|
LAST UPDATED 20 September 2019 |
FAT32 HARD DISK |
Resize: 800x600 800x700 |
Backup & Repair & Data Recovery
• Routines to Backup & Restore -
1. Track 0 : MBR sector (incl. Partition Table), MBR Backup sector
2. Primary Partition : Boot sector, FS Info sector, FAT, Root Directory Table
3. Extended Partition : Extended-MBR sector (E-MBR)
4. Logical Partitions : Boot sector, FS Info sector, FAT, Root Directory Table
This set of Backup and Data Recovery routines is for a FAT32 hard disk only
~ It requires some knowledge of DOS, the MS-DOS disk operating system ~
~ It requires some knowledge of DOS, the MS-DOS disk operating system ~
You must be booted to real DOS mode to use the repair and recovery routines;
they will NOT work in a DOS box within Windows.
They work on a Windows ME system booted using a Windows ME Emergency Boot Disk;
or on a Windows 98 system, booted to DOS mode; or the 2nd edition of Windows 95
(Windows 95 OSR2), if it does NOT use FAT16, booted to DOS mode.
All versions of Windows 9x can boot into DOS mode by starting with an appropriate
boot disk in Drive A: (i.e. a floppy disk containing the bootstrap program). All
versions of Windows 95 or 98 can be restarted in DOS mode without the floppy disk.
![](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="11" height="11"><rect fill-opacity="0"/></svg>) You can download the appropriate MS-DOS Boot Disk here or here A batch file containing the routines below can be downloaded from this link
|
• Disk Repair and Data Recovery -
The fact that the computer can't load Windows, or perhaps can't even recognise
the hard disk, does NOT mean the disk is unrecoverable!
There are many reasons why a disk might not be recognised, or is recognised
but can't load Windows. Most of them can be put right in DOS, loaded from
the floppy drive, using the instructions below. (NB: A brief DOS Tutorial)
![Hard disk (cutaway)](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="230" height="195"><rect fill-opacity="0"/></svg> "Hard disk (cutaway)") |
• System -
In order to carry out disk repairs or data recovery using the software mentioned
below, you will need to have access to that software on your system; the following
routines therefore assume you have a working second hard disk or a USB pen drive.
These backup and recovery routines were designed around a system with two hard disks
on the Primary IDE cable: the Primary Master had 2 partitions (Drive C and Drive E);
and the Primary Slave had 1 partition (Drive D); CD-ROM on the Secondary IDE cable;
and a USB pen drive disk (Drive F), containing the rescue utilities, on a USB port.
The routines make very extensive use of the USB pen drive as Drive F, because
for serious disk repair or data rescue a 1.44MB floppy disk is much too small. I
use a ByteStor 8 GB USB 1.1 pen drive: the software only occupies 300 MB of disk
space, leaving more than 7 GB of free space for files rescued from the hard disks.
The routines can be easily modified to cater for a system in which the rescue tools,
and the free space to store rescued files in, are at a location other than Drive F.
The customised Windows ME Emergency Boot Disk is configured to provide an option,
when booting the system in DOS, to load DOS drivers for a USB 1.1 drive, thereby
providing access to a USB pen drive disk (a.k.a. USB memory stick) under DOS.
All the software referred to on this page can be found on-line, through the links
in the Program Download Sources section, below.
Note -
These rescue routines were designed, originally, for use with Windows ME; and the
customised AUTOEXEC.BAT and CONFIG.SYS files can only be used with a Windows ME
Emergency Boot Disk. If you're using Win98/98SE (or Win95 OSR2 with FAT32) you'll
need to modfify a standard boot disk for that Operating System, particularly the
AUTOEXEC.BAT and CONFIG.SYS files on it, if you wish to access USB devices in DOS.
--------------------------------------------------------------------------------
DISCLAIMER:
You use this information entirely at your own risk. There shall be no duty of
care owed by me, and I hereby disclaim all liability. Also, there shall be no
implied term, condition or warranty of merchantability, nor of fitness for any
particular purpose. No representation or warranty is made as to the accuracy of
the information, nor is any such intended, and none shall be implied. I shall
not be liable for any loss or damage whatever, however arising: including, but
not limited to, damage to your equipment, loss of data, or financial loss,
either direct or indirect, whether or not caused by errors in the information.
This information is solely a result of my personal experiences in maintaining
my own home computers, running either DOS, Windows 95, 98SE or ME. I've never
owned a Windows NT, XP, Vista or 7 computer: their FAT32 structure may differ.
If you are not an experienced MS-DOS computer user, do not use this information.
You must pay for professional data recovery instead.
Subject to the foregoing, the provisions at ClitheroeKid.ihostfull.com/legal.htm
apply, and any dispute shall be governed exclusively by the laws of England.
If you do not agree the terms herein contained or referred to, you may not use
this page or any information provided by it or accessed through it.
--------------------------------------------------------------------------------
 |
Tip of the Day:
"The definition of insanity is doing the same thing over and over
and expecting different results" - Benjamin Franklin
"Data you don't have a backup of is data you don't want to keep"
- Anon
![Cutaway](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><rect fill-opacity="0"/></svg> "Cutaway")
_______________________
ABOUT THIS PAGE
_______________________
This page contains detailed instructions on how to backup and restore the key
sectors of a FAT32 hard disk (for any size of disk from ~32 MB to 127.53 GB).
Included are instructions on how to use those backups to recover from a disk
crash, and on how to recover from a disk crash even if you do not have those
backups (a rather more difficult problem).
A great deal of information about the data structure of a FAT32 hard disk is
included, in an attempt to provide an all-purpose DIY solution to disk repair
and data recovery for such a disk.
In terms of disk repair, this page tackles: (a) repairing the data structure of
a FAT32 disk which has suffered only data corruption (due to data being written
to the system area, overwriting the MBR, Boot Sector or FAT); and (b) repairing
a disk which has been physically damaged, including repairing bad sectors.
In terms of data recovery, this page explains how to safely copy files from a
crashed FAT32 hard disk to a new disk: how to install the new disk, and how to
safely copy the files to it (by cloning the old disk, to create an identical
bit-for-bit copy; or by copying just the files, either one-by-one or en mass).
Instructions are also included on recovering from common file system errors,
such as the "Blue Screen Of Death". Many other error messages generated by
the Windows 98/ME operating systems are also tackled.
Each section of this page includes recommendations on which software to use,
and details of how to use it most effectively. These are mostly DOS programs,
to enable you to carry out the work even where Windows can't load.
Included at the bottom of the page are download links to enable you to obtain
on-line the software referred to.
Back-up all of your data before running any of that software (except in so far
as you need to run the software in order to do that backup).
Note: This page can ONLY help in resolving a fault on a FAT32 hard disk;
and ONLY if the disk uses partition types 05, 0B, 0C and 0F only, and no other;
and if, but only if, the disk also matches all the requirements detailed below.
• The Batch File
A batch file is a plain text file with a filename that ends in .BAT
which, in its simplest form, contains a series of commands that could be
typed at the command prompt (i.e. the DOS prompt). The batch file stores
them, then runs them when you type its filename at the command prompt.
To write a batch file, you simply figure out what commands you would type
at a DOS prompt to achieve your desired result, then type them, one per line,
in a text file - and rename it with the .BAT extension.
You do not need to be an expert on MS-DOS batch files to use the batch file.
You only need to know a little about them: for example, that if you execute
(i.e. run) a batch file it won't execute any line which begins with "rem"
or with a double colon "::" as those are used to disable ("comment out") a line.
That file contains many different solutions; so it's best to make a copy of it,
and delete the sections that aren't applicable to your particular problem.
The file is self-explanatory and fully annotated. It contains all the information
on this page, for reference under MS-DOS (where your HTML browser can't be run).
View the contents of the batch file by using this command: SHOW RECOVERY.BAT
(to do so, the file SHOW.COM must be in your DOS path).
*** View the Batch file in DOS ***
SHOW RECOVERY.BAT
Here’s Wikipedia's summary of DOS commands for quick reference. Windows 98 & 98SE
run on MS-DOS version 7, and Windows ME runs on MS-DOS version 8. See also Google.
• Crash-course on Disk Structure
This page gives a crash-course (no pun intended!) on how to survive a disk crash.
Read this page through completely, before taking any steps. Then read it AGAIN!!!
Make sure you understand what has gone wrong before attempting any recovery action!
NB: At the very least, read Section A completely (which explains Disk Structures),
and then read it AGAIN, before attempting any action.
You will need a basic understanding of the structure of a FAT32 disk. You may have
one which has only a single partition (e.g. Drive C:), or you may have one which
has more than one partition (e.g. Drive C: and Drive D:). This page tries to provide
the necessary basic understanding, but you will find it helpful to also read up on
the subject through Google (e.g. search for information on both FAT32 and MBR).
A disk is divided into sectors (millions of them). Each sector is usually 512 bytes
long. Two sectors thus total 1024 bytes, or 1 KB (kilobyte). Depending on the size
of the disk, usually either 32 sectors or 64 sectors make 1 cluster. The disk stores
information (files) in a cluster: so a file might only be 1 byte of information, but
will still be alloted 1 cluster all to itself (even though a cluster is typically
64 sectors, i.e. 64 x 512 bytes = 32,768 bytes). So a cluster can contain a vast amount
of empty space, in addition to your file's data. A file is alloted as many clusters as
it needs; which clusters contain the file is recorded in the File Allocation Table (FAT).
A disk can contain more than one Partition. Each Partition begins with a Partition
Table sector (e.g. the MBR, or Master Boot Record, the first sector on the disk);
this is typically followed 63 sectors later by the Boot Sector, which is typically
followed 32 sectors later by the first sector of the FAT (File Allocation Table). The
FAT might be 20,000 sectors (or longer), depending on the partition's size. A second
copy (i.e. a backup copy) of the FAT typically follows immediately after the first FAT.
The Root Directory table then typically follows immediately after the second copy of
the FAT. The rest of the Partition contains your files.
This page provides routines for making a backup copy of all of these vital data
structures: MBR, Boot Sector, FAT, and Root Directory table. It also explains how to
reconstruct them if you don't have a backup copy of them. And it tells you where to
find the tools to use to automate as much as possible of the recovery process if you
don't have the necessary backup copies of those key sectors.
The most useful tool for gaining a practical working understanding of disk structure
is probably Norton's DiskEdit (DISKEDIT.EXE). The 2001 and 2002 versions (or later)
are needed for a FAT32 disk (because earlier versions either don't work at all for
FAT32, or only work if the disk is smaller than 8 GB). Norton DiskEdit includes tools
which will find for you the starting sector of the various data structures: such as
the Partition Table, Boot Sector, and each FAT.
CLONE the disk (carefully following the instructions below), as your first step:
before taking any recovery action! And carry out all recovery steps on the
clone disk (not on the damaged original), so that if things go wrong the original
is preserved and you can try again.
• What This Page Is Not
This page is NOT a guide to maintaining or repairing a FAT32 file system under
any version of Windows NT (including Windows XP, Vista or 7). Those NT variants
have built-in restrictions against using FAT32, designed to force the user into
using the NTFS file system instead. This page does not try to deal with the
differences arising out of the attempt to block the use of FAT32 on NT variants.
NB: For a complete description of the NTFS file system, go to www.ntfs.com
FAT32 partitions created by NT variants are NOT compatible with real FAT32
partitions (i.e. those created by 32-bit DOS or by 32-bit Windows 98/98SE/ME).
Do NOT use any information on this page in connection with a FAT32 partition
created by an NT variant. The so-called FAT32 structures on such a partition
will NOT match those on this page!
Furthermore, all of the software mentioned on this page is designed for use in
a computer with an x86 architecture running MS-DOS, Windows 98SE or Windows ME;
hence is unsuitable for use on the non-x86 Windows NT architecture, in critical
condition after a disk crash, in a DOS environment without Windows support.
FAT32 on Windows XP
Windows XP is crippled to prevent it creating a FAT32 partition larger than 32GB.
If a partition is larger than 32GB, it can't have been created by XP.
NB: If the partition size exceeds 32GB, Windows XP's Windows Disk Management
tool will NOT offer FAT32 as an option when formatting a partition.
If you must have a FAT32 partition, but have no safe means of creating one,
Windows XP can format a partition of 32GB or smaller as FAT32 if you type
the following command at the DOS Prompt (a.k.a. "Command Prompt") -
FORMAT X: /FS:FAT32 (where X is the drive letter)
NB: To open a DOS Prompt click on the START button, click on 'Run...',
then type CMD in the 'Open:' box which appears, then click on 'OK'
That procedure runs the program C:\Windows\System32\CMD.exe
Some online self-help forums recommend the following command instead, but
in my opinion this will format a partition as FAT16 -
FORMAT X: /FS:FAT (where X is the drive letter)
NB: Using a FAT16 command may cause partitioning to fail if partition
size exceeds the FAT16 design limit of 65,526 clusters (about 2 GB)
According to Microsoft, it is unsafe to format as FAT16 or FAT32 a partition
which exceeds the design limits of the FAT filesystem -
• FAT16 restricts the number of clusters to no more than 65,526
• FAT32 restricts the number of clusters to between 65,527 and 4,177,917
See below for full details of the maximum safe size of a FAT16 and a FAT32
partition. In brief, FAT16 partitions must not exceed about 2 GB and FAT32
partitions must not exceed about 126 GB. Those are built-in design limits.
NB: Partitioning may fail if you exceed those limits.
Further information: technet.microsoft.com/en-us/library/cc730730(v=ws.10)
• MKDOSFS : Make DOS File Sytem
Jens-Uwe Mager has ported the Linux mkdosfs tool to Windows. It enables you
to create a FAT32 partition exceeding 32GB from the Windows NT command line.
It cannot be used to format a partition on which Windows NT / XP / Vista / 7
will be installed, as those operating systems MUST run on an NTFS partition.
To format drive X you type: mkdosfs -v -F 32 -n volname X:
Notes: 1. The option -v (verbose) displays extra on-screen details
2. The option -F 32 specifies FAT32 (it uses FAT16 by default)
3. Use the option -n volname to specify the volume name / label
4. The size of the partition is read from the disk's Partition Table
For the Help screen, type mkdosfs (i.e. without any options).
WARNINGS • It uses unusual cluster sizes, typically 4 KB Clusters
• CHKDSK.EXE may fail, reporting 'Unable to test a RAW filesystem'
Download mkdosfs (Windows NT version): mkdosfs.zip
Further information: Jens-Uwe Mager's website
• SwissKnife
SwissKnife allows the creation of FAT32 partitions larger than 32GB in WinXP.
SwissKnife can't resize, move or delete a partition. Nor can it create a new
partition on a system's boot disk. It can, however, create FAT32 partitions
on, for example, an external disk (e.g. a disk attached to a USB port).
You might have to create the partition as NTFS (with any partitioning tool),
then use SwissKnife to convert that partition to FAT32. Some users have said
this is sometimes the only way to successfully use the program.
In partitioning an external disk, you must disconnect and reconnect the disk
afterwards to see the changes, or the partitioning may appear to have failed.
WARNING: It is ESSENTIAL to read the instructions and the help pages provided,
because SwissKnife is less straightforward than it at first appears.
Download SwissKnife here: Download
NB: Users say that although it functions successfully on a Windows XP system,
it reportedly does NOT work under Windows Vista or Windows 7. Some users
have even said it doesn't work under Windows XP Service Pack 3, although
some do report using it successfully with that Service Pack installed.
Others report that it DOES run in Windows Vista, if you set the program to
"WINDOWS XP MODE" (right-click the program's .EXE file, click 'Properties',
click 'Compatibility' tab, select 'Windows XP Service Pack 2', click 'OK').
• EaseUS Partition Master v9.1.1
Partition Master is a partition manager:
� Create and delete partitions
� Resize partitions, e.g. extend NTFS system partition
� Merge adjacent partitions into one without data loss
� Wipe data in unallocated space
� Wipe disk or wipe partition, to permanently erase sensitive data
� Convert FAT file system to NTFS
� Convert a dynamic disk to a basic disk
� Convert Primary partition to Logical partition or vice versa
� Speed up computer by defragmentation
� Disk surface test to check for bad sectors
� Rebuild MBR to repair ability to boot system
Program supports:
• Hardware RAID, multiple removable storage devices, MBR disks,
and GPT disks
• Partition sizes up to 2 TerraBytes (4 TerraBytes on GPT disks)
O/S: Windows 2000 / XP / Vista / Win7 SP1 / Win8 (32 bit & 64 bit)
Download Partition Master here: Download
• Other Partitioning Software
The following programs are reportedly capable of creating a FAT32 partition
exceeding 32 GB on a system running Windows XP (all these are freeware):
• FAT32 Format v1.01 for WinXP / Vista (a.k.a. guiformat.exe): Download
• TOKIWA's Fat32Formatter v1.1 for WinXP / Vista / 7: Download
• 2Tware's Fat32Format: Download
|
*** Set Path ***
Set DOSpath=%path%
PATH ;
SET PATH=%path%;F:\
*** Disk Cache for MS-DOS Mode ***
** To make the routines run faster **
C:\WINDOWS\SMARTDRV.EXE 8192 16>nul
** Alternative file location **
F:\SMARTDRV.EXE 8192 16>nul
^ Top of Page ____________________________ SECTION A: DISK STRUCTURES ____________________________ DISK STRUCTURES OUTLINED ======================== (Includes a note about Floppy Disks and USB Flash Disks) FAT32 FILE SYSTEM ================= The FAT32 file system is a method for storing files on a computer's hard disk, using magnetic storage. A disk may contain only a single partition, or can be sub-divided into two or more. A partition larger than 8GB must use the FAT32 file system, or it will not have enough addresses for file storage on the partition; and a partition smaller than that may use it. NB: A partition smaller than 8GB that is formatted for the FAT system will normally be using the FAT16 file system (often termed "FAT"). Such a disk can NOT be backed-up or repaired using the procedures or tools described on this page; data loss is certain if you do so. FAT32 uses 32 bits for each entry in the File Allocation Table (i.e. 4 bytes, as there are 8 bits in a byte: 4 x 8 = 32), so providing more addresses than FAT16 (which uses only 16 bits). NB: In some disk utility programs, FAT32 is called "BigFAT" and FAT16 is called "FAT". NB: The notes on this page are for the FAT32 file system only, on a computer running only Windows ME or Windows 98/98SE. Those Windows versions cannot access an NTFS partition. Note: Install the SysInternals program "NTFS for Windows 98" to read an NTFS partition in Windows 98/98SE/ME : NTFS98RO.EXE Note: Install the program "NTFS4DOS" to read an NTFS partition in DOS : NTFS4DOS.EXE v1.8 NB: This page does NOT describe a system that dual-boots (shares a partition with more than one Operating System), nor does it describe a disk that is larger than 127.53GB (but it does contain procedures for cloning such a disk). CHS ADDRESSING ============== CHS = Cylinder : Head : Sector Each sector (consisting of 512 bytes) has a CHS address. A FAT32 disk starts at Cylinder 0, Head 0, Sector 1 (CHS 0-0-1), and is typically structured as follows - Sector : There are normally 63 sectors per head (counted from 1 to 63) Head : There are normally 255 heads per cylinder (counted from 0 to 254) Cylinder : The maximum number of Cylinders is 1024 (counted from 0 to 1023; i.e. 1023 is the largest value in a Partition Table) NB: The maximum number will be less than 1023 if the disk is smaller than 8GB NB: If the disk is larger than 8GB, the number 1024 is used: meaning use LBA values (sectors only) instead of CHS Where the disk is larger than 8GB, Logical Block Addressing (LBA) is used for all critical disk functions instead of CHS, but some key disk structures nonetheless contain CHS values. NB: The largest possible CHS address is the 1,024th Cylinder (and this is commonly known as the 1024 Cylinder limit). If the BIOS supports a hard disk larger than 8GB, set it to LBA (Logical Block Addressing) or an error may occur (e.g. "The 1024 cylinder limitation has been exceeded"). NB: See also http://en.wikipedia.org/wiki/Cylinder-head-sector Technical Note: CHS addressing uses 10 bits for the Cylinder number (thus a maximum of 1,024 cylinders), 8 bits for the Head number (thus a maximum of 256), and 6 bits for the Sector number (thus a maximum of 64) - 210 = 2 x 2 x 2 x 2 x 2 x 2 x 2 x 2 x 2 x 2 = 1,024 28 = 2 x 2 x 2 x 2 x 2 x 2 x 2 x 2 = 256 26 = 2 x 2 x 2 x 2 x 2 x 2 = 64 However, the largest values hard disks traditionally use are 1,024 Cylinders, 255 Heads per Cylinder, 63 Sectors per Head. NB: For Heads per Cylinder, the largest value possible is 255 (not 256, the theoretical maximum), as 255 is the largest decimal number that a 2-byte hex value can store (FF hex). For Sectors per Head, the largest value possible is 63 (not 64, the theoretical maximum), as 0 is not used; i.e. the values used are 1 to 63, not 0 to 63. Multiplying these values together, at 512 bytes per sector, gives a maximum disk size of 8,422,686,720 bytes: 1,024 x 255 x 63 = 16,450,560 x 512 = 8,422,686,720 NB: 8,422,686,720 bytes � 1,000,000,000 = 8.42 GB 8,422,686,720 bytes � 1,073,741,824 = 7.84 GiB That is the largest disk size which can be addressed using the Int13h (Interrupt 13 hex) interface, i.e. CHS addressing. Larger disks must use Extended Int 13 functions (i.e. LBA). LOGICAL BLOCK ADDRESSING (LBA) ============================== An LBA sector is the same as a CHS sector: a 512 byte block of data. CHS cannot provide sufficient addresses for a disk exceeding 8GB, so LBA addressing must be used instead. LBA uses sectors only, treating the disk as a single unbroken chain of them. NB: LBA is an alternative to C-H-S addressing, giving only a sector number (instead of the traditional three numbers: Cylinder, Head and Sector). NB: In LBA the sectors begin with sector 0, whereas CHS values begin with sector 1; thus their sector numbering is always out-of-step with each other by 1. Formula to convert a CHS value into an LBA value: (Cylinders x Heads per Cylinder x Sectors per Head) + (Heads x Sectors per Head) + (Sectors - 1) This formula, in practice, is usually: (Cylinders x 255 x 63) + (Heads x 63) + (Sectors - 1) This formula is only of use if the disk is smaller than 8GB; a larger disk will have artificial (i.e. maximum) CHS values. This formula can, nevertheless, calculate the number of sectors on a disk from the CHS information printed on the disk's casing (since the disk label does not observe the rule that Cylinder values cannot exceed 1023, because this form of labelling is a convenient way to record the disk's "geometry" - see below). Convert using PT Calc: The program PTCALC.EXE (and PT Calc for Windows) can translate CHS values to LBA, and vice versa ("PARTITION TABLE EDITOR", below). Sanity Check of Partition Table: In the MBR Partition Table, the starting sector and ending sector of each partition is described by a CHS value. These should agree with the LBA values for "start sector" and "number of sectors", even though those LBA values are enough to define the partition. NB: If the partition ends beyond the 8GB boundary, the CHS value for the ending sector will be merely the maximum permitted (typically 1024-254-63). A Cylinder value of 1024 is a special value, indicating that LBA values are in use instead of CHS. The LBA start sector is stored directly in the Partition Table. To calculate the LBA end sector: ( "Start sector" + "Number of sectors" ) - 1 DISK GEOMETRY ============= The Disk Geometry will usually be 255 Heads per cylinder and 63 Sectors per head; 255 x 63 = 16,065 sectors per Cylinder. But don't just assume that, as other values are sometimes used. NB: Disk Geometry (the number of Cylinders - Heads - Sectors) can be read from the BIOS. It is also printed on a label on the Hard Disk's casing. To enter the BIOS, press the appropriate key (e.g. DEL) (on some systems, F1 or F2 or F11) repeatedly at startup. A sector is a real disk structure: a block of 512 bytes. But the terms 'Head' and 'Cylinder' are now mere conventionalisations; they are no longer related to the actual engineering structures. In a disk larger than 8GB all CHS values are unreal; CHS cannot address a disk larger than 8GB. But CHS values must be used in key disk structures, to ensure compatibility with the BIOS. So the CHS values used are typically the largest allowable values, i.e. 1023-254-63 or 1024-254-63 (or sometimes 512-254-63). NB: These CHS values are in what is known as "L-CHS" format, as they are CHS values that have been modified by LBA. The disk manufacturer will still typically label the disk with CHS values, but the values given are unreal. An 80GB hard disk will typically be labelled CHS 9729-254-63, but it does not have 9,729 cylinders within it, nor can a CHS value greater than 1024 be used in a Partition Table: that CHS value is merely a literal translation of the number of sectors on the disk. CHS values remain important because key BIOS functions are based on the Disk Geometry, by which is meant the CHS values: the number of Cylinders, Heads per cylinder, and Sectors per head. NB: The CHS value printed on the disk's casing, although unreal, is a convenient means of telling the user the Head and Sector values, which remain important (even though the figure given for the number of Cylinders is irrelevent, except for the key fact that the value exceeds 1,023). If you are unsure what the correct disk geometry is, try using the following values in the Partition Table, as one of these values is likely to be the correct one: (a) Sectors per Head: The most likely value is 63 (as almost all hard disks base their CHS values on this traditional number) (b) Heads per Cylinder: Try 255, 16, 32, 64, 128 and 240 (in that order). NB: The number FF in Hexadecimal (base 16) represents 255 in Decimal (base 10); thus 255 is the maximum decimal number that a 2-byte hex value can store. (Being the maximum value possible, 255 is the value most likely to be the correct one on a normal disk) The equivalent LBA sector number will be 1 less than the actual number (as LBA numbers start from 0 rather than 1). So the maximum LBA value in a Partition Table entry is 254 (i.e. 255 - 1 = 254). NB: Computers use Binary storage, so any factor of two that can be stored in a 2-byte hex value can be valid (i.e. 4, 8, 16, 32, 64, or 128). DISK SIZE ========= Disk Size in Megabytes - To calculate the size of a hard disk from its C-H-S values: (Cylinders x Heads per Cylinder x Sectors per Head) � 2,048 = MegaBytes To calculate the size of a disk from its LBA value: (LBA Sectors + 1) � 2,048 = MegaBytes Notes: 1. The LBA figure will be slightly greater, as the LBA calculation gives the true number of sectors on the disk. The CHS calculation only counts the number of sectors included in all the partitions; a few sectors are left unused, as partitioning rules demand that a partition MUST end on a Cylinder boundary (1 Cyl = 16,065 sectors). 2. To calculate the size of a Partition from its CHKDSK.EXE value: Kilobytes � 1,024 = MegaBytes Kilobytes � 1,048,576 = GigaBytes NB: Even if the hard disk has only a single partition that is NOT the size of the disk. It doesn't include the System Area (Track 0, Boot Sector, FAT x2, etc). 3. To convert from Bytes to MegaBytes: 1 MB = 512 x 2,048 (i.e. 2,048 sectors) = 1,048,576 bytes Bytes � 1,048,576 = MegaBytes MegaBytes x 1,048,576 = Bytes NB: 1 MB = 1,024 x 1,024 (i.e. 1,024²) 4. To convert from Bytes to GigaBytes: 1 GB = 1,048,576 x 1,024 = 1,073,741,824 Bytes Bytes � 1,073,741,824 = GigaBytes GigaBytes x 1,073,741,824 = Bytes NB: 1 GB = 1,024 x 1,024 x 1,024 (i.e. 1,024³) DISK SIZE LIMITATIONS ===================== A. BIOS LIMITATIONS A disk attached to the motherboard's ATA interface (a.k.a. the IDE interface) cannot exceed 137 GB, as the original ATA specification used 28 bits for sector numbers, in the interface between the BIOS, the Operating System, and the Hard Disk. As this gives a maximum of 2^28 sectors (i.e. 268,435,456 sectors), at 512 bytes per sector it imposes a maximum size of 137.4 GB for any disk connected to the IDE cables. For BIOS limitations that restrict disk size to less than 137 GB see http://www.dewassoc.com/kbase/hard_drives/hard_drive_size_barriers.htm B. WINDOWS LIMITATIONS There are four design limitations of Windows that limit the size of partition which Windows 95/98/98SE/ME can run on, as follows. Note: These limitations are included here for convenience. But whereas BIOS limitations restrict the size of the hard disk, Windows limitations are limitations of the Operating System only; hence they concern only partition size, not disk size. 1. ScanDisk and Defrag In Win 95B/98/98SE, the disk tools SCANDISK.EXE and DEFRAG.EXE are 16-bit applications. They accordingly have a maximum memory allocation of 64 KB less than 16 MB (i.e. 16,711,680 bytes). NB: The revised version of Windows 95 is known as Windows 95B or as Windows 95 OSR2 (Operating System Release 2). These tools cannot correctly process a File Allocation Table (FAT) if it is larger than that. As FAT32 uses 32 bits (i.e. 4 bytes) to record each cluster's address (hence the name FAT32), a FAT of 16,711,680 bytes can record a maxmum of 4,177,920 clusters: 16,711,680 � 4 = 4,177,920 The MAXIMUM partition size (including the 2 reserved clusters) that these tools can process, using the largest valid cluster size (32KB per cluster), is: 4,177,920 x 32,768 = 136,902,082,560 bytes Notes: 1. 32KB = 32 x 1,024 = 32,768 bytes 2. 136,902,082,560 � 1,048,576 = 130,560 MB 3. 136,902,082,560 � 1,073,741,824 = 127.5 GB Therefore, for compatibility with Windows 95 OSR2 / 98 / 98SE, 127.5 GB is the largest safe partition size. The versions of SCANDISK and DEFRAG in Windows ME do not have this limitation, and can be used with Windows 98 and 98SE also. As true 32-bit applications, they function on a partition of up to 512 GB. But a partition exceeding 127.5 GB could be damaged if accidentally used with an unmodified Windows 95 OSR2 / 98 / 98SE system. Calculation Notes: 1 MB = 1,048,576 bytes (512 bytes x 2,048 sectors) 16 MB = 1,048,576 bytes x 16 = 16,777,216 bytes 1 KB = 1,024 bytes (512 bytes x 2 sectors) 64 KB = 1,024 x 64 = 65,536 bytes Subtract 64 KB from 16 MB: 16,777,216 - 65,536 = 16,711,680 bytes Divide by 4 to convert to Clusters: 16,711,680 bytes � 4 = 4,177,920 clusters 2. ESDI_506.PDR Windows 95/98/98SE/ME do not support 32-bit addressing for IDE disks. Although they were intended to support 32-bit disk access, a fault in the IDE driver file (ESDI_506.PDR) resulted in it actually only using 28-bit LBA. Accordingly, the maximum possible partition size that Windows can recognise is 127.53 GB, the largest possible for 28-bit LBA. NB: The Windows ESDI_506.PDR driver file is only used by disks connected to the IDE ports. Therefore this partition size limit does not apply to disks connected to the PCI slots, which map as SCSI devices. NB: Some recovery programs and their documentation refer to 28 bit LBA, 32 bit LBA and 48 bit LBA as LBA28, LBA32 and LBA48 respectively. Workarounds for the ESDI_506.PDR fault: These workarounds will only work if the BIOS chip supports 48-bit LBA. If so, use any of the following in conjunction with a hard disk on the IDE cables that does not exceed 512 GB. • Workaround #1 Partition the disk into several partitions, each smaller than 127.53 GB, with a user-friendly program (e.g. Partition Magic v8.05) • Workaround #2 Patch the system, using one of the non-Micro$oft replacements for the defective Micro$oft ESDI_506.PDR file such as BHDD31.ZIP 3. 64 GB Barrier in Windows 98/98SE There is a fault in the Windows 98 and 98SE versions of FDISK.EXE and FORMAT.COM, which use 16-bit values in their calculations: which consequently 'overflow' if the disk size is 64GB or larger. The versions of FDISK and FORMAT in Windows ME do not have this fault, and can be used with Windows 98 and 98SE also. As true 32-bit applications, they function on a partition of up to 512 GB. Download the Windows ME version of FDISK.EXE here: http://www.dewassoc.com/kbase/download/263044USA8.EXE or here: http://support.microsoft.com/default.aspx?scid=kb;en-us;Q263044 There is no fix for FORMAT.COM, as the fault is only cosmetic. Whilst a partition is being formatted, the screen will show wrong information; but the formatting will nevertheless complete properly. 4. 32 GB Limit in Windows 95 Windows 95 does not support FAT32 partitions larger than 32 GB. If a computer has Windows 95 installed as its Operating System, then EVERY partition in that system will necessarily be 32 GB or smaller. NB: This applies only to Windows 95 OSR2 (Operating System Release 2), also known as "Windows 95B". The original release of Windows 95 ("Windows 95A") was a 16-bit O/S, and can only run on a FAT16 partition; it can't recognise any FAT32 partitions. Furthermore, a FAT16 partition cannot exceed 2 GB. PARTITIONS ========== A partition is a contiguous area of disk space (i.e. a single continuous region, without intervening data), usually defined by its size. Known also as a "Drive" or a "Volume". NB: It is an uninterrupted sequence (or chain) of sectors. Partition sizes are normally given in bytes (or, more commonly, Megabytes or Gigabytes), or in sectors (1 sector = 512 bytes). There are three kinds of partition: a. Primary : Normally the first partition on the disk. If there is only one partition, it is usually of this kind. A disk cannot have more than one Primary partition. NB: Sometimes called a "Primary DOS" partition, as it was historically associated with the DOS operating system. b. Extended : Not really a partition at all, but a container for Logical partitions; it may contain only one Logical partition, or it can contain several. A disk cannot have more than one Extended partition. c. Logical : A partition which can only exist within an Extended partition. Primary and Logical partitions can't be sub-divided. An Extended partition can be partitioned into smaller parts; but, alternatively, it can be fully occupied by a single Logical partition. Creating a Partition: The tool you MUST use to create a partition is Micro$oft's FDISK.EXE as this is the closest thing there is to a partitioning standard. Other partitioning programs are easier to use; but none has better compatibility with the infinite variety of hardware and software configurations which are possible in a modern computer system. Only use other tools, such as Partition Magic, for tasks which FDISK cannot handle. And ALWAYS use FDISK to partition new hard disks. Further information: • Fdisk information • FDISK - Guide to Hard Disk partitioning WARNING: You should not run CHKDSK or SCANDISK or any other disk scanning program if the disk has crashed, e.g. if there is a logical error in the Partition structures (Boot Record, FAT, or Root Directory). Running such programs in that situation can cause data loss. PARTITION SIZE ============== The disk space is divided into one or more separate Partitions (usually called "Drives"). These are the ranges for partition size: Type Min Partition Size Max Partition Size ----- ------------------ ------------------------------------- FAT12 1.5 KB 32 MB ( 33,472,512 bytes) FAT16 16 MB 2,047 MB (2 GB) (2,147,123,200 bytes) FAT32 ~32 MB 2,000 GB (2 TB) ( about 2^40 bytes) Note: If the partition is larger than 2GB it must be using FAT32. It can't be FAT16, because the partition could contain more than 65,526 clusters, which is the most FAT16 can address. Practical Limits: The above partition sizes are the theoretical limits, but the following practical restrictions also apply - 1. Although FAT16 cannot be used for a partition larger than 2GB, a disk of up to 4GB can have several FAT16 partitions on it, each not exceeding 2GB. 2. Large Disk Support (FAT32) is NOT available on disks smaller than 510MB. A FAT32 partition smaller than 510MB can only exist as one of several partitions on a hard disk larger than that. 3. Windows 98/ME can't address a FAT32 partition exceeding 127.53GB, and Windows XP can't create a FAT32 partition exceeding 32GB; so in practice those are upper limits for a FAT32 partition. Notes: 12-bit FAT (i.e. FAT12) is used by 1.44MB floppy disks. 16-bit FAT (i.e. FAT16) is commonly referred to simply as FAT by many disk tools (including FDISK.EXE and FORMAT.COM), and in documentation and Help files accompanying those programs. 