http://www.ntfs.com/mbr-damaged.htm

FindNTFS - Freeware Utility for Partition Recovery

FindNTFS is a small effective free program to locate and recover NTFS (NT File System, The default method of storing files on Windows 2k/XP) files. It is available in several versions, including one that will run from a DOS boot, and thus can be used when the Windows OS is not bootable.
To use FINDNTFS, boot your system into DOS using a boot disk with the findntfs.exe file on it.
To obtain a list of NTFS files and directories on the drive you are attempting to recover from, type 'FINDNTFS # 1 1 1 c:\recoverlog.txt files' at the command prompt. The "#" should be replaced with the number of the hard drive you are reading from. If you have only one drive, it will be '1', if there is more than one drive in the system the physical hard drive with the 'c:' logical drive on it will be '1'.
This command tells The FindNTFS program to search the entire specified disk for NTFS files, and output the file list to a text file on the C: drive. Note that you can save the text file under any name on any drive, as long as it has the '.txt' extension. Do not save the log file onto a drive you are trying to recover data from however. If everything went well, you should have a reassuring, if somewhat jumbled list of the available NTFS files on the drive you selected. Search the document for the filenames that are most essential, and then scroll up until you see the directory that they are in.
You will need to do this, since the directory order that FindNTFS sees will not necessarily be the same as you had before the data was lost. Note down the number of the directory before proceeding on with the next step.
To recover files using FindNTFS, you need to use the 'copy' command. A limitation of the program is that it will only save recovered files into the directory where the FindNTFS executable is located, so make sure you have enough space available to hold your restored files.
Type 'FINDNTFS # (replace "#" with the drive you are recovering from, as before) 1 1 1 copy #'. This is the directory number holding the files you wish to restore. You may enter up to 10 directory numbers. If you do not enter a number, the program will attempt to restore and copy all NTFS files on the selected disk.
FindNTFS will copy the selected directories and files to the directory containing the FindNTFS.exe file. Check the recovered files to make sure they are not corrupted.
Sadly, FindNTFS has one major limitation. It cannot copy NTFS files onto DOS readable (FAT) partitions, and therefore is not able to recover files without an NTFS supporting operating system running (Windows NT/2K/XP). Thus it is not possible to recover files directly with this program using a DOS boot disk.

ADRC Data Recovery Software Tools

ADRC Data Recovery Software Tools contains a software suite of data various recovery tools that supports a wide variety of drives and file systems.

The software incorporates extremely simple GUI with novice users in mind. The software zooms in to do only critical recovery functions with minimum complexity so one could recover the data easily. It gives you full control to undelete files, disk image back up, restore a backup image, copy files from hard disk with bad sectors, disk cloning, backup, edit and restore your boot parameters.

Features:

1. ADRC Data Recovery Tools - Undelete

When a file is deleted from the data media, the space that the file used to reside is marked as available or the file in question is marked "deleted". For as long as the space has not been overwritten, the data can be retrieved.

ADRC Data Recovery Tools - Undelete helps you to recover lost and deleted data from hard drives, floppy disks, basic or dynamic volumes, compressed or fragmented files. Besides hard disk drives, it also supports removable devices such as compact flash, Smart Media, Iomega Zip drives, USB drives etc…

The file recovery tool allows recovery of accidental deletion of files. It works on drives formatted in FAT12, FAT16, FAT32 and NTFS file-systems. It works under all windows family operating systems such as Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, Windows 2003 Server and Windows XP.

You could undelete the files even after you have cleared the recycle bin.

2. ADRC Data Recovery Tools - Copy Files

This is not a normal kind of copy function. The Copy Files tool actually recovers files from disks with physical damage such propagation of bad sectors on disk. Normal windows copy will result in system being "halt" or "hang" (the infamous CRC IO errors). In this situation, Copy Files tool could come to your rescue handy.

The program will attempt to recover every readable bits of a file and put the bits together to salvage your data. It is hopeful that in the worst case scenario, most parts of files can still be extracted even some parts are gone.

To reduce the number of tedious retries, whenever a bad sector is encountered, the program will intelligently search the neighboring sectors to determine the extent of bad blocks and mathematically calculate the number of retires needed.

It also features the "Copy Sub Folders" option which scans through the entire directory and attempts to copy everything you need.

3. ADRC Data Recovery Tools - Raw Copy

Raw Copy transfers the binary raw image from one drive directly to another. It is rather similar to the infamous "Ghost" function. You could perform a disk clone backup (or if your disk is slightly faulty) and do not want perform a file by file copy. This is really ideal if you do not want to re-install the operating system. As the transfer is done in true low level binary, you could do this for drives with an unknown file system to be cloned such as game machines, Mac disk etc. With some built in recovery features, the program will try to recover data even if it is on bad sectors to ensure all or maximum data is restored from the drive.

This is a very powerful function and must be used with care. As it is a binary dump, the original data on the target drive is no longer recoverable upon completion of process.

4. ADRC Data Recovery Tools - Image Backup / Restore

Image Backup / Restore create and write disk image files to and from hard drives and any removable media. In just one click, it performs wholesome backup and restoration of the entire drive. A common application is to create a floppy image for transfer across internet and then downloaded the image to be written back to floppy again. One can also backup a disk image for safe keeping. It is an ideal way to backup all your operating system, data and program files.

5. ADRC Data Recovery Tools - Boot Builder

The primary function of Boot builder is to allow you to import or export the boot sector of a drive (either FAT or NTFS boot sector type). In case the boot sector is damaged due to virus or system corruption, one can easily import it back. You can even custom make your own boot sector from scratch (if you know the standard parameters) to rescue a corrupted disk.

Software is absolutely free and does not require installation.

Developer’s Website: http://www.adrc.com/software/data_recovery_tools/

SoftPerfect File Recovery

SoftPerfect File Recovery is a free and useful tool to restore accidentally deleted files from hard and floppy disks, USB flash drives, CF and SD cards and other storage media. It supports the popular file systems such as FAT12, FAT16, FAT32, NTFS and NTFS5 with compression and encryption. If your important files disappeared and you can’t find them in the recycle bin, try this software product and get the files back to life. Easy to use, no installation is required.

MAIN FEATURES

* Lightweight (268 KB only).
* Supports FAT & NTFS.
* Supports compressed and encrypted volumes.
* Supports most storage media.
* Easy to use, just run it!
* Completely portable, works from removable media, and does not leave any residual traces.
* Software is free to use for any purposes, as soon as the code is not modified.

Note that when you restore the files from the main boot-up Hard Drive, the success rate might be lower due to the considerations of the time to recovery parameter. The software is able to restore accidentally deleted files from built-in hard disk drives as long as two the following conditions are met:

1. The file was deleted recently and no writing was made on the volume after that.
2. So, if you delete a file from a system volume (e.g. C:’), there are little chances to restore it because the OS is constantly writing on this volume (logs, registry branches, etc).

Developers Website: http://www.softperfect.com/products/filerecovery/

Data Recovery Techniques © 2008. Template by Dicas Blogger.

TOPO