Tip

How to recover data from corrupt NTFS boot sectors

Although the NTFS file system was designed to be much less prone to corruption than FAT or FAT-32, corruption can still occur.

One common NTFS-related problem involves a corrupt boot sector. If the NTFS boot sector is corrupt, it can cause boot problems, but, even worse, it can make the data on the volume inaccessible. So it's good to know techniques for repairing a corrupt NTFS boot sector.

How to repair a corrupt NTFS boot sector

The boot sector is critical to NTFS. If the boot sector is corrupt, the entire volume may be inaccessible. So important is the boot sector that Microsoft includes a backup copy of it on the volume. To repair a corrupt boot sector, all you need to do is locate the backup copy, then use the information it contains to overwrite the primary boot sector.

This isn't as hard as it sounds. The primary NTFS boot sector is located on the first sector of a drive. The backup NTFS boot sector is located on the last sector. (Note: Windows NT 3.51 and earlier versions placed the boot sector in the middle of the drive. But since these versions are all but extinct, I'll assume your backup boot sector is in the last sector.)

For the purpose of this article, I'm also going to make another assumption: That the computer with the problem has a single hard disk with a single volume that is formatted as NTFS.

How to start recovering data from a corrupt NTFS boot sector

Begin

    Requires Free Membership to View

the recovery process by booting from the Disk Edit boot disk you made earlier. When Disk Editor starts, it will display the contents of the A: drive. So you must redirect the Disk Editor to look at your hard disk.

To do so, select the Drive command from the Object menu. You'll see a dialog box asking you which disk you want to edit. By default, your boot floppy will be listed, but the hard drive will not. Therefore, you must select the Physical Disks option to reveal the hard drive. Now select the hard drive (listed as Hard Disk 1) and click OK.

Now that you've switched to the hard drive, you need to collect some data about the corrupt volume. To do so, select the Partition Table command from the Disk Editor's View menu. You'll see a screen that gives you some basic information related to each partition on the disk. Make note of the starting and ending side, cylinder and sector.

This should be a simple operation if you're trying to recover the drive's primary partition. But if the corrupt partition happens to exist as a logical drive on an extended partition, you'll have to drill down through the table to get to the logical drive in question. The information you write down regarding the partition should look something like this:

 

 

Side

 

Cylinder

 

Sector

 

Starting 1 0 1
Ending 254 1023 63

While at this screen, you should also make note of the relative sectors and the number of sectors per track.

How to verify primary and backup NTFS boot sector location

The next step is to verify the locations of the primary and backup boot sectors. To access the primary boot sector, select the Physical Sector command from the Disk Editor's Object menu. You will see a screen prompting you to enter a physical sector range.

To determine the physical sector containing the primary boot sector, take the starting sector and add the number of relative sectors, then subtract 1. If your disk matched the table above, the primary master boot record would be located at physical sector number 63.

Fill in the Starting sector field with the value you just calculated and set the number of sectors to 1. Click OK and the Disk Editor should take you to the beginning of the corrupt partition. You will now see a screen filled with hex code.

The actual boot sector code varies depending on the version of NTFS that was used to create the partition. The boot sector's version is irrelevant, other than you shouldn't try to use the code listed above to manually rebuild your boot sector. What is important is that you should be able to use the sector data to verify that you are indeed looking at a boot sector. If your NTFS boot sector is corrupt, there's no telling what shape it will be in, but there are a few telltale signs that you are indeed looking at a boot sector.

On the screen filled with hex code, the column on the right contains ASCII characters rather than hexadecimal code. This means that this column should contain some readable text. Regardless of the version of Windows used to create the partition, the first line's ASCII code should contain a reference to NTFS. Further down in the sector, you should see more readable text, such as messages like "A disk read error occurred" or "A kernel file is missing from the disk." Newer versions of Windows also embed the messages "NTLDR is missing," "NTLDR is Compressed," and "Press Ctrl+Alt+Del to restart." If you can make out the NTFS reference in the first line, and at least one or two of the other messages, you're probably looking at the boot sector.

The method for verifying the location and integrity of the backup boot sector depends on the version of Windows used to create the partition. For partitions that were created using Windows NT 4.0 (or higher), you can determine the location of the backup boot sector by adding the total number of sectors to the number of relative sectors, then subtracting one. If you're repairing a partition that was created by a version of NT older than 4.0, take the total number of sectors, divide by two, then add the number of relative sectors.

Select the Physical Sector command from the Object menu. You'll see the Select Physical Sector Range dialog box. Enter the number you have calculated into the Starting Sector field, and set the number of sectors to 1. Note: This is very important. You should now see an exact duplicate of the primary boot sector. Actually, it won't be an exact duplicate because your primary boot sector is corrupt, and hopefully your backup boot sector isn't.

Repairing your primary NTFS boot sector

Now it's time to repair your primary boot. Note: Follow these instructions exactly -- you can make the problem worse if you make a mistake.

  • Select the Mark command from the Edit menu.
  • Select the Write Object To command from the Tools menu.
  • A prompt will ask you where you would like to write the 1 sector that is selected to. Choose the Physical Sectors option and click OK.
  • Disk Editor will now prompt you for the drive you want to write the sector to. Choose the hard disk and click OK.
  • Now enter a cylinder, side and sector number. (You should retrieve the cylinder and side information from the values you recorded originally. The sector would be the sector that you determined the boot sector to exist at.)
  • Click OK and confirm that you really want to overwrite the sector.

At this point, you should reboot your computer. I recommend running CHKDSK /F prior to attempting to start Windows. This should help fix any remaining NTFS boot sector problems. Once CHKDSK completes, the system should boot.


Data Recovery Techniques for Windows
- Introduction
- How to recover data
- How to create a boot disk to run Norton Disk Editor
- How disk cluster size affects data recovery processes
- How long file names complicate data recovery
- How to recover deleted files on FAT via Disk Editor
- How data recovery for NTFS differs from FAT
- How to recover corrupt NTFS boot sectors
- Signature-based data recovery: A last ditch technique

About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server, Exchange Server and IIS. He has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. He writes regularly for SearchWinComputing.com and other TechTarget sites.

This was first published in June 2006

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.