32-bit FAT (i.e. FAT32) is sometimes referred to as "BigFAT" by disk tools, and in documentation and Help files. See also: http://en.wikipedia.org/wiki/File_Allocation_Table PARTITION STRUCTURE =================== It may help in understanding disk structure to think of a partition as starting with a Partition Table, followed 63 sectors later (i.e. 1 Head later) by a Boot Sector. NB: Technically, though, the Partition Table defines the Partition (as begining with the Boot Sector), and is NOT treated as being part of the Partition. The Boot Sector defines the 63 sectors containing the Partition Table as "hidden sectors", and they are NOT counted as part of the Partition by any disk tool. However, it is necessary to INCLUDE "hidden sectors" in calculating whether a partition is an exact multiple of 16,065 sectors. Examples: In the case of the Primary DOS partition, the Partition Table is in the MBR sector, at CHS 0-0-1; and the Boot Sector is in CHS 0-1-1 (i.e. 63 sectors later). In the case of Logical Partitions, the relationship is clearer: the 1st Logical partition is defined in the MBR as beginning with its Partition Table sector (the MBR points to that sector). NB: Technically, the MBR is defining the Extended partition, by pointing to the first sector of it (which happens to contain the Partition Table for the 1st Logical partition). As with the Primary partition, the 63 sectors containing the Partition Table are defined as NOT being part of the 1st Logical partition and are treated as "hidden sectors". Note on Partition Reconstruction: The Boot Sector usually contains all the necessary information (see below) to undelete the partition that it belongs to. Every partition begins with a Boot Sector, immediately preceeded by 1 Head (typically 63 sectors) containing a Partition Table. Thus a partition ends immediately before a sector that contains ONLY another Partition Table (not any boot code, because Logical partitions are not bootable): the sector will be entirely BLANK (i.e. filled with zeros), except for a 32 byte Partition Table. NB: A Logical partition can be bootable, but only in special circumstances not usually encountered (see below). To be valid, a Partition Table usually must be on a cylinder boundary (but see "PARTITIONING RULES", below, for exceptions). (NB: If it is not, it might be a backup copy created by a disk recovery tool) NB: A sector is on a Cylinder boundary if its LBA Sector Number + 1 is an exact multiple of 16,065 (see "PARTITIONING RULES", below) Regions in the Partition: A FAT32 partition is composed of three regions, laid out in the following order: # Region Notes - ------------------------------ ---------------------- 0 Reserved region Typically 32 sectors 1 FAT region FAT size in sectors x2 2 File and Directory Data region Remainder of partition NB: A FAT32 partition also contains a fourth region, Hidden Sectors, preceeding those listed; typically 63 sectors. PARTITIONING RULES ================== Partitioning rules demand that a partition MUST end on a Cylinder boundary (1 Cylinder = 255 x 63 = 16,065 sectors); i.e. every partition must be a multiple of 16,065 sectors. NB: This is a FUNDAMENTAL requirement. Data damage is a certainty if this rule is breached! NB: But this ONLY applies to the Primary DOS partition and the Extended Partition, not to the Logical partitions within the Extended Partition. However, the 1st Logical partition will obey this if it is the ONLY Logical partition and occupies ALL the space in the Extended partition. NB: This applies even if the partition uses LBA instead of CHS addressing. For backwards compatibility (with Windows 95) all FAT32 partitions must be a multiple of 16,065 sectors. Partitions are thus "cylinder aligned": they start and end on a cylinder boundary (even though a Cylinder is now only a logical, rather than a physical, disk structure). NB: For tools to convert LBA values to CHS, and vice versa, see below under PTCALC.EXE and CONVERSION CALCULATIONS Such a partition must begin with the CHS address xxxx-0-1 (i.e. the first sector of a cylinder), and must end with the CHS address xxxx-254-63 (i.e. the final sector of a cylinder). NB: The Partition Table will therefore be at CHS xxxx-0-1 and the Boot Sector will therefore be at CHS xxxx-1-1 Although Logical partitions (other than the 1st Logical partition) can begin part-way through a Cylinder, they nevertheless will NOT begin part-way through a Head; they always start at CHS xxxx-x-1. PARTITION TABLE =============== The Partition Table in the MBR sector defines: - one Primary partition (type 0C); - one Extended partition (type 0F) if any disk space remains. The Partition Table in the Extended partition defines: - one Logical partition (type 0B) within the Extended partition; - a further partition (type 05) if remaining disk space within the Extended partition permits. The Partition Table in a Type 05 partition defines: - one Logical partition (type 0B), filling the type 05 partition; - a further partition (type 05) if remaining disk space within the Extended partition permits. NB: There can be several Logical partitions on the disk - • Drive letters A: and B: are reserved for floppy disks. • Drive letter C: is reserved for the Primary partition. • Drive letters D: to Z: (23 drives!) are available for Logical partitions. Every Partition Table contains only two 16-byte entries (the other two entries are blank in FAT32) - 1. Entry No.1 defines the Start and End sectors of the current partition (e.g. the MBR defines the Primary DOS Partition) 2. Entry No.2 points to the Start sector of the NEXT partition (i.e. it points to its Partition Table sector, a.k.a. E-MBR) [Entry No.2 will be BLANK if there are no further partitions] 3. Entry No.3 is BLANK (16 bytes, all zero) 4. Entry No.4 is BLANK (16 bytes, all zero) In a WinME (or Win98/98SE) system using 32-bit FAT - 1. The Primary DOS partition will normally be type 0C (i.e. the 1st entry in the MBR's partition table will be type 0C). 2. The Extended partition, in which the Logical partitions are stored, will normally be type 0F (i.e. the 2nd entry in the MBR's partition table will normally be type 0F). NB: If the Extended partition ends at cylinder 1024 or later (i.e. the hard disk exceeds 8GB), the Extended partition must be type 0F. If it is not, data damage will occur. 3. Each Logical partition (INCLUDING the first) will normally be type 0B (i.e. the 1st entry in each E-MBR partition table, with which the Logical partition begins, will normally be type 0B). NB: Each partition table sector (other than the MBR sector at CHS 0-0-1) is called an Extended MBR (E-MBR) sector, because it's part of the Extended partition. 4. Each Logical partition (EXCEPT the first), although part of the Extended partition, will also be in an individual partition of its own, of type 05 (i.e. the 2nd entry, if any, in each E-MBR partition table will normally be type 05). If a partition table (in the MBR or any E-MBR sector) does NOT specify the normal partition type expected, check carefully to establish why! An abnormal partition type may cause data damage. Partition Table sector - • 1st sector in the Partition • 1st sector of the partition's Hidden Sectors PARTITION TYPES =============== ID types in a Partition Table - FAT32 typically uses four main partition types: 05, 0B, 0C and 0F (these are numerical values, expressed in hex: i.e. hexadecimal). NB: The procedures set out on this page are ONLY safe to use with a hard disk that has these partition types only AND NO OTHER 0C = FAT32 Primary DOS Partition, ending at cylinder 1024 or later Entry No.1 in the MBR Type: FAT32X (Type 0B with Interrupt-13 extensions) (i.e. FAT32 with LBA) ("Win95 FAT32 (LBA)") (NB: The normal type of FAT32 for a Primary partition larger than 8GB, i.e. where the 1024 cylinder limit is exceeded) Note: If the disk is bootable and contains only one partition, that will be a Primary DOS Partition (i.e. type 0C). NB: Same as type 0B, but with LBA (Interrupt 13 hex) extensions 0F = FAT32 Extended Partition, ending at cylinder 1024 or later Entry No.2 in the MBR Type: Extended X (Type 05 with Interrupt-13 extensions) (i.e. FAT32 with LBA) ("Win95 Extended") (NB: The normal partition type for an Extended partition on a disk larger than 8GB, i.e. where the 1024 cylinder limit is exceeded) NB: This is a container of partitions (NOT a container of data), as indicated by its being labelled an "Extended" partition. Note: If there is more than one partition, an Extended partition (i.e. type 0F) contains all of them except the first one. (The first one, of course, is the Primary DOS partition) Note: The 2nd partition is a Logical partition (i.e. type 0B), as are any further partitions (e.g. the 3rd, 4th, etc). Note: If there are only two partitions on the disk, the 2nd partition will normally completely fill the Extended partition. If the disk has three or more partitions, each Logical partition will occupy PART of the Extended partition, but without any overlapping. NB: Same as type 05, but with LBA (Interrupt 13 hex) extensions 0B = FAT32 Logical Partition ("Win95 FAT32") (NB: Originated in Windows 95) Entry No.1 in an E-MBR ALL Logical partitions on a FAT32 disk are type 0B Note: If a FAT32 disk contains more than one partition, the 2nd partition (i.e. the 1st Logical partition), and any subsequent partition(s), will each be type 0B. 05 = MS-DOS Extended Partition Entry No.2 in an E-MBR On a FAT32 disk a SECOND or subsequent Logical partition is contained in - and entirely fills - a partition of type 05 NB: This is a container of partitions (NOT a container of data), as indicated by its being labelled an "Extended" partition. Note: If there are MORE than two partitions on the disk, the 3rd partition (i.e. the 2nd Logical partition), and any subsequent one, each completely fills one type 05 partition. Hidden Partitions: 1B = Hidden FAT32 0B Partition 1C = Hidden FAT32 0C Partition (e.g. hidden IBM rescue partition) A hidden partition type starts with a 1, and an unhidden type starts with a 0. To hide a partition, change leading 0 to 1. For example: Type 0B is FAT32, and type 1B is Hidden FAT32. Warning for Windows 95: Types 0E and 0F can cause data loss in Win95 (but not in Win98 or WinME), if you exit from Windows to MS-DOS mode WITHOUT rebooting (although only if the Disk has more than one partition). This fault can be cured by installing the updated Windows 95 file DISKTSD.VXD v4.00.952 (dated 3/22/96), or any later version. NB: The earliest releases of Windows 95 used the FAT16 filesystem by default. Only Windows 95 OSR2 used FAT32 by default. These notes CANNOT be used as a guide to repairing a FAT16 disk. Note on FAT16: If the partition type is 06 the partition is using FAT16. This also means the partition size cannot be larger than 2GB. NB: A FAT16 disk cannot safely be repaired using any procedure set out here; there are crucial differences from FAT32 in the MBR, in the Partition Table, in the Boot Sector, in the Boot Record, in the File Allocation Table structure, and in the Root Directory table. Note on NTFS: If the partition type is 07 the partition is using NTFS. This also means the partition cannot be accessed by Windows 95/98/98SE/ME. NB: Partition type 17 is a Hidden NTFS partition. Note: Install the SysInternals program "NTFS for Windows 98" to read an NTFS disk in Windows 98/98SE/ME : NTFS98RO.EXE (which can READ from, but NOT write to, such a partition) NON-DOS PARTITION ================= The first 63 sectors on the Disk (CHS 0-0-1 to 0-0-63). For historical reasons, sometimes called "Track 0". NB: Although called the "Non-DOS Partition" this is NOT truly a partition at all, as it does not contain any user data. (As disks were once so small that they usually had only a single DOS partition, the name "Non-DOS Partition" arose) It starts at sector 1 (CHS 0-0-1) (LBA 0) and ends at sector 63 (CHS 0-0-63) (LBA 62); a hidden 63 sectors at the start of the disk. It contains the Partition Table for the entire Disk. NB: The LBA sector numbering starts at 0, whereas CHS sector numbering starts at 1; hence there is a discrepancy of 1. Sector 1 (CHS 0-0-1), the Master Boot Record (MBR), contains the Partition Table. All other sectors are usually blank; but special backup software sometimes stores recovery data in the 62 empty sectors, so it is prudent to make a backup copy of ALL the 63 sectors of Track 0. Examples: (a) Sector CHS 0-0-3 sometimes contains recovery data. (b) Sector CHS 0-0-9 typically contains a backup copy of the MBR sector from CHS 0-0-1. (c) Sector CHS 0-0-62 sometimes contains recovery data. (d) Sector CHS 0-0-63 sometimes contains recovery data. The name "Non-DOS partition", used for historical reasons, is misleading. This is NOT a partition: it contains NO user data. It's actually an essential part of ALL the partitions on the disk, because it contains the Master Partition Table. Master Boot Record (MBR) - The Master Boot Record is located in the first physical sector of the disk. It contains some executable code and the Partition Table. The executable code is loaded into RAM at boot time and executed. Its role is to determine which partition is the bootable one, and then to load and execute the code in the Boot Sector of that partition (which in turn loads the Operating System, i.e. Windows). FDISK's notorious /MBR command recreates the executable code in the Master Boot Record (but on Disk 0 only). NB: That command will be HARMFUL if any drive overlay software is installed (e.g. OnTrack Disk Manager), to handle large disks, something that is required only on a disk larger than 127.53 GB. The loader code in the MBR on such a disk is not standard code; the command will destroy the special loader code, so the disk will no longer be accessible. (The Partition Table information is also not the same on such a disk as it would be on a disk that does not have drive overlay software.) How OnTrack Disk Manager works: The MBR boot code loads a program located in CHS 0-0-10 and the following sectors, which installs a TSR program that replaces the BIOS code for interrupt 13h. NB: That command will also be HARMFUL if - (a) the Hard Disk has more than four partitions, or (b) the Hard Disk has dual-boot capability installed, or (c) the Hard Disk was originally partitioned using a SpeedStor utility from Storage Dimensions, with the /BOOTALL option. Structure of MBR Sector: Offset Nature Size -------- ------------------------- --------- 00(hex) Executable code 446 bytes 1BE(hex) 1st partition table entry 16 bytes 1CE(hex) 2nd partition table entry 16 bytes 1DE(hex) 3rd partition table entry 16 bytes 1EE(hex) 4th partition table entry 16 bytes 1FE(hex) Executable marker (55 AA) 2 bytes Executable Code: On a FAT32 hard disk, formatted by Windows 98/98SE/ME, the first 446 bytes of the MBR Sector normally look like this (in Hex and ASCII): < --------------- Hexadecimal --------------- > < -- ASCII --- > 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF --------------------------------------------------------------------------- 0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3��м |�P P �� | ] 0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ � PW�� �˾� � ] 0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u �� ��� � � ] 0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ �� It 8,t�� N� ] 0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ t�� � � ��F% ] 0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -�F � t � t ] 0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :�u+@�F% u$��UP� ] 0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A� Xr �U�u �� t ] 0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ ���V$� � � �f � ] 0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ � ��3Ƀ� �N ] 00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N � r)�F >�}U ] 00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ �tZ�� څ�u��' � ] 00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ ���R� F V � Z� ] 00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 00 00 00 00 [ �Ot�3�� � ] 00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3�VVRP SQ� V�� ] 00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR� B�V$� ZX d r ] 0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B�� ���^��tI ] 0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ] 0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ] 0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ] 0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ] 0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ] 0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ �� W��� ] 0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 ... [ ] Notes - 1. Hexadecimal: Base 16 (0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F). 2. ASCII: American Standard Code for Information Interchange (a set of 255 characters, including A to Z and 0 to 9). 3. For each 2-digit hexadecimal number in the above table, you can identify its (hexadecimal) address in the sector by combining the row number (hex) in the left-hand margin with the column number (also in hex) across the top; e.g. the number in the 3rd column of the 3rd line is 7C and its address is 22 hex: 0020 (left column) + 02 (top). Examples: Copies of sector CHS 0-0-1 are set out below, saved by the program MBRSCAN.EXE from several FAT32 disks, as examples of the correct code for this sector (see MBRSCAN RESULTS). CHS values in the MBR: If the disk is larger than 8GB, the only VALID numbers in the MBR are the LBA sector numbers (the numbers in the fields "sectors" and "sectors before"). The CHS values in the MBR are NOT correct as they stand: they are "L-CHS" values (see above); a conversion factor must be applied to them to calculate the true CHS values. Disk Serial Number: The six bytes DA to DF (bytes 219 to 224) in the MBR sector are a serial number, used by Windows to identify the different disks attached to the computer. [NB: In line 14, on a standard display] NB: Those six bytes are highlighted in green in the table above. They are shown set to zero in this example. If two hard disks have the same serial number, a fault will occur during bootup (because, in effect, both have the same "address"). The fault can be prevented, or repaired, by manually zeroing these six bytes (a.k.a. the "mystery bytes") on either disk. This forces Windows to allocate a new serial number to the disk, on the next bootup, thereby preventing a clash of disk addresses. NB: This serial number must NOT be confused with - (a) the hardware serial number, set by the disk's manufacturer (a.k.a. the "physical serial number"), on the disk's label; (b) the serial number that Windows allocates to each Partition (the Volume Serial Number), to allow it to differentiate between the different partitions [readable with CHKDSK.EXE]. This fault may cause the following errors:- 1. Windows may refuse to start. Restart in DOS, and use a Disk Editor (below) to set the six bytes to 00 (zero hex), on either disk. 2. Windows may WIPE the system registry. The registry can be restored in DOS from the backups in C:\WINDOWS\SYSBCKUP by using the following commands (and then carrying out the on-screen instructions): SET PATH=%path%;C:\WINDOWS\COMMAND SCANREG /RESTORE 3. Windows may change the Volume Identifier on the affected disk, setting it as non-bootable. If it's subsequently installed as the Primary Master, the computer will not boot. Use PowerQuest's Partition Table Editor to set the Primary DOS partition on the disk to "active" (i.e. bootable). Alternate MBR Type: In practice, the following MBR sector is sometimes encountered. This is (informally) the "90 E9 7D 01 FA" variant, as it always begins with those 5 bytes. They immediately preceed the three bytes "33 C0 8E" which typically begin a standard MBR in FAT32 (see above). The first 446 bytes of this variant (i.e. the beginning of the sector, prior to the Partition Table) are usually in the following form: < --------------- Hexadecimal --------------- > < -- ASCII --- > 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF --------------------------------------------------------------------------- 0000: 90 E9 7D 01 FA 33 C0 8E-D0 8E C0 8E D8 BC 00 7C [ �} �3��Ў��ؼ | ] 0010: 8B F4 FB BF 00 06 B9 00-01 F3 A5 BB 20 06 FF E3 [ ���� � � �� ] 0020: 90 90 BE 7D 07 81 3C AA-55 75 11 E8 58 00 73 0C [ �} �Uu �X s ] 0030: E8 65 00 72 07 E8 B1 00-72 3B EB 2C BE 7D 07 C7 [ �e r � r;�,�} � ] 0040: 04 00 00 BA 80 00 BE BE-07 B9 04 00 F6 04 80 75 [ �� �� � � �u ] 0050: 07 83 C6 10 E2 F6 EB 1D-8A 74 01 8B 4C 02 BB 00 [ �� ��� �t �L � ] 0060: 7C B8 01 02 CD 13 72 0D-81 3E FE 7D 55 AA 75 05 [ |� � r >�}U�u ] 0070: EA 00 7C 00 00 BE 6A 07-AC 0A C0 74 FE BB 07 00 [ � | �j � �t�� ] 0080: B4 0E CD 10 EB F2 BB 00-7E C6 07 13 C6 47 01 00 [ � � �� ~� �G ] 0090: B2 80 B8 00 E0 CD 13 C3-BF 00 7E BA F0 01 B3 A0 [ ��� �� ÿ ~�� � ] 00A0: E8 84 00 72 0C B1 01 E8-48 00 72 05 E8 19 00 73 [ � r � �H r � s ] 00B0: 16 F6 C3 10 75 05 80 CB-10 EB E5 81 FA 70 01 74 [ �� u �� �� �p t ] 00C0: 05 BA 70 01 EB D8 F9 C3-81 BD FE 01 55 AA 75 17 [ �p ���� �� U�u ] 00D0: 8B 75 02 81 FE BE 01 77-0E 03 F7 81 3C AA 55 75 [ �u �� w � �Uu ] 00E0: 06 F6 44 02 01 75 01 F9-C3 BF 00 7C B1 0A E8 01 [ �D u �ÿ |� � ] 00F0: 00 C3 52 57 83 C2 02 B0-01 EE 42 8A C1 EE 42 32 [ �RW�� � �B���B2 ] 0100: C0 EE 42 EE 42 8A C3 EE-42 B0 20 EE E8 33 00 EC [ ��B�B���B� ��3 � ] 0110: 24 FD 3C 58 75 0D 83 EA-07 B9 00 01 FA F3 6D FB [ $� Xu �� � ��m� ] 0120: F8 EB 01 F9 5F 5A C3 52-83 C2 07 EC A8 80 75 0F [ �� �_Z�R�� 쨀u ] 0130: 4A 8A C3 EE 42 EC 24 D0-3C 50 75 03 F8 EB 01 F9 [ J���B�$� Pu �� � ] 0140: 5A C3 51 8B 0E 6C 04 83-C1 12 81 C2 FF 01 EC 8A [ Z�Q� l �� �� � ] 0150: E0 80 E4 D8 80 FC 58 74-06 3B 0E 6C 04 75 EF 81 [ ����Xt ; l u� ] 0160: EA FF 01 B9 00 20 E2 FE-59 C3 0D 0A 45 72 72 6F [ �� � ��Y� Erro ] 0170: 72 20 4C 6F 61 64 69 6E-67 20 4F 53 00 AA 55 00 [ r Loading OS �U ] 0180: 00 E9 80 FE 00 00 00 00-00 00 00 00 00 00 00 00 [ �� ] 0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 ... [ ] Notes - 1. Excludes the final 66 bytes of the sector, which are unique to each disk (because they contain the Partition Table). 2. I have come across this variant of the MBR sector so infrequently that I can't be certain whether it is always in this exact form! 3. Win NT/XP/Vista/7 stores a 4-byte Disk ID in bytes 01B8 to 01BB (hex); so those bytes, at least, are not always in the form set out above. This Disk ID will only be present if the disk has on at least one occasion been connected to a computer running Windows NT/XP/Vista/7. [NB: Bytes 1B8 to 1BB are highlighted in green in the above table] 4. The final two bytes of the sector are always "55 AA". 5. As the MBR is non-standard, the Boot Sector is likely to be so too. NB: I have seen this variant with FAT32 hard disks and with NTFS disks. Partition Table The Partition Table is located in the MBR Sector (CHS 0-0-1) at offset 1BE hex (byte 447). The Partition Table (64 bytes) contains four 16-byte entries. (NB: Any not in use will be empty, i.e. filled with zero's) The format of each 16-byte entry (see PTEDIT.EXE, below): - Boot indicator (00 = Not active; 80 = Bootable) (1 byte) - Starting Head number (0 to 254) (1 byte) - Starting Cylinder number (0 to 1023) (10 bits) and starting Sector number (1 to 63) (6 bits) (2 bytes) - Partition Type (Entry No.1 = 0C; Entry No.2 = 0F) (1 byte) - Ending Head number (0 to 254) (1 byte) - Ending Cylinder number (0 to 1023) (10 bits) and ending Sector number (1 to 63) (6 bits) (2 bytes) - Relative sectors (see note, below) (4 bytes) - Number of sectors in the partition (4 bytes) This data in the Partition Table tells the Operating System where each partition starts and ends on the disk, how big that partition is, whether it's bootable, and the type of filesystem it contains. NB: If the partition has fewer than 65,527 clusters, Windows treats it as a FAT16 filesystem. Otherwise, Windows treats it as FAT32. Number of Clusters = No. of Sectors in the partition � No. of Sectors per Cluster If 16K clusters (i.e. 32 sectors per cluster):- Number of Sectors in the partition / 32 If 32K clusters (i.e. 64 sectors per cluster):- Number of Sectors in the partition / 64 The 'Ending cylinder number' is meaningless. 'Starting sector' and 'Number of sectors in the partition' are enough to identify the partition: Partition type 0F uses INT 13 Extensions which use those two numbers as LBA addresses, and does not use the 'Ending cylinder number'. NB: Where a CHS value is meaningless, it might be not fatal if that value is incorrect! CHS values in the Partition Table: A single byte can hold a number up to 255 (FF hex). On this basis, a disk would have a limit of 255 cylinders, 255 heads & 255 sectors. For the Heads byte, this is in fact the case; but the other two bytes are manipulated to allow for larger numbers. Thus the Sector number is stored as a 6 digit binary number, and the Cylinders as a 10 digit binary number. To fit the byte structure of 8 bits to a byte, the first two digits of the Cylinder number are chopped off and put on the front of the Sector number. It gives a limit of 1023 cylinders, 255 heads, and 63 sectors (i.e. 8GB). 16 Bits (numbered 0 to 15) [Cylinder = 10 bits, Sector = 6 bits]: 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Cylinder bits 7 to 0 Cyl bits 9 & 8 Sector bits 5 to 0 Example: The number 957F hex - Hex values : Byte #1 = 95 (hex) Byte #2 = 7F (hex) Step 1: Convert those Hex numbers to Binary. Step 2: Assign the resulting two 8-bit binary numbers to two 8-bit registers (8 bits in a byte) as follows - Bit # 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Binary 1 0 0 1 0 1 0 1 0 1 1 1 1 1 1 1 Step 3: The Cylinder value is derived from reading the Bits in the following order (i.e. the "Cylinder bits"): 7, 6, 15, 14, 13, 12, 11, 10, 9, 8 In this example, doing so gives the Binary number 0110010101 which is 405 in decimal (Cylinder 405) Step 4: The Sector value is derived from reading the remaining Bits in the following order (i.e. the "Sector bits"): 5, 4, 3, 2, 1, 0 In this example, doing so gives the Binary number 111111 which is 63 in decimal (Sector 63) 4-Entry Structure: The fact that the Partition Table has four entries imposed a limit of four partitions on FAT16 disks, as each partition required one of the Partition Table entries. This four-entry structure is retained on FAT32 disks for backward compatibility with FAT16-based Operating Systems and disk tools; but FAT32 can have an unlimited number of partitions. FAT32 uses only the first two entries in the Partition Table. The 1st entry defines the current partition (start sector and length), and the 2nd entry points to the start of the next partition. FAT32 partitions are thus linked together ("chained") by a series of Partition Table sectors, starting with the MBR. NB: A partition table sector at a location other than CHS 0-0-1 (i.e. located within the Extended partition) is known as an Extended MBR (E-MBR). NB: Some sources will tell you, incorrectly, that a partition table sector is called an EBR (Extended Boot Record). There is in fact no boot code in it, since it contains only the partition table. In the FAT32 filesystem, an Extended Partition is not bootable. Nor would it be wise to describe it as an extended Boot Record, as that would risk confusing it with the partition's actual Boot Record, which typically follows 63 sectors later. Relative Sectors: In the MBR (sector CHS 0-0-1), the column "Relative Sectors" specifies the starting sector of each partition (i.e. usually the Primary and Extended partitions), in LBA format. Thus, in the MBR, "relative sectors" means the number of sectors from the start of the disk. E-MBR "Relative Sectors": In an E-MBR partition table, the field "relative sectors" means the number of sectors from the 1st sector of that Logical partition (except in the link to the next Partition Table). In the link to the next Partition Table, "relative sectors" means relative to the start of the entire Extended partition. NB: What this means in practice is that the "relative sectors" field in Entry No.1 in an E-MBR Partition Table is relative to the first sector of the current partition; but that this field in Entry No.2 in an E-MBR Partition Table is relative to the first sector of the entire Extended Partition. In the 1st Logical partition, these values will be the same. But in any 2nd or subsequent Logical partition, the value in Entry No.2 will always be much greater than in No.1. NB: The Extended Partition is defined in the MBR (sector 0-0-1), i.e. in Entry No.2 of the MBR's Partition Table. Each of the subsequent Partition Tables defines only a Logical partition. Windows NT Disk ID: The MBR may contain a Windows NT disk signature, a 32-bit value intended to uniquely identify the disk (as opposed to the Drives - the two are not necessarily the same with removable hard disks). Windows NT/XP/Vista/7 use this as an index to all the partitions on any disk ever connected to the computer under that O/S. Thus it will only be present on a disk which has, on at least one occasion, been connected to a computer running Win NT/XP/Vista/7. It is stored in the 4 bytes 01B8 to 01BB (hex), highlighted in green in the above table. Note on PTEDIT.EXE: PowerQuest's Partition Table Editor (PTEDIT.EXE) is confusing, in that it doesn't display the Non-DOS Partition (LBA 0 to 62) (because that is not a real partition). The first partition it shows is the Primary DOS partition. NB: Beeblebrox.exe, an alternative Partition Editor, might be easier to understand. It's a little less confusing, as it gives additional information in its Status line. MBR Backup Sector: A backup copy of the MBR is usually stored in the 7th sector of the disk, i.e. at CHS 0-0-7 (LBA 6). The ultimate sanity test for the MBR is whether it matches the contents of this backup copy. Note on Windows XP: A FAT32 disk partitioned using the Windows XP partitioning tools will not boot. The data written to the offset-from-start-of-disk field is faulty; WinXP incorrectly writes the offset from the start of the Extended partition there. It also makes errors in the chain of Partition Tables for the Logical partitions within the Extended partition. MBRWIZD.EXE =========== MBR Wizard for DOS v2.0b (MBRWizD.exe) can supply information about the MBR (Master Boot Record) on the IDE Primary Master hard disk (known as disk 0), and automate some of the repairs to that disk. NB: This program numbers IDE hard disks from zero (as 0, 1, 2 and 3), and the program can ONLY adjust disk 0 (the IDE Primary Master). [Some functions in the latest version support other disks too!] Only Primary and Extended partitions can be displayed and modified by the program; it does not support Logical partitions. The program can only be run in pure DOS, not in a Windows DOS Box. Syntax - Usage: MBRWizD [/option] /List List MBR Entries /Disk=# Selects the disk to use, defaults to '0' if not specified /Part=# Specifies partition to use, defaults to '0' /Sector=# Specifies sector (or sectors) to use for certain operations /Save=x Saves MBR to filename 'x', or first head using /Sector=head /Restore=x Reads and restores the MBR from filename 'x' /Show=x Shows contents of MBR backup file 'x' /Wipe=x MBR=Wipes MBR, HEAD=Wipes first head, 3=Wipes range of sectors /Sort Sorts MBR Entries by physical location on disk /IsSorted Returns 0 if MBR partitions are already sorted /Hide=# 1=Hides partition, 0=Unhides partition /Active=# 1=Sets the partition bootable, 0=Sets it inactive /Del Deletes the partition specified by /Part /Type=# Modifies the specified partition type to # /Shutdown=# 1=Reboot /Copy=# Copies sector identified by /Sector to '#' /WriteIni=x Writes structured disk and partition info to filename 'x' /WipeDisk=# Securely erases the entire contents of disk, 1=writes all zeros /Signature Returns disk signature, or writes new signature with =xxxx /Status Shows the status flag, or writes new status with =x /BootMenu Allows user to select an active partition from a menu /Msg=# Hides the status message displayed upon program exit /Confirm Automatically answers 'Yes' /Ignore Ignores Errors and continues processing /Result Shows Errorlevel code on program exit Make a Backup of the MBR: Before making any changes to the MBR, make a backup copy of it which the program can restore if necessary. The program can ONLY save and restore a copy of the MBR for the 1st IDE disk (Disk 0). *** Save a Backup copy of the 1st disk's MBR to a file *** ** (e.g. save it on drive A, in a file named MBR.dat) ** MBRWizD /Save=A:\MBR.dat *** Restore the Backup copy of the 1st disk's MBR *** MBRWizD /Restore=A:\MBR.dat Show the Partition Structure: The program can show details of the partitions on the 1st disk (Disk 0), and provide additional information about that disk. *** Show the Partition details of the 1st disk *** MBRWizD /List Set a Partition as Bootable: A hard disk must have only ONE partition set as bootable ("active"). This can be achieved for the 1st IDE disk (disk 0) using MBRWizD. NB: A hard disk need NOT be bootable, unless it has Windows installed on it AND is intended to be the disk which starts-up the computer. Such a disk will normally be installed as the IDE Primary Master, the 1st disk on the system (known to MBRWizD.exe as "Disk 0"). *** Set the 1st partition on the 1st disk as Bootable *** MBRWizD /Active=Yes /Disk=0 /Part=0 *** Set the 2nd partition on the 1st disk as Non-bootable *** MBRWizD /Active=No /Disk=0 /Part=1 *** Set ALL the partitions on the 1st disk as Non-bootable *** MBRWizD /Active=No /Disk=0 /Part=* Note - To carry out a repair, it may be best to first set ALL the partitions on disk 0 as Non-bootable; and secondly to then set the 1st partition on that disk as bootable (as this is sure to work, and with least complications) Hide or Unhide a partition: To boot from a hard disk on which Windows is installed in a partition that is NOT the first partition on the disk, hide all earlier partitions. The program can ONLY do this on IDE disk 0. *** Hide the 1st partition on the 1st disk *** MBRWizD /Hide=Yes /Disk=0 /Part=0 *** Unhide the 2nd partition on the 1st disk *** MBRWizD /Hide=No /Disk=0 /Part=1 *** Unhide ALL the partitions on the 1st disk *** MBRWizD /Hide=No /Disk=0 /Part=* Change the Partition Type: The program can alter the Partition Type recorded in the MBR for an existing partition (i.e. change it to match the actual type of partition which the drive contains), though only on disk 0. NB: This only CORRECTS the partition type recorded in the MBR. It does NOT convert the partition to a different type! *** Change the Partition Type of the 1st partition to 0C (hex) *** ** The Primary Partition on a FAT32 disk is ALWAYS type 0C ** MBRWiz /Part=0 /Type=0Ch PRIMARY DOS PARTITION ===================== This is the first partition on the Disk that is recognised by DOS and Windows. It starts at CHS 0-1-1 (LBA sector 63). NB: Its correct name is the Primary DOS Partition; but it's often referred to loosely as simply the "Primary Partition". Also, some DOS programs call it just "Primary DOS". It is defined in the MBR Partition Table (at CHS 0-0-1) (LBA 0), which specifies its 1st sector (always CHS 0-1-1) (LBA 63), and its length in sectors. Bootable: The Disk is bootable if the Primary DOS partition is marked as "active" in the MBR's Partition Table (at CHS 0-0-1). NB: Only the Primary DOS partition can normally be bootable. A Logical partition can't be set as "active" (i.e. bootable), unless the earlier partitions have Hidden partition types. Hidden Sectors - Technically, the Primary partition begins with 1 Head (63 sectors) containing the MBR sector. Not counted as part of the partition by any disk tool, these are known as "hidden sectors". The "hidden sectors" occupy CHS 0-0-1 to 0-0-63 (LBA 0 to 62), i.e. Track 0 ("Non-DOS partition"). This immediately preceeds the Boot Record. Boot Record - The partition's Boot Record is comprised of 3 sectors (the first 3 sectors of the partition): • CHS 0-1-1 (LBA 63) : Boot sector • CHS 0-1-2 (LBA 64) : FSInfo sector • CHS 0-1-3 (LBA 65) : Boot Data sector NB: Sometimes called the "Extended Boot Record", because the old FAT16 boot record had only a single sector. Boot Sector - Located in the 1st sector of the Partition (CHS 0-1-1) (LBA 63), incorporating the BIOS Parameter Block (BPB), the Extended BPB, and the Initial Program Loader (IPL) code. On a FAT32 hard disk, formatted by Win98/98SE/ME, the Boot Sector looks similar to this (in Hex and ASCII). 32 lines of 16 bytes each:- < --------------- Hexadecimal --------------- > < -- ASCII --- > 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF ---------------------------------------------------------------------------- 0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ �X MSWIN4.1 ] 0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ] 0020: FC 8A 38 01 08 27 00 00-00 00 00 00 02 00 00 00 [ ��8 ' ] 0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0040: 80 00 29 DF 0D 00 00 44-52 49 56 45 20 43 20 20 [ � )� DRIVE C ] 0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ] 0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ] 0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ] 0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ] 0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ] 00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ] 00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ] 00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ] 00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ] 00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ] 00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ] 0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ] 0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ] 0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ] 0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ] 0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ] 0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ] 0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ] 0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ] 0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ] 0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ � Disk I ] 01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error� Inser ] 01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ] 01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ] 01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ] 01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ] 01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ] The Boot Sector set out above is an EXAMPLE only, though in practice much of the sector will be identical on every FAT32 disk, as this sector uses standard values at many points (for historical reasons). The following notes explain the contents of the sector, and can assist in interpreting or reconstructing an actual Boot Sector: Size Comment Example No. ------- --------------------------------------------- -------- ----- 2 bytes Jump instruction (jump to IPL boot code) EB58 01-02 (NB: Valid options for 1st byte are EB or E9) [i.e. jump over next 88 bytes (58 hex = 88)] 1 byte NOP instruction 90 03 8 bytes OEM ID - Name of formatting Operating System MSWIN4.1 04-11 (start of BPB) (53 bytes) 2 bytes Number of bytes per sector [200 hex = 512] 200 12-13 (NB: This MUST be 512 bytes, i.e. 200 hex) 1 byte Number of sectors per cluster [40 hex = 64] 40 14 (NB: 08 hex = 8; 10 hex = 16; 20 hex = 32) (NB: 64 sectors = 32KB; 32 sectors = 16KB) (NB: Cluster size must NOT exceed 32KB) 2 bytes Number of reserved sectors [NB: 20 hex = 32] 20 15-16 (Number of sectors before the first FAT) (32 sectors = CHS 0-1-1 to CHS 0-1-32) (NB: 3 sectors are used for the Boot Record, and 3 are used for the backup Boot Record; but the remainder are unused and blank) 1 byte Number of File Allocation Tables (always 2) 2 17 (NB: This value MUST be 2, as otherwise many software programs will not function properly) 2 bytes No. of Root Directory sectors (zero in FAT32) 0000 18-19 (NB: In FAT32, there is NO limit to the number of files that can be stored in Root) 2 bytes Total number of sectors (Not used in FAT32) 0000 20-21 (Small Sectors field; must be 0 under FAT32, the Large Sectors field is used instead) 1 byte Media Descriptor (Hard Disk = F8) F8 22 (NB: Must be F8 on non-removeable media) 2 bytes Number of Sectors per FAT (Must be 0 in FAT32) 0000 23-24 (NB: See 'Big Sectors per FAT' instead, below) 2 bytes Number of Sectors per Head [3F hex = 63] 3F 25-26 2 bytes Number of Heads per Cylinder [FF hex = 255] FF 27-28 4 bytes Number of Hidden sectors [3F hex = 63] 3F 29-32 (Number of sectors in the Non-DOS partition) (i.e. sectors CHS 0-0-1 to 0-0-63: Track 0) 4 bytes Total number of sectors in this partition 33-36 (a.k.a. "Large Sectors"/"Big Total Sectors") (NB: MUST be non-zero in a FAT32 partition!) 4 bytes Number of Sectors per FAT (FAT32 only) 37-40 (The number of sectors occupied by each FAT) (NB: Also known as 'Big Sectors per FAT') 2 bytes FAT handling flag (Enables FAT mirroring, 0000 41-42 if set. If mirroring is enabled, all copies (i.e. both copies) of the FAT are updated) [NB: If set as 0, FAT mirroring is ENABLED] 2 bytes File system version (Always zero in Win9x) 0000 43-44 4 bytes Cluster number of the 1st cluster of Root 2 45-48 Directory (usually 2, unless if bad sector) (NB: 1st cluster of Root Directory Table) 2 bytes File system info sector (FS Info Sector) 0001 49-50 (The number of the sector in this partition occupied by the FS Info sector) (usually 1) (Sector count starts at 0; so 1 = CHS 0-1-2) (NB: Must be within Reserved Sectors area) 2 bytes Backup Boot Sector (NB: Always 6) 0006 51-52 (The number of the sector in this partition occupied by the Backup Boot Sector) (Sector count starts at 0; so 6 = CHS 0-1-7) 12 bytes Reserved (Value of all 12 bytes always zero) 00 (all) 53-64 (end of BPB) (start of Extended BPB) (26 bytes) 1 byte Disk ID (Floppy = 00 hex, Hard Disk = 80 hex) 80 65 1 byte Reserved for NT (Value is always zero in Win9x) 00 66 1 byte Extended Boot signature (Usually 29 hex) 29 67 (NB: If value is 29, the Extended BPB contains also a Volume Serial Number & a Volume Label) 4 bytes Volume Serial Number (A random serial number, 68-71 created by FORMAT.COM to differentiate Drives) 11 bytes Volume Label (Some bytes may be spaces, 20 hex) DRIVE C 72-82 (NB: This is user-defined, any ASCII characters) 8 bytes File System type (a.k.a. File System ID) FAT32 83-90 (This is NOT conclusive: Windows does NOT read this value, it determines the FAT type SOLELY from the number of clusters in the partition!) (end of Extended BPB) Total = 90 bytes (Address: 00 hex to 59 hex, inclusive) 404 bytes The IPL (Initial Program Loader) boot code 91-494 (which passes control to the Operating System in the Active partition) 16 bytes Partition Table (Defines the partitions) 495-510 2 bytes The Signature bytes (NB: Always 55AA) 55AA 511-512 (NB: MUST occupy this location EVEN if the partition does NOT use 512 bytes per sector) Total = 512 bytes (Address: 00 hex to 1FF hex, inclusive) Notes - (1) Wherever an entry comprises 2 or more bytes, as usual these are read from right-to-left (i.e. little endian). See also: http://en.wikipedia.org/wiki/Endianness (2) A number followed by the letter h means a Hexadecimal number. (3) The BPB is also known as the Drive Parameter Block (DPB). Examples: Copies of sector CHS 0-1-1 follow (below), saved by the program MBRSCAN.EXE from several disks, as examples of the correct code for that sector. Further Information - Read Microsoft's hardware white paper, FAT: General Overview Jump Instruction (3 bytes): Instructs the computer to jump to the first byte of executable code (the first byte after the BPB and Extended BPB). Thus the jump is 88 bytes (88 = 58 hex), to byte 5A hex, which is the first byte of the Initial Program Loader (IPL) code. NB: The first 3 bytes (EB 58 90) are called the Jump Instruction, but only the first two bytes are the actual JMP instruction (a two-byte SHORT jump, executing a jump to the executable code). The third byte (90 hex) is just a NOP instruction [NOP = 'No Op', i.e. do nothing]. NB: The MBR transfers CPU execution to the Boot Sector, so the sector must contain valid executable x86 CPU instructions. This is why there must be a jump instruction; to skip the non-executable bytes of the BPB and extended BPB. OEM ID (8 bytes): Following the jump instruction is the 8-byte OEM ID (MSWIN4.1), a string of characters that identify the name and version number of the Operating System which formatted the partition. BIOS Parameter Block (BPB) (53 bytes): The BIOS Parameter Block (BPB) [or Drive Parameter Block (DPB)] is a structure DOS creates. It starts at byte 12 (offset 0B hex) in the Boot Sector, the 1st sector of the partition. If the BPB/DPB is invalid, Windows 9x can't format the partition. Extended BPB (26 bytes): The Extended BPB is a feature of FAT32, thus is present in Windows 95 OSR 2 and later. It is NOT present in FAT16. Media Descriptor (1 byte): The media descriptor byte, located at byte 22 (offset 15 hex), identifies the type of disk and the type of filesystem: F8 (hex) means a hard disk, with a FAT32 filesystem 06 (hex) means a hard disk, with a FAT16 filesystem NB: The File Allocation Table (FAT) also contains a media descriptor (located in the 1st byte of the FAT entry for cluster 0). It must be the same type as is specified in the Boot Sector! As the backup FAT (FAT2) is a copy of the main FAT, the same media descriptor must also appear in the 1st byte of FAT2. ScanDisk and ScanDisk for Windows check only the media descriptor in the FAT, not the media descriptor in the Boot Sector; so they CANNOT be relied on to detect an error. If the error is in the Boot Sector, they will not detect that error. Total Sectors (4 bytes): This value is stored in bytes 33-36. If the Total Sectors value is less than the Disk Size value, this does not indicate a fault. It is quite common to have fewer sectors in the partition than exist on the disk. All it means is some disk space is being wasted. It does not by itself mean the partition structure is damaged. But if this value is LARGER than the Disk Size value, the partition is faulty: it extends past the end of the disk, or it overlaps the next partition. If this fault is not fixed severe data loss will occur. Number of FATs (1 byte): This value is stored in byte 17. The reason the usual value in this field is 2 is to provide redundancy: so that if a sector goes bad in one FAT that data is not lost, as it is duplicated in the other FAT. FAT Mirroring (2 bytes): Bits 0-3 : The number of the active FAT (starting from 0, not 1). (Only valid if mirroring disabled, i.e. if bit 7 = 1) Bits 4-6 : Reserved (i.e. not used). Bit 7 : A value of 0 means the FAT is mirrored into all FATs. A value of 1 means only one FAT is active (i.e. the one specified in bits 0-3). Bits 8-15: Reserved (i.e. not used). NB: There are 8 bits in a byte (usually numbered from 0 to 7). FS Info Sector (2 bytes): This MUST point to the FS Info Sector (which is invariably the second sector in the partition, i.e. CHS 0-1-2). This value is always 1 (as the LBA sector count starts at 0) (0 = CHS 0-1-1). The only other possible value in this field is 0 (zero), which means the FS Info Sector will be ignored (i.e. will not be used). NB: In that situation, the O/S will recalculate the amount of free space on the disk whenever that value is needed (a slower procedure than simply looking it up), instead of storing the free space value in the FS Info Sector. Sanity Check of Boot Sector: All the following mandatory elements must be present:- • The jump signature must be EB or 90 or E0 • The sector size (i.e. Bytes per Sector) must be 512 • The cluster size (i.e. Sectors per Cluster) must be: 1, 2, 4, 8, 16, 32 or 64 • The FAT32 version must be 0.0 • There must be 2 copies of the FAT • The media type must be F8 (though it's an obsolete feature) • The signature (i.e. File System ID) should be "FAT32" (though it's meaningless) • The sector must end with the hex value AA55 (written as 55AA) NB: Although not strictly a sanity check, the ultimate test of the boot sector's validity is whether it matches the contents of the backup boot sector (usually CHS 0-1-6). NB: A partition's validity can be checked by examining it with PowerQuest's Partition Magic (which can identify more than 100 types of partition error). It checks the Boot Sector for logical errors on accessing the disk (because it can't alter a disk which has a faulty partition structure). BPB and Extended BPB: Summary for use in partition reconstruction - • extdpb_FSInfoSec : Sector number of the FSINFO sector. This is set to FFFF hex if there is no FSINFO sector; otherwise, must be non-zero and within the reserved sectors. • extdpb_BkUpBootSec : Sector number of Backup Boot Sector. This is set to FFFF hex if there is no backup boot sector; otherwise, must be non-zero and within the reserved sectors. • dpb_fat_count : The number of FATs • dpb_first_fat : The sector number of the 1st sector of the 1st FAT • extdpb_fat_size : The number of sectors occupied by each FAT (i.e. size of FAT in sectors) • extdpb_first_sector : Sector number of the 1st sector of the 1st Cluster in the Root directory (the Root Directory table) • extdpb_root_clus : Cluster number of 1st cluster in the Root directory Standard Geometry: On a hard disk using 255 Heads per cylinder and 63 Sectors per head (i.e. standard geometry) a FAT32 partition's Boot Sector should look like this - 1. Jump: EB 58 90 2. OEM Name: MSWIN4.1 3. Bytes per Sector: 512 4. Sectors per Cluster: 16 or 32 5. Reserved Sectors: 32 6. Number of FAT's: 2 7. Reserved: 0000 8. Reserved: 0000 9. Media Descriptor: F8 10. Sectors per FAT: 0 11. Sectors per Track: 63 (3F hex) 12. Number of Heads: - 13. Hidden Sectors: 63 (3F hex) 14. Big Total Sectors: - 15. Big Sectors per FAT: - 16. Extended Flags: 0000 17. FS Version: 0 18. First Cluster of Root: 2 (02 hex) 19. FS Info Sector: 1 20. Backup Boot Sector: 6 21. Reserved: 000000000000000000000000 22. Drive ID: 80 23. Reserved for NT: 00 24. Extended Boot Sig: 29 25. Serial Number: 26. Volume Name: 27. File System Type: FAT32 28. Boot Signature: AA55 Notes: 1. This is the display you will see if you examine the disk using PowerQuest's Partition Table Editor (PTEDIT.EXE). 2. Those entries which vary depending upon the size of the partition have been left blank (indicated '-'). Warning: You should not run CHKDSK or SCANDISK or any other disk scanning program if the disk has crashed, or there is any logical error in the MBR or Boot Record, or the FAT or Root Directory is corrupted. It may distort data information, and can cause data loss. FS Info Sector - File System Information Sector (FS Info Sector) (CHS 0-1-2) The second sector of the partition. There is a pointer to it in the partition's Boot Sector (at bytes 49 & 50). The ID marker RRaA at the start of the sector marks it as an Extended Boot Record. A similar ID, rrAa (the same letters, but with the case of the letters inverted) marks the start of the "Total Free Clusters" and "Next Available Cluster" data. Offset Description Size ------ -------------------------------------------- --------- 00 ID marker (Always 52 52 61 41) (ASCII: RRaA) 4 bytes (Leading signature; validates the sector) 04 Null (all 00) 480 bytes 1E4 ID marker (Always 72 72 41 61) (ASCII: rrAa) 4 bytes (Structure signature; validates the sector) 1E8 Number of Free Clusters 4 bytes (Contains the last-known free cluster count) (The count is unknown if FF FF FF FF or -1) 1EC Cluster # where the O/S should start looking 4 bytes for free clusters. (If value is FF FF FF FF the O/S should start looking from Cluster 2) [Cluster 2 is written in hex as: 02 00 00 00] (NB: Stored in bytes 493-496) 1F0 Reserved (all 00) 12 bytes 1FC Null (00 00) 2 bytes 1FE ID marker (55AA hex) 2 bytes (Trailing signature; validates the sector) Both ScanDisk for DOS (SCANDISK.EXE) and ScanDisk for Windows (SCANDSKW.EXE) check the amount of free space in the partition (the "free cluster count"), and correct the value stored in the FS Info Sector if it's wrong (but NOT if the Boot Sector's pointer is 0 (i.e. zero): this prevents detection of the error). NB: Norton's DiskEdit CANNOT detect an error in the "free cluster count"; the only tools that can detect and fix it are ScanDisk and Norton Disk Doctor. NB: It appears that NO critical disk operations are dependent on the accuracy of the "free cluster count", which seems to be provided for information only. This sector is known technically as the BIGFATBOOTFSINFO structure (BOOT record's FS INFO sector on BigFAT [i.e. FAT32] partitions). *** Routine to view the FS Info Sector *** View the current state of the FS Info sector to discover:- • The number of free clusters. • The cluster number at which the O/S will begin looking for free clusters (those marked 0 in the FAT); usually, but not always, this points to the first free cluster. NB: The O/S often specifies Cluster 2 as the one to start looking for free clusters from, since this leaves no chance of missing any unused clusters in the search. NB: Whenever ScanDisk corrects an error in the FSInfo Sector it resets the "start from" value to 2. ** View FSInfo Sector of Drive C (using XVI32.EXE) ** FINDPART GETSECT 1 0 1 2 1 DISK_C.FS noheader badf6 C:\Progra~1\HexEdi~1\XVI32.exe DISK_C.FS ** View FSInfo Sector of Drive D ** FINDPART GETSECT 2 0 1 2 1 DISK_D.FS noheader badf6 C:\Progra~1\HexEdi~1\XVI32.exe DISK_D.FS ** View FSInfo Sector of Drive E ** FINDPART GETSECT 1 1275 1 2 1 DISK_E.FS noheader badf6 C:\Progra~1\HexEdi~1\XVI32.exe DISK_E.FS Sanity Check of FSInfo Sector: Make sure that FSInfo Sector is sector 1 or later of the partition, counting from 0 (it's normally sector 1); and that it's within the reserved disk area; and that its sector number is not the same as that used for the Backup BootSector; and that its three signatures are correct (though only the second is documented by Microsoft). If it does not satisfy these conditions, do not use the sector; but the file system should still be usable. NB: The number of free clusters is normally checked only by disk analysis programs: it is not critical to the filesystem. Boot Data sector - The 3rd sector of the partition (CHS 0-1-3) It contains boot code (510 bytes of boot program code), beginning with the ID marker "FA 66 OF" (though this is NOT a unique marker). It ends with a two byte ID signature (55AA hex). This sector contains NO system-specific information! It contains only standard code that is identical on all FAT32 disks. Executable Code: On a FAT32 hard disk, formatted by Win98/98SE/ME, the Boot Data sector normally looks like this (in Hex and ASCII). 32 lines of 16 bytes each:- < --------------- Hexadecimal --------------- > < -- ASCII --- > 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF --------------------------------------------------------------------------- 0000: FA 66 0F B6 46 10 66 8B-4E 24 66 F7 E1 66 03 46 [ �f.�F.f�N$f��f.F ] 0010: 1C 66 0F B7 56 0E 66 03-C2 33 C9 66 89 46 FC 66 [ .f.�V.f.�3�f�F�f ] 0020: C7 46 F8 FF FF FF FF FA-66 8B 46 2C 66 83 F8 02 [ �F�....�f�F,f��. ] 0030: 0F 82 CF FC 66 3D F8 FF-FF 0F 0F 83 C5 FC 66 0F [ .���f=�....���f. ] 0040: A4 C2 10 FB 52 50 FA 66-C1 E0 10 66 0F AC D0 10 [ ��.�RP�f��.f.��. ] 0050: 66 83 E8 02 66 0F B6 5E-0D 8B F3 66 F7 E3 66 03 [ f��.f.�^.��f��f. ] 0060: 46 FC 66 0F A4 C2 10 FB-BB 00 07 8B FB B9 01 00 [ F�f.��.��..���.. ] 0070: E8 BE FC 0F 82 AA FC 38-2D 74 1E B1 0B 56 BE D8 [ ��.���8-t.�.V�� ] 0080: 7D F3 A6 5E 74 19 03 F9-83 C7 15 3B FB 72 E8 4E [ }�^t..���.;�r�N ] 0090: 75 D6 58 5A E8 66 00 72-AB 83 C4 04 E9 64 FC 83 [ u�XZ�f.r���.�d�� ] 00A0: C4 04 8B 75 09 8B 7D 0F-8B C6 FA 66 C1 E0 10 8B [ �.�u.�}.���f��.� ] 00B0: C7 66 83 F8 02 72 3B 66-3D F8 FF FF 0F 73 33 66 [ �f��.r;f=�...s3f ] 00C0: 48 66 48 66 0F B6 4E 0D-66 F7 E1 66 03 46 FC 66 [ HfHf.�N.f��f.F�f ] 00D0: 0F A4 C2 10 FB BB 00 07-53 B9 04 00 E8 52 FC 5B [ .��.��..S�..�R�[ ] 00E0: 0F 82 3D FC 81 3F 4D 5A-75 08 81 BF 00 02 42 4A [ .�=� ?MZu. �..BJ ] 00F0: 74 06 BE 80 7D E9 0E FC-EA 00 02 70 00 03 C0 13 [ t.��}�.��..p..�. ] 0100: D2 03 C0 13 D2 E8 18 00-FA 26 66 8B 01 66 25 FF [ �.�.��..�&f�.f%. ] 0110: FF FF 0F 66 0F A4 C2 10-66 3D F8 FF FF 0F FB C3 [ ...f.��.f=�...�� ] 0120: BF 00 7E FA 66 C1 E0 10-66 0F AC D0 10 66 0F B7 [ �.~�f��.f.��.f.� ] 0130: 4E 0B 66 33 D2 66 F7 F1-66 3B 46 F8 74 44 66 89 [ N.f3�f��f;F�tDf� ] 0140: 46 F8 66 03 46 1C 66 0F-B7 4E 0E 66 03 C1 66 0F [ F�f.F.f.�N.f.�f. ] 0150: B7 5E 28 83 E3 0F 74 16-3A 5E 10 0F 83 A4 FB 52 [ �^(��.t.:^..���R ] 0160: 66 8B C8 66 8B 46 24 66-F7 E3 66 03 C1 5A 52 66 [ f��f�F$f��f.�ZRf ] 0170: 0F A4 C2 10 FB 8B DF B9-01 00 E8 B4 FB 5A 0F 82 [ .��.��߹..��Z.� ] 0180: 9F FB FB 8B DA C3 00 00-00 00 00 00 00 00 00 00 [ ������.......... ] 0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ] 01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ] 01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ] 01C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ] 01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ] 01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ................ ] 01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ ..............U� ] Notes - 1. Hexadecimal: Base 16 (0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F). 2. ASCII: American Standard Code for Information Interchange (a set of 255 characters, including A to Z and 0 to 9). 3. For each 2-digit hexadecimal number in the above table, you can identify its (hexadecimal) address in the sector by combining the row number (hex) in the left-hand margin with the column number (also in hex) across the top; e.g. the number in the 3rd column of the 3rd line is F8 and its address is 22 hex: 0020 (left column) + 02 (top). Backup Sectors - The 7th sector of the partition (CHS 0-1-7) (LBA 69) (at 8A00 hex) contains a BACKUP copy of CHS 0-1-1 (LBA 63) (Boot sector). The 8th sector of the partition (CHS 0-1-8) (LBA 70) (at 8C00 hex) contains a BACKUP copy of CHS 0-1-2 (LBA 64) (FS Info sector). NB: This backup of the FS Info Sector is NOT kept synchronised with the main FS Info Sector. Its "Number of Free Clusters" is set to -1 and its "Most Recently Allocated Cluster" is 2 (suggesting that those were the initial settings used by the formatting program which created this partition, e.g. FDISK) The 9th sector of the partition (CHS 0-1-9) (LBA 71) (at 8E00 hex) contains a BACKUP copy of CHS 0-1-3 (LBA 65) (Boot Data sector). Reserved Sectors - As specified in the partition's Boot Sector (CHS 0-1-1) (LBA 63), the first 32 sectors of the Partition (CHS 0-1-1 to 0-1-32) are reserved. CHS 0-1-1 to 0-1-9 are in use, as above. The remainder of the 32 reserved sectors (CHS 0-1-10 to 0-1-32) only contain zeros; and are immediately followed by the 1st FAT, which starts at CHS 0-1-33. NB: As only 9 sectors are normally in use, the number of reserved sectors can in theory be ANY number greater than 9. In practice, for historical reasons the number of reserved sectors is usually 32. File Allocation Table - The 1st FAT begins in the first sector after the number of Reserved Sectors specified in the partition's Boot Record. NB: In a FAT32 partition, the Boot Sector (CHS 0-1-1) usually specifies 32 reserved sectors (20 hex), thus the 1st FAT begins in CHS 0-1-33 (the 33rd sector of the Partition), i.e. LBA 95 (a.k.a. "Absolute Sector 95"). The FAT begins with a unique marker (usually F8 FF FF FF) (see below). FAT32 uses 4 bytes (32 bits) in the File Allocation Table to record each disk cluster's address. The high 4 bits of this 32-bit value are reserved, so are not part of the cluster number; hence it is actually only a 28-bit value. NB: FAT32 uses 4-byte entries (32 bits), whereas FAT16 uses 2-byte entries (16 bits). [Note: 8 bits in a byte] Example: FAT size for an 80GB partition = 19,075 sectors (according to PowerQuest's Partition Manager, PTEDIT.EXE) so FATs 1 and 2 = 19,075 x 2 = 38,150 sectors (19,075 KB) The 2nd FAT begins at CHS 1-49-19 (LBA 19,170) (95C400 hex) because 95 + 19,075 = 19,170 (since there are 95 sectors before the 1st FAT: CHS 0-0-1 to CHS 0-1-32 inclusive). FAT mirroring: If FAT mirroring is enabled (in the Boot Sector), a backup copy - or "mirror" - of the FAT is kept. This second FAT is stored immediately after the first FAT, and can be used by the Operating System if the first FAT is damaged; both are updated together, hence are backups of each other. NB: By default, mirroring involves two FATs only; but it is possible for a partition to have more. FAT mirroring (which is enabled by default) can be disabled. If so, only one of the FATs is "active"; a "mirror" FAT (i.e. one other than the first FAT) can be the active FAT. The active FAT is the one specified by bits 0 to 3 of the entry in the BPB; the other FAT is ignored. NB: It is necessary to disable mirroring if a bad sector occurs in one of the FATs. Once mirroring is disabled, a new FAT can be built in an inactive FAT which can then be made accessible by changing the active FAT value in the Boot Sector. Further Information: For technical details of the FILE ALLOCATION TABLE see below. Root Directory - The Root Directory table usually begins in the first sector after the 2nd FAT (i.e. Cluster 2). That sector can be calculated from the CHS address of the starting sector of the 1st FAT, as follows: (Cylinders x 255 x 63) + (Heads x 63) + (Sectors x 1) + (Big Total Sectors per FAT x 2) - 1 = LBA Sector Primary Partition: If the 1st FAT begins at CHS 0-1-33 (i.e. if the partition has the traditional 32 reserved sectors), the calculation is - (0 x 255 x 63) + (1 x 63) + (33 x 1) = 0 + 63 + 33 = 96 + (Big Total Sectors per FAT x 2) - 1 = LBA Sector A simpler way of expressing this is - Hidden Sectors + Reserved Sectors + (Sectors per FAT x 2) In both cases, this is equivalent to - 95 + (Sectors per FAT x 2) = LBA Sector NB: To convert the LBA sector number to a CHS value, see the note "Convert from Sectors to CHS" (below); or use the Win9x program PTcalc.exe (a CHS calculator for Windows). Logical Partitions: For partitions other than the Primary Partition, the number of sectors prior to the partition must be taken into account. Here is an illustration of the simplest way to do this - • Step 1 - Relative Address The address of the 1st sector of the Root Directory Table (i.e. the 1st sector of the data region), relative to the 1st sector of the partition (i.e. the Boot Sector) - Relative Address (sectors) = Number of Reserved Sectors + (Number of FATs x FAT Size) This typically resolves as - 32 + (2 x FAT Size) • Step 2 - Absolute Address To calculate the absolute address, add to the Relative Address the number of sectors prior to this partition (i.e. add the LBA address of the partition's Boot Sector) This typically resolves as - Absolute Address (LBA) = Boot Sector (LBA) + 32 + (2 x FAT Size) Location of Root Directory Table: The root directory can be located anywhere in the partition! Its cluster address is stored in the Boot Sector: this can point to ANY cluster in the partition, it need not point to cluster 2. Size of Root Directory Table: The Root Directory table occupies 1 Cluster (64 sectors, if cluster size is 32KB). Those sectors are mostly empty; they reserve space which the table can use if necessary. But if that space is fully used, the Root Directory Table (like any file) can continue in another cluster. Note - The amount of space occupied in the table by a file's Directory entry depends upon whether the file has a Long File Name; so the number of files which will fill up 64 sectors can vary. Where the cluster is full, a pointer is set indicating the next cluster used to store the table (which can be ANY cluster in the partition's data region). There is NO limit to the number of files which can be stored in the Root directory. As the directory table is stored in a chain of sectors, it can expand as necessary. Example (Hard Disk WD800JB, Drive C): Data for 1st FAT - Starting sector of 1st FAT: CHS 0-1-33 Size of 1st FAT in sectors: 9,992 Step 1: Calculate in REAL sectors - CHS 0-1-33 = (0 x 255 x 63) + (1 x 63) + (33 x 1) = 96 96 + (2 x 9,992) = 20,080 Step 2: Convert REAL sectors to CHS - 1 Cylinder = 255 heads x 63 sectors = 16,065 sectors (i.e. Sectors � 16,065 = Cylinders) 20,080 � 16,065 = 1 cylinder (Remainder = 4,015) 1 Head = 63 sectors (i.e. Remainder � 63 = Heads) 4,015 � 63 = 63 heads (Remainder = 46) 1 Sector = 1 sector (i.e. Remainder = Sectors) 46 � 1 = 46 sectors CHS = 1-63-46 Step 3: Convert REAL sectors to LBA - Real Sectors - 1 = LBA 20,080 - 1 = 20,079 CHS address of Root Directory Table: Western Digital WD800JB 80GB Primary DOS Partition (Drive C:) = CHS 1-63-46 (LBA: 20,079) 1st Logical Partition (Drive E:) = CHS 1277-17-49 (LBA: 20,516,124) Western Digital WD800JB 80GB Primary DOS Partition (Drive D:) = CHS 2-97-9 (LBA: 38,249) M02GB2: SeaGate ST320423A 18GB (Win98 HDD) Primary DOS Partition (Drive D:) = CHS 1-40-39 (LBA: 18,623) NB: CHS 0-0-1 = LBA 0 (i.e. Add 1 to convert LBA into actual sectors) Files - Actual files begin in the first sector after the cluster reserved for the Root Directory Table, i.e. in cluster 3. NB: On a WinME system, the directory table for the RECYCLE bin (a hidden system directory) usually occupies cluster 3. Address of cluster 3 = (1st sector of Root Directory Table, LBA) + (Sectors per Cluster) NB: Sectors per Cluster = Bytes in each Allocation Unit � 512 (Run CHKDSK.EXE, where "allocation unit" means a Cluster) [Usually 64 sectors per cluster if partition exceeds 32GB] Example (Western Digital WD800JB 80GB): Cluster 3 = LBA 38,249 + 64 = LBA 38,313 (CHS 2-98-10) Note: The largest possible file size on a FAT32 partition is 4GB less 1 byte. Dual Booting - If the hard disk has more than one Primary partition, it has been set up to dual-boot (i.e. to load alternative Operating Systems). It is NOT safe to use the information on this page as a guide to backing up or repairing such a disk. It will have a non-standard layout, to enable the user to interact with the boot loader code and choose which partition to boot from (i.e. choose which Operating System to transfer control to). A typical dual-booting arrangement will look like this: No. Description -- ------------------------------------------------- #1 Primary DOS partition - Windows 9x (1st Primary) #2 Primary DOS partition - Windows XP (2nd Primary) #3 Extended partition: #4 • Logical No.1 (e.g. Linux, bootable) #5 • Logical No.2 (e.g. Data storage) EXTENDED PARTITION ================== A FAT32 disk can have more than one partition: • 1 x Primary DOS Partition • 1 x Extended Partition, containing Logical partitions NB: A FAT32 disk can have more than 4 partitions (unlike FAT16) but all the partitions except the Primary partition are contained within the Extended partition. This is so that older software, designed for disks with not more than 4 partitions, will recognise the disk. To them, the disk appears to have two partitions. On a FAT32 disk, the second entry in the MBR Partition Table (at CHS 0-0-1) defines the Extended Partition, specifying its 1st sector (the LBA sector number) and its length in sectors. The 1st sector of the Extended partition is called the E-MBR (Extended Master Boot Record). The first sector of the Extended partition reads just like the MBR in sector CHS 0-0-1, but has blanks instead of code in some locations. In its Partition Table, the first entry defines the 1st Logical partition. NB: The 1st Logical partition MUST fall entirely within the Extended partition. If the 1st Logical partition does not completely fill the Extended partition, further Logical partitions can exist in the remaining space. If there is more than one Logical partition, the 2nd entry in the E-MBR Partition Table points to the partition table sector of another Logical partition; but the sector number given is relative to the 1st sector of the entire Extended partition. NB: The overriding rule, which must NEVER be violated, is that there is NEVER any unallocated space in between Logical partitions (though there can be unallocated space AFTER all the Logical partitions, i.e. at the end of the Extended partition). Whenever a new Logical partition is created in the Extended partition, it begins with whichever then is the first unallocated sector in the Extended partition. Thus the Extended partition is sub-divided into one or more Logical partitions. In practice, there is NO limit to the number of Logical partitions: FAT32 is not constrained by the fact that the Partition Table has only 4 entries, since it never uses entries 3 or 4 (chaining the Partition Tables instead, in a linked chain of E-MBR sectors). As the Partition Tables form a 'chain', if that chain is broken at any point, all Logical partitions defined later in the chain (beyond the 'breakpoint') cannot be accessed. A Partition Table sector pointing to the next Partition Table sector must ALWAYS point forward, never to a previous sector! A Logical Partition is structured like the Primary Partition:- • 63 "hidden" sectors, starting with a Partition Table • 64th sector is the Boot sector • 65th sector is the FS Info sector • 66th sector is the Boot Data sector • 96th sector is the start of the 1st FAT Making a Logical Partition Bootable: In theory, Logical drives are NOT bootable. In reality, this limitation can be overcome by hiding any prior partitions; i.e. assigning them a HIDDEN partition type. For example, a Primary Partition of type 0C can be hidden by changing it to type 1C. (NB: A partition type should ONLY be changed by altering the leading 0 [zero] to a 1. It might be unsafe to alter the partition type in any other way.) Note on Partition Reconstruction: Undeleting Logical partitions without causing Partition Table errors is tricky. However, it is possible to undelete a Logical partition as a Primary partition, in order to copy the data off that partition (e.g. by hiding all the prior partitions). NB: See also Pierre's Guide to Partition Table Recovery - http://www.datarescue.com/laboratory/partition.htm DELETING PARTITIONS =================== Sometimes, due to a corrupt E-MBR (Extended Master Boot Record) chain, FDISK.EXE will not delete a particular partition correctly. To delete the partition manually, change all the values in the partition's entry in the Partition Table to 0. PARTITION TABLE EDITOR ====================== PTEDIT.EXE PowerQuest's Partition Table Editor for DOS, v1.0 This enables the Partition Table in the MBR sector to be edited in a user-friendly GUI. *** Edit the Partition Table *** SET PATH=%path%;F:\RECOVERY MOUSE PTEDIT NB: There is also a version of the program that runs under Win9x (PTEDIT32.EXE) Calculate Partition: To calculate all the CHS and LBA values in a Partition, see below under CALCULATE LBA PARTITION CLUSTER SIZE ============ Default Cluster Size - On a FAT32 partition, the default cluster size is: Partition size Cluster size -------------- ------------ 0 to 8 GB 4 KB 8 to 16 GB 8 KB 16 to 32 GB 16 KB Over 32 GB 32 KB NB: These are the default values; but the user can override them in the initial partitioning and formatting of the disk. These values are thus only a guide, and will NOT be correct in all cases! Actual Cluster Size - The program CHKDSK.EXE shows the Cluster Size in use by a partition, displaying:- (a) The total number of clusters in the partition (describing them as "allocation units"), and (b) The number of bytes in each cluster ("allocation unit") (in multiples of 1,024 [8 KB = 8,192; 16 KB = 16,384] ) *** Run CHKDSK.EXE *** CHKDSK C: CHKDSK D: CHKDSK E: ** Save Output from CHKDSK.EXE ** CHKDSK C: > F:\SAVED\CHKDSK_C.txt CHKDSK D: > F:\SAVED\CHKDSK_D.txt CHKDSK E: > F:\SAVED\CHKDSK_E.txt Sectors per Cluster - 1 sector is 0.5 KB, so if a partition has a cluster size of 16 KB each cluster contains 32 sectors; but if cluster size is 32 KB, then each cluster contains 64 sectors. Limits on Cluster Size - The possible cluster sizes are restricted by limitations built into Windows and built into the FAT32 file system. (a) Minimum number of Clusters possible in FAT32: A FAT32 partition MUST contain at least 65,527 clusters (because if it contains fewer, Windows will treat the partition as FAT16). Therefore the maximum cluster size possible is 32 KB; a larger cluster size (i.e. 64 KB) would make it possible to have less than 65,527 clusters. (b) Maximum number of Clusters possible in FAT32: FAT32 permits the maximum number of Clusters to be several million, by using 32-bit values in the File Allocation Table to store the cluster addresses. However, the maximum number of addresses is only 0FFFFFFF hex (a 28-bit value), not the full 32-bit value FFFFFFFF hex. This is to enable programs that manipulate the File Allocation Table to use four bits as tags in their internal data structures; but it has no impact on the theoretical maximum FAT32 partition size, as this is capped by the FFFFFFFF (hex) maximum sector count: which, at 512 bytes per sector, gives a theoretical maximum partition size of 2 TeraBytes. NB: Calculations - Maximum number of Clusters possible for a 28-bit value: 0FFFFFFF hex = 268,435,455 Maximum Partition size possible for a 32-bit value (Sectors x 512): FFFFFFFF hex = 4,294,967,295 x 512 = 2,199,023,255,040 bytes (2TB) (c) Maximum Partition size possible for Windows 98 / 98SE / ME: In Windows 98/98SE/ME, ScanDisk can't process a FAT that defines more than 4,177,920 clusters (including the two reserved clusters). Adding the two FATs, each using 32-bits (4 bytes) for each cluster, at the maximum cluster size of 32 KB per cluster this amounts to - Data Area: 4,177,920 Clusters x 32 KB = 133,693,440 KB 133,693,440 KB x 1,024 = 136,902,082,560 Bytes FATs (x2): 4,177,920 Clusters x 4 Byte = 16,711,680 Bytes 16,711,680 Bytes x 2 = 33,423,360 Bytes Reserved : 32 Reserved Sectors x 512 Bytes = 16,384 Bytes Maximum Partition Size = 136,935,522,304 Bytes (136,935,522,304 � 1,073,741,824 = 127.53 GB ) Conversion between KB / MB / GB - 1 KB = 1,024 x 1 = 1,024 Bytes (1,024�) 1 MB = 1,024 x 1,024 = 1,048,576 Bytes (1,024�) 1 GB = 1,024 x 1,024 x 1,024 = 1,073,741,824 Bytes (1,024�) Formula to calculate maximum number of Clusters in a partition: ( (No. of Sectors in Partition) - (No. of Sectors per FAT x 2) - (No. of Reserved Sectors) ) � (No. of Sectors per Cluster) If there is any remainder in the result from that formula, it only means that there are unused sectors at the end of the partition (usually not enough to make another cluster). NB: The NUMBER of clusters tells you the type of FAT. If a partition has 65,526 clusters or less, it is FAT16 [see Note 1]. If it has 65,527 clusters or more, it is FAT32 [but see Note 2]. 00000FF7-0000FFF6 ( 4,087 - 65,526) : FAT16 0000FFF7-0FFFFFF6 (65,527 - 268,435,446) : FAT32 Note 1: Many sources will wrongly tell you that FAT16 supports a maximum of 65,517 clusters. Note 2: Some Windows NT variants can create a FAT16 partition with up to 65,535 clusters (FFFF hex). Such a partition is VERY dangerous, as Windows 9x treats a partition with 65,527 clusters or more as FAT32. Note 3: Cluster size is not relevent: in Win9x both FAT16 and FAT32 have a maximum cluster size of 32 KB (i.e. 64 sectors per cluster). [Some NT variants can create a FAT16 partition with 128 sectors per cluster, but such a partition can't be accessed by DOS or Windows 9x] NB: The ONLY method used by Windows 9x to determin a partition's FAT type is the value stored in the MBR for the total number of Clusters. It does NOT use the size of the partition. Cluster size, which determines the number of clusters on disk, and thus the FAT type, is user-selectable: so partition size is an unsafe guide! It does NOT use the ID string in the partition's Boot Sector, e.g. "FAT16" or "FAT32", which has no significance whatever. Cluster No.2 - The Data Region starts with cluster number 2, not cluster zero, because there are two "reserved clusters" (numbers 0 and 1). NB: Cluster numbers are ONLY assigned to the Data Region of the partition, not to the "system area". Cluster 2 is the first cluster used for the storage of data. Norton's DiskEdit (2002), which reports the cluster numbers, can identify it. It usually contains the Root Directory Table. NB: The alternative to using Norton's DiskEdit is to manually calculate the LBA location of the 1st sector occupied by the Root Directory Table: see below under ROOT DIRECTORY. The first sector containing a file is thus usually the 1st sector in cluster 3 (i.e. the 4th cluster, as LBA counts from 0 not 1): 1st sector of Root Dir Table (LBA) + No. of Sectors per Cluster NB: This is because the Root Directory Table usually occupies 1 cluster (i.e. 32 sectors if the partition's cluster size is 16KB, or 64 sectors if the partition uses 32KB clusters). NB: Cluster 3 is typically occupied by the Directory Table of the directory RECYCLED (a hidden system directory). Examples: If cluster size is 16 KB, cluster 3 starts (in LBA sectors) at: (1st sector of Root Directory Table) + 32 If cluster size is 32 KB, cluster 3 starts (in LBA sectors) at: (1st sector of Root Directory Table) + 64 Clusters used by a File - Norton's DiskEdit can read from the FAT the cluster numbers used by a file, if the FAT is undamaged (see below under FILE CLUSTERS).
^ Top of Page FLOPPY DISKS ============ Floppy Disks are outside the scope of this analysis. But as their structure is simple, it can be briefly mentioned. The following notes refer solely to a 3�-inch (1.44MB) disk. Note - Floppy Disks use FAT12 (the File Allocation Table uses 12 bits to record the address of each cluster) instead of FAT32 (which uses 32 bits to store each cluster address). DISK STATISTICS =============== A floppy disk comprises - • Bytes per Sector : 512 • Sectors per Cluster : 1 • Reserved Sectors : 33 • Total Sectors : 2,880 • Total Clusters : 2,847 • Total Disk Space : 1,457,664 bytes NB: The difference between the number of Sectors and the number of Clusters is due to use of 33 sectors by the Master Boot Record, File Allocation Tables, and Root Directory Table. SECTORS ======= As a 1.44MB disk has (by definition) a fixed size of 1.44MB, using standard 512-byte sectors it contains 2,880 sectors in all. Sectors are identified using the Cylinder-Head-Sector (CHS) system (the same system used by Hard Disks smaller than 8GB: see above). The disk comprises - • C - Cylinders: 80 Cylinders, also known as "Tracks" (numbered from 0 to 79) • H - Heads: 2 Heads per Cylinder (numbered from 0 to 1) • S - Sectors: 18 Sectors per Head (numbered from 1 to 18) MASTER BOOT RECORD (MBR) ======================== The first sector of a floppy disk contains the Master Boot Record. This is the ONLY sector that contains information about the disk. It includes everything which, on a Hard Disk, would be stored in the MBR, Boot Sector, FS Info Sector, and Boot Data Sector. Since a floppy disk cannot be partitioned, the disk will have a single partition occupying the entire disk. Notes - 1. The Media Descriptor Byte for a floppy disk is F0 (hex). 2. A floppy disk has 18 sectors per head (rather than 63). C-H-S Addressing: The CHS address of the Master Boot Record (the MBR sector) of a floppy disk is CHS 0-0-1 (LBA 0). NB: As some disk tools (including Norton Disk Doctor) report only LBA addresses, regardless of whether the disk is a hard disk or a floppy disk, the equivalent LBA address is noted here. Executable Code: On a 1.44MB floppy disk, the Master Boot Record (MBR) sector normally looks like this (in Hex and ASCII). 32 lines of 16 bytes each:- < --------------- Hexadecimal --------------- > < -- ASCII --- > 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF --------------------------------------------------------------------------- 0000: EB 3C 90 2C 3B 23 55 4B-49 48 43 00 02 01 01 00 [ �<�,;#UKIHC ] 0010: 02 E0 00 40 0B F0 09 00-12 00 02 00 00 00 00 00 [ � @ � ] 0020: 00 00 00 00 00 00 29 21-27 7D 34 20 20 20 20 20 [ )!'}4 ] 0030: 20 20 20 20 20 20 46 41-54 31 32 20 20 20 33 C9 [ FAT12 3� ] 0040: 8E D1 BC FC 7B 16 07 BD-78 00 C5 76 00 1E 56 16 [ �Ѽ�{ �x �v V ] 0050: 55 BF 22 05 89 7E 00 89-4E 02 B1 0B FC F3 A4 06 [ U�" �~ �N � �� ] 0060: 1F BD 00 7C C6 45 FE 0F-38 4E 24 7D 20 8B C1 99 [ � |�E� 8N$} ��� ] 0070: E8 7E 01 83 EB 3A 66 A1-1C 7C 66 3B 07 8A 57 FC [ �~ ��:f� |f; �W� ] 0080: 75 06 80 CA 02 88 56 02-80 C3 10 73 ED 33 C9 FE [ u �� �V �� s�3�� ] 0090: 06 D8 7D 8A 46 10 98 F7-66 16 03 46 1C 13 56 1E [ �}�F ��f F V ] 00A0: 03 46 0E 13 D1 8B 76 11-60 89 46 FC 89 56 FE B8 [ F ыv `�F��V�� ] 00B0: 20 00 F7 E6 8B 5E 0B 03-C3 48 F7 F3 01 46 FC 11 [ ��^ �H�� F� ] 00C0: 4E FE 61 BF 00 07 E8 28-01 72 3E 38 2D 74 17 60 [ N�a� �( r>8-t ` ] 00D0: B1 0B BE D8 7D F3 A6 61-74 3D 4E 74 09 83 C7 20 [ � ��}�at=Nt �� ] 00E0: 3B FB 72 E7 EB DD FE 0E-D8 7D 7B A7 BE 7F 7D AC [ ;�r���� �}{��}� ] 00F0: 98 03 F0 AC 98 40 74 0C-48 74 13 B4 0E BB 07 00 [ � �@t Ht � � ] 0100: CD 10 EB EF BE 82 7D EB-E6 BE 80 7D EB E1 CD 16 [ � �ﾂ}�澀}��� ] 0110: 5E 1F 66 8F 04 CD 19 BE-81 7D 8B 7D 1A 8D 45 FE [ ^ f� � ��}�} �E� ] 0120: 8A 4E 0D F7 E1 03 46 FC-13 56 FE B1 04 E8 C2 00 [ �N �� F� V�� �� ] 0130: 72 D7 EA 00 02 70 00 52-50 06 53 6A 01 6A 10 91 [ r�� p RP Sj j � ] 0140: 8B 46 18 A2 26 05 96 92-33 D2 F7 F6 91 F7 F6 42 [ �F �& -�3������B ] 0150: 87 CA F7 76 1A 8A F2 8A-E8 C0 CC 02 0A CC B8 01 [ ���v ����� ̸ ] 0160: 02 80 7E 02 0E 75 04 B4-42 8B F4 8A 56 24 CD 13 [ �~ u �B��V$� ] 0170: 61 61 72 0A 40 75 01 42-03 5E 0B 49 75 77 C3 03 [ aar @u B ^ Iuw� ] 0180: 18 01 27 0D 0A 49 6E 76-61 6C 69 64 20 73 79 73 [ ' Invalid sys ] 0190: 74 65 6D 20 64 69 73 6B-FF 0D 0A 44 69 73 6B 20 [ tem disk� Disk ] 01A0: 49 2F 4F 20 65 72 72 6F-72 FF 0D 0A 52 65 70 6C [ I/O error� Repl ] 01B0: 61 63 65 20 74 68 65 20-64 69 73 6B 2C 20 61 6E [ ace the disk, an ] 01C0: 64 20 74 68 65 6E 20 70-72 65 73 73 20 61 6E 79 [ d then press any ] 01D0: 20 6B 65 79 0D 0A 00 00-49 4F 20 20 20 20 20 20 [ key IO ] 01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7F 01 [ SYSMSDOS SYS ] 01F0: 00 41 BB 00 07 60 66 6A-00 E9 3B FF 00 00 55 AA [ A� `fj �;� U� ] FILE ALLOCATION TABLE (FAT) =========================== A floppy disk uses FAT12: each entry in the table is only 12 bits. This is because even though a 0.5KB cluster size (1 sector) is used, only a limited number of addresses are needed on such a small disk. The FAT begins in the second sector of the disk, and occupies 9 sectors (sectors 2 to 10) (CHS 0-0-2 to 0-0-10)(LBA 1 to 9): 2,880 sectors � 1 = 2,880 clusters 2,880 x 12 bits = 34,560 bits 34,560 � 8 = 4,320 bytes 4,320 � 512 bytes = 8.4375 sectors The FAT invariably begins with the unique marker bytes F0 FF FF (hexadecimal): part of the first 8 "admin" bytes containing administrative data, needed by the Operating System. An identical copy of the FAT (known as FAT2) immediately follows the main FAT. This is a backup in case the other becomes damaged. FAT2 thus also occupies 9 sectors (sectors 11 to 19) (LBA 10 to 18). ROOT DIRECTORY TABLE ==================== File data begins immediately after the backup copy of the FAT. The first sector holding file data is always the Root Directory Table (i.e. the Directory Table for the files in the Root directory). 14 sectors are reserved for this Directory Table. This limits the number of files that can be stored in the Root Directory; if each file has a lengthy Long File Name it SEVERELY restricts the number. NB: The maximum number of files in the Root directory is 224. Thus the Root Directory Table occupies sectors 20 to 33 (CHS 0-1-2 to 0-1-15) (LBA 19 to 32). FILES ===== The first file containing user-data begins immediately following the Root Directory Table: in sector 34 (CHS 0-1-16) (LBA 33). This sector may contain - (a) A file in the Root directory; or (b) If the disk contains sub-directories, another Directory Table.
^ Top of Page USB FLASH DISKS =============== USB Flash Drives are also known as USB Pen Drives; or as USB SSD's (Solid State Devices), because they have no moving parts FILE SYSTEM =========== USB Flash Drives typically use the FAT file system, rather than NTFS. Because of licensing restrictions imposed by Micro$oft, these devices usually use FAT32; not the extended FAT filesystem, exFAT ("FAT64"). PARTITION TYPE ============== The Primary Partition will typically be type 0C : Win95 FAT32 (LBA) DIFFERENCES FROM FAT32 HARD DISK ================================ The disk structure will typically have the following differences from a FAT32 hard disk: 1. The device will usually have only a single partition, i.e. only a Primary partition (a.k.a. "Primary DOS" partition). NB: In the 64-byte Partition Table, all the entries will be zero except the first 16-bytes (the first entry). 2. The device will not usually be bootable, i.e. the Primary Partition will accordingly be marked "inactive" (non-bootable). 3. The partition will usually not exceed 8GB. Accordingly, it will have a relatively small cluster size, typically using only 4 KB clusters; i.e. each cluster (or "allocation unit") will comprise 4,096 bytes. 4. Each Head (in the logical structure of Cylinders-Heads-Sectors) might have only 32 Sectors per Head, instead of the normal 63. Thus although the Primary Partition still begins at CHS 0-1-1 this will be, in LBA terms, sector LBA 32 (not LBA 63). NB: All the usual FAT32 structures will be present: Boot Sector, FS Info sector, 3rd Sector, FAT, and FAT2; but the partition will begin in the 33rd sector on the disk (LBA 32), not in the 64th sector of the disk (LBA 63), thus all the structures that are normal for FAT32 will be displaced by 31 sectors. In consequence, some disk tools (including Norton's Utilities) will NOT correctly recognise the disk. They will - wrongly - report an error in the partition's Boot Sector, because they are designed only for disks which use 63 Sectors per Head. When a disk has a non-standard number of Sectors per Head, it will usually have the normal 255 Heads per Cylinder. Note: Where every Head consists of only 32 sectors, each Cylinder will be only 8,160 sectors (255 x 32). The Primary Partition will be an exact multiple of this number, not of the usual 16,065 (255 x 63). 5. Each Cylinder (in the logical structure of Cylinders-Heads-Sectors) might have only 32 Heads per Cylinder, instead of the usual 255; or might have only 240 Heads per Cylinder (numbered 0 to 239). NB: In consequence, some disk tools (including Norton's Utilities) will NOT correctly recognise the disk. They will - wrongly - report an error in the partition's Boot Sector, because they are designed only for disks which use 255 Heads per Cylinder. NB: When a disk has a non-standard number of Heads per Cylinder, it nevertheless usually has the normal 63 Sectors per Head. Note: Where a disk has (for example) 32 Heads per Cylinder, each Cylinder will be only 2,016 sectors (32 x 63). The Primary Partition will be an exact multiple of this number, not of the usual 16,065 (255 x 63). 6. Non-standard geometry is not unusual on USB flash disks. I have, for example, met instances of 16 Heads per Cylinder on some. MBR SECTOR & BOOT SECTOR ======================== Below are examples of a USB Flash Drive's MBR Sector (CHS 0-0-1) (LBA 0) and its Boot Sector (CHS 0-1-1) (LBA 32). The structures of both the MBR sector and the Boot Sector are the same as on a FAT32 hard disk. USB Flash Drive (Example: USB DISKPRO) Size: 8GB Single Partition: Begins at CHS 0-0-1 (LBA 0) MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa LBA mode 1 - Master Boot Record (00000000h) 0000: FA BE 00 7C BF 00 7A B9-00 01 FC 0E 1F 0E 07 F3 [ �� |� z� � � ] 0010: A5 EA 16 7A 00 00 BB BE-7B 33 C9 80 3F 80 75 06 [ �� z ��{3ɀ?�u ] 0020: FE C5 8B F3 EB 07 80 3F-00 75 02 FE C1 83 C3 10 [ �ŋ�� �? u ���� ] 0030: 81 FB FE 7B 72 E5 83 F9-04 74 0B 81 F9 03 01 74 [ ���{r�� t �� t ] 0040: 0A BB A5 7A EB 2C BB 87-7A EB 27 8B 4C 02 8B 14 [ ��z�,��z�'�L � ] 0050: B8 01 02 BB 00 7C CD 13-73 05 BB BC 7A EB 13 2E [ � � |� s ��z� . ] 0060: A1 FE 7D 3D 55 AA 74 05-BB BC 7A EB 05 EA 00 7C [ ��}=U�t ��z� � | ] 0070: 00 00 2E 8A 07 3C 00 74-0C 53 BB 07 00 B4 0E CD [ .� < t S� � � ] 0080: 10 5B 43 EB ED EB FE 4E-6F 20 62 6F 6F 74 61 62 [ [C����No bootab ] 0090: 6C 65 20 70 61 72 74 69-74 6F 6E 20 69 6E 20 74 [ le partiton in t ] 00A0: 61 62 6C 65 00 49 6E 76-61 6C 69 64 20 50 61 72 [ able Invalid Par ] 00B0: 74 69 74 6F 6E 20 74 61-62 6C 65 00 49 6E 76 61 [ titon table Inva ] 00C0: 6C 69 64 20 6F 72 20 64-61 6D 61 67 65 64 20 42 [ lid or damaged B ] 00D0: 6F 6F 74 61 62 6C 65 20-70 61 72 74 69 74 69 6F [ ootable partitio ] 00E0: 6E 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ n ] 00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ] 01C0: 01 00 0C 0F E0 77 20 00-00 00 E0 EF EE 00 00 00 [ �w ��� ] 01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ] 1 - Partition table entry = 0 << Win95 FAT32 (LBA) >> 01BE: 00 01 01 00 0C 0F E0 77-20 00 00 00 E0 EF EE 00 [ �w ��� ] ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC +0 00 STATUS: Inactive +1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h (0-1-1) +4 0C PARTITION ID: Win95 FAT32 (LBA) +5 0F E0 77 END CYL-HEAD-SECTOR: 377h-0Fh-20h (887-15-32) +8 00000020 START SECTOR: 32 +C 00EEEFE0 NUMBER OF SECTORS: 15658976 1-0 Win95 FAT32 (LBA) Boot Sector (00000020h) 0000: EB 58 90 2D 37 3D 5E 77-49 48 43 00 02 08 40 00 [ �X�-7=^wIHC @ ] 0010: 02 00 00 00 00 F8 00 00-20 00 10 00 20 00 00 00 [ � ] 0020: E0 EF EE 00 A0 3B 00 00-00 00 00 00 02 00 00 00 [ ��� ; ] 0030: 01 00 08 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0040: 00 00 29 59 BD 13 F7 55-53 42 44 49 53 4B 50 52 [ )Y� �USBDISKPR ] 0050: 4F 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ O FAT32 �3ɎѼ ] 0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ] 0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ] 0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ] 0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ] 00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ] 00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ] 00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ] 00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ] 00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ] 00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ] 0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t < ] 0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �}� ] 0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ �}���� ^ f� � ] 0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ] 0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ] 0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ] 0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a�d ] 0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ] 0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ] 0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ] 01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ] 01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ] 01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ] 01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ] 01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ] 01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ] 1 - Partition table entry = 1 << Empty >> 01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC +0 00 STATUS: Inactive +1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0) +4 00 PARTITION ID: Empty +5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0) +8 00000000 START SECTOR: 0 +C 00000000 NUMBER OF SECTORS: 0 1 - Partition table entry = 2 << Empty >> 01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC +0 00 STATUS: Inactive +1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0) +4 00 PARTITION ID: Empty +5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0) +8 00000000 START SECTOR: 0 +C 00000000 NUMBER OF SECTORS: 0 1 - Partition table entry = 3 << Empty >> 01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC +0 00 STATUS: Inactive +1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0) +4 00 PARTITION ID: Empty +5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0) +8 00000000 START SECTOR: 0 +C 00000000 NUMBER OF SECTORS: 0 PARTITION MAP - LBA ABSOLUTE PART-TABLE START END START BLOCKS ======== ======== ======== ======== 1-0 : 00000020 00EEEFFF 00000020 00EEEFE0 Win95 FAT32 (LBA) CHKDSK Report (8GB) =================== Total disk space in partition: 7,814,192 KB 4,096 bytes in each allocation unit 1,953,548 total allocation units [Clusters] SUMMARY OF DISK STRUCTURES ========================== Disk Investigator's summary of Disk structure - Example: USB Pen Drive, 8GB, Primary DOS partition Volume Label: USBDISKPRO Logical drive: G Physical drive: 130 Total logical sectors: 15658976 Cylinders: 975 Sectors per Head: 63 Heads: 16 Bytes per sector: 512 File system: FAT32 Sectors per Cluster: 8 Number of copies of FAT: 2 Sectors per FAT: 15264 Start sector for FAT1: 64 Start sector for FAT2: 15328 Root DIR Sector: 30592 Root DIR Cluster: 2 2nd Cluster Start Sector: 30592 Ending Cluster: 1953549 Media Descriptor: 248 Root Entries: 0 Heads: 16 Hidden sectors: 32 Backup boot sector: 8 Reserved sectors: 64 FS Info sector: 1 Sectors per track: 32 File system version: 0 SerialVolumeID: F713BD59 1. Calculate Disk Size • Disk size in Sectors = 'Hidden Sectors' + 'Total logical sectors' 32 + 15,658,976 = 15,659,008 sectors Alternate: Disk size in Sectors = 'Hidden Sectors' + 'Reserved Sectors' + ('Sectors per FAT' x 2) + (('Ending Cluster' - 'Root DIR Cluster' + 1) x 8) 32 + 64 + (15,264 x 2) + ((1,953,549 - 2 + 1) x 8) = 96 + ( 30,528 ) + ( 1,953,548 x 8) = 96 + ( 30,528 ) + ( 15,628,384 ) = 15,659,008 sectors • For disk size in Bytes, multiply by 'Bytes per sector' 15,659,008 x 512 = 8,017,412,096 bytes • For disk size in Gigabytes, divide by 1,073,741,824 8,017,412,096 + 1,073,741,824 = 7.467 GiB 2. Calculate Partition Size • Partition size in Sectors = 'Hidden sectors' + 'Total logical sectors' 32 + 15,658,976 = 15,659,008 • Partition size in KB = Divide by 2 15,659,008 � 2 = 7,829,504 KB • Partition size in Gigabytes = Divide by 1,048,576 7,829,504 � 1,048,576 = 7.46 GiB • Partition size in Sectors a. Data Region size in Sectors = 'Total logical sectors' - ('Reserved Sectors' + ('Sectors per FAT' x 2)) 15,658,976 - ( 64 + (15,264 x 2) ) = 15,658,976 - ( 64 + ( 30,528 ) ) = 15,658,976 - ( 30,592 ) = 15,628,384 Sectors Data Region size in Clusters = Size in Sectors divided by 'Sectors per Cluster' = 15,628,384 � 8 = 1,953,548 Clusters Alternate: Data Region size in Sectors = ('Ending Cluster' - 'Root DIR Cluster' + 1) x 'Sectors per Cluster' (1,953,549 - 2 + 1) x 8 = 15,628,384 Sectors b. Add Reserved Region and FAT Region ('Reserved sectors' + 'Sectors per FAT' x 2): 15,628,384 + 64 + (15,264 x 2) = 15,658,976 Sectors c. Add Track 0 ('Hidden sectors'): 15,658,976 + 32 = 15,659,008 Sectors 3. Calculate Size of Data Region • Size in Clusters = ('Ending Cluster' - 'Root DIR Cluster') + 1 ( 1,953,549 - 2 ) + 1 = 1,953,547 + 1 = 1,953,548 Clusters • Bytes per Cluster = 'Sectors per Cluster' x 'Bytes per sector' 8 x 512 = 4,096 bytes per cluster • Disk Area in KB = Clusters x Bytes per cluster 1,953,548 x 4,096 = 8,001,732,608 bytes Divide by 1,024 for size in KB: 8,001,732,608 � 1,024 = 7,814,192 KB 4. Calculate Partition Geometry [Primary Partition] • Boot Sector : 'Hidden sectors' 32 (LBA) • FS Info Sector : 'Hidden sectors' + 'FS Info sector' 32 + 1 = 33 (LBA) • Backup Boot Sector : 'Hidden sectors' + 'Backup boot sector' 32 + 8 = 40 (LBA) • 1st sector of FAT1 : 'Hidden sectors' + 'Reserved Sectors' 32 + 64 = 96 (LBA) • 1st sector of FAT2 : 'Hidden sectors' + 'Reserved Sectors' + 'Sectors per FAT' 32 + 64 + 15,264 = 15,360 (LBA) • 1st sector of Root : 'Hidden sectors' + 'Root DIR Sector' Directory Table 32 + 30,592 = 30,624 (LBA) • C-H-S Geometry : 'Cylinders' x 'Heads' x 'Sectors per track' 975 x 16 x 32 = 499,200 sectors An artificial value. See disk size, above: Partition has 15,659,008 sectors • Sectors per Cylinder : 'Heads' x 'Sectors per track' 16 x 32 = 512 The Primary partition MUST be an exact multiple of this, as partitions must be Cylinder-aligned NB: 15,659,008 � 512 = 30,584
^ Top of Page
SAVE DISK INFORMATION
=====================
The information in this section outlines how to make a backup copy of the
important information that defines the disk data structures (disk layout).
NB: If you do this while the disk is in good working order, and keep them
up-to-date, the backups will help you recover from a future disk crash.
CHKDSK.EXE
==========
The CheckDisk program (CHKDSK.EXE) reports the size of the partition
("Total disk space"), Cluster size ("Bytes in each allocation unit"),
and the number of Clusters ("Total allocation units on disk").
Syntax -
Specify the partition's Drive letter
*** Save Result to File ***
CHKDSK C: > F:\CHKDSK_C.txt
CHKDSK D: > F:\CHKDSK_D.txt
CHKDSK E: > F:\CHKDSK_E.txt
Note:- This example uses a removable USB disk as Drive F:
to store the output from the CheckDisk program on
MBRSCAN.EXE
===========
MBRSCAN v1.12 saves MBR & Boot Sector information for any
hard disk recognised by the BIOS (IDE, SCSI, USB or SATA).
Saves an exact record (as ASCII) of the disk's MBR sector
including the Partition Table, AND of each Boot Sector;
and saves partition details for each partition on the disk.
NB: This program's geometry function sometimes fails under
Windows. If so, run the program in DOS instead.
*** Save a report for Disk 1 ***
MBRSCAN 80 > F:\MBRscan.D1
*** Save a report for Disk 2 ***
MBRSCAN 81 > F:\MBRscan.D2
*** Save a report for Disk 3 ***
MBRSCAN 82 > F:\MBRscan.D3
*** Save a report for Disk 4 ***
MBRSCAN 83 > F:\MBRscan.D4
Notes -
DOS and Windows identify working hard disks consecutively,
beginning with the ID number 80.
Disks attached to the IDE interface are recognised first,
in this order:
1. Primary Master
2. Primary Slave
3. Secondary Master
4. Secondary Slave
NB: An SCSI optical drive attached to the IDE interface
(i.e. a CD-ROM or DVD-ROM), typically attached as
Secondary Master, cannot be scanned by MBRSCAN.EXE
Disks attached to the PCI slots (e.g. USB or SATA disks)
are recognised next, in this order:
5. Devices attached to Slot 1
6. Devices attached to Slot 2
7. Devices attached to Slot 3
8. Devices attached to Slot 4
9. Devices attached to Slot 5
NB: A Micro-ATX motherboard usually has space for only
3 PCI slots, but an ATX board typically has 5 slots.
NB: Any number of devices may be attached to a single slot
(e.g. some models of PCI Card have up to 5 USB ports).
BIOS.EXE
========
BIOS.EXE v1.35 (24 KB)
Save and Restore the computer's BIOS settings.
The program's functions:
• Save and restore the BIOS settings
• Validate actual settings to saved settings
• Delete the BIOS settings (there are some strange cases...)
• Display information about the BIOS, BIOS Extensions and
BIOS beepcodes
• Find BIOS passwords for Award, Ami, Phoenix and AST BIOS
• Find BIOS universal passwords for Award BIOS
• Dump the whole BIOS segment to disk
• Switch the 1st and 2nd level caches on/off
• Turn the PC into Standby or Suspend mode (requires APM 1.1+)
• Turn off the PC (requires APM 1.2+)
• Reboot the PC (cold/warm/Int19)
• Return DOS error codes for batch processing
Syntax -
Usage: BIOS [option]
I = information on BIOS
X = information on BIOS extensions
B = information on BIOS beep codes
P = find BIOS passwords (only Award, AMI, PHOENIX and AST)
U = find BIOS universal password (only Award)
S [FILE] = save CMOS data [to FILE] (default: c:\bios.sav)
R [FILE] = restore CMOS data [from FILE] (default: c:\bios.sav)
V [FILE] = validate CMOS data [to FILE] (default: c:\bios.sav)
E = erase CMOS data
D [FILE] = dump BIOS segment [to FILE] (default: c:\bios.dmp)
A+/A- = enable/disable Advanced Power Management
L1+/L1-/L2+/L2- = enable/disable 1st/2nd level cache
Y = system information (requires LM7x/LM80/Winbond chipset)
C/W/Z = cold boot / warm boot / reset using Interrupt 19 hex
M/N/O = standby / suspend / turn PC off
For updates: http://mbockelkamp.dyndns.org/mbockelkamp/mysoft_d.htm
For bug reports and improvement tips write to mbockelkamp@web.de
Save the BIOS
** Save BIOS settings to a Backup file **
BIOS S F:\CMOS.BIN
Note -
Do NOT do this in a Windows DOS box. The BIOS is divided
in two parts: the first contains procedures only needed
while booting, the second contains all other procedures.
The first part of the BIOS segment is used as conventional
memory after booting. If you try to make a BIOS dump from
within Win9x, you get a dump file with some normal memory
and the second part of the BIOS; the first part is missing.
** Compare the BIOS settings with a Backup file **
BIOS V F:\CMOS.BIN
Meaning of result codes -
000 - Everything OK
128 - V: Identical
129 - V: Not identical
130 - D: PC isn't in Real Mode
253 - Error in commandline
254 - Error in file operation
255 - Function not supported
** Restore the BIOS settings from a Backup file **
BIOS R F:\CMOS.BIN
*** Save additional BIOS information ***
BIOS I > F:\BiosInfo.txt
BIOS X > F:\BiosExtensions.txt
BIOS B > F:\BiosBeepCodes.txt
*** Save BIOS Password ***
BIOS P > F:\PASSWORD.txt
*** Save BIOS Password State ***
BIOS D BIOS.DMP
There are eight possible states -
1. No passwords, security option: setup
2. No passwords, security option: system
3. Only superviser password, security option: setup
4. Only superviser password, security option: system
5. Only user password, security option: setup
6. Only user password, security option: system
7. Both passwords, security option: setup
8. Both passwords, security option: system
*** Manage BIOS Cache from DOS ***
Enable 1st level cache:
BIOS L1+
Disable 1st level cache:
BIOS L1-
Enable 2nd level cache:
BIOS L2+
Disable 2nd level cache:
BIOS L2-
*** Other BIOS tools ***
• See http://lists.thedatalist.com/pages/BIOS_Tools.htm
LOST BIOS PASSWORD
==================
The user can be locked out of the BIOS by a forgotten password!
A lost BIOS password usually has to be reset using a master password,
software program, or hardware jumper (to gain access to the BIOS).
A. Master Password
To bypass a BIOS password, try one of these standard manufacturer's
"backdoor" passwords.
(a) AWARD BIOS -
AWARD SW, AWARD_SW, Award SW, AWARD PW, _award, awkward, J64, j256,
j262, j332, j322, 01322222, 589589, 589721, 595595, 598598, HLT,
SER, SKY_FOX, aLLy, aLLY, Condo, CONCAT, TTPTHA, aPAf, HLT, KDD,
ZBAAACA, ZAAADA, ZJAAADC, djonet, %����� �p������%, %������ �p������%
(NB: The last two passwords in that list are in Russian!)
(b) AMI BIOS -
AMI, A.M.I., AMI SW, AMI_SW, BIOS, PASSWORD, HEWITT RAND, Oder
(c) AMI/AWARD or other BIOS -
LKWPETER, lkwpeter, BIOSTAR, biostar, BIOSSTAR, biosstar, ALFAROME,
Syxz, Wodj
Notes -
1. These passwords are Case Sensitive!
2. The key marked "_" on a US keyboard corresponds to "?" on some
European keyboards, so type AWARD?SW or AMI?SW when using one.
B. Software Solution - Reset the BIOS
To bypass the BIOS password, run the following program at startup. It
removes the password by resetting the BIOS to its default settings.
*** Clear (ERASE) BIOS settings ***
BIOS E
Alternatively, do the same manually. Use the MS-DOS tool DEBUG to
reset the BIOS to its default values: type DEBUG at the command prompt
in pure MS-DOS mode (NOT from an MS-DOS box in Windows); and then
type the following 2 line command:
For an AMI/AWARD BIOS -
O 70 17
O 71 17
Q
For a PHOENIX BIOS -
O 70 FF
O 71 17
Q
For a GENERIC BIOS -
O 70 2E
O 71 FF
Q
This invalidates the CMOS RAM, so should work on all AT motherboards;
XT motherboards don't have CMOS.
Notes -
1. The first character is the letter "O" not the number "0".
2. The numbers which follow it are two bytes in hex format.
3. The third line is Q (QUIT).
C. Hardware Solution - Reset the Jumper
On most motherboards there are not one but two sets of jumpers.
One resets the BIOS defaults (usually the one near the battery or
CMOS chip). The other resets the BIOS password (the password jumper).
NB: The motherboard's manual will identify the correct jumper!
NB: Most systems store the BIOS password in nvram (non-volitile ram),
which does NOT lose information when the power is off. Therefore
removing the CMOS battery will not reset the BIOS password!
D. Hardware Solution - Accessing the Data
To access data on a HDD, remove it from the inaccessible computer
and install it temporarily as IDE Primary Slave on another computer.
E. Other Solutions
There are other hardware solutions: e.g. short-circuiting the chip,
replacing the chip.
For these, see http://www.elfqrin.com/docs/biospw.html
The only other hardware option is to REPLACE the motherboard.
CMOS.COM
========
Save and Restore the CMOS settings.
Saves and restores all 114 bytes of CMOS memory. Many older
programs only save the first 50 bytes: this used not to matter
but many BIOS manufacturers are now using the 'high' 64 bytes.
Syntax -
CMOS /SAVE filename
Save CMOS to file "filename"
(NB: If no filename is specified, the default is CMOS.SAV)
CMOS /COMPARE filename
Verifies the contents of CMOS memory against a file
(NB: ERRORLEVEL 7 indicates a mismatch between CMOS and file)
CMOS /RESTORE filename
Load CMOS settings from file "filename" and reboot
(NB: If no filename is specified, the default is CMOS.SAV)
CMOS /DUMP
Dumps current contents of CMOS to the screen (or to STDOUT)
in hex. (NB: Useful only to hexperts)
Note -
Uses a different file format from other programs. You cannot
share data files between CMOS.COM and SAVECMOS.EXE or ROM2.EXE
as it uses a special file header to prevent the user loading
(for instance) AUTOEXEC.BAT or some other non-CMOS data into
CMOS memory, and to guarantee file integrity.
NB: Test this utility to determine whether it can correctly
save and restore your CMOS - before an emergency occurs!
*** Save the CMOS settings ***
CMOS /SAVE F:\CMOS.SAV
*** Compare the CMOS settings with Backup file ***
CMOS /COMPARE F:\CMOS.SAV
*** Restore the CMOS settings ***
CMOS /RESTORE F:\CMOS.SAV
^ Top of Page
BACKUP A SECTOR
===============
This routine is designed to work with -
Svend's Utilities: FINDPART for DOS (version 4.72)
FINDPART for Windows (version 4.95 for FAT32)
NB: In this version of Svend's Utilities the GETSECT function is
a switch (i.e. an option) in FINDPART, not a separate program
*** Preparation ***
1. Make an empty directory (C:\SAVED\DATA) to store output files in,
and put the Batch File in that directory.
2. Make an empty directory on a USB Disk at F:\DATA
to store a backup copy of the output files.
SYNTAX of FINDPART
==================
First is the number of the Disk (numbered from 1), e.g. 1
Next is the CHS number, e.g. 0 0 1
Next is the number of sectors to save, e.g. 1
Next specify a destination file, e.g. on Drive A: (floppy)
The option NOHEADER means only the actual data will be written,
not the identifying fileheader normally added by GETSECT
The option BADF6 means the program will write character F6 (hex)
for all bytes that can't be read (something that will only occur
if the Disk is physically damaged)
NB: The program WILL cope with bad sectors, writing the hex
character specified in place of every byte of a bad sector,
but its multiple read attempts will slow the program down
(such that to read a 19,075 sector FAT took 1.5 hours)
NB: FINDBAD.EXE can also locate bad sectors, and overwrite each
sector with F6 (hex) characters. This repairs the sector,
but the previous content of the bad sector is lost.
Note -
When examining a binary file saved by FINDPART (e.g. viewing it
with Norton's DISKEDIT), bear in mind that like any file it will
consist of 32 sectors (on a FAT32 partition with 16KB clusters).
Therefore it does NOT contain only the content of the sector(s)
saved: a Disk Editor does NOT recognise the End Of File marker,
so ALSO shows the unused sectors, of those 32, containing junk.
Abbreviations used in FINDPART's output:
B Based on boot sector.
BU Based on backup boot sector (meaning that the boot sector
may be missing or damaged, or the partition is obsolete).
00 The boot sector is filled with ASCII character 0.
F6 The boot sector is filled with ASCII character 246.
R Reiser file system.
3 Ext3 file system.
H HPFS (OS/2) file system.
B5 A Linux boot sector with boot signature.
NR Boot sector not readable: bad sector, or outside disk area.
NB Nota Bene.
R0 The boot sector relative field is relative to LBA sector 0.
OK Okay.
!! An extended partition ending at cylinder 1024 or later (type 05).
* In front of ID: Active flag set.
After cylinder number: The actual entry is 1023.
After Cluster KB in FAT output: Based on boot sector.
After Root size/Cluster number in FAT output: Based on boot sector.
# After cylinder number: The actual entry is 1023/(heads-1)/sectors.
After Cluster KB in FAT output: Not confirmed in boot sector.
After Root size/Cluster number in FAT output: Not confirmed in
boot sector.
? In front of ID: Active flag not hexadecimal 00 or 80.
After partition line: Ending after end of disk.
DISK 1
======
NON-DOS PARTITION (Track Zero)
=================
*** Save Sector 0-0-1 (Master Boot Record & Partition Table) ***
FINDPART GETSECT 1 0 0 1 1 F:\0-0-1.D1 noheader badf6
*** Save Sector 0-0-9 (Sector 9 of Track 0) (Backup MBR) ***
FINDPART GETSECT 1 0 0 9 1 F:\0-0-9.D1 noheader badf6
*** Save Sector 0-0-1 to 0-0-63 (Entire Track 0) ***
FINDPART GETSECT 1 0 0 1 63 F:\0-0-1-63.D1 noheader badf6
Note -
Track 0 is usually empty except for CHS 0-0-1 and 0-0-9
NB: The above sectors only need to be saved ONCE,
as their values are permanent!
PRIMARY PARTITION
=================
*** Save Sector 0-1-1 (Boot Sector) ***
FINDPART GETSECT 1 0 1 1 1 F:\0-1-1.D1 noheader badf6
*** Save Sector 0-1-2 (FS Info Sector) ***
FINDPART GETSECT 1 0 1 2 1 F:\0-1-2.D1 noheader badf6
*** Save Sector 0-1-3 (Boot Data Sector) ***
FINDPART GETSECT 1 0 1 3 1 F:\0-1-3.D1 noheader badf6
*** Save Sector 0-1-1 to 0-1-32 (First 32 sectors) ***
FINDPART GETSECT 1 0 1 1 32 F:\0-1-1-32.D1 noheader badf6
*** Save Sector 0-1-1 to 0-1-63 (Entire Track 1) ***
** This includes some duplication, but is essential **
FINDPART GETSECT 1 0 1 1 63 F:\0-1-1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors Per FAT **
The value of "Big Sectors Per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 0 1 33 _____ F:\PRI_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ _ __ _____ F:\PRI_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 1, Primary Partition) **
** A quick search, for a Disk which has only one partition **
FINDPART FINDFAT 1 0 1 F:\FAT_CHS1.TXT
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 ROOT.D1 noheader badf6
EXTENDED PARTITION
==================
1st Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 1 F:\L1_1st.D1 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 1 _____ 0 2 1 F:\L1_2nd.D1 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 1 _____ 0 3 1 F:\L1_3rd.D1 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 32 F:\L1_1-32.D1 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 63 F:\L1_1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ 1 33 _____ F:\L1_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ _ __ _____ F:\L1_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 L1_ROOT.D1 noheader badf6
2nd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 1 F:\L2_1st.D1 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 1 _____ 0 2 1 F:\L2_2nd.D1 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 1 _____ 0 3 1 F:\L2_3rd.D1 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 32 F:\L2_1-32.D1 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 63 F:\L2_1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS using PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ 1 33 _____ F:\L2_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ _ __ _____ F:\L2_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 L2_ROOT.D1 noheader badf6
3rd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 1 F:\L3_1st.D1 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 1 _____ 0 2 1 F:\L3_2nd.D1 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 1 _____ 0 3 1 F:\L3_3rd.D1 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 32 F:\L3_1-32.D1 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 1 _____ 0 1 63 F:\L3_1-63.D1 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ 1 33 _____ F:\L3_FAT1.D1 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 1 _ _ __ _____ F:\L3_FAT2.D1 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 1, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 1 _ __ __ 64 L3_ROOT.D1 noheader badf6
DISK 2
======
NON-DOS PARTITION (Track Zero)
=================
*** Save Sector 0-0-1 (Master Boot Record & Partition Table) ***
FINDPART GETSECT 2 0 0 1 1 F:\0-0-1.D2 noheader badf6
*** Save Sector 0-0-9 (Sector 9 of Track 0) (Backup MBR) ***
FINDPART GETSECT 2 0 0 9 1 F:\0-0-9.D2 noheader badf6
*** Save Sector 0-0-1 to 0-0-63 (Entire Track 0) ***
FINDPART GETSECT 2 0 0 1 63 F:\0-0-1-63.D2 noheader badf6
Note -
Track 0 is usually empty except for CHS 0-0-1 and 0-0-9
NB: The above sectors only need to be saved ONCE,
as their values are permanent!
PRIMARY PARTITION
=================
*** Save Sector 0-1-1 (Boot Sector) ***
FINDPART GETSECT 2 0 1 1 1 F:\0-1-1.D2 noheader badf6
*** Save Sector 0-1-2 (FS Info Sector) ***
FINDPART GETSECT 2 0 1 2 1 F:\0-1-2.D2 noheader badf6
*** Save Sector 0-1-3 (Boot Data Sector) ***
FINDPART GETSECT 2 0 1 3 1 F:\0-1-3.D2 noheader badf6
*** Save Sector 0-1-1 to 0-1-32 (First 32 sectors) ***
FINDPART GETSECT 2 0 1 1 32 F:\0-1-1-32.D2 noheader badf6
*** Save Sector 0-1-1 to 0-1-63 (Entire Track 1) ***
** This includes some duplication, but is essential **
FINDPART GETSECT 2 0 1 1 63 F:\0-1-1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 0 1 33 _____ F:\PRI_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 0 _ __ _____ F:\PRI_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 2, Primary Partition) **
** A quick search, for a Disk which has only one partition **
FINDPART FINDFAT 2 0 1 F:\FAT_CHS2.TXT
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 ROOT.D2 noheader badf6
EXTENDED PARTITION
==================
1st Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 1 F:\L1_1st.D2 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 2 _____ 0 2 1 F:\L1_2nd.D2 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 2 _____ 0 3 1 F:\L1_3rd.D2 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 32 F:\L1_1-32.D2 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 63 F:\L1_1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _ 1 33 _____ F:\L1_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _ _ __ _____ F:\L1_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 L1_ROOT.D2 noheader badf6
2nd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 1 F:\L2_1st.D2 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 2 _____ 0 2 1 F:\L2_2nd.D2 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 2 _____ 0 3 1 F:\L2_3rd.D2 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 32 F:\L2_1-32.D2 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 63 F:\L2_1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _ 1 33 _____ F:\L2_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _ _ __ _____ F:\L2_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 L2_ROOT.D2 noheader badf6
3rd Logical Partition -
*** Save Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 1 F:\L3_1st.D2 noheader badf6
*** Save FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART GETSECT 2 _____ 0 2 1 F:\L3_2nd.D2 noheader badf6
*** Save Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART GETSECT 2 _____ 0 3 1 F:\L3_3rd.D2 noheader badf6
*** Save first 32 sectors of Partition ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 32 F:\L3_1-32.D2 noheader badf6
*** Save first 63 sectors of Partition ***
** This includes some duplication, but is essential **
** User must insert CHS value of 1st sector of this Partition **
FINDPART GETSECT 2 _____ 0 1 63 F:\L3_1-63.D2 noheader badf6
** The above sectors only need to be saved ONCE **
** as their values are permanent (but see Note) **
Note - FS Info Sector should be regularly backed up.
The amount of free disk space is stored in
this sector; but CHKDSK.EXE or SCANDISK.EXE
can recalculate it!
*** Save Sector 96 onward: FAT 1 & 2 ***
** Need to be saved daily, as FAT details change constantly **
** These will be BIG files, so do NOT save them to floppy! **
** Number of sectors to save = Big Sectors per FAT **
The value of "Big Sectors per FAT" is displayed by
the 32bit version of PowerQuest Partition Table Editor
- Find this value in DOS with PTEDIT.EXE (below),
PowerQuest's Partition Table Editor for DOS
** User must insert CHS value of 33rd sector of this Partition **
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _ 1 33 _____ F:\L3_FAT1.D2 noheader badf6
** User must find CHS start sector of 2nd FAT with FINDPART (below)
** and the number of sectors to be saved: "Big Sectors per FAT" **
FINDPART GETSECT 2 _ _ __ _____ F:\L3_FAT2.D2 noheader badf6
*** PowerQuest Partition Table Editor for DOS ***
** Find value of "Big Sectors Per FAT" **
SET PATH=%path%;F:\RECOVERY
MOUSE
PTEDIT
Svend's FINDPART: FindFAT Option
** Find start sector of 2nd FAT (Disk 2, All Partitions) **
** Reports starting sector (CHS) and size (sectors) **
** of all FATs on the Disk (Primary & Logical) **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2.TXT
See also SRCFAT, below
SRCFAT.EXE is a utility which can save and restore the FAT,
without needing any user input as to the sector addresses
Save the Root Directory table
The Root Directory table begins in the first sector
after the 2nd FAT, and one cluster is reserved for it
** User must insert CHS value of 1st sector after the 2nd FAT **
NB: Svend's FINDPART: FindFAT Option (above) reports the
starting sector (CHS) and size (sectors) of the 2nd FAT
NB: See note, Convert from Sectors to CHS, below!
FINDPART GETSECT 2 _ __ __ 64 L3_ROOT.D2 noheader badf6
^ Top of Page
RESTORE A SECTOR
================
Svend's Utilities: FINDPART for DOS (version 4.72)
NB: In this version of Svend's Utilities the PUTSECT function is
a switch (i.e. an option) in FINDPART, not a separate program
RECOVERY PROCEDURE
==================
The quickest way to recover is -
1. Boot to the DOS prompt (with a bootable floppy disk)
2. Rebuild the hard disk's MBR (CHS 0-0-1) (from backup)
3. Rebuild the hard disk's Boot Sector (CHS 0-1-1) (from backup)
4. Restore hard disk's File Allocation Table (FAT1) (from backup)
NB: The floppy disk must contain the version of DOS required by
the version of Windows that's on the hard disk being fixed
NB: This will only repair the Primary DOS partition; but that is
the partition most likely to be damaged if the disk won't boot
Note - If the 2nd (backup) FAT is undamaged, set the first 4 bytes
of the 1st FAT to 00 00 00 00 so that Windows will detect
it's corrupt, therefore will automagically use the 2nd FAT
SYNTAX of PUTSECT
=================
Writes a 512 byte file to a (512 byte) disk sector
(NB: The PUTSECT function will only write a 512 byte file!)
First is the number of the Disk (numbered from 1), e.g. 1
(NB: Valid disk numbers are from 1 to 8)
Next is the sector's CHS number: e.g. 0 0 1
Next is the FILENAME of the source file
Next is the number of cylinders on the disk, a 4-digit number
(NB: Get this number [a DECIMAL number] with PARTINFO.EXE)
(NB: Or get this number with the command FINDPART TABLES)
Next is the hash number of the source file, an 8-digit number
(To find this number: FINDPART PUTSECT GETHASH FILENAME.TYP)
(Or HASH can be entered as 00000000 if FORCE added to command)
*** Identify the number of Cylinders on the Disk ***
** Identifies CHS values for ALL disks present **
Display result on screen -
PARTINFO
FINDPART TABLES
Save result to file -
PARTINFO > F:\PARTINFO.txt
FINDPART TABLES > F:\TABLES.txt
Notes -
The PUTSECT function can only write a 512 byte file, but -
1. The program MBRutilD.exe can save and restore the entire
TRACK 0 (CHS 0-0-1 to 0-0-63), but ONLY for Disk 1
2. The program SRCFAT.COM can save and restore an entire FAT
*** Display the Help screen ***
FINDPART PUTSECT /?
*** Save the Help screen to a file ***
FINDPART PUTSECT /? > F:\PUTSECT.TXT
*** Set Environment Variable ***
NB: All PUTSECT operations will FAIL if this is not set!
SET FINDPART=EDIT
DISK 1
======
____ Cylinders (decimal)
NON-DOS PARTITION (Track Zero)
=================
*** Write Sector 0-0-1 (MBR Sector) ***
FINDPART PUTSECT 1 0 0 1 F:\0-0-1.D1 ____ 00000000 FORCE
*** Write Sector 0-0-9 (Backup MBR Sector) ***
NB: Write this to CHS 0-0-1 instead if MBR is corrupted
FINDPART PUTSECT 1 0 0 9 F:\0-0-9.D1 ____ 00000000 FORCE
Note -
Track 0 is usually empty except for CHS 0-0-1 and 0-0-9
MBRUtil Copyright (c) 2002 PowerQuest Corporation
MBRutilD.exe [/?] [/S[H]=filename] [/R[H]=filename]
/S Save MBR (sector 1 only) to filename
/SH Save entire first head to filename
/R Restore MBR (sector 1 only) from filename
/RH Restore entire first head from filename
*** Restore Track 0 from a Backup File located on Drive F ***
MBRUtilD.exe /RH=F:\0-0-1-63.D1
PRIMARY PARTITION
=================
*** Write Sector 0-1-1 (Boot Sector) ***
FINDPART PUTSECT 1 0 1 1 F:\0-1-1.D1 ____ 00000000 FORCE
*** Write Sector 0-1-2 (FS Info Sector) ***
FINDPART PUTSECT 1 0 1 2 F:\0-1-2.D1 ____ 00000000 FORCE
*** Write Sector 0-1-3 (Boot Data Sector) ***
FINDPART PUTSECT 1 0 1 3 F:\0-1-3.D1 ____ 00000000 FORCE
*** Write Sector 0-1-7 (Backup Boot Sector) ***
FINDPART PUTSECT 1 0 1 7 F:\0-1-1.D1 ____ 00000000 FORCE
*** Write Sector 0-1-8 (Backup FS Info Sector) ***
FINDPART PUTSECT 1 0 1 8 F:\0-1-2.D1 ____ 00000000 FORCE
*** Write Sector 0-1-9 (Backup Boot Data Sector) ***
FINDPART PUTSECT 1 0 1 9 F:\0-1-3.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
Most other sectors in Track 0 and in the first 33 sectors
of each Partition are empty, i.e. filled with zero's, and may
need to be set to zero if overwritten with garbage by a crash
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
EXTENDED PARTITION
==================
1st Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 1 _____ 1 1 F:\L1_1st.D1 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 2 F:\L1_2nd.D1 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 3 F:\L1_3rd.D1 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 7 F:\L1_1st.D1 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 8 F:\L1_2nd.D1 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 9 F:\L1_3rd.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
2nd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 1 _____ 1 1 F:\L2_1st.D1 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 2 F:\L2_2nd.D1 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 3 F:\L2_3rd.D1 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 7 F:\L2_1st.D1 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 8 F:\L2_2nd.D1 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 9 F:\L2_3rd.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
3rd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 1 _____ 1 1 F:\L3_1st.D1 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 2 F:\L3_2nd.D1 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 1 _____ 1 3 F:\L3_3rd.D1 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 7 F:\L3_1st.D1 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 8 F:\L3_2nd.D1 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 1 _____ 1 9 F:\L3_3rd.D1 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 1 _____ ___ __ !zero ____ 00000000 FORCE
DISK 2
======
____ Cylinders (decimal)
NON-DOS PARTITION (Track Zero)
=================
*** Write Sector 0-0-1 (MBR Sector) ***
FINDPART PUTSECT 2 0 0 1 F:\0-0-1.D2 ____ 00000000 FORCE
*** Write Sector 0-0-9 (Backup MBR Sector) ***
NB: Write this to CHS 0-0-1 instead if MBR is corrupted
FINDPART PUTSECT 2 0 0 9 F:\0-0-9.D2 ____ 00000000 FORCE
Note -
Track 0 is usually empty except for CHS 0-0-1 and 0-0-9
PRIMARY PARTITION
=================
*** Write Sector 0-1-1 (Boot Sector) ***
FINDPART PUTSECT 2 0 1 1 F:\0-1-1.D2 ____ 00000000 FORCE
*** Write Sector 0-1-2 (FS Info Sector) ***
FINDPART PUTSECT 2 0 1 2 F:\0-1-2.D2 ____ 00000000 FORCE
*** Write Sector 0-1-3 (Boot Data Sector) ***
FINDPART PUTSECT 2 0 1 3 F:\0-1-3.D2 ____ 00000000 FORCE
*** Write Sector 0-1-7 (Backup Boot Sector) ***
FINDPART PUTSECT 2 0 1 7 F:\0-1-1.D2 ____ 00000000 FORCE
*** Write Sector 0-1-8 (Backup FS Info Sector) ***
FINDPART PUTSECT 2 0 1 8 F:\0-1-2.D2 ____ 00000000 FORCE
*** Write Sector 0-1-9 (Backup Boot Data Sector) ***
FINDPART PUTSECT 2 0 1 9 F:\0-1-3.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
Most other sectors in Track 0 and in the first 33 sectors
of each Partition are empty, i.e. filled with zero's, and may
need to be set to zero if overwritten with garbage by a crash
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
EXTENDED PARTITION
==================
1st Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 2 _____ 1 1 F:\L1_1st.D2 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 2 F:\L1_2nd.D2 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 3 F:\L1_3rd.D2 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 7 F:\L1_1st.D2 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 8 F:\L1_2nd.D2 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 9 F:\L1_3rd.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
2nd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 2 _____ 1 1 F:\L2_1st.D2 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 2 F:\L2_2nd.D2 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 3 F:\L2_3rd.D2 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 7 F:\L2_1st.D2 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 8 F:\L2_2nd.D2 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 9 F:\L2_3rd.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
3rd Logical Partition -
*** Write Boot Sector ***
** User must insert CHS value of 1st sector of this Partition **
FINDPART PUTSECT 2 _____ 1 1 F:\L3_1st.D2 ____ 00000000 FORCE
*** Write FS Info Sector ***
** User must insert CHS value of 2nd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 2 F:\L3_2nd.D2 ____ 00000000 FORCE
*** Write Boot Data Sector ***
** User must insert CHS value of 3rd sector of this Partition **
FINDPART PUTSECT 2 _____ 1 3 F:\L3_3rd.D2 ____ 00000000 FORCE
*** Write Backup Boot Sector ***
** User must insert CHS value of 7th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 7 F:\L3_1st.D2 ____ 00000000 FORCE
*** Write Backup FS Info Sector ***
** User must insert CHS value of 8th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 8 F:\L3_2nd.D2 ____ 00000000 FORCE
*** Write Backup Boot Data Sector ***
** User must insert CHS value of 9th sector of this Partition **
FINDPART PUTSECT 2 _____ 1 9 F:\L3_3rd.D2 ____ 00000000 FORCE
*** Write all zero's to a sector ***
** This command replaces the filename with a special value **
FINDPART PUTSECT 2 _____ ___ __ !zero ____ 00000000 FORCE
UTILITIES FOR WRITING MULTIPLE SECTORS
======================================
1. PowerQuest's MBR Utility for DOS (MBRUTILD.EXE)
MBRutilD.exe is the DOS version of the MBR manager program MBRutil.exe
It can save and restore the MBR Sector alone, or the whole of Track 0
(which, ordinarily, is 63 sectors: CHS 0-0-1 to 0-0-63 [LBA 0 to 62])
NB: This program only works on Disk 1, not Disks 2 or 3
It might be made to work on any Hard Disk, by setting the
disk as Primary Master on the IDE cables. But this might be
impractical, as the disk to be restored will inevitably be
damaged and not bootable.
** Save the MBR (Sector 0-0-1) to a file **
MBRutilD /S=F:\MBR_MBR.D1
** Restore the MBR (Sector 0-0-1) from a file **
MBRutilD /R=F:\MBR_MBR.D1
** Save the entire first Track to a file **
(Save sectors 0-0-1 to 0-0-63: all 63 sectors of Track 0)
MBRutilD /SH=F:\MBR_TRK1.D1
** Restore the entire first Track from a file **
(Restore sectors 0-0-1 to 0-0-63 from a backup file)
MBRutilD /RH=F:\MBR_TRK1.D1
^ Top of Page
MASTER BOOT RECORD
==================
This section sets out examples of actual MBR sectors. For a detailed analysis
of the MBR sector, see the section Disk Structures outlined (above).
A damaged MBR sector might be repaired manually from these various examples,
using a Disk Sector Editor (below). A lot of the information in these scans
(except the Partition Table data) is common to most FAT32 hard disks.
NB: The MBR sector of a HDD is unique, so CANNOT be copied to any other!
(See http://thestarman.pcministry.com/asm/mbr/mystery.htm#COPY)
[And see Mystery Bytes section (below), for further information]
Note -
In addition to the MBR, this program also saves a copy of the boot sector
from every partition on the disk; but not the other sectors making up the
FAT32 boot record (i.e. not the FS Info sector, nor the Boot Data sector)
DISK No.1:-
Western Digital 80GB WD800JB
2 partitions: 1 = Primary DOS (1 x 10 GB) (Bootable: WinME)
2 = Logical (1 x 66 GB) (Data)
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
Partition 2: (1st Logical) begins at CHS 1275-1-1 (LBA 20,482,938)
Non-DOS, Track 0 : Begins at CHS 0-0-1 (LBA 0) (Partition Table)
Primary DOS : Begins at CHS 0-1-1 (LBA 63) (Boot Sector) (PT+63)
Extended Partitn : Begins at CHS 1275-0-1 (LBA 20,482,875) (Partition Table)
1st Logical : Begins at CHS 1275-1-1 (LBA 20,482,938) (Boot Sector) (PT+63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3��м |�P P �� | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ � PW�� �˾� � ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u �� ��� � � ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ �� It 8,t�� N� ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ t�� � � ��F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -�F � t � t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :�u+@�F% u$��UP� ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A� Xr �U�u �� t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ ���V$� � � �f � ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ � ��3Ƀ� �N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N � r)�F >�}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ �tZ�� څ�u��' � ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ ���R� F V � Z� ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 00 00 00 00 [ �Ot�3�� � ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3�VVRP SQ� V�� ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR� B�V$� ZX d r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B�� ���^��tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ �� W��� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ � ]
01C0: 01 00 0C FE 3F FA 3F 00-00 00 FC 8A 38 01 00 00 [ �?�? ��8 ]
01D0: 01 FB 0F FE BF 00 3B 8B-38 01 86 59 18 08 00 00 [ � �� ;�8 �Y ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE 3F FA-3F 00 00 00 FC 8A 38 01 [ � �?�? ��8 ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h Start = CHS 0-1-1
+4 0C PARTITION ID: Win95 FAT32 (LBA) Partition Type 0C
+5 FE 3F FA END CYL-HEAD-SECTOR: 0FAh-FEh-3Fh End = CHS 250-254-63
+8 0000003F START SECTOR: 63 Start = LBA 63
+C 01388AFC NUMBER OF SECTORS: 20482812 Sectors = 20,482,812
Partition Table -
1. The partition table is shown highlighted in red in this example.
2. Each of the numbers in the table is in hexadecimal form (base 16).
3. Individual entries are read from right-to-left ("Little endian").
4. The table is 16 bytes in length, numbered from 0 to 15:
• Byte 0 is 80 hex if the partition is Active (bootable)
• Bytes 1 to 3 give the partition start sector in C-H-S form CHS 0-1-1 = LBA 63
• Byte 4 gives the Partition Type (NB: 0C hex = 13 decimal) Type 0C = Win95 FAT32
• Bytes 5 to 7 give the partition end sector in C-H-S form FA-FE-3F = 250-254-63
(if the partition exceeds 8GB this is a maximum value)
• Bytes 8 to 11 give the partition start sector in LBA form 3F hex = 63
• Bytes 12 to 15 give the partition's total number of sectors 01388AFC = 20,482,812
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector] (3F = Sector 63)
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: FC 8A 38 01 08 27 00 00-00 00 00 00 02 00 00 00 [ ��8 ' ]
0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 DF 0D 00 00 44-52 49 56 45 20 43 20 20 [ � )� DRIVE C ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ � Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error� Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
1 - Partition table entry = 1 << Win95 Extended >>
01CE: 00 00 01 FB 0F FE BF 00-3B 8B 38 01 86 59 18 08 [ � �� ;�8 �Y ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 FB START CYL-HEAD-SECTOR: 0FBh-00h-01h
+4 0F PARTITION ID: Win95 Extended
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 01388B3B START SECTOR: 20482875
+C 08185986 NUMBER OF SECTORS: 135813510
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Win95 Extended (01388B3Bh) (Partition Table Entry: 1-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 FB 0B FE BF 00 3F 00-00 00 47 59 18 08 00 00 [ � �� ? GY ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
2 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 FB 0B FE BF 00-3F 00 00 00 47 59 18 08 [ � �� ? GY ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 FB START CYL-HEAD-SECTOR: 0FBh-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 08185947 NUMBER OF SECTORS: 135813447
2-0 Win95 FAT32 Boot Record (01388B7Ah) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ �X MSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 7A 8B 38 01 [ � ? � z�8 ]
0020: 47 59 18 08 C1 40 00 00-00 00 00 00 02 00 00 00 [ GY �@ ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 FC 15 58 23 44-41 54 41 20 20 20 20 20 [ � )� X#DATA ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
2 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 01388B3A 0000003F 01388AFC Win95 FAT32 (LBA)
1-1 : 01388B3B 0950E4C0 01388B3B 08185986 Win95 Extended
2-0 : 01388B7A 0950E4C0 0000003F 08185947 Win95 FAT32
DISK No.2:-
Western Digital 80GB
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
Non-DOS, Track 0 : Begins at CHS 0-0-1 (LBA 0)
Primary DOS : Begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3��м |�P P �� | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ � PW�� �˾� � ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u �� ��� � � ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ �� It 8,t�� N� ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ t�� � � ��F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -�F � t � t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :�u+@�F% u$��UP� ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A� Xr �U�u �� t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ ���V$� � � �f � ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ � ��3Ƀ� �N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N � r)�F >�}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ �tZ�� څ�u��' � ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ ���R� F V � Z� ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 81 25 16 04 [ �Ot�3�� � % ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3�VVRP SQ� V�� ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR� B�V$� ZX d r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B�� ���^��tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ �� W��� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ � ]
01C0: 01 00 0C FE BF 00 3F 00-00 00 82 E4 50 09 00 00 [ �� ? ��P ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE BF 00-3F 00 00 00 82 E4 50 09 [ � �� ? ��P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ �X MSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: 82 E4 50 09 85 4A 00 00-00 00 00 00 02 00 00 00 [ ��P �J ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 10 0B 5C 35 4E-4F 20 4E 41 4D 45 20 20 [ � ) \5NO NAME ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
DISK No.3:-
External USB Backup
Western Digital 120GB - External Enclosure USB
4 partitions: Primary DOS (Bootable: WinME)
Logical x 3
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
Partition 2: (1st Logical) begins at CHS ____-1-1 (LBA __________)
Partition 3: (2nd Logical) begins at CHS ____-1-1 (LBA __________)
Partition 4: (3rd Logical) begins at CHS ____-1-1 (LBA __________)
Non-DOS, Track 0 : Begins at CHS 0-0-1 (LBA 0) Size: 63
Primary DOS (G:) : Begins at CHS 0-1-1 (LBA 63) Size: 33,142,032
Hidden Sectors : Begins at CHS 2063-0-1 (LBA 33,142,095) Size: 63
1st Logical (H:) : Begins at CHS 2063-1-1 (LBA 33,142,158) Size: 67,103,442
Hidden Sectors : Begins at CHS 6240-0-1 (LBA 100,245,600) Size: 63
2nd Logical (I:) : Begins at CHS 6240-1-1 (LBA 100,245,663) Size: 67,103,505
Hidden Sectors : Begins at CHS 10417-1-1 (LBA 167,349,168) Size: 63
3rd Logical (J:) : Begins at CHS 10417-2-1 (LBA 167,349,231) Size: 67,103,442
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3��м |�P P �� | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ � PW�� �˾� � ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u �� ��� � � ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ �� It 8,t�� N� ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ t�� � � ��F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -�F � t � t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :�u+@�F% u$��UP� ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A� Xr �U�u �� t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ ���V$� � � �f � ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ � ��3Ƀ� �N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 46 07 81 3E FE 7D 55 [ % N � r)�F >�}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 27 07 EB [ �tZ�� څ�u��' � ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ ���R� F V � Z� ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 80 09 53 08 [ �Ot�3�� � � S ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3�VVRP SQ� V�� ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR� B�V$� ZX d r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B�� ���^��tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 00 45-72 72 6F 72 20 6C 6F 61 [ table Error loa ]
0130: 64 69 6E 67 20 6F 70 65-72 61 74 69 6E 67 20 73 [ ding operating s ]
0140: 79 73 74 65 6D 00 4D 69-73 73 69 6E 67 20 6F 70 [ ystem Missing op ]
0150: 65 72 61 74 69 6E 67 20-73 79 73 74 65 6D 00 00 [ erating system ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ �� W��� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-66 1F 67 1F 00 00 80 01 [ f g � ]
01C0: 01 00 0C FE 3F 0E 3F 00-00 00 10 B5 F9 01 00 00 [ �? ? �� ]
01D0: 01 0F 0F FE 7F 00 4F B5-F9 01 72 82 FF 0B 00 00 [ � O�� r�� ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE 3F 0E-3F 00 00 00 10 B5 F9 01 [ � �? ? �� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE 3F 0E END CYL-HEAD-SECTOR: 00Eh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 01F9B510 NUMBER OF SECTORS: 33142032
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: 10 B5 F9 01 27 3F 00 00-00 00 00 00 02 00 00 00 [ �� '? ]
0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 17 0E 00 00 31-32 30 47 42 20 44 49 53 [ � ) 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ � Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error� Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
1 - Partition table entry = 1 << Win95 Extended >>
01CE: 00 00 01 0F 0F FE 7F 00-4F B5 F9 01 72 82 FF 0B [ � O�� r�� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 0F START CYL-HEAD-SECTOR: 00Fh-00h-01h
+4 0F PARTITION ID: Win95 Extended
+5 FE 7F 00 END CYL-HEAD-SECTOR: 100h-FEh-3Fh
+8 01F9B54F START SECTOR: 33142095
+C 0BFF8272 NUMBER OF SECTORS: 201294450
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Win95 Extended (01F9B54Fh) (Partition Table Entry: 1-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 0F 0B FE 3F 5F 3F 00-00 00 D2 EA FF 03 00 00 [ �?_? ��� ]
01D0: 01 60 05 FE 3F B0 11 EB-FF 03 11 EB FF 03 00 00 [ ` �?� �� �� ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
2 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 0F 0B FE 3F 5F-3F 00 00 00 D2 EA FF 03 [ �?_? ��� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 0F START CYL-HEAD-SECTOR: 00Fh-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE 3F 5F END CYL-HEAD-SECTOR: 05Fh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 03FFEAD2 NUMBER OF SECTORS: 67103442
2-0 Win95 FAT32 Boot Record (01F9B58Eh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 8E B5 F9 01 [ � ? � ��� ]
0020: D2 EA FF 03 FB 3F 00 00-00 00 00 00 02 00 00 00 [ ��� �? ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 E3 11 22 07 31-32 30 47 42 20 44 49 53 [ � )� " 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
2 - Partition table entry = 1 << Extended >>
01CE: 00 00 01 60 05 FE 3F B0-11 EB FF 03 11 EB FF 03 [ ` �?� �� �� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 60 START CYL-HEAD-SECTOR: 060h-00h-01h
+4 05 PARTITION ID: Extended
+5 FE 3F B0 END CYL-HEAD-SECTOR: 0B0h-FEh-3Fh
+8 03FFEB11 START SECTOR: 67103505
+C 03FFEB11 NUMBER OF SECTORS: 67103505
2 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
3 - Extended (05F9A060h) (Partition Table Entry: 2-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 60 0B FE 3F B0 3F 00-00 00 D2 EA FF 03 00 00 [ ` �?�? ��� ]
01D0: 01 B1 05 FE 7F 00 22 D6-FF 07 50 AC FF 03 00 00 [ � � "�� P�� ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
3 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 60 0B FE 3F B0-3F 00 00 00 D2 EA FF 03 [ ` �?�? ��� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 60 START CYL-HEAD-SECTOR: 060h-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE 3F B0 END CYL-HEAD-SECTOR: 0B0h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 03FFEAD2 NUMBER OF SECTORS: 67103442
3-0 Win95 FAT32 Boot Record (05F9A09Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 9F A0 F9 05 [ � ? � � � ]
0020: D2 EA FF 03 FB 3F 00 00-00 00 00 00 02 00 00 00 [ ��� �? ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 EE 11 36 07 31-32 30 47 42 20 44 49 53 [ � )� 6 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
3 - Partition table entry = 1 << Extended >>
01CE: 00 00 01 B1 05 FE 7F 00-22 D6 FF 07 50 AC FF 03 [ � � "�� P�� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 B1 START CYL-HEAD-SECTOR: 0B1h-00h-01h
+4 05 PARTITION ID: Extended
+5 FE 7F 00 END CYL-HEAD-SECTOR: 100h-FEh-3Fh
+8 07FFD622 START SECTOR: 134207010
+C 03FFAC50 NUMBER OF SECTORS: 67087440
3 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
3 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
4 - Extended (09F98B71h) (Partition Table Entry: 3-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 B1 0B FE 7F 00 3F 00-00 00 11 AC FF 03 00 00 [ � � ? �� ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
4 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 B1 0B FE 7F 00-3F 00 00 00 11 AC FF 03 [ � � ? �� ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 B1 START CYL-HEAD-SECTOR: 0B1h-01h-01h
+4 0B PARTITION ID: Win95 FAT32
+5 FE 7F 00 END CYL-HEAD-SECTOR: 100h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 03FFAC11 NUMBER OF SECTORS: 67087377
4-0 Win95 FAT32 Boot Record (09F98BB0h) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 B0 8B F9 09 [ � ? � ��� ]
0020: 11 AC FF 03 F7 3F 00 00-00 00 00 00 02 00 00 00 [ �� �? ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 F8 11 22 06 31-32 30 47 42 20 44 49 53 [ � )� " 120GB DIS ]
0050: 4B 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ K FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
4 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
4 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
4 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 01F9B54E 0000003F 01F9B510 Win95 FAT32 (LBA)
1-1 : 01F9B54F 0DF937C0 01F9B54F 0BFF8272 Win95 Extended
2-0 : 01F9B58E 05F9A05F 0000003F 03FFEAD2 Win95 FAT32
2-1 : 05F9A060 09F98B70 03FFEB11 03FFEB11 Extended
3-0 : 05F9A09F 09F98B70 0000003F 03FFEAD2 Win95 FAT32
3-1 : 09F98B71 0DF937C0 07FFD622 03FFAC50 Extended
4-0 : 09F98BB0 0DF937C0 0000003F 03FFAC11 Win95 FAT32
Note -
1. Western Digital HDD, 120GB (111GB formatted)
2. 4 drives (1 x 15GB, 3 x 32GB) (Total = 111GB):
- Primary DOS Partition (Active) (15GB)
- Extended: Logical Partition (32GB)
Logical Partition (32GB)
Logical Partition (32GB)
DISK No.4:-
Fujitsu 10GB
1 partition: Primary DOS (Bootable: WinME)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3��м |�P P �� | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ � PW�� �˾� � ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u �� ��� � � ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ �� It 8,t�� N� ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ t�� � � ��F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -�F � t � t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :�u+@�F% u$��UP� ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A� Xr �U�u �� t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ ���V$� � � �f � ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ � ��3Ƀ� �N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 75 07 81 3E FE 7D 55 [ % N � r)�u >�}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 3F 07 EB [ �tZ�� څ�u��? � ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ ���R� F V � Z� ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 80 18 26 12 [ �Ot�3�� � � & ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3�VVRP SQ� V�� ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR� B�V$� ZX d r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B�� ���^��tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 2E 20-53 65 74 75 70 20 63 61 [ table. Setup ca ]
0130: 6E 6E 6F 74 20 63 6F 6E-74 69 6E 75 65 2E 00 45 [ nnot continue. E ]
0140: 72 72 6F 72 20 6C 6F 61-64 69 6E 67 20 6F 70 65 [ rror loading ope ]
0150: 72 61 74 69 6E 67 20 73-79 73 74 65 6D 2E 20 53 [ rating system. S ]
0160: 65 74 75 70 20 63 61 6E-6E 6F 74 20 63 6F 6E 74 [ etup cannot cont ]
0170: 69 6E 75 65 2E 00 00 00-00 00 00 00 00 00 00 00 [ inue. ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ �� W��� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ � ]
01C0: 01 00 0C FE 3F DC 3F 00-00 00 5E 30 31 01 00 00 [ �?�? ^01 ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE 3F DC-3F 00 00 00 5E 30 31 01 [ � �?�? ^01 ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE 3F DC END CYL-HEAD-SECTOR: 0DCh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0131305E NUMBER OF SECTORS: 20000862
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: 5E 30 31 01 22 26 00 00-00 00 00 00 02 00 00 00 [ ^01 "& ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 DB 13 66 27 4D-50 46 33 31 30 32 41 54 [ � )� f'MPF3102AT ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
1 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 0131309C 0000003F 0131305E Win95 FAT32 (LBA)
DISK No.5:-
Seagate 18GB, ST320423A (Bootable: Win98SE)
[NB: Currently used for data backup/storage at M.H.]
[NB: Not bootable on the Tiny PC, due to incompatible device drivers]
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 33 C0 8E D0 BC 00 7C FB-50 07 50 1F FC BE 1B 7C [ 3��м |�P P �� | ]
0010: BF 1B 06 50 57 B9 E5 01-F3 A4 CB BE BE 07 B1 04 [ � PW�� �˾� � ]
0020: 38 2C 7C 09 75 15 83 C6-10 E2 F5 CD 18 8B 14 8B [ 8,| u �� ��� � � ]
0030: EE 83 C6 10 49 74 16 38-2C 74 F6 BE 10 07 4E AC [ �� It 8,t�� N� ]
0040: 3C 00 74 FA BB 07 00 B4-0E CD 10 EB F2 89 46 25 [ t�� � � ��F% ]
0050: 96 8A 46 04 B4 06 3C 0E-74 11 B4 0B 3C 0C 74 05 [ -�F � t � t ]
0060: 3A C4 75 2B 40 C6 46 25-06 75 24 BB AA 55 50 B4 [ :�u+@�F% u$��UP� ]
0070: 41 CD 13 58 72 16 81 FB-55 AA 75 10 F6 C1 01 74 [ A� Xr �U�u �� t ]
0080: 0B 8A E0 88 56 24 C7 06-A1 06 EB 1E 88 66 04 BF [ ���V$� � � �f � ]
0090: 0A 00 B8 01 02 8B DC 33-C9 83 FF 05 7F 03 8B 4E [ � ��3Ƀ� �N ]
00A0: 25 03 4E 02 CD 13 72 29-BE 75 07 81 3E FE 7D 55 [ % N � r)�u >�}U ]
00B0: AA 74 5A 83 EF 05 7F DA-85 F6 75 83 BE 3F 07 EB [ �tZ�� څ�u��? � ]
00C0: 8A 98 91 52 99 03 46 08-13 56 0A E8 12 00 5A EB [ ���R� F V � Z� ]
00D0: D5 4F 74 E4 33 C0 CD 13-EB B8 00 00 80 24 13 09 [ �Ot�3�� � �$ ]
00E0: 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 [ V3�VVRP SQ� V�� ]
00F0: 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 [ PR� B�V$� ZX d r ]
0100: 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 49 [ @u B�� ���^��tI ]
0110: 6E 76 61 6C 69 64 20 70-61 72 74 69 74 69 6F 6E [ nvalid partition ]
0120: 20 74 61 62 6C 65 2E 20-53 65 74 75 70 20 63 61 [ table. Setup ca ]
0130: 6E 6E 6F 74 20 63 6F 6E-74 69 6E 75 65 2E 00 45 [ nnot continue. E ]
0140: 72 72 6F 72 20 6C 6F 61-64 69 6E 67 20 6F 70 65 [ rror loading ope ]
0150: 72 61 74 69 6E 67 20 73-79 73 74 65 6D 2E 20 53 [ rating system. S ]
0160: 65 74 75 70 20 63 61 6E-6E 6F 74 20 63 6F 6E 74 [ etup cannot cont ]
0170: 69 6E 75 65 2E 00 00 00-00 00 00 00 00 00 00 00 [ inue. ]
0180: 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 [ �� W��� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ � ]
01C0: 01 00 0C FE FF FE 3F 00-00 00 3C 3F 43 02 00 00 [ ���? ?C ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE FF FE-3F 00 00 00 3C 3F 43 02 [ � ���? ?C ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE FF FE END CYL-HEAD-SECTOR: 3FEh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 02433F3C NUMBER OF SECTORS: 37961532
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 20 20 00 [ �X MSWIN4.1 ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: 3C 3F 43 02 30 24 00 00-00 00 00 00 02 00 00 00 [ ?C 0$ ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 F0 11 3F 18 4D-30 32 47 42 32 20 20 20 [ � )� ? M02GB2 ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
1 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
MBRS011 Geometry was not saved. Assuming HH = FF, SS = 3F
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 02433F7A 0000003F 02433F3C Win95 FAT32 (LBA)
DISK No.6:-
TINY PC, Drive C: (NB: Faulty)
Seagate 80GB, ST380011A (Bootable: WinME)
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
MBRSCAN v1.1 Copyright (C) 1995,1999 by Nobumichi Kozawa
LBA mode
1 - Master Boot Record (00000000h)
0000: 90 E9 7D 01 FA 33 C0 8E-D0 8E C0 8E D8 BC 00 7C [ �} �3��Ў��ؼ | ]
0010: 8B F4 FB BF 00 06 B9 00-01 F3 A5 BB 20 06 FF E3 [ ���� � � �� ]
0020: 90 90 BE 7D 07 81 3C AA-55 75 11 E8 58 00 73 0C [ �} �Uu �X s ]
0030: E8 65 00 72 07 E8 B1 00-72 3B EB 2C BE 7D 07 C7 [ �e r � r;�,�} � ]
0040: 04 00 00 BA 80 00 BE BE-07 B9 04 00 F6 04 80 75 [ �� �� � � �u ]
0050: 07 83 C6 10 E2 F6 EB 1D-8A 74 01 8B 4C 02 BB 00 [ �� ��� �t �L � ]
0060: 7C B8 01 02 CD 13 72 0D-81 3E FE 7D 55 AA 75 05 [ |� � r >�}U�u ]
0070: EA 00 7C 00 00 BE 6A 07-AC 0A C0 74 FE BB 07 00 [ � | �j � �t�� ]
0080: B4 0E CD 10 EB F2 BB 00-7E C6 07 13 C6 47 01 00 [ � � �� ~� �G ]
0090: B2 80 B8 00 E0 CD 13 C3-BF 00 7E BA F0 01 B3 A0 [ ��� �� ÿ ~�� � ]
00A0: E8 84 00 72 0C B1 01 E8-48 00 72 05 E8 19 00 73 [ � r � �H r � s ]
00B0: 16 F6 C3 10 75 05 80 CB-10 EB E5 81 FA 70 01 74 [ �� u �� �� �p t ]
00C0: 05 BA 70 01 EB D8 F9 C3-81 BD FE 01 55 AA 75 17 [ �p ���� �� U�u ]
00D0: 8B 75 02 81 FE BE 01 77-0E 03 F7 81 3C AA 55 75 [ �u �� w � �Uu ]
00E0: 06 F6 44 02 01 75 01 F9-C3 BF 00 7C B1 0A E8 01 [ �D u �ÿ |� � ]
00F0: 00 C3 52 57 83 C2 02 B0-01 EE 42 8A C1 EE 42 32 [ �RW�� � �B���B2 ]
0100: C0 EE 42 EE 42 8A C3 EE-42 B0 20 EE E8 33 00 EC [ ��B�B���B� ��3 � ]
0110: 24 FD 3C 58 75 0D 83 EA-07 B9 00 01 FA F3 6D FB [ $� Xu �� � ��m� ]
0120: F8 EB 01 F9 5F 5A C3 52-83 C2 07 EC A8 80 75 0F [ �� �_Z�R�� 쨀u ]
0130: 4A 8A C3 EE 42 EC 24 D0-3C 50 75 03 F8 EB 01 F9 [ J���B�$� Pu �� � ]
0140: 5A C3 51 8B 0E 6C 04 83-C1 12 81 C2 FF 01 EC 8A [ Z�Q� l �� �� � ]
0150: E0 80 E4 D8 80 FC 58 74-06 3B 0E 6C 04 75 EF 81 [ ����Xt ; l u� ]
0160: EA FF 01 B9 00 20 E2 FE-59 C3 0D 0A 45 72 72 6F [ �� � ��Y� Erro ]
0170: 72 20 4C 6F 61 64 69 6E-67 20 4F 53 00 AA 55 00 [ r Loading OS �U ]
0180: 00 E9 80 FE 00 00 00 00-00 00 00 00 00 00 00 00 [ �� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ � ]
01C0: 01 00 0C FE FF FF 3F 00-00 00 82 E4 50 09 00 00 [ ���? ��P ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
Note -
There may be a fault in the above MBR sector. The bytes "90 E9 7D 01 FA"
preceed the three bytes which ought to begin the sector (i.e. "33 C0 8E"),
and the rest of the sector does not look like any other MBR sector above.
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE FF FF-3F 00 00 00 82 E4 50 09 [ � ���? ��P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB FE 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ �� MSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: 82 E4 50 09 83 4A 00 00-00 00 00 00 02 00 00 00 [ ��P �J ]
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 C9 09 14 75 53-54 33 38 30 30 31 31 41 [ � )� uST380011A ]
0050: 20 20 46 41 54 33 32 20-20 20 00 00 00 00 00 00 [ FAT32 ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
Note -
There may be a fault in the above Boot sector. The bytes "EB 58 90",
which ought to begin the sector, are not present; and the rest of the
sector does not look like any other Boot sector above.
1 - Partition table entry = 1 << Empty >>
01CE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
MBRS011 Geometry was not saved. Assuming HH = FF, SS = 3F
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0000003F 0950E4C0 0000003F 0950E482 Win95 FAT32 (LBA)
ALTERNATIVE:-
*** Note on Ending CHS Values ***
A second use of the MBRSCAN program 4 months later showed a strangely
different result in the Primary DOS Partition for the *ending* CHS values;
and the contents of the Partition boot sector (sector 3F hex) (CHS 0-1-1)
are VERY different to their previous state:-
1 - Partition table entry = 0 << Win95 FAT32 (LBA) >>
01BE: 80 01 01 00 0C FE BF 00-3F 00 00 00 82 E4 50 09 [ � �� ? ��P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 80 STATUS: Active
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h
+4 0C PARTITION ID: Win95 FAT32 (LBA)
+5 FE BF 00 END CYL-HEAD-SECTOR: 200h-FEh-3Fh
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
1-0 Win95 FAT32 (LBA) Boot Record (0000003Fh) [Boot Sector]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ �X MSWIN4.1 @ ]
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ]
0020: 82 E4 50 09 83 4A 00 00-00 00 00 00 02 00 00 00 [ ��P �J ]
0030: 00 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 E5 0E 00 00 53-54 33 38 30 30 31 31 41 [ � )� ST380011A ]
0050: 20 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ � Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error� Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
DISK No.7:-
TINY PC
500GB Western Digital SATA HDD
Partition 0: (Non-DOS, Track 0) begins at CHS 0-0-1 (LBA 0)
Partition 1: (Primary DOS) begins at CHS 0-1-1 (LBA 63)
Backup Disk (500GB SATA) -
1 x Primary DOS Partition (Non-bootable)
1 x Extended Partition, containing 11 x Logical Partitions
Note: Only first three partitions (of 12) shown here
MBRSCAN V1.11 Copyright (C) 1995-2003 by Nobumichi Kozawa
LBA mode
DRV:82 CC=ED80h(60800), HH=FFh(255), SS=3Fh(63), BLKS=3A380D80h(976752000)
1 - Master Boot Record (00000000h) [500GB SATA HDD] [CHS 0-0-1]
0000: 90 E9 7D 01 FA 33 C0 8E-D0 8E C0 8E D8 BC 00 7C [ �} �3��Ў��ؼ | ] SATA disk's
0010: 8B F4 FB BF 00 06 B9 00-01 F3 A5 BB 20 06 FF E3 [ ���� � � �� ] MBR Sector
0020: 90 90 BE 7D 07 81 3C AA-55 75 11 E8 58 00 73 0C [ �} <�Uu �X s ]
0030: E8 65 00 72 07 E8 B1 00-72 3B EB 2C BE 7D 07 C7 [ �e r � r;�,�} � ]
0040: 04 00 00 BA 80 00 BE BE-07 B9 04 00 F6 04 80 75 [ �� �� � � �u ]
0050: 07 83 C6 10 E2 F6 EB 1D-8A 74 01 8B 4C 02 BB 00 [ �� ��� �t �L � ]
0060: 7C B8 01 02 CD 13 72 0D-81 3E FE 7D 55 AA 75 05 [ |� � r >�}U�u ]
0070: EA 00 7C 00 00 BE 6A 07-AC 0A C0 74 FE BB 07 00 [ � | �j � �t�� ]
0080: B4 0E CD 10 EB F2 BB 00-7E C6 07 13 C6 47 01 00 [ � � �� ~� �G ]
0090: B2 80 B8 00 E0 CD 13 C3-BF 00 7E BA F0 01 B3 A0 [ ��� �� ÿ ~�� � ]
00A0: E8 84 00 72 0C B1 01 E8-48 00 72 05 E8 19 00 73 [ � r � �H r � s ]
00B0: 16 F6 C3 10 75 05 80 CB-10 EB E5 81 FA 70 01 74 [ �� u �� �� �p t ]
00C0: 05 BA 70 01 EB D8 F9 C3-81 BD FE 01 55 AA 75 17 [ �p ���� �� U�u ]
00D0: 8B 75 02 81 FE BE 01 77-0E 03 F7 81 3C AA 55 75 [ �u �� w � <�Uu ]
00E0: 06 F6 44 02 01 75 01 F9-C3 BF 00 7C B1 0A E8 01 [ �D u �ÿ |� � ]
00F0: 00 C3 52 57 83 C2 02 B0-01 EE 42 8A C1 EE 42 32 [ �RW�� � �B���B2 ]
0100: C0 EE 42 EE 42 8A C3 EE-42 B0 20 EE E8 33 00 EC [ ��B�B���B� ��3 � ]
0110: 24 FD 3C 58 75 0D 83 EA-07 B9 00 01 FA F3 6D FB [ $� Xu �� � ��m� ]
0120: F8 EB 01 F9 5F 5A C3 52-83 C2 07 EC A8 80 75 0F [ �� �_Z�R�� 쨀u ]
0130: 4A 8A C3 EE 42 EC 24 D0-3C 50 75 03 F8 EB 01 F9 [ J���B�$� Pu �� � ]
0140: 5A C3 51 8B 0E 6C 04 83-C1 12 81 C2 FF 01 EC 8A [ Z�Q� l �� �� � ]
0150: E0 80 E4 D8 80 FC 58 74-06 3B 0E 6C 04 75 EF 81 [ ����Xt ; l u� ]
0160: EA FF 01 B9 00 20 E2 FE-59 C3 0D 0A 45 72 72 6F [ �� � ��Y� Erro ]
0170: 72 20 4C 6F 61 64 69 6E-67 20 4F 53 00 AA 55 00 [ r Loading OS �U ]
0180: 00 E9 80 FE 00 00 00 00-00 00 00 00 00 00 00 00 [ �� ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: 01 00 0B FE FF FF 3F 00-00 00 FC 8A 38 01 00 00 [ ���? ��8 ]
01D0: C1 FF 0F FE FF FF 3B 8B-38 01 45 82 FF 38 00 00 [ �� ���;�8 E��8 ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
1 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 01 00 0B FE FF FF-3F 00 00 00 FC 8A 38 01 [ ���? ��8 ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 01 00 START CYL-HEAD-SECTOR: 000h-01h-01h (0-1-1)
+4 0B PARTITION ID: Win95 FAT32
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh (1023-254-63)
+8 0000003F START SECTOR: 63
+C 01388AFC NUMBER OF SECTORS: 20482812
1-0 Win95 FAT32 Boot Record (0000003Fh) [Primary DOS]
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 10 20 00 [ �X MSWIN4.1 ] Clone of
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3F 00 00 00 [ � ? � ? ] Drive C:'s
0020: FC 8A 38 01 08 27 00 00-00 00 00 00 02 00 00 00 [ ��8 ' ] Boot Sector
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 B9 30 CF D3 53-41 54 41 20 44 52 56 20 [ � )�0��SATA DRV ]
0050: 43 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ C FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 4E 6F 20 4F-53 20 46 6F 75 6E 64 20 [ ' No OS Found ]
0190: 20 20 20 20 20 20 20 FF-0D 0A 44 69 73 6B 20 49 [ � Disk I ]
01A0: 2F 4F 20 45 72 72 6F 72-FF 0D 0A 49 6E 73 65 72 [ /O Error� Inser ]
01B0: 74 20 4F 53 20 73 65 74-75 70 20 64 69 73 6B 2C [ t OS setup disk, ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
1 - Partition table entry = 1 << Win95 Ext'd (LBA) >>
01CE: 00 00 C1 FF 0F FE FF FF-3B 8B 38 01 45 82 FF 38 [ �� ���;�8 E��8 ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 C1 FF START CYL-HEAD-SECTOR: 3FFh-00h-01h (1023-0-1)
+4 0F PARTITION ID: Win95 Ext'd (LBA)
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh (1023-254-63)
+8 01388B3B START SECTOR: 20482875
+C 38FF8245 NUMBER OF SECTORS: 956269125
1 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
1 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Win95 Ext'd (LBA) (01388B3Bh) (Partition Table Entry: 1-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Clone of
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Drive D:'s
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Partition
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Table
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: C1 FF 0B FE FF FF 3F 00-00 00 82 E4 50 09 00 00 [ �� ���? ��P ]
01D0: C1 FF 05 FE FF FF C1 E4-50 09 86 59 18 08 00 00 [ �� �����P �Y ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
2 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 C1 FF 0B FE FF FF-3F 00 00 00 82 E4 50 09 [ �� ���? ��P ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 C1 FF START CYL-HEAD-SECTOR: 3FFh-01h-01h (1023-1-1)
+4 0B PARTITION ID: Win95 FAT32
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh (1023-254-63)
+8 0000003F START SECTOR: 63
+C 0950E482 NUMBER OF SECTORS: 156296322
2-0 Win95 FAT32 Boot Record (01388B7Ah)
0000: EB 58 90 2D 79 36 68 28-49 48 43 00 02 40 20 00 [ �X -y6h(IHC @ ] Clone of
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 7A 8B 38 01 [ � ? � z�8 ] Drive D:'s
0020: 82 E4 50 09 85 4A 00 00-00 00 00 00 02 00 00 00 [ ��P �J ] Boot Sector
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 E9 29 90 1E 53-41 54 41 20 44 52 56 20 [ � )�) SATA DRV ]
0050: 44 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ D FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
2 - Partition table entry = 1 << Extended >>
01CE: 00 00 C1 FF 05 FE FF FF-C1 E4 50 09 86 59 18 08 [ �� �����P �Y ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 C1 FF START CYL-HEAD-SECTOR: 3FFh-00h-01h (1023-0-1)
+4 05 PARTITION ID: Extended
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh (1023-254-63)
+8 0950E4C1 START SECTOR: 156296385
+C 08185986 NUMBER OF SECTORS: 135813510
2 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
2 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
3 - Extended (0A896FFCh) (Partition Table Entry: 2-1)
0000: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Clone of
0010: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Drive E:'s
0020: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Partition
0030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] Table
0040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0050: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0060: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0070: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0080: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0090: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00C0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00D0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
00F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0100: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0110: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0120: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0130: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0140: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0150: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0160: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01B0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 [ ]
01C0: C1 FF 0B FE FF FF 3F 00-00 00 47 59 18 08 00 00 [ �� ���? GY ]
01D0: C1 FF 05 FE FF FF 47 3E-69 11 10 EC 03 00 00 00 [ �� ���G>i � ]
01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
01F0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA [ U� ]
3 - Partition table entry = 0 << Win95 FAT32 >>
01BE: 00 01 C1 FF 0B FE FF FF-3F 00 00 00 47 59 18 08 [ �� ���? GY ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 01 C1 FF START CYL-HEAD-SECTOR: 3FFh-01h-01h (1023-1-1)
+4 0B PARTITION ID: Win95 FAT32
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh (1023-254-63)
+8 0000003F START SECTOR: 63
+C 08185947 NUMBER OF SECTORS: 135813447
3-0 Win95 FAT32 Boot Record (0A89703Bh)
0000: EB 58 90 4D 53 57 49 4E-34 2E 31 00 02 40 20 00 [ �X MSWIN4.1 @ ] Clone of
0010: 02 00 00 00 00 F8 00 00-3F 00 FF 00 3B 70 89 0A [ � ? � ;p� ] Drive E:'s
0020: 47 59 18 08 C1 40 00 00-00 00 00 00 02 00 00 00 [ GY �@ ] Boot Sector
0030: 01 00 06 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
0040: 80 00 29 CA 3C 07 EF 53-41 54 41 20 44 52 56 20 [ � )�< �SATA DRV ]
0050: 45 20 46 41 54 33 32 20-20 20 FA 33 C9 8E D1 BC [ E FAT32 �3ɎѼ ]
0060: F8 7B 8E C1 BD 78 00 C5-76 00 1E 56 16 55 BF 22 [ �{���x �v V U�" ]
0070: 05 89 7E 00 89 4E 02 B1-0B FC F3 A4 8E D9 BD 00 [ �~ �N � ��ٽ ]
0080: 7C C6 45 FE 0F 8B 46 18-88 45 F9 38 4E 40 7D 25 [ |�E� �F �E�8N@}% ]
0090: 8B C1 99 BB 00 07 E8 97-00 72 1A 83 EB 3A 66 A1 [ ���� �- r ��:f� ]
00A0: 1C 7C 66 3B 07 8A 57 FC-75 06 80 CA 02 88 56 02 [ |f; �W�u �� �V ]
00B0: 80 C3 10 73 ED BF 02 00-83 7E 16 00 75 45 8B 46 [ �� s�� �~ uE�F ]
00C0: 1C 8B 56 1E B9 03 00 49-40 75 01 42 BB 00 7E E8 [ �V � I@u B� ~� ]
00D0: 5F 00 73 26 B0 F8 4F 74-1D 8B 46 32 33 D2 B9 03 [ _ s&��Ot �F23ҹ ]
00E0: 00 3B C8 77 1E 8B 76 0E-3B CE 73 17 2B F1 03 46 [ ;�w �v ;�s +� F ]
00F0: 1C 13 56 1E EB D1 73 0B-EB 27 83 7E 2A 00 77 03 [ V ��s �'�~* w ]
0100: E9 FD 02 BE 7E 7D AC 98-03 F0 AC 84 C0 74 17 3C [ �� �~}�� ��t < ]
0110: FF 74 09 B4 0E BB 07 00-CD 10 EB EE BE 81 7D EB [ �t � � � �� }� ]
0120: E5 BE 7F 7D EB E0 98 CD-16 5E 1F 66 8F 04 CD 19 [ � }���� ^ f � ]
0130: 41 56 66 6A 00 52 50 06-53 6A 01 6A 10 8B F4 60 [ AVfj RP Sj j ��` ]
0140: 80 7E 02 0E 75 04 B4 42-EB 1D 91 92 33 D2 F7 76 [ �~ u �B� ��3��v ]
0150: 18 91 F7 76 18 42 87 CA-F7 76 1A 8A F2 8A E8 C0 [ ��v B���v ���� ]
0160: CC 02 0A CC B8 01 02 8A-56 40 CD 13 61 8D 64 10 [ � ̸ �V@� a d ]
0170: 5E 72 0A 40 75 01 42 03-5E 0B 49 75 B4 C3 03 18 [ ^r @u B ^ Iu�� ]
0180: 01 27 0D 0A 49 6E 76 61-6C 69 64 20 73 79 73 74 [ ' Invalid syst ]
0190: 65 6D 20 64 69 73 6B FF-0D 0A 44 69 73 6B 20 49 [ em disk� Disk I ]
01A0: 2F 4F 20 65 72 72 6F 72-FF 0D 0A 52 65 70 6C 61 [ /O error� Repla ]
01B0: 63 65 20 74 68 65 20 64-69 73 6B 2C 20 61 6E 64 [ ce the disk, and ]
01C0: 20 74 68 65 6E 20 70 72-65 73 73 20 61 6E 79 20 [ then press any ]
01D0: 6B 65 79 0D 0A 00 00 00-49 4F 20 20 20 20 20 20 [ key IO ]
01E0: 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7E 01 [ SYSMSDOS SYS~ ]
01F0: 00 57 49 4E 42 4F 4F 54-20 53 59 53 00 00 55 AA [ WINBOOT SYS U� ]
3 - Partition table entry = 1 << Extended >>
01CE: 00 00 C1 FF 05 FE FF FF-47 3E 69 11 10 EC 03 00 [ �� ���G>i � ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 C1 FF START CYL-HEAD-SECTOR: 3FFh-00h-01h (1023-0-1)
+4 05 PARTITION ID: Extended
+5 FE FF FF END CYL-HEAD-SECTOR: 3FFh-FEh-3Fh (1023-254-63)
+8 11693E47 START SECTOR: 292109895
+C 0003EC10 NUMBER OF SECTORS: 257040
3 - Partition table entry = 2 << Empty >>
01DE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
3 - Partition table entry = 3 << Empty >>
01EE: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 00 00 START CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+4 00 PARTITION ID: Empty
+5 00 00 00 END CYL-HEAD-SECTOR: 000h-00h-00h (0-0-0)
+8 00000000 START SECTOR: 0
+C 00000000 NUMBER OF SECTORS: 0
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START SECTORS
======== ======== ======== ========
1-0 : 0000003F 01388B3A 0000003F 01388AFC Win95 FAT32
1-1 : 01388B3B 3A380D7F 01388B3B 38FF8245 Win95 Ext'd (LBA)
2-0 : 01388B7A 0A896FFB 0000003F 0950E482 Win95 FAT32
2-1 : 0A896FFC 12A1C981 0950E4C1 08185986 Extended
3-0 : 0A89703B 12A1C981 0000003F 08185947 Win95 FAT32
3-1 : 12A1C982 12A5B591 11693E47 0003EC10 Extended
4-0 : 12A1C9C1 12A5B591 0000003F 0003EBD1 FAT16
4-1 : 12A5B592 1394B6A0 116D2A57 00EF010F Extended
5-0 : 12A5B5D1 1394B6A0 0000003F 00EF00D0 Win95 FAT32
5-1 : 1394B6A1 15D7F61B 125C2B66 02433F7B Extended
6-0 : 1394B6E0 15D7F61B 0000003F 02433F3C Win95 FAT32
6-1 : 15D7F61C 17D1AB6A 149F6AE1 01F9B54F Extended
7-0 : 15D7F65B 17D1AB6A 0000003F 01F9B510 Win95 FAT32
7-1 : 17D1AB6B 1BD1967B 16992030 03FFEB11 Extended
8-0 : 17D1ABAA 1BD1967B 0000003F 03FFEAD2 Win95 FAT32
8-1 : 1BD1967C 1FD1818C 1A990B41 03FFEB11 Extended
9-0 : 1BD196BB 1FD1818C 0000003F 03FFEAD2 Win95 FAT32
9-1 : 1FD1818D 23D12DDC 1E98F652 03FFAC50 Extended
10-0 : 1FD181CC 23D12DDC 0000003F 03FFAC11 Win95 FAT32
10-1 : 23D12DDD 2E02DBF2 2298A2A2 0A31AE16 Extended
11-0 : 23D12E1C 2E02DBF2 0000003F 0A31ADD7 Win95 FAT32
11-1 : 2E02DBF3 3A380D7F 2CCA50B8 0C35318D Extended
12-0 : 2E02DC32 3A380D7F 0000003F 0C35314E Win95 FAT32
[ FREE SPACE ]
Summary of 500GB SATA HDD:
SATA DRV C -
Partition sector = CHS 0-0-1 (LBA 0) (MBR)
Boot sector = CHS 0-1-1 (LBA 63)
SATA DRV D -
Partition sector = CHS 1275-0-1 (LBA 20482875) (E-MBR 1)
Boot sector = CHS 1275-1-1 (LBA 20482938)
SATA DRV E -
Partition sector = CHS 11004-0-1 (LBA 176779260) (E-MBR 2)
Boot sector = CHS 11004-1-1 (LBA 176779323)
LOGICAL 3 (125.5 MB) -
Partition sector = CHS 19458-0-1 (LBA 312592770) (E-MBR 3)
Boot sector = CHS 19458-1-1 (LBA 312592833)
LOGICAL 4 (7,648.1 MB) -
Partition sector = CHS 19474-0-1 (LBA 312849810) (E-MBR 4)
Boot sector = CHS 19474-1-1 (LBA 312849873)
LOGICAL 5 (18,535.9 MB) -
Partition sector = CHS 20449-0-1 (LBA 328513185) (E-MBR 5)
Boot sector = CHS 20449-1-1 (LBA 328513248)
LOGICAL 6 (16,182.6 MB) -
Partition sector = CHS 22812-0-1 (LBA 366474780) (E-MBR 6)
Boot sector = CHS 22812-1-1 (LBA 366474843)
LOGICAL 7 (32,765.4 MB) -
Partition sector = CHS 24875-0-1 (LBA 399616875) (E-MBR 7)
Boot sector = CHS 24875-1-1 (LBA 399616938)
LOGICAL 8 (32,765.4 MB) -
Partition sector = CHS 29052-0-1 (LBA 466720380) (E-MBR 8)
Boot sector = CHS 29052-1-1 (LBA 466720443)
LOGICAL 9 (32,757.5 MB) -
Partition sector = CHS 33229-0-1 (LBA 533823885) (E-MBR 9)
Boot sector = CHS 33229-1-1 (LBA 533823948)
LOGICAL 10 (83,509.7 MB) -
Partition sector = CHS 37405-0-1 (LBA 600911325) (E-MBR 10)
Boot sector = CHS 37405-1-1 (LBA 600911388)
LOGICAL 11 (100,006.2 MB) -
Partition sector = CHS 48051-0-1 (LBA 771939315) (E-MBR 11)
Boot sector = CHS 48051-1-1 (LBA 771939378)
DISK INVESTIGATOR
=================
Disk Investigator v1.31
This program can display the following data structures in a
partition, and in doing so also shows the LBA sector number:
• Boot Sector (NB: Partition's Boot Sector, NOT the MBR!)
• FAT 1
• FAT 2
• Root Directory
To display the relevent data structure -
1. Run the program
2. Go to the VIEW menu and select DISK
3. Go to the VIEW menu, and select the desired option
*** Run Disk Investigator ***
SET PATH=%path%;F:\HARDWARE\DI
DI
Examples of Disk Investigator's summary of Disk structure -
DISK 1, PARTITION 1
Western Digital WD800JB, 80GB, Primary DOS partition
Volume Label: DRIVE C
Logical drive: C
Physical drive: 128
Total logical sectors: 20482812
Cylinders: 1275
Sectors per cylinder: 63
Heads: 255
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 16
Number of copies of FAT: 2
Sectors per FAT: 9992
Start sector for FAT1: 32
Start sector for FAT2: 10024
Root DIR Sector: 20016
Root DIR Cluster: 2
2nd Cluster Start Sector: 20016
Ending Cluster: 1278925
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 63
Backup boot sector: 6
Reserved sectors: 32
FS Info sector: 0
Sectors per track: 63
File system version: 0
SerialVolumeID: 00000DDF
DISK 1, PARTITION 2
Western Digital WD800JB, 80GB, Logical 1 partition
Volume Label: DATA
Logical drive: E
Physical drive: 0
Total logical sectors: 135813447
Cylinders: 8454
Sectors per cylinder: 63
Heads: 255
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 64
Number of copies of FAT: 2
Sectors per FAT: 16577
Start sector for FAT1: 32
Start sector for FAT2: 16609
Root DIR Sector: 33186
Root DIR Cluster: 2
2nd Cluster Start Sector: 33186
Ending Cluster: 2121567
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 35706
Backup boot sector: 6
Reserved sectors: 32
FS Info sector: 1
Sectors per track: 63
File system version: 0
SerialVolumeID: 235815FC
DISK 2, PARTITION 1
SeaGate, 18GB, Primary DOS partition
Volume Label: M02GB2
Logical drive: D
Physical drive: 129
Total logical sectors: 37961532
Cylinders: 2363
Sectors per cylinder: 63
Heads: 255
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 32
Number of copies of FAT: 2
Sectors per FAT: 9264
Start sector for FAT1: 32
Start sector for FAT2: 9296
Root DIR Sector: 18560
Root DIR Cluster: 2
2nd Cluster Start Sector: 18560
Ending Cluster: 1185718
Media Descriptor: 248
Root Entries: 0
Heads: 255
Hidden sectors: 63
Backup boot sector: 6
Reserved sectors: 32
FS Info sector: 1
Sectors per track: 63
File system version: 0
SerialVolumeID: 183F11F0
DISK 3, PARTITION 1
USB Pen Drive, 8GB, Primary DOS partition
Volume Label: USBDISKPRO
Logical drive: G
Physical drive: 130
Total logical sectors: 15658976
Cylinders: 975
Sectors per cylinder: 63
Heads: 16
Bytes per sector: 512
File system: FAT32
Sectors per Cluster: 8
Number of copies of FAT: 2
Sectors per FAT: 15264
Start sector for FAT1: 64
Start sector for FAT2: 15328
Root DIR Sector: 30592
Root DIR Cluster: 2
2nd Cluster Start Sector: 30592
Ending Cluster: 1953549
Media Descriptor: 248
Root Entries: 0
Heads: 16
Hidden sectors: 32
Backup boot sector: 8
Reserved sectors: 64
FS Info sector: 1
Sectors per track: 32
File system version: 0
SerialVolumeID: F713BD59
^ Top of Page
FILE ALLOCATION TABLE
=====================
FAT32 FILE SYSTEM
=================
The "system area" of the partition contains a table that records
which file is stored in each cluster of the partition's data region
and records which clusters are not currently in use ("free space").
The table is known as the File Allocation Table (or FAT for short).
Each entry in the FAT occupies 32 bits, hence the designation FAT32.
NB: Although the partition is divided into sectors, it is impossible
to record each sector in the FAT. That would need more addresses
than Windows 9x can provide. So the minimum disk space a file
can occupy is 1 cluster (a cluster being a group of sectors).
The Boot Sector specifies the partition's Cluster size (in KB).
Based upon the fact that a sector is always 512 bytes (0.5 KB),
the possible cluster sizes on a FAT32 disk exceeding 8GB are:
Cluster size Sectors Bytes per Cluster
------------ ------- -----------------------
4 KB 8 8 x 512 = 4,096 bytes
8 KB 16 16 x 512 = 8,192 bytes
16 KB 32 32 x 512 = 16,384 bytes
32 KB 64 64 x 512 = 32,768 bytes
FAT AND BACKUP FAT
==================
A partition usually contains two File Allocation Tables, stored
consecutively in the "system area". These should be identical.
If the partition Boot Sector specifies FAT mirroring shall be used,
the main FAT (called FAT1 in some disk tools) is duplicated in the
backup FAT (called FAT2 in some disk tools).
The duplicate copy of the FAT is never used, as it is only intended
as a backup in case the FAT becomes corrupted (in which event a
special procedure can be applied [see below], to bring it into use).
CONTENTS OF THE FAT
===================
The data region in a Partition starts at cluster 2. The first
two entries in the FAT (4 bytes each) are therefore not needed,
so are used to identify the FAT itself (i.e. 8 "admin" bytes).
In the first entry, the first byte is the media descriptor (F8),
& the other 3 bytes are 0F FF FF (written backwards as FF FF 0F).
The second entry is the end-of-cluster-chain marker (0F FF FF FF,
written backwards as FF FF FF 0F). This is the Dirty Shutdown
flag: its value changes if the last shutdown was not clean,
or if a disk I/O error was detected last session.
Note - In many FAT32 disks, the second entry in the FAT
is actually 07 FF FF FF (written as FF FF FF 07)!
Viewed while the disk was in use; so this is probably
the value of the "dirty shutdown" flag! If this value
is set on bootup, then NOT reset to FF FF FF 0F on
shutdown, it shows Windows on the next bootup that
the computer was not properly shut down last time.
Each cluster has a 4-byte entry in the FAT. The entry tells you
whether the cluster has data in it (if the entry is 0 there is
no data in the cluster, otherwise the entry is a cluster number
or a special function); and whether it's the last cluster used by
the file (the entry 0F FF FF FF is the final entry in the chain).
NB: On disk the 4 bytes are written BACKWARDS (right-to-left)
("Little Endian" http://en.wikipedia.org/wiki/Endianness)
so for instance 0F FF FF FF appears on disk as FF FF FF 0F
Value Description
----- -----------
00000000 Free cluster (No data in it)
00000001 Reserved cluster, do not use
(NB: Written 01 00 00 00)
00000002 - 0FFFFFEF Number of the next cluster
(NB: Written 02 00 00 00 to EF FF FF 0F)
0FFFFFF0 - 0FFFFFF6 Reserved cluster, do not use
(NB: Written F0 FF FF 0F to F6 FF FF 0F)
0FFFFFF7 Bad sector in cluster or reserved cluster
(NB: Written F7 FF FF 0F)
0FFFFFF8 - 0FFFFFFF Last cluster in file (written FF FF FF 0F)
NB: The part highlighted in green shows the Cluster numbers.
NB: Any entry which (on disk) begins with F has a SPECIAL function,
i.e. if it starts with F it's a Function, NOT a cluster number!
The FAT is a chain of cluster numbers: each entry contains a pointer that
records the next cluster in the chain, or the fact that there are no more
clusters in that particular chain, or that the cluster is free space.
NB: The FAT does not tell you where the chain starts (though this can
be worked out from the FAT, by analysing every entry in the FAT, which
is what the better data recovery programs do; e.g. Easy Recovery v6.10)
But the FAT doesn't tell you the name of the file to which the Cluster
chain belongs, nor which Directory that file is located in. It's the
Directory Table that points to the FAT (pointing to the first cluster
that belongs to the file) - not the other way round!
In the case of a text file, examining the cluster location which the
FAT specifies will enable you to read the file and gain clues to its
identity and completeness. But other file types are more difficult.
NB: If the FAT becomes damaged it's fairly easy to repair (as you can
simply replace it with FAT2 or a recent backup made by SRCFAT.EXE)
but if the Directory Table becomes damaged the repair is difficult
(unless you have a recent CLONE backup of the entire partition).
NB: See also http://en.wikipedia.org/wiki/File_Allocation_Table
FINDFAT
=======
Svend's Utilities: FINDPART for DOS (version 4.72)
NB: In this version of Svend's Utilities the FINDFAT function is
a switch (i.e. an option) in FINDPART, not a separate program
The FINDFAT function can be used for two purposes:
1. To identify the starting sector of the 1st and 2nd FAT
on a working Disk, so as to BACKUP the FAT.
2. To locate a lost or damaged FAT on a damaged Disk.
SYNTAX of FINDFAT -
Usage:
FINDPART FINDFAT {disk} [comprehensive | {cyl} {cyl}] {file}
Specify the number of the Disk to search, e.g. 1
[NB: Valid numbers are 1, 2, 3 or 4]
(Alternatively, to search all Disks specify ALL)
To search the entire Disk (i.e. all partitions) specify
COMPREHENSIVE
(Alternatively, to do a quicker search, specify cylinder
number to begin the search from and to end the search at)
Specify the name of the file to save the search results in
(which MUST have the filetype .TXT)
Search Primary Partition only
** Find FAT on Disk 1 **
** Save the report to a file **
FINDPART FINDFAT 1 0 1 F:\FAT_DSK1.TXT
** Find FAT on Disk 2 **
** Save the report to a file **
FINDPART FINDFAT 2 0 1 F:\FAT_DSK2.TXT
** Find FAT on ALL Disks **
** Save the report to a file **
FINDPART FINDFAT ALL 0 1 F:\FAT_ALL.TXT
Search Primary & Extended Partitions
** Find FAT on Disk 1 **
** Save the report to a file **
FINDPART FINDFAT 1 comprehensive F:\FAT_DSK1_.TXT
** Find FAT on Disk 2 **
** Save the report to a file **
FINDPART FINDFAT 2 comprehensive F:\FAT_DSK2_.TXT
** Find FAT on ALL Disks **
** Save the report to a file **
FINDPART FINDFAT ALL comprehensive F:\FAT_ALL_.TXT
NORTON DISKEDIT
===============
Norton's DiskEdit (2002) can identify all File Allocation Tables
on the hard disk (and so help build up a picture of the disk's
structure), by searching for the unique markers F8 FF FF 0F and
F8 FF FF 07 (one of which is in the first sector of every FAT).
When the program starts, in "Type" select "Physical disks"; then
choose the damaged disk, then click "OK". To open the search tool:
TOOLS > FIND... (or press CTRL + S)
Type the text to search for (the unique marker) into the box
marked "Hex", then select "Ignore Case", then click on "Find".
NB: Note that this unique signature is also present in every
backup copy of the FAT stored on the disk.
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
NORTON DISKEDIT
===============
Norton's DiskEdit (2002) can show the sector numbers assigned
to the 1st FAT and 2nd FAT in the selected partition.
When the program starts, in "Type" select "Logical disks"; then
choose a partition, then click "OK". When the program has finished
scanning that partition, go to:
OBJECT > SECTOR (or press ALT + S)
The sector number displayed is NOT the LBA sector! It's only the
sector's number within the selected partition. To convert it to
the LBA number, add the number of sectors before this partition,
from the "Sectors Before" field in the MBR.
NB: If this is the Primary DOS partition, the number of sectors
to add is (always) 63.
*** Run PowerQuest's Partition Table Editor ***
** (Displays the MBR partition table) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
CLUSTERS USED BY A FILE
=======================
Norton's DiskEdit (2002) can view the cluster information in the FAT
that identifies the clusters used by a file (see FILE CLUSTERS below)
DISK INVESTIGATOR
=================
On an undamaged partition, the program Disk Investigator v1.31 (above)
reports the LBA address of the first sector of each FAT.
NB: There are normally two copies of the FAT (see above).
*** Run Disk Investigator ***
SET PATH=%path%;F:\RECOVERY
DI
SIZE OF FAT
===========
FAT32 uses 4 bytes of the FAT to record each data cluster, so
1 sector in the FAT (512 bytes) records 128 clusters (512 � 4).
Calculation based on Allocation Units:
To calculate the size of the FAT (in bytes), multiply the number of
Allocation Units in the partition (i.e. the number of Clusters) by 4
(because the FAT uses 4 bytes to record the address of each Cluster)
Then add 8 bytes, as the FAT allocates 8 bytes for "admin" purposes.
Divide the result by 512 to calculate the size of the FAT in sectors
(because there are 512 bytes in a sector)
Size of FAT (in sectors) = ( ( Number of Clusters x 4 ) + 8 ) � 512
NB: Round up the result to the next whole number of sectors -
INT ( Result + 0.99 )
Calculate size of FAT from size of Data Region:
As FAT32 uses 4 bytes to record each cluster address, 1 sector
in the FAT (512 bytes) records 128 clusters (i.e. 512 � 4).
If cluster size = 8KB (i.e. 1 cluster = 16 sectors) -
• 128 clusters = 128 x 16 = 2,048 sectors
• 2,048 sectors � 2 = 1,024 KB (1,024 � 1,024 = 1 MB)
If cluster size = 16KB (i.e. 1 cluster = 32 sectors) -
• 128 clusters = 128 x 32 = 4,096 sectors
• 4,096 sectors � 2 = 2,048 KB (2,048 � 1,024 = 2 MB)
If cluster size = 32KB (i.e. 1 cluster = 64 sectors) -
• 128 clusters = 128 x 64 = 8,192 sectors
• 8,192 sectors � 2 = 4,096 KB (4,096 � 1,024 = 4 MB)
In each case, the number of disk sectors recorded by each
FAT sector is cluster size (in KB) multiplied by 256 -
• 8KB : 8 x 256 = 2,048 sectors
• 16KB : 16 x 256 = 4,096 sectors
• 32KB : 32 x 256 = 8,192 sectors
From this, the FAT size (in sectors) can be calculated:
• Size of Data Region (in sectors) divided by the
Number of disk sectors recorded by each FAT sector
In each case, the disk area recorded by each FAT sector is
cluster size (in KB) multiplied by 128 -
• 8KB : 8 x 128 = 1,024 KB (1MB)
• 16KB : 16 x 128 = 2,048 KB (2MB)
• 32KB : 32 x 128 = 4,096 KB (4MB)
From this, the FAT size (in sectors) can be calculated:
• Size of Data Region (in KB) divided by the
Disk area (in KB) recorded by each FAT sector
Size of Data Region -
The size of the Data Region can be ascertained by a physical
examination of the disk, to see where Root Directory begins.
The ending sector of the Data Region (i.e. the final sector
of the partition) is given by the NumSectors field in the MBR.
Calculate upper limit for size of FAT:
Take the number of sectors in the Partition and subtract 32
(the number of Reserved Sectors); then divide that result by
cluster size multiplied by 256 (i.e. 2,048 or 4,096 or 8,192)
NB: Be aware that this will result in a FAT size slightly
larger than on the actual disk, since in actuality no FAT
entries are needed for the space occupied by the FAT itself
(so the calculated value should be checked, by a physical
examination of the disk to see where Root Directory begins)
A more accurate value for the size of the FAT is calculated
below: see under "Magic Number".
NB: The size of a FAT can be calculated from the filesize (in KB)
of any backup copy of it, as the size of a FAT in sectors is
equal to its file size (in KB) x 2 (since 1 sector = 0.5 KB)
Calculate size of FAT in KB:
(a) Divide the size of the FAT in sectors by 2
(because 1 sector = 0.5 KB)
(b) Divide the size of the FAT in bytes by 1,024
NB: Round-up the result to the next whole KB
Maximum Size of FAT:
The maximum size of the FAT is 16MB less 64KB (16,711,680 bytes)
NB: 16 x 1,048,576 = 16,777,216 - (64 x 1,024) = 16,711,680
(because MegaBytes x 1,048,576 = Bytes)
ScanDisk for Win98/98SE is a 16-bit program: such programs have
a memory block maximum allocation size of 64 KB less than 16 MB.
As the File Allocation Table uses 4 bytes per cluster, ScanDisk
can't process a FAT that addresses more than 4,177,920 clusters
(including the two reserved clusters).
NB: As the FAT uses 4 bytes (32 bits) per entry:
4,177,920 clusters x 4 = 16,711,680 bytes
As the Cluster size for a partition exceeding 32GB is 32KB,
maximum partition size is: 4,177,920 x 32 = 133,693,440 KB
(= 136,902,082,560 Bytes) (= 130,560 MB) (= 127.5 GB)
NB: Although the Windows ME version of ScanDisk does NOT suffer
from this restriction, for compatibility with Win98 systems
it would be prudent to observe this limit even under WinME.
Size of System Area:
To calculate the total size of the System Area, add together:-
1. The 63 "Hidden sectors" (starting with the Partition Table)
2. The 32 "Reserved sectors" (starting with the Boot Sector)
3. The size of the FAT, multiplied by 2 (there are 2 copies)
NB: The Data Region begins with the cluster containing the
start of the Root Directory Table (a.k.a. Cluster no.2)
[because there are 2 reserved clusters: numbered 0 & 1]
USING THE 2ND FAT
=================
On a FAT32 partition, FAT mirroring can be disabled, allowing
a copy of the FAT (instead of the first FAT) to be active.
NB: To disable FAT mirroring, edit the appropriate byte in the
Boot Record of the Partition in question (see above);
set bytes 41-42 in the BIOS Parameter Block to 0000
SANITY-CHECKING THE FAT
=======================
A FAT must start with the hex value F8, so check that it does.
Both copies of the FAT must be identical. Compare them, using
Norton's DiskEdit (2002), to detect any errors (i.e. differences):
1. Scan the relevent Logical drive: OBJECT > DRIVE (or ALT+D)
2. Split the viewing Window: VIEW > SPLIT WINDOW (or SHIFT+F5)
3. Open FAT1 in one window (OBJECT > 1st FAT) (or ALT+F1) and
FAT2 in the other (OBJECT > 2nd FAT) (or ALT+F2).
4. Compare the two windows: TOOLS > COMPARE WINDOWS
NB: Norton Disk Doctor (NDD.EXE) also includes a comparison
of the FAT and backup FAT in the tests it carries out.
Run ScanDisk in Windows, and use it to recover any "lost chains".
Unique Cluster Addresses -
Cluster addresses must be unique; unless zero (signifying unused),
or a special value (for bad clusters or end-of-file markers).
If a cluster address is not unique, it indicates cross-linked files,
or that arbitrary garbage [below] has been dumped into the FAT area.
Arbitrary Garbage -
Outright garbage can be spotted in several ways:
1. Viewed as text (using VIEW > AS TEXT), garbage will typically
give itself away by including recognisable English words.
2. In FAT32 the cluster addresses are quite low numbers. Arbitrary
garbage dumped into the FAT is usually obvious from the insanely
high address values.
3. A normal FAT looks like a steadily increasing set of cluster
numbers, punctuated by end-of-file markers, with a few zeros
where files have been deleted (although as files are deleted
and created, breaks will occur, as files become fragmented or
are simply created later in the Volume). This pattern makes
it possible to distinguish valid FAT data from garbage.
4. Arbitrary garbage can be spotted by a comparison of the FAT
with the backup FAT, using DiskEdit's Compare tool (see above):
being arbitrary, any garbage will not be identical in both FATs.
Garbage which is a copy of empty disk space is less obvious:
Unused disk space just contains zeros, making it hard to distinguish
from the genuine FAT content of unused clusters. However, raw disk
usually includes ASCII "divide-by" characters, which a FAT does not.
Tie Breaking -
Where a file has two possible cluster chains, one in each FAT,
re-create the file twice (i.e. use both alternatives).
NB: Activate each FAT in turn, in DOS mode, and use the COPY
command to rescue the file by copying it to another disk.
However, if either cluster chain contains zeros (the hex character
zero) the COPY operation will fail. That part of the file which has
been overwritten by zeros is lost anyway, but the COPY command in DOS
will typically abort if it encounters an empty cluster.
File Length Mismatches -
Both the FAT and the Directory Table contain information about
the length of the file.
There are two possible mis-matches:
(a) An end-of-file marker appears in the FAT's cluster chain
where a "next cluster" address was expected; or
(b) Further cluster addresses exist in the FAT beyond the point
where the directory entry expects an end-of-file marker.
NB: This latter is the preferable one, as it does not cause
a COPY operation to fail.
Flat FAT and UnFormat -
The theoretical solutions known as "flat-FAT" and UnFormat are
not discussed here, as they can't repair a damaged FAT in reality.
The logic of "flat-FAT" is to treat the entire partition as a
single cluster chain (i.e. cross-link all the files on the Drive),
as a brute-force means of re-building the FAT from scratch. But
this fails if even a single file on the partition is fragmented!
Using Microsoft's UnFormat to rebuild the FAT also depends on there
being absolutely no file fragmentation! But it also requires that
all the end-of-file markers are correct!
Even worse, if the cluster alignment is wrong then UnFormat will
"fix" the . pointers to use the cluster addresses, i.e. the exact
opposite of what's needed (you'd rather believe the . pointers and
fix the alignment to match their locations), so destroying the only
clue to the correct alignment and invalidating all other pointer
cluster addresses too!
Using the Repaired Partition -
Make sure all FAT errors are fixed (or save all the files to
another disk), before allowing any file writes to the affected Drive.
SRCFAT
======
SRCFat v1.3(c)2001 - The W0rm
Usage: SRCFat {drive:} {filename} {switch}
Program to BACKUP and RESTORE the 1st or 2nd FAT
SRCFat.com can save, restore and check the FAT on a FAT32 Disk
(NB: Replaces older utilities that don't support FAT32)
The program can save and restore the first or second FAT,
or both; and can restore the 2nd FAT over a damaged 1st FAT
(i.e. restore the second FAT to the first), or vice versa.
Switches:
/S - Save FAT table to file
/R - Restore FAT table from file
/C - Compare FAT table to file
/2 - Use the second FAT copy
Note -
This program can also restore a FAT which was saved by
another program, e.g. by FINDPART.EXE (provided no header
or other extra data was saved along with the sector data).
Notes -
1. This program can compare a backup file with the on-disk FAT.
2. Norton's DiskEdit has a function which can compare two backup
files: split the window (View > Split Window), load both files
(Object > File), then compare them (Tools > Compare Windows).
The program halts at the first difference between the files.
NB: It can find subsequent differences by moving the cursor to
the next line, then restarting (Tools > Compare Windows).
BACKUP THE FAT
==============
** Save 1st FAT **
SRCFAT C: F:\SRC_FAT1.C /S
SRCFAT D: F:\SRC_FAT1.D /S
SRCFAT E: F:\SRC_FAT1.E /S
** Save 2nd FAT **
SRCFAT C: F:\SRC_FAT2.C /S /2
SRCFAT D: F:\SRC_FAT2.D /S /2
SRCFAT E: F:\SRC_FAT2.E /S /2
*** Alternative Backup Routine ***
** In practice, the following Backup routine is preferable **
** This saves 4 backup copies instead of only a single one **
** (so guards against overwriting with a *faulty* backup) **
[NB: SERCOPY will *not* save to Root, only to a Subdirectory]
** Save 1st FAT, Drive C: **
SRCFAT C: C:\SAVED\C_FAT1.BIN /S
SERCOPY C:\SAVED\C_FAT1.BIN F:\SAVED /L:4 /D:2 /Q
** Save 1st FAT, Drive D: **
SRCFAT D: D:\SAVED\D_FAT1.BIN /S
SERCOPY D:\SAVED\D_FAT1.BIN F:\SAVED /L:4 /D:2 /Q
** Save 1st FAT, Drive E: **
SRCFAT E: E:\SAVED\E_FAT1.BIN /S
SERCOPY E:\SAVED\E_FAT1.BIN F:\SAVED /L:4 /D:2 /Q
** Save 2nd FAT, Drives C:, D: & E: **
SRCFAT C: F:\C_FAT2.BIN /S /2
SRCFAT D: F:\D_FAT2.BIN /S /2
SRCFAT E: F:\E_FAT2.BIN /S /2
RESTORE THE FAT
===============
*** Help Screen Operations ***
** Display Help screen **
SRCFAT /?
** Save Help screen to file **
SRCFAT /? > F:\SRCFAT.txt
*** Disk Operations in DOS under Win 98/ME ***
** Enable direct disk access **
LOCK C:
LOCK D:
LOCK E:
Note -
In MS-DOS v8.0 the HDD is protected (the default state) by an internal
COMMAND.COM function that prevents direct disk access by any program
other than DOS itself. The HDD must be locked - NOT unlocked! - to
enable SRCFAT to write to the disk. [NB: DOS v8.0 comes with Win98/ME]
Operations on 1st FAT
** Compare 1st FAT to Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /C
SRCFAT D: F:\D_FAT1.000 /C
SRCFAT E: F:\E_FAT1.000 /C
** Compare 1st FAT to Backup File of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /C
SRCFAT D: F:\D_FAT2.BIN /C
SRCFAT E: F:\E_FAT2.BIN /C
** Save a backup of damaged 1st FAT **
(May give error: "Error, could not read sector")
SRCFAT C: F:\BAD_FAT1.C /S
SRCFAT D: F:\BAD_FAT1.D /S
SRCFAT E: F:\BAD_FAT1.E /S
** Restore 1st FAT from Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /R
SRCFAT D: F:\D_FAT1.000 /R
SRCFAT E: F:\E_FAT1.000 /R
** Restore 1st FAT from Backup file of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /R
SRCFAT D: F:\D_FAT2.BIN /R
SRCFAT E: F:\E_FAT2.BIN /R
Note -
If the first 8 bytes of the 1st FAT are replaced with 00000000
Win9x will automatically default to using the 2nd FAT instead
(i.e. treats the 1st FAT as corrupt). This might be tried
*before* attempting to replace the 1st FAT with the 2nd!
Operations on 2nd FAT
** Compare 2nd FAT to Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /C /2
SRCFAT D: F:\D_FAT1.000 /C /2
SRCFAT E: F:\E_FAT1.000 /C /2
** Compare 2nd FAT to Backup File of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /C /2
SRCFAT D: F:\D_FAT2.BIN /C /2
SRCFAT E: F:\E_FAT2.BIN /C /2
** Save a backup of damaged 2nd FAT **
(May give error: "Error, could not read sector")
SRCFAT C: F:\BAD_FAT2.C /S /2
SRCFAT D: F:\BAD_FAT2.D /S /2
SRCFAT E: F:\BAD_FAT2.E /S /2
** Restore 2nd FAT from Backup file of 1st FAT **
Before using, insert filename of LATEST backup!
SRCFAT C: F:\C_FAT1.000 /R /2
SRCFAT D: F:\D_FAT1.000 /R /2
SRCFAT E: F:\E_FAT1.000 /R /2
** Restore 2nd FAT from Backup file of 2nd FAT **
SRCFAT C: F:\C_FAT2.BIN /R /2
SRCFAT D: F:\D_FAT2.BIN /R /2
SRCFAT E: F:\E_FAT2.BIN /R /2
Note -
This procedure should normally only be necessary if
BOTH copies of the FAT are corrupted on a damaged Disk
AND the backup copy of the 1st FAT is also corrupted.
In theory, that situation can never arise! The backup copy
should be on a different Disk (e.g. at F:\).
^ Top of Page
ROOT DIRECTORY
==============
ROOT DIRECTORY TABLE
====================
The Root Directory table usually immediately follows the 2nd FAT
(i.e. begins in the first sector after the 2nd FAT).
NB: Its location is specified by an entry in the Partition's
Boot Sector at offset 44, i.e. in bytes 45-48.
This makes the Root Directory very vulnerable: anything which
damages the 2nd FAT might also wipe out the Root Directory table!
This table MUST be backed up!
In a FAT32 partition there is NO limit to the number of entries
(i.e. files) in the Root Directory. If the cluster size is 32KB,
a block of 64 sectors (i.e. 1 cluster) is reserved for the Root
Directory table: the first 64 sectors after the 2nd FAT. When
this is full, the table can continue anywhere in the partition
(just like any other file); a pointer is set to the next cluster
it occupies.
NB: If all the entries have only a Short Name (so no Long File Name
entries are required), a maximum of 1,024 files and directories
can be stored in a directory table occupying 64 sectors.
Address of Root Directory Table (Examples) -
Western Digital WD800JB 80GB (New bootable HDD)
Primary DOS Partition (Drive C:) = CHS 1-63-46 (LBA: 20,079)
1st Logical Partition (Drive E:) = CHS 1277-17-49 (LBA: 20,516,124)
Western Digital WD800JB 80GB (Drive D: HDD)
Primary DOS Partition (Drive D:) = CHS 2-97-9 (LBA: 38,249)
M02GB2: SeaGate ST320423A 18GB (Win98 HDD)
Primary DOS Partition (Drive D:) = CHS 1-40-39 (LBA: 18,623)
Seagate ST380011A 80GB (Broken HDD)
Primary DOS Partition (Drive C:) = CHS 2-97-5
NB: CHS 0-0-1 = LBA 0 (i.e. Add 1 to convert LBA into actual sectors)
Finding the Root Directory Table:
The Root Directory Table contains the Volume label (i.e. name)
of the partition. Norton's DiskEdit can find the Table by
searching for that name (if it's a unique name).
The Root Directory Table on a Windows system also contains the
(possibly) unique directory entry RECYCLED (unique at least in
its Hex form: followed by 3 spaces and a unique file attribute).
That string can be searched for, using Norton's DiskEdit.
Hex characters for "RECYCLED" (8.3 filename + file attribute):
52 45 43 59 43 4C 45 44 20 20 20 16
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
NORTON DISKEDIT
===============
Norton's DiskEdit (2002) can show the sector number assigned to
the Root Directory table in the selected partition. Go to:
OBJECT > SECTOR (or press ALT + S)
NB: To enable this option, "Logical Disks" must be selected in
DiskEdit's opening screen (in order to display the Disk's
partition structure, rather than its physical structure).
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
The sector number displayed is NOT the LBA sector, but only the
sector's number within the selected partition. To convert it to
the LBA number, add the number of sectors before this partition
from the partition table (the "Sectors Before" field).
NB: If this is the Primary DOS partition, the number of sectors
to add is invariably 63.
*** Run PowerQuest's Partition Table Editor ***
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
CONVERT FROM CHS TO SECTORS
===========================
The utilities which can identify the location of the FAT
give the result by specifying: (a) its starting sector
(a CHS value), and (b) its size (in sectors).
The following calculation uses that information to calculate
the location of the Root Directory Table (giving the result
as a CHS value, needed to make a backup copy of that Table) -
Step 1: Convert the CHS value of the 1st sector of the FAT
from CHS to sectors:
Cylinders x 255 x 63 = ______
Heads x 63 = ______
Sectors x 1 = ______
Total = ______ sectors
Step 2: Multiply the size of the FAT (in sectors) by two,
as the FAT32 file system uses two FATs (main and backup).
Step 3: Add the result from Step 1 and the result from Step 2
together. The total is the sector number of the start of the
Root Directory Table.
Step 4: Convert the total into a CHS value:
(a) 1 cylinder = 255 heads x 63 sectors = 16,065 sectors
So total from Step 3 � 16,065 = cylinders
NB: Carry any remainder to (b) below
(b) 1 Head = 63 sectors
So remainder from (a) � 63 = heads
NB: Carry any remainder to (c) below
(c) 1 sector = 1 sector
So remainder from (b) = sectors
Examples -
Disk 1: WD800JB 80GB (Drive C: & E:)
*** Find the starting sector of all FATs on Disk 1 ***
FINDPART FINDFAT 1 comprehensive FAT_DSK1.TXT
Result for Disk 1:
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 9992 8 2 9992 0 0 0 001203 5060
1275 1 33 16577 32 2 16577 0 0 0 081104 13704
This gives the CHS address, and other details, for FAT1
Column 1 FAT CHS Cylinder number }
Column 2 FAT CHS Head number } CHS Address of FAT
Column 3 FAT CHS Sector number }
Column 4 Size FAT size in Sectors
Column 5 Cl Cluster size in KB (x2 = Sectors per Cluster)
Column 6 Root Cluster number of Root Directory Table
Column 7 Good Number of valid sectors in FAT
Column 8 Rep Number of repaired sectors in FAT
Column 9 Maybe Number of doubtful sectors in FAT
Column 10 Bad Number of bad sectors in FAT
Column 11 YYMMDD Date partition created (Year-Month-Day)
Column 12 DataMB Data stored in partition (in MegaBytes)
NB: To calculate FAT size in sectors, add colums 7, 8, 9 & 10
(i.e. if the FAT is undamaged, its size is in column 7)
Partition No.1 (Drive C:) -
Step 1:
Convert the CHS value of the 1st sector of the FAT to sectors
CHS 0-1-33 = (0 x 255 x 63) + (1 x 63) + (33 x 1) = 96
Step 2:
Multiply the size of the FAT (in sectors) by 2
9,992 x 2 = 19,984
Step 3:
Add the result of the first and second steps
96 + 19,984 = 20,080
Step 4:
Convert the result to CHS
20,080 � 16,065 = 1 cylinder (Remainder = 4,015)
4,015 � 63 = 63 heads (Remainder = 46)
46 � 1 = 46 sectors
So Root Directory Table starts at address CHS 1-63-46
Partition No.2 (Drive E:) -
Step 1:
Convert the CHS value of the 1st sector of the FAT to sectors
CHS 1275-1-33 = (1275 x 255 x 63) + (1 x 63) + (33 x 1) = 20,482,971
Step 2:
Multiply the size of the FAT (in sectors) by 2
16,577 x 2 = 33,154
Step 3:
Add the result of the first and second steps
20,482,971 + 33,154 = 20,516,125
Step 4:
Convert the result to CHS
20,516,125 � 16,065 = 1,277 cylinder (Remainder = 1,120)
1,120 � 63 = 17 heads (Remainder = 49)
49 � 1 = 49 sectors
So Root Directory Table starts at address CHS 1277-17-49
** Save Root Directory of Disk 1, Primary Partition **
FINDPART GETSECT 1 1 63 46 64 ROOT_D1.PRI noheader badf6
** Save Root Directory of Disk 1, 1st Logical Partition **
FINDPART GETSECT 1 1277 17 49 64 ROOT_D1.L1 noheader badf6
** Save Root Directory of Disk 1, 2nd Logical Partition **
FINDPART GETSECT 1 ____ __ __ 64 ROOT_D1.L2 noheader badf6
** Save Root Directory of Disk 1, 3rd Logical Partition **
FINDPART GETSECT 1 ____ __ __ 64 ROOT_D1.L3 noheader badf6
Disk 2: WD800JB 80GB (Drive D:)
*** Find the starting sector of *all* FATs on Disk 2 ***
FINDPART FINDFAT 2 comprehensive FAT_DSK2.TXT
Result for Disk 2:
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0 1 33 19077 32 2 19077 0 0 0 070225 56668
Partition No.1 (Drive D:) -
Step 1:
Convert the CHS value of the 1st sector of the FAT to sectors
CHS 0-1-33 = (0 x 255 x 63) + (1 x 63) + (33 x 1) = 96
Step 2:
Multiply the size of the FAT (in sectors) by 2
19,077 x 2 = 38,154
Step 3:
Add the result of the first and second steps
96 + 38,154 = 38,250
Step 4:
Convert the result to CHS
38,250 � 16,065 = 2 cylinder (Remainder = 6,120)
6,120 � 63 = 97 heads (Remainder = 9)
9 � 1 = 9 sectors
So Root Directory Table starts at address CHS 2-97-9
** Save Root Directory of Disk 2, Primary Partition **
FINDPART GETSECT 2 2 97 9 64 ROOT_D2.PRI noheader badf6
** Save Root Directory of Disk 2, 1st Logical Partition **
FINDPART GETSECT 2 ____ __ __ 64 ROOT_D2.L1 noheader badf6
** Save Root Directory of Disk 2, 2nd Logical Partition **
FINDPART GETSECT 2 ____ __ __ 64 ROOT_D2.L2 noheader badf6
** Save Root Directory of Disk 2, 3rd Logical Partition **
FINDPART GETSECT 2 ____ __ __ 64 ROOT_D2.L3 noheader badf6
CALCULATE STARTING SECTOR
=========================
Starting sector of Root Directory (containing first sector of the
Root Directory Table):
RootStart = Sectors Before + Hidden Sectors + Reserved Sectors
+ (Number of FATs x SectorsPerFAT)
Some of these values are in the MBR / E-MBR sector or Boot Record,
which are most easily read using PowerQuest's Partition Table Editor
*** Run PowerQuest's Partition Table Editor ***
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\RECOVERY
PTEDIT
Primary Partition -
To calculate the RootStart sector of the Primary DOS partition,
"Sectors Before" is nil, "Hidden Sectors" is usually 63 sectors
(the entire Non-DOS partition), and "Reserved Sectors" normally
comprises the first 32 sectors of the Primary DOS partition;
so there are typically 95 sectors (LBA 0 to 94) prior to the FAT
RootStart = Sectors Before + Hidden Sectors + Reserved Sectors
+ (Number of FATs x SectorsPerFAT)
Typically resolves as: 0 + 63 + 32 = 95 + (2 x SectorsPerFAT)
^ Top of Page
FILES
=====
FILE NAMES
==========
Under FAT32, a file typically has TWO names:
1. A Short name, used by MS-DOS to access the file.
2. A Long File Name (LFN), used by Windows to access
the file. An LFN is optional; if one is not present,
Windows uses the Short name instead.
Short name -
All files have a short filename, comprising 11 characters
(also known as an 8.3 name). This is the ONLY name by which
the file can be accessed under MS-DOS.
It consists of an 8 character name, followed by a dot,
followed by 3 more characters (known as the Extension).
The name can have fewer than 8 characters; and the Extension
can have fewer than 3 characters, or can be omitted entirely.
Only letters of the alphabet (uppercase only), numbers 0 to 9,
and the underscore character, can be used in a Short name.
The Short name is the name displayed by the command DIR when
the computer is booted to DOS.
Long File Name -
A file can, optionally, also have a Long File Name (or LFN),
comprising up to 256 characters, by which Windows (but not DOS)
can access the file.
An LFN can contain any character on the keyboard, except the
reserved characters (i.e. colon, question mark, quotation mark,
forward slash, backslash, asterisk, angle-brackets).
The LFN overcomes the many drawbacks of the Short name system
inherited from MS-DOS; but not even the FAT32 version of MS-DOS,
which underlies Windows 98/ME, can recognise an LFN.
NB: Some third-party (i.e. non-Microsoft) tools can enable DOS
to access a file using the Long File Name - see below.
DIRECTORY TABLE
===============
A Directory Table does not have a mandatory location, nor does
it have a fixed size. Each directory (folder) has such a table:
which is just a file, but with a special (Directory) attribute.
NB: Even the Root Directory Table has no mandatory location.
Its 1st sector is usually in cluster 2 of the Data Region;
but this is only common practice, not a requirement. The
Boot Sector pointer can legitimately point to ANY cluster.
NB: Norton's DiskEdit can be used to locate a Directory Table,
by searching the disk for the first 8 characters of the
8.3 file name of any file in that directory.
Filenames are stored in the Directory Table (not in the FAT).
Each 8.3 file entry is 32 bytes long. LFNs are also stored in
the Directory Table, alongside the 8.3 filename.
The LFN (if any) is stored as one or more separate directory
entries, immediately before the 8.3 filename. The LFN is stored
first because the 8.3 filename is derived from it, not vice versa!
Length of Directory Entry:
If a file has no LFN, the directory table entry will be 32 bytes
(i.e. that's the minimum length).
Up to 640 bytes are occupied by the Long File Name (LFN); thus an
entry can be a maximum of 672 bytes (32 bytes + 640 bytes).
NB: Each directory entry can store up to 13 characters of an LFN,
so several entries may be needed. As an LFN can consist of up
to 255 characters, the maximum size is 20 entries (255 � 13).
Directory Table format (8.3 filename entry):
Size Description
---- -----------
8 bytes Filename
3 bytes Extension
1 byte Attribute: 00 (hex) : None 01 (hex) : Read-only
02 (hex) : Hidden 04 (hex) : System
08 (hex) : Volume 10 (hex) : Directory
20 (hex) : Archive
1 byte Reserved (00)
1 byte Time Created (Seconds) } If zero, might be
2 bytes Time Created (Hour & Minute) } a Directory entry
2 bytes Date Created
2 bytes Date Last Accessed
2 bytes Reserved (0F 00 or 0C 00) (or 0E 00)
2 bytes Time Modified
2 bytes Date Modified
2 bytes Cluster Number (Location of beginning of file)
4 bytes File Size (If zero, might be a Directory entry)
Total = 32 bytes
Attributes:
Attrib Meaning Notes
------ ------- -----
- Unused No attributes set
A Archive File needs Archiving (i.e. backing-up), as it
has been modified since BACKUP.EXE was last run
R Read-only File is Read-only
S System File is a System file (i.e. part of Windows)
H Hidden File is a Hidden file (i.e. part of Windows)
D Directory The "file" is actually a Directory Table
V Volume Volume label or Long File Name (LFN) block
Only 1 byte is allocated to store a file's Attributes, even though
a file can have 4 different attributes set at once: i.e. R,A,S,H
But the total value of the combined attributes is always unique;
e.g. if a file is marked Archive and Read-only it has a hex value
of 21 hex (i.e. 20 hex + 01 hex) [Directory Table format, above]
Identifying the File sectors:
The file is stored in clusters of sectors. If cluster size is
32KB each cluster contains 64 sectors (sector size = 0.5KB).
The Directory Table stores the location of the first cluster
used by the file. And each sector of a file contains a pointer
to the next sector used by that file. So if the file occupies
more than 64 sectors the next cluster can be identified.
This information is also stored in the File Allocation Table
(FAT). If the FAT is undamaged, Norton's DiskEdit can read
from it all the cluster numbers used by a file (see above).
The 11 character filename is in the following format:
• 8 characters, padded with spaces (20 hex) if not all
are used. If the Long File Name exceeds 8 characters,
it's truncated to the first 6 plus ~1 (or ~2, etc)
in forming the 8.3 short name
• 3 character filetype, but NO dot preceeding it
NB: The number following the ~ character (1, 2, 3, etc) is to
distinguish between files whose short name would otherwise
be identical (i.e. which have the same first 6 characters)
NB: A ~1 (or ~2, etc) is also used if the short name contains
whitespace; even if, including the space(s), the short
name does not exceed 8 characters!
NB: A file will have a Long File Name (LFN) entry if the short
name contains Lowercase characters, even if the short name
does not exceed 8 characters and contains no spaces!
Sector Level Access:
In operating systems which use FAT32, DOS is locked out of
sector-level access to the disk, to prevent it damaging the
LFN entries when performing directory operations. (NB: Use
the DOS internal command UNLOCK to enable read/write access)
SANITY-CHECKING DIRECTORY TABLE
===============================
Logic within a Directory Table -
Every entry in a Directory Table is 32 bytes long (a "block").
For each file or sub-directory, its LFN entries (if it has an LFN)
are written first, in blocks of 32 bytes each; if the LFN exceeds
13 characters there will be more than one LFN block.
The LFN blocks are stored from last to first (i.e. to read them you
must start at the block immediately preceeding the block containing
the Short Name; then the 2nd one preceeding it; then the 3rd; etc).
The Short Name (the 8.3 filename), and the Date/Time and Size data,
are contained in the block immediately following its LFN block(s).
NB: If the sequence of blocks in a directory table is interrupted,
this interruption in the chain of entries may be detected by
ScanDisk as an "LFN error".
Zero Markers -
If the first byte of an entry is zero (00 hex), that marks the end
of the Directory Table: no further entries should follow.
If such a marker occurs in the middle of the Directory Table
(i.e. by accident) and ScanDisk is allowed to "fix" the error,
it will fatally DELETE all data in the Table after that marker!
NB: This error is typically reported by ScanDisk as (for example)
"Directory entry C: has an invalid FAT chain". (But there is
actually no error in the File Allocation Table!)
You should NEVER let ScanDisk "fix" such an error, as the result
will ALWAYS be data loss. The solution is to use a Disk Editor to
manually edit the Directory Table: change the first byte of each
affected 32-byte "block" from zero (00 hex) to E5 (E5 hex); E5 is
the marker for a deleted directory entry.
If a deleted block (or, in fact, any non-zero data) is present
after the legitimate end of the Directory Table, ScanDisk will
report this as an error of the above type (even though, being a
deleted entry, this is not a real error in the Directory Table).
NB: This error shouldn't happen in normal use, but can result from
a bug in ScanDisk itself, i.e. can be the result of ScanDisk's
flawed attempt to correct some other error in the Directory Table.
NB: If ScanDisk reports an error, but the better designed Norton
Disk Doctor (NDD.EXE) does not, this typically indicates that
the "error" is not a real error, but is merely old data present
in the Directory Table *after* the end of the legitimate data.
You must NEVER use a zero marker to "comment out" garbage entries
when repairing a damaged Directory Table. Use the marker E5 (hex)
instead (i.e. mark the unwanted block as "deleted").
Invalid Names -
Non-unique Short names, or invalid characters within the Short name,
will cause the file or sub-directory to be uncopyable or undeletable.
You can attempt to use wildcard selection logic (e.g. COPY *.*) to
get round this; but it may be better to fix such errors by editing
the Directory Table with a disk editor.
Root Directory -
The .. pointer (double-dot pointer) in a Directory Table, which
should be the first entry in the Table, holds the cluster number
(i.e. the address) of the parent directory.
If this pointer has a value of zero, the parent directory is the
Root directory. So to rebuild the Root directory from scratch,
identify all sub-directories with .. pointers of zero.
Subdirectories -
A Subdirectory (i.e. all directories other than the Root directory)
starts with . and .. entries. Norton's DiskEdit can find "lost"
directories by searching for these markers, to enable you to
reconstruct the hard disk's Directory Tree.
The . pointer should point to itself, i.e. to the cluster address
it occupies. If it does not (i.e. those addresses do not match),
the hard disk has one of the following errors:
(a) The file system logic is faulty (e.g. faulty Boot Sector,
faulty Partition Table, or faulty CHS Geometry settings);
(b) It is a directory from a previous format of the hard disk;
(c) It is a copy of a directory (e.g. as written to a file); or
(d) It is a mislocated directory, i.e. written to the wrong part
of the hard disk.
NB: If you are searching for "lost" directories, bear in mind the
possibility that what DiskEdit has found might be in category
(b) or (c), and hence NOT a legitimate directory at all.
Faulty Hardware -
Byte offsets and 4-byte garbage errors are typically caused by
failing hardware (e.g. bad IDE cables, poor chassis grounding,
faulty RAM, overheating, over-clocked PCI bus, etc).
NB: You can sometimes correct an offset error, or a stuck-bit
error, and get full recovery of what looked like garbage.
A stuck-bit error occurs in the RAM memory hardware (due
to one data location [bit] retaining an old value, whilst
the other seven bits in that byte change correctly). This
only occurs in non-ECC RAM, as it has no Error Correction.
Total Garbage -
Total garbage directories are either: the result of a sector full
of garbage being written into the cluster chain; or cross-linking
followed by overwriting (e.g. caused by ScanDisk); or a corrupted
pointer that points to arbitrary data.
In that last-mentioned case, look for "bit-puns": a value that
differs by one "flipped" bit may point to the real data!
(Example of a flipped bit: A hex value A5 being written as 5A)
NB: A search using Norton's DiskEdit (2002), for the Short Name
of one of the files in the affected Directory, can locate
the true sector address of the missing Directory Table.
INVALID LFN ENTRY
=================
ScanDisk for Windows, Norton DiskEdit, and Norton Disk Doctor
(if its option to test Date and Time is set), will wrongly
report that a disk error exists if a file's Directory Table
entry includes any of the following:
(a) if the Created or Last Modified date is in the future; or
(b) if the Last Modified time ends in "00" (zero) seconds.
Actually, there is NO disk error - nor any damage to the file!
And the "error" can be cured by editing the Date or Time stamp
in Windows, using a program such as AttributeMagic v1.0.4:
- To cure a Future date, change the date to any date BEFORE
the current date
- To cure a "Last Modified" time which ends in zero seconds,
change the seconds to any OTHER value that's an even number
[Note: ScanDisk's cure is to reduce the value by 2 seconds]
NB: The "Last Modified" time is stored as a 2-byte value,
which is not enough space to store the actual number
of seconds, so they're stored in 2-second increments.
When that field holds a value of 30, Windows doubles
the value (i.e. to 60), reports "seconds" as 00, and
increases the "minutes" field by 1; but the disk tools
are programmed to reject any value for "seconds" that
exceeds 59, and so report the value of 60 as an error.
LONG FILE NAMES IN DOS
======================
The following tools can use Long File Names in DOS -
1. Odi's LFN tools:
These include: LDIR.EXE, LCOPY.EXE, LDEL.EXE, LREN.EXE, LMD.EXE
NB: See below ("Recover Individual Files") for syntax and use.
2. Henrik Haftmann's DOSLFN.COM:
This has the advantage of being a driver, which can be loaded at
boot time, that performs ALL functions in LFN format! But it's
complicated to use, compared with the simplicity of Odi's tools.
FILE CLUSTERS
=============
If a partition is damaged, to recover a file the first thing that
must be done is to establish how many clusters the file occupies.
To establish the cluster size, run CHKDSK.EXE to display the
partition's "allocation unit size" (i.e. cluster size):
*** Find the Cluster Size ***
CHKDSK C:
CHKDSK D:
CHKDSK E:
SYNTAX -
chkdsk [drive:][[path]filename] [/F] [/V]
[drive:][path] Specifies the drive and directory to check
filename Specifies the file(s) to check for fragmentation
/F Fixes errors on the disk
/V Displays the full path and name of every file on
the disk
NB: Do NOT use the /F switch! That switch causes the program to
try to Fix errors, but disk activity will damage data and
reduce the changes of recovering the files in the partition!
Note -
For the default cluster size (which depends on the size of the
partition), see above. Since a partition does NOT have to use
the default size it is prudent to establish the actual value by
using CHKDSK.EXE (or from byte 14 in the Boot Record: see above).
Calculation -
To calculate how many clusters a file occupies: divide the file size
(in bytes) by the cluster size (in bytes), and round the result up
(to the next whole number).
Cluster size, in bytes: 8KB cluster = 1,024 x 8 = 8,192 bytes
16KB cluster = 1,024 x 16 = 16,384 bytes
32KB cluster = 1,024 x 32 = 32,768 bytes
File Storage -
If the file is larger than a single cluster, the Operating System
stores the excess data in the next available cluster; and repeats
this until all the data in the file is stored.
Clusters used by a File -
The Directory Table records the "starting cluster number", i.e. the
address of the first cluster used by the file. Each cluster contains
a pointer to the next cluster in the file (i.e. the cluster number),
or (if it's the last one in the file) an end-of-file marker (FFFF).
In addition, the File Allocation Table (FAT) contains a record of
all the clusters used by the file. (This is of more practical use
than the Directory Table, because a BACKUP can be made of the FAT!)
NB: There are therefore TWO ways of identifying the clusters occupied
by a file!
NB: Programs such as Tiramisu (a.k.a. Easy Recovery), Lost & Found,
and Active Partition Recovery make use of this redundancy.
They scan the disk, sector by sector, to rebuild an undamaged
File Allocation Table in RAM memory.
Viewing the FAT -
Norton's DiskEdit (see below) can display the cluster numbers stored
in the FAT:
1. To display the Directory Tree, go to: OBJECT > DIRECTORY
2. Select the directory the file is stored in, then click "OK"
3. Go to: VIEW > AS DIRECTORY (or press F4)
4. Move the cursor onto the filename
5. On the LINK menu, select "Cluster chain (FAT)" (or press Ctrl+T)
NB: Alternatively, display the Root Directory (go to OBJECT > DRIVE)
and select Directory view (go to VIEW > AS DIRECTORY). From that,
double-clicking on the name of a sub-directory will change to
that directory. In this way, navigate to the file in question.
NB: If the Directory structure is inaccessible (due to a disk crash),
to find the sector containing the directory table use DiskEdit
to search for the first 8 characters of the file's 8.3 filename.
(Note: The Long File Name CANNOT be used, as the characters in it
are NOT stored consecutively on disk, but mixed with other data)
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
The contents of the FAT, as displayed by Norton's DiskEdit, are:
0 (Zero) : This represents a disk cluster that is not in use.
It may, for example, have been part of an erased file.
NB: The sector is NOT necessarily empty of data; zero is
merely a marker, indicating the cluster is available
to store new data in. Data in it will be overwritten.
A decimal number, greater than 1 : This entry represents a
cluster containing data belonging to a file. The number is
the number of the NEXT cluster in the chain for that file.
EOF ("End Of File") : This entry, too, represents a cluster
containing data belonging to a file. This is the last cluster
in the chain. Part of this cluster will thus be slack space
(i.e. wasted space), possibly containing data from an old file.
BAD : An unusable cluster. Often only one sector is actually
bad (of the 32 or 64 sectors a cluster usually contains). Even
a bad sector can get fixed; to try reading it, press ALT+L,F.
Thus a cluster number that is NOT zero contains a file.
The STATUS line (at the foot of the screen) gives the cluster
number of the cluster the cursor is on. The number HIGHLIGHTED
by the cursor is the number of the next cluster in the file!
Navigating a File:
In FAT view, select a cluster (i.e. click on one). If it belongs
to a file (i.e. its value is neither "0" nor "BAD"):-
- to view the contents of that File, press Ctrl + F (or ALT+L,F)
(or go to: LINK > FILE)
- to view the Directory entry for that file, press Ctrl + D
(or go to: LINK > DIRECTORY)
- to view the FAT entries for that file, press Ctrl + T
(or go to: LINK > FAT)
NB: If an entry goes RED when selected, it belongs to a file.
The on-screen status line will show the file's name.
Other entries highlighted in RED are other clusters in the same
file ("allocation chain") as the selected cluster; but they might
not be the only other clusters for that file.
NB: To change the format of the display, go to the VIEW menu
• To view sector as Hex, go to: VIEW > HEX
• To view sector as Text, go to: VIEW > TEXT
• To view sector as a Directory, go to: VIEW > DIRECTORY
File Size:
The maximum size possible for a file is 1 byte less than 4 GB
(i.e. 4,294,967,295 bytes). This size limit is a consequence
of the file length entry in the directory table.
Note: In FAT16, 4 GB is the maximum size possible for
a partition. In FAT32, 4 GB is the maximum size possible
for a file; the maximum size for a partition is 127.5 GB.
^ Top of Page ___________________________________ SECTION B: DISK STRUCTURE REPAIRS ___________________________________
IDENTIFYING THE PARTITION STRUCTURE
===================================
Step 1: Discover the Disk's Geometry
Norton's DiskEdit can display the disk's geometry (i.e. the CHS
information for the disk). Start DISKEDIT.EXE then go to:
Tools > Advanced
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Alternatively, TESTDISK.EXE can display the disk's geometry.
Alternatively, the information can be viewed in the BIOS (run
the routine "Auto-Detect Hard Disks"); or read the information
from the label on the disk's casing.
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup.
Step 2: Search for possible Partition Boot Sectors
Norton's DiskEdit can help to build up a picture of all possible
boot/partition sectors on the hard disk, and hence of the disk's
structure, by searching for the "55AA" marker (or the signature
"FAT32") (or the signature "MSWIN4.1") present in such sectors.
NB: To search, display the target HDD as a physical disk; then
go to sector LBA 0; then press CTRL + S simultaneously.
A partition begins with a Boot Sector, and ends immediately before
another Boot Sector (provided the disk has more than one partition).
Therefore locating all boot sectors on the disk will reveal a lot
about the partition structure.
NB: The CHS address of the boot sector of a partition is the first
sector of that partition. It is preceeded by 63 hidden sectors,
the first of which contains the Partition Table for that partition.
The Boot Sector of a partition will normally have the CHS address
xxxx-1-1 (i.e. head 1 sector 1) (except for the 2nd or subsequent
Logical partitions). If the Boot Sector for the Primary DOS or the
1st Logical partition does not have that address, it is NOT genuine!
It is essential to visually confirm whether a possible boot sector
is actually a boot sector, by using Norton's DiskEdit to view it.
(NB: Compare it against sample MBR sectors in this file - see above)
The most likely cause of false positives is backups:
(a) The FAT32 structure includes a backup boot sector in every
partition, so every boot sector on the disk will potentially
show up twice (i.e. if the disk data has not been corrupted).
(b) Many utilities exist that can save a copy of the MBR or
the Boot Sector of a partition, as a backup file. Being
ordinary files, these can be stored anywhere on the disk.
Note - The partition Boot Sector contains a text-string identifying
the type of partition (e.g. "FAT16" or "FAT32"). Although it
is not used by the O/S in managing the partition, this is
nonetheless a helpful clue to the structure of the partition.
Note - The first place to look for a partition Boot Sector is in
sector CHS 0-1-1 (its almost invariable location in FAT32).
Step 3: Search for possible FS Info Sectors
Norton's DiskEdit can also search the hard disk for the unique
signatures of an FS Info Sector ("RRaA" and "rrAa").
The most likely cause of false positives is backups. Many utilities
exist that can save a copy of this sector as a backup; being
ordinary files, these backups can be stored anywhere on the disk.
Step 4: Search for possible FATs
Norton's DiskEdit can also search the hard disk for the unique
signature of a File Allocation Table (F8 FF FF 0F) (see above).
NB: That signature can (in some circumstances) be F8 FF FF 07
(since this is used as a "flag" to record a bad shutdown).
Svend's FINDPART program can also search the disk for FATs,
with the option FINDPART FINDFAT (see above).
FATs come in pairs: a mirror copy (FAT2) immediately follows the FAT
(FAT1). The first of the pair will normally begin within 33 sectors
after the start of the partition (i.e. of its boot sector); so the
presence of a FAT within 33 sectors of a boot sector indicates the
boot sector is the genuine article (i.e. the start of a partition).
The most likely cause of false positives is backups:
(a) The FAT32 structure includes a backup FAT in every partition,
so every FAT on the disk will potentially show up twice
(i.e. if the disk data has not been corrupted).
(b) Many utilities exist that can save a copy of the FAT as a backup.
Being ordinary files, these can be stored anywhere on the disk.
Step 5: Rebuild the Partition Table entry
To recover a partition, all that is needed is to recreate a correct
pointer in the MBR (at CHS 0-0-1).
If that pointer points to a partition table, not to a boot sector,
the pointer must be an Extended Partition entry. In any event,
that partition begins at the sector which it points to.
NB: The Primary DOS partition on a FAT32 disk will invariably
begin at CHS 0-1-1 (i.e. LBA sector 63), the 64th sector.
The last sector at which the partition can end is the final
sector of the Extended partition (an address which might be
revealled by one of the other partition table entries in the MBR).
The VERY last sector at which the partition can end is the last
sector of the disk; but it will probably have to end before that,
as partitions MUST end on a Cylinder boundary.
NB: Calculate the total number of disk sectors, and from that
the CHS address of the final sector of the final Cylinder.
(See "Step 1: Discover the Disk's Geometry", above)
A FAT32 partition MUST be a multiple of 16,065 sectors, as it
must end in the last sector (63) of the last head (254) in a
cylinder; so it MUST end with the CHS address xxxx-254-63.
NB: This applies ONLY to the Primary DOS and Extended partitions,
not to any Logical partition(s) - although it will apply to
the 1st Logical partition if it's the only Logical partition
and occupies the entire Extended partition.
Another clue is the size of the FAT, since the number of sectors
it occupies ("Big Total Sectors per FAT" in the partition's boot
record) is directly related to the size of the partition (as the
FAT allows 4 bytes per Cluster, and the default Cluster size is
32KB [i.e. 64 sectors] if the partition exceeds 32GB).
NB: For the default cluster size of smaller partitions, see above.
(The default is the logical starting point, as few users will
be capable of changing it)
NB: The number of sectors between the first sector of FAT1 and the
first sector of FAT2 discloses the size of FAT1; this can be
established with Norton's DiskEdit, by searching for FATs
(see above) or by viewing the disk sectors.
The Ending Location for ANY partition exceeding 8GB is meaningless,
since by definition its CHS address MUST be 1023-254-63 (regardless
of the true size of the partition); but the numbers for the entries
"Relative Sectors" and "Number of Sectors" are correct.
OUTLINE OF PARTITION STRUCTURE
==============================
No. Partition CHS Address Notes
-- --------- ----------- -----
1 Primary 0-0-1 Partition Table (MBR)
0-1-1 Boot Sector (MBR + 1 Head)
2 1st Logical xxxx-0-1 Partition Table
xxxx-1-1 Boot Sector (P.Table + 1 Head)
3 2nd Logical xxxx-x-1 Partition Table
xxxx-x-1 Boot Sector (P.Table + 1 Head)
4 3rd Logical xxxx-x-1 Partition Table
xxxx-x-1 Boot Sector (P.Table + 1 Head)
Extended Partition:
The Extended partition is defined in the MBR (CHS 0-0-1) and
comprises all of the Logical partitions.
The first sector of the Extended partition is the Partition
Table sector of the 1st Logical partition.
The last sector of the Extended partition is the end sector
of the final Logical partition (unless there is unallocated
space in the Extended partition). [NB: Partitioning utilities
can only leave unallocated space AFTER all Logical partitions]
Cylinder Boundary rule:
The Primary partition and the Extended partition MUST end on
a Cylinder boundary, so partitions (except Logical partitions)
will inevitably begin in the FIRST sector of a Cylinder
(i.e. the value for HEAD is 0 and the value for SECTOR is 1).
For backwards compatibility, this is so even on a HDD larger
than 8 GB (i.e. one which uses LBA addressing instead of CHS).
Note - Although this rule applies only to the Primary and Extended
partitions, not Logical partitions in the Extended partition,
it must inevitably apply to the FIRST Logical partition.
Importance of the Starting Sector:
To have a clear picture of the Disk, you usually need to locate
only the starting Sector for each partition, because there is
NEVER any unused space between partitions on an ordinary disk.
NB: Partitioning programs, especially Microsoft's FDISK.EXE, can
only leave unallocated space AFTER all partitions.
Even within the Extended partition, partitioning utilities
can only leave unallocated space AFTER all Logical partitions.
Partition Size
A partition is a multiple of 16,065 sectors, inclusive of the Track
containing its Partition Table (if the HDD uses standard geometry,
i.e. 255 Heads per Cylinder, 63 sectors per Head).
This is because 1 Cylinder = 16,065 sectors (i.e. 255 x 63 = 16,065)
and because a partition is always a whole number of Cylinders.
NB: This does NOT apply to Logical partitions, only to the
Primary DOS partition and the Extended partition (but it
will apply to the FIRST Logical partition if it's the ONLY
Logical partition and occupies the entire Extended partition).
NB: To calculate the value of "Big Total Sectors" for the MBR or E-MBR,
subtract 63 (the first 63 sectors containing the Partition Table)
as they are counted under "Hidden Sectors" not "Big Total Sectors".
Notes on Partition Size -
If the disk uses standard geometry (i.e. 255 Heads per Cylinder,
63 Sectors per Head, 512 bytes per Sector) -
Cylinder A Cylinder's size, in sectors, is an exact
multiple of 16,065 (i.e. 255 x 63 = 16,065)
Primary partition The Primary Partition must start and end on
a cylinder boundary; so its size, in sectors,
will be an exact multiple of 16,065 (because
it must comprise a whole number of Cylinders)
Extended partition The Extended Partition must start and end on
a cylinder boundary; so its size, in sectors,
will be an exact multiple of 16,065 (because
it must comprise a whole number of Cylinders)
Logical partition A Logical partition's size, in sectors, must
be an exact multiple of 63 (because it must
comprise a whole number of Heads)
First Logical The 1st Logical partition's size, in sectors,
partition must be an exact multiple of 16,065 if it is
the ONLY Logical partition and it fills the
ENTIRE Extended partition
Note - Hidden Sectors:
A partition begins with 1 Head (63 sectors) preceeding its Boot
Sector, known as the 'Hidden sectors' (as they are, technically,
not part of the partition), from CHS xxxx-0-1 to CHS xxxx-1-1
You MUST include these 63 hidden sectors in the total size of the
partition, when calculating whether its size is an exact multiple
of 16,065 or of 63; the Partition Table for this partition is in
the 1st hidden sector, which is also the 1st sector of a Cylinder
(in the case of a Logical partition, the 1st sector of a Head).
CALCULATE GEOMETRY OF FAT32 HDD
===============================
The script "Calculate Geometry of FAT32 IDE" (below) will calculate
the LBA sector numbers of all the partition's FAT32 data structures
from a very basic set of information about the disk.
The script requires minimal information from the user: it's designed
to calculate most of the addresses for you.
By doing a separate calculation for each partition, using that script,
a picture of the entire disk is created.
This information can then be used as a guide in repairing the disk's
data structures (e.g. repairing the MBR's partition table).
NON-FAT PARTITIONS
==================
Although this file is only intended as a guide to repairing a FAT32
disk, it is possible that even such a disk may contain a non-FAT32
partition (e.g. a hidden setup or rescue partition); or other disks
on the system might not be FAT32.
If the LAST partition in the Extended partition is not a FAT partition,
the Extended partition on ALL disks attached to the computer must be
the same type: i.e. if one disk has an Extended partition of type 0F,
then the Extended partition on ALL disks in the system must be type 0F.
Data damage will occur if this rule is not followed.
^ Top of Page
PARTITION TABLE ERRORS
======================
FDISK.EXE
=========
*** View the Partition information for ALL the Disks ***
FDISK /status
WARNING -
Do NOT enter the FDISK "create partition" screen. Just entering
that screen will write sectors containing ASCII character 246
(hex F6) to large areas at the beginning of the partition space
(overwriting the Boot Sector, FSInfo sector, FAT and backup FAT,
and Root Directory Table).
FDISK writes that information to the partition in the process of
checking the disk, BEFORE it prompts you for any input! This
writes over (i.e. replaces) whatever was there before.
WARNING -
Do NOT attempt to recover a partition by creating a new one using
standard partitioning tools, such as FDISK. To do so will cause
additional damage: new FAT and other data structures will be created
along with the partition table entries, deleting the previous data.
POSSIBLE ERRORS
===============
The following are possible errors which could occur in a corrupted
Partition Table or E-MBR (Extended Master Boot Record) chain:
- Partition overlaps end of disk (see below)
- Partition does not begin on a Cylinder boundary [Note 1]
- Partition does not end on a Cylinder boundary [Note 1]
- Partition has inconsistent length [Note 2]
- Partition has inconsistent start sector [Note 2]
- Partitions overlap [Note 3]
- Partition has zero length [Note 3]
- E-MBR points to sector with no partition table [Note 4]
- E-MBR points backward [Note 4]
- Circular E-MBR chain [Note 4]
- E-MBR overlaps [Note 4]
- Extended partition table entries in wrong order [Note 4]
Notes -
1. Only the Primary DOS and Extended partitions must begin and end
on a cylinder boundary (i.e. must comprise an exact multiple of
16,065 sectors), beginning with CHS 0-0-1 (see below).
2. A partition is inconsistent if its LBA values do not match its
CHS values (where both LBA and CHS values are used).
3. If a partition is the wrong size, partitions might overlap,
or one might be of zero length.
4. E-MBR (Extended Master Boot Record) chain might be corrupt.
Partition Overlaps End of Disk
Sometimes termed "Partition ends after end of disk", which means
the same thing.
Note: As in Partition Magic (error 109 on its list of possible
partition errors).
In other words, the physical geometry of the hard disk differs from
the logical geometry assigned to it by the Operating System.
This error means that the ending cylinder value is greater than
the total number of cylinders on the disk (so that the partition
extends beyond the physical end of the hard disk). In some cases,
the end cylinder value is too large by just one or two cylinders.
This can happen if: the disk has been used on a different computer;
or with a different disk controller (e.g. if a new motherboard
has been installed); or if the BIOS settings have been changed.
You can check the ending cylinder value using BEEBLEBROX.EXE
For hard disks larger than 8GB the Partition Table stores a maximum
ending cylinder value of 1024, but the disk has more than 1024 cyls.
Use a CHS/LBA Calculator to convert the LBA values ("Start Sector"
and "Number of Sectors") to the true CHS value: if it is greater
than the Geometry value reported by Beeblebrox, that is the problem.
It may be possible to "truncate" the partition to solve the problem.
To do this, you have to modify the length of the partition.
NB: Using Partition Magic, start the program with the /IPE option,
then resize the partition. That option causes Partition Magic
to ignore partition table errors. This might cause data loss;
it isn't likely, but back-up all important data first.
To truncate a partition using Beeblebrox:-
Firstly, make a backup copy of the Partition Table.
Secondly, if the new ending cylinder of the partition is greater than
1024, you only have to change the "NumSectors" value. Use a CHS to LBA
Calculator (below) to find the correct NumSector value (the Number of
Sectors in the partition). Type this number in the NumSectors field for
the partition, then save the changes. Verify that the fix was successful.
If not, restore the partition table from the backup file and try to see
what went wrong.
If the new cylinder value is less than 1024, see whether changing
the translation mode to LBA (in the BIOS) fixes the problem. If the
partition definitely needs to be truncated, the process is the same
as for partitions that cross cylinder 1024 except that you must
also change the ending cylinder, head and sector values (to those
desired), as well as figuring out the correct NumSectors value
using a CHS to LBA calculator.
Partition does not Begin / End on a Cylinder Boundary
Sometimes termed "Partition does not end at end of cylinder",
which means the same thing.
Note: As in Partition Magic (error 108 on its list of possible
partition errors).
The partition table contains values which violate the requirement
that a partition must both BEGIN and END on a Cylinder boundary.
Note: This is only a requirement of the Primary partition and
of the Extended partition (not of the Logical partitions
within the Extended partition).
Normally, it must begin at CHS xxx-0-1 and end at CHS xxx-254-63
(if the hard disk has standard geometry: 255 heads per cylinder,
63 sectors per head). [See the notes on disk geometry, above]
Note: CHS xxx-0-1 is the CHS address of the 1st sector of the
partition, i.e. the 1st HIDDEN sector. The Boot Record
will be 1 Head (63 sectors) later at CHS xxx-1-1.
UNDOCUMENTED FDISK COMMANDS
===========================
Undocumented switches that work with FDISK.EXE at the command line:
FDISK 1/PRI:9000 Creates 9,000 MB Primary partition on hard disk 1
FDISK 1/EXT:5000 Creates 5,000 MB Extended partition on hard disk 1
FDISK 1/LOG:2500 Creates 2,500 MB Logical Partition on hard disk 1
FDISK /STATUS Shows partition status of all hard disks
FDISK /FPRMT No prompt for FAT32 support (Enables creation
of FAT32 partition on disk smaller than 540MB)
FDISK /MBR Repairs the Master Boot Record (MBR sector)
FDISK /X Ignores extended disk-access support (Use if you
receive a disk access or stack overflow message)
FDISK /Q Prevents FDISK rebooting the system automatically
when FDISK exits
Example -
Partition a disk from the command line, e.g. 80 GB disk:
FDISK 1 /PRI:60000 /Q
FDISK 1 /EXT:20000 /Q
FDISK 1 /LOG:10000 /Q
FDISK 1 /LOG:10000 /Q
NB: Hard Disks number from 1
Delete Extended Partition
Error: "Can't delete extended partition with logical drives existing",
although the command FDISK /STATUS shows no logical drives on the disk.
Solution -
• Step 1: Create a Logical partition from the command line, as above.
• Step 2: From the command line, first delete the Logical partition,
then the Extended partition, then the Primary partition.
Help for FDISK
FDISK /? Shows FDISK help screen
Further information: http://www.fdisk.com/fdisk/
^ Top of Page
DISK SECTOR EDITORS
===================
A Disk Sector Editor allows the user to manually edit the disk,
to correct errors in the data that define the disk structure.
It can be used to manually repair a Partition which has been
corrupted by any cause other than physical damage.
NB: The notes on Disk Structures (above) can assist with this.
NB: The utilities in UTILS TO REPAIR DISK STRUCTURES
automate some parts of the repair process.
INTEL BYTE ORDER
================
When editing disk sectors, there is one important convention to
be aware of: Intel Byte order (a.k.a. "little endian").
When a value exceeds 255 (decimal), more than one byte is needed
to store that value. And those bytes are stored in reverse order!
To store a decimal number greater than 255: first convert it to hex,
then write the bytes to disk in reverse order (i.e. from right to left).
NB: 1-byte Hex values 00 to FF are used in computers to represent
the decimal values 0 to 255. The largest Hex value which can
be stored in a single byte is FF, equivalent to 255 in decimal.
NB: Windows 98/98SE/ME comes with a Calculator program which can
convert numbers from decimal to hex (and vice versa). Go to
START > RUN and type CALC in the box, then click on "OK".
Then on the Calculator's VIEW menu, select "Scientific".
Example: The decimal value 41393, which is A1B1 in hex, is written
to disk as B1A1 (so B1A1 is what you'd actually see in a disk editor).
NORTON DISK EDITOR
==================
Edit the damaged HDD manually with Norton's DiskEdit
(e.g. to correct a damaged MBR, Partition Table, etc).
The only version of Norton's DiskEdit which will ALWAYS run in
DOS is version 7.0 (1993). Later versions are too large to run
in Conventional memory ("low DOS" memory) if ANY devices other
than the Mouse are loaded (such as CD-ROM or USB drivers).
NB: Not even the DOS internal command LOADHIGH can load
later versions of the program under such conditions!
[PTS Disk Editor can run: see "PTS DISK EDITOR" below]
NB: Being a FAT16 program, none of v7.0's Tools functions are
useable with a FAT32 disk, but the editing function works
(though not for sector addresses beyond the 8GB boundary;
but the MBR, Boot Sector, FAT etc are accessible with it)
There is notionally 640K of Conventional memory; but it is
partly in use by DOS, and by any device drivers loaded.
Therefore to run later versions of DiskEdit in DOS, boot
using a bootable floppy disk that loads NO other devices!
NB: The program MI.COM (below) displays a map of Conventional
memory, showing the amount of free memory and the drivers
loaded at bootup (together with how much memory each uses).
To increase the amount of free memory, edit AUTOEXEC.BAT
and CONFIG.SYS (on the floppy boot disk) to stop all other
drivers from loading!
*** Load a Mouse driver before running Norton's DiskEdit ***
SET PATH=%path%;F:\RECOVERY
MOUSE
*** Run Norton DiskEdit v7.0 (1993): FAT16 only, 8GB limit ***
** This runs under almost ANY conditions (essential tool) **
SET PATH=%path%;F:\NORTON\1993
DISKEDIT
*** Run Norton DiskEdit 2001: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2001) **
SET PATH=%path%;F:\NORTON\2001
DISKEDIT
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Note -
Alternatively, to run DiskEdit 2001 or 2002, boot to Windows
(using an undamaged bootable HDD as the IDE Primary Master).
Solutions if DiskEdit Crashes -
Norton's DiskEdit 2001 and 2002 scans the target Partition's
directory structure while loading.
If that Partition contains a large number of directories
(e.g. if the Partition is larger than about 60GB), DiskEdit
will run out of memory and crash while loading.
There are two solutions for this fault:
1. Abort the directory scan, by clicking the mouse, before
DiskEdit has scanned all of the Partition in question.
NB: The problem with this is that the unscanned part of
the partition will then be *invisible* to DiskEdit.
2. Use an alternative Disk Sector Editor. For instance, use
the PTS Disk Editor (DE.EXE) [see below], as that program
does NOT scan the partition when loading).
Identifying Disk Errors -
When Norton DiskEdit 2002 first opens a disk in "Logical Disks"
view, it spends 5 minutes scanning that disk. When the scanning
completes, if any disk errors were found it displays the details.
NB: The errors found can thereafter be viewed at any time. Go to:
INFO > ERROR INFO
NB: Its use can be confusing, in that if NO errors are found it
does NOT say so, nor does it make any entry under ERROR INFO
that the disk was found to have no errors.
Repairing LFN errors -
Norton's DiskEdit 2002 can fix the fault, if a Long File Name (LFN)
becomes dis-associated from a file's 11 character short name:
1. Go to: INFO > ERROR INFO then click on one of the errors found
(which will jump to the disk Cluster containing that error).
2. Select Directory view (press F4 or go to: VIEW > AS DIRECTORY).
3. With the cursor, select the first line of the Long File Name
(LFN); then go to: TOOLS > ATTACH LFN and click "OK".
4. Repeat step 3 for every line of the LFN.
This procedure will re-attach the Long File Name to the file's
short name, thus repairing the error.
NB: The HDD must not be 'Read Only'. Go to: TOOLS > CONFIGURATION
and uncheck "Read Only". (If the disk is "Read Only" the option
ATTACH LFN will be unavailable, i.e. greyed-out).
NB: This repair is only possible if the Short name and LFN entries
are in the same directory, not if the LFN became disassociated
as a result of SCANDISK moving the file (e.g. because of its
DOS path exceeding the maximum valid length).
Copying Sectors -
Norton's DiskEdit 2002 can copy up to 8 sectors at a time.
Firstly, mark the section to be copied:
1. Move the cursor to the start of the first sector to copy,
then in the menu go to: EDIT > MARK
2. Move the cursor to the end of the final sector to copy,
then in the menu go to: EDIT > MARK
NB: The marked section should appear highlighted!
Secondly, press Ctrl & C to copy the marked section into memory.
The program only allocates 4K of RAM; enough to store 8 sectors.
NB: An instruction like this means press both the indicated keys
simultaneously. "Ctrl" indicates the Control key (typically
abbreviated to Ctrl on the keyboard).
Thirdly, move the cursor to the 1st byte of the first sector to be
over-written, then press Ctrl & V to paste the information in memory
to the disk.
File Attributes -
Norton's DiskEdit 2002 can display the Attributes of a file,
in Directory view (go to VIEW > AS DIRECTORY):
A (Archive), R (Read Only), S (System), H (Hidden), D (Directory),
and V (Volume Label).
NB: An LFN entry = RSHV (i.e. a unique combination of attributes)
PTS DISK EDITOR
===============
An excellent alternative is PTS Disk Editor, version 1.04
The program recognises a FAT32 hard disk larger than 32GB,
and is small enough to load into conventional DOS memory
even if devices other than the Mouse are loaded.
NB: No version of Norton's DiskEdit can match this!
If all that's needed is the ability to edit disk sectors,
the PTS Disk Editor (DE.EXE) will be the best option. The
drawback is that it doesn't have any of the sophisticated
additional functions of Norton's DiskEdit.
** Load a Mouse driver before running PTS Disk Editor **
SET PATH=%path%;F:\RECOVERY
MOUSE
*** Run the PTS Disk Editor ***
SET PATH=%path%;F:\PTS
DE
^ Top of Page
UTILS TO REPAIR DISK STRUCTURES
===============================
These utilities can repair a Partition if it has been corrupted
(by any cause other than physical disk damage)
These are alternatives to repairing the damage manually
with a Disk Sector Editor (above), as the utilities
below automate parts of the repair process
TESTDISK.EXE
============
TestDisk v6.11.3
The program can recover the Partition, Boot Sector, & FAT
On a FAT32 hard disk: TestDisk can run under DOS, after booting
from a Win9x boot disk and loading the DPMI program CWSDPMI.EXE
NB: To run the program in DOS, CWSDPMI.EXE must be run first
(but to run it in Windows, CWSDPMI.EXE must not be run)
*** Run TestDisk in DOS ***
CWSDPMI
TESTDISK
*** Test Partition Structure of all disks in DOS ***
CWSDPMI
TESTDISK /LIST
TESTDISK /LIST > PRT_LIST.TXT
Example of TestDisk Scan Results -
Disk 80 : 80 GB / 74 GiB : CHS 9729 255 63, sector size=512
Disk 81 : 80 GB / 74 GiB : CHS 9729 255 63, sector size=512
NB: Disk 80 = IDE 0 : Drive C (10GB) and Drive E (66GB)
Disk 81 = IDE 1 : Drive D (76GB)
Disk 80 - 80 GB / 74 GiB - CHS 9729 255 63
Partition Start End Size in sectors
1 * FAT32 LBA 0 1 1 1274 254 63 20482812 [DRIVE C]
2 E extended LBA 1275 0 1 9728 254 63 135813510
5 L FAT32 1275 1 1 9728 254 63 135813447 [DRIVE E]
Disk 81 - 80 GB / 74 GiB - CHS 9729 255 63
Partition Start End Size in sectors
1 P FAT32 LBA 0 1 1 9728 254 63 156296322 [DRIVE D]
No partition is bootable
NB: * = Asterix indicates the active (bootable) partition
P = Primary DOS partition
E = Extended partition
L = Logical partition
Notes -
If one of the disk's Partitions is accidentally deleted, e.g. by
faulty software (or any cause other than physical disk damage),
you can get it back using TESTDISK.
TestDisk can also COPY any file (or entire subdirectories) from a
lost partition WITHOUT having to first restore the partition or
reboot. Ideal if you can't access the partition any other way!
Runs under DOS 6.x or higher, or Win9x. 32-bit DJGPP build; requires
a PC-AT 386+ and a DOS Protected Mode Interface (provided by CWSDPMI
[included] or the O/S). Download package and some files have Win32
Long File Names.
Tutorial: TestDisk Step By Step
Syntax -
TestDisk [/log] [/debug] [/dump] [file or device]
TestDisk /list [/log] [file or device]
/log : create a testdisk.log file
/debug : add debug information
/dump : dump raw sectors
/list : display current partition
Display the Geometry (Cylinders, Heads, Sectors) -
Under DOS (or Windows 9x), TestDisk queries the BIOS to find the
hard disks and their LBA size and CHS geometry.
Under DOS, TestDisk gets the disk size using an extended BIOS
function (ah=0x48, int 0x13), and the geometry (number of heads
and sectors) using a standard BIOS function (ah=0x08, int 0x13).
TestDisk uses the default sector size of 512 bytes.
NB: Partitioning programs (such as FDISK.EXE) make the Primary
DOS Partition and the Extended Partition end on a cylinder
boundary. This is a MANDATORY requirement!
Recover the Boot Sector -
TestDisk can fix a corrupted FAT32 Boot Sector, using the backup
Boot Sector. The Boot Sector is the first sector of the Partition,
and a backup copy of the Boot Sector is located at the 6th sector
of the Partition.
TestDisk checks the Boot Sector and the backup Boot Sector:
if the Boot Sector and backup Boot Sector mismatch, you can
overwrite the Boot Sector (Org BS) [Original BootSector] with
the backup Boot Sector (Backup BS), or vice versa.
The option "Dump" can used to display the sector content in both
hexadecimal (hex) and ascii (plain text).
Rebuild a valid Boot Sector:
If a FAT32 boot sector is corrupted, TestDisk can rebuild that
boot sector: choose the option "RebuildBS" in the menu.
To rebuild a FAT boot sector, TestDisk requires that:
(1) filesystem size is equal to partition size, and
(2) fragmentation is low.
[NB: The second condition is highly unlikely in reality!]
Sanity Check: Partitions -
TestDisk's analysis includes a "sanity" check of the partition
structures (in the partition tables: the MBR and Extended MBR):-
The MBR partition table is limited to 4 entries (one of which can
be an Extended partition containing several logical partitions).
Every partition table (in the MBR and in each Logical partition)
must end with the two bytes 55 AA (hex).
A partition entry must contain the following fields:
- beginning of partition (C-H-S)
- end of partition (C-H-S)
- partition type
- beginning of partition (LBA)
- size in sectors
- boot flag
Only the Primary partition can have the bootable flag set.
NB: This might not be so if the Primary partition is a
hidden partition (i.e. if the partition type is 1C).
CHS data storeage is limited to a maximum of 1,024 cylinders:
0 to 1023 (the 8GB limit, 1024 x 255 x 63 = 16,450,560 sectors).
A modern BIOS uses LBA mode to address disk data, not CHS; but
FAT32 boot sectors still include the CHS geometry.
Each CHS value must be within the valid range, so Testdisk checks
that CHS sector 0 is not used (the first valid CHS sector is 1),
and checks the CHS sector number is less than the number of sectors
per head. It also checks: whether the LBA address values match the
CHS address values; whether the partition ends after the end of the
disk; and whether any partitions are overlapping each other.
*** Test the Partition Structure in DOS ***
** Display the result on screen **
CWSDPMI
TESTDISK /list
** Alternatively, save result to a file ***
CWSDPMI
TESTDISK /list > testdisk.txt
** Alternatively, save result to a file ***
CWSDPMI
TESTDISK /list /log
Recover Partition -
TestDisk compares the disk's structure with the Partition Table,
to check for Partition Table errors.
It can find lost FAT32 partitions and restore them. It finds
deleted partitions, then allows you to write the necessary data
into the Partition Table.
Where there are missing partitions, or an empty Partition Table,
it can search for partitions and create a new Partition Table,
or even a new MBR.
Undelete PARTITION -
Step 1: Disk selection
Run TestDisk. All hard drives should automatically be detected,
and listed with the correct size.
1. Use the up/down arrow keys to select the hard drive with the lost
partition(s).
2. Press "Enter" to proceed.
Step 2: Partition table selection
TestDisk displays the partition types.
1. Select the partition type. Usually the default value will be the
correct one, because TestDisk auto-detects the partition type.
2. Press "Enter" to proceed.
Step 3: Current partition table status
1. Select "Analyse" to check the current partition structure
(i.e. a sanity check: see below) & search for lost partitions.
2. Press "Enter" to proceed.
The current partition structure is displayed. Examine it for missing
partitions and errors:
- e.g. The first partition is listed twice: this indicates a
corrupted partition or an invalid partition table entry.
- e.g. "Invalid boot": this indicates a faulty boot sector.
- e.g. Only one logical partition (labelled "Partition 2") is shown
in the Extended partition, so one logical partition is missing.
Step 4: Quick Search for partitions
1. If there are missing partitions or errors, select the O/S
(Operating System) and partitions to proceed.
e.g. TestDisk finds two partitions, including a missing
logical partition labelled "Partition 3".
2. Highlight the partition found, then press "P" to list its files.
3. If all directories and data are correctly shown, press "Enter"
to proceed. To go back to the previous display, press "Q" to Quit.
Step 5: Save the partition table, or search for more partitions
1. If all partitions are shown and all files correctly listed:
Select "Write" to save the partition structure.
NB: The option "Extd Part" gives you the choice whether the
Extended partition will use ALL the available disk space
or only the MINIMUM required space.
2. If a partition is still missing, go to Step 6:
Select "Deeper Search", then press "Enter" to proceed.
Step 6: If a partition is still missing, do a Deeper Search
A Deeper Search will search for FAT32 backup boot sectors; and to detect
more partitions it will scan each cylinder (click on the thumbnail).
The results are displayed as follows -
If a partition is found by its backup boot sector, on the last line
of the display you'll see the message "found using backup sector!"
and the size of the partition.
NB: You might get a false result, if there were backup copies stored
on the damaged disk of the Boot Sector for this or any other disk
(i.e. backups made by a data backup or data rescue program).
If a partition is displayed twice, with different sizes, both will be
listed with status D (i.e. deleted) because they overlap each other:
1. Highlight the first, then press "P" to list its files. If the
file system of this partition is damaged (click on thumbnail
to check), press "Q" for Quit to go back to the previous display.
2. Highlight the second, then press "P" to list its files. If it works,
you've found the correct partition! Use the left/right arrows to
navigate into the directories: examine the files in them for more
verification. Press "Q" (Quit) to go back to the previous display.
NB: The FAT directory listing is limited to 10 clusters, so some
files may not appear; but this doesn't affect recovery.
3. The status options are: Primary, *bootable, Logical, and Deleted.
Using the left/right arrow keys, change the status of the selected
partition to L (Logical).
NB: The primary partition starts at cylinder 0, head 1, sector 1;
additional partitions usually start at head 0 sector 1,
(e.g. C-H-S 2231-0-1).
NB: If a partition is listed as * (bootable), but you don't
boot from that partition, you can change it to Primary.
4. Press "Enter" to proceed.
Step 7: Partition table recovery
Write the new partition structure to disk.
1. At "Write" select 'Enter', 'y' or 'Ok', to save all partitions
to the partition table.
2. TestDisk displays the message "You have to restart your Computer
to access your data"; so press 'Enter', then reboot the computer.
Undelete FILES -
TestDisk can COPY any file (or recurse through whole subdirectories)
from within a lost partition without having to first restore that
partition.
1. Select "Advanced".
2. Select the partition containing the lost files and choose "Undelete".
3. To undelete a file, select the file to recover and press "c" to copy
the file to another disk. To recover a deleted directory, select the
directory and press "c" to undelete the directory and its contents.
4. Select the destination disk.
5. When you have recovered all the lost files, press "Q" to Quit.
Repair the FAT -
File Allocation Tables are maps of the data region, indicating
which clusters are used by files and directories. To repair FAT,
(menu: "Repair FAT") TestDisk compares the two FAT copies. If FAT
mismatches (sector by sector check) or contains errors, TestDisk
uses the FAT copy with less errors and removes the obvious errors.
This function must ONLY be used on a filesystem with correct
values in the boot sector! It has been used with success when
SCANDISK or CHKDSK refused to repair the filesystem or crashed.
Make Backups of Essential Sectors -
The "Dump" option can be used to dump a backup copy of essential
sectors to disk (i.e. save them to another disk).
Further Information -
See also: http://en.wikipedia.org/wiki/TestDisk
SCANDISK.EXE
============
It's safe to run Microsoft SCANDISK to check a hard disk for errors,
but do NOT allow it to make any changes to the disk!
It gives priority to file system integrity, discarding user data
to do so, thus it CANNOT be trusted in a data recovery situation.
UNFORMAT.EXE
============
Norton's UNFORMAT for DOS -
Recovers files and directories after an accidental format,
and can rebuild disks corrupted by a virus or power failure.
The program can recover all the files on a partition which has
been accidentally formatted by the DOS program FORMAT.COM (if
no new files have been written to the disk afterward).
NB: Where files have been written to the disk after it was
formatted, the program might still recover some files; but
this will depend on how much data has been over-written.
Norton's UNFORMAT for DOS (UNFORMAT.EXE) is one of the rescue
tools included in -
(a) Norton Utilities 2001
(b) Norton Utilities 2002
(c) Disk 1 of the Norton Emergency Disks (a set of 4 floppy disks)
Syntax:
UNFORMAT [drive:] [/IMAGE|/MIRROR] [/G0] [/BW|/LCD]
drive Drive letter of disk to unformat.
/IMAGE Uses Image recovery info (excludes Mirror info).
/MIRROR Uses Mirror recovery info (excludes Image info).
/G0 Disable graphical mouse and all graphical characters.
/BW, /LCD Improve display on monochrome or LCD monitors.
PARTITION LOGIC
===============
Partition Logic is a hard disk partitioning tool.
It can create, delete, format, defragment, resize and move partitions
and modify their attributes. It can copy entire hard disks.
Partition Logic is based on the Visopsys operating system. It boots
from a CD or floppy disk, and runs as a standalone system independent
of your regular operating system. It is a free alternative to such
commercial programs as Partition Magic, Drive Image, and Norton.
The bootable floppy disk IMG file includes a minimal distribution. It
must be written to a 1.44MB floppy disk. Windows users will need a
program such as RawWrite (RAWWRITEWIN.EXE) to create the disk.
Under Windows 95, 98 and ME the file DISKIO.DLL (included with RawWrite)
must be present in the same directory as RAWWRITEWIN.EXE.
Installation note:
Partition Logic is a self-contained disk image with its own operating
system (Visopsys) included on the disc. It is not installed as a Windows
program as such. Instead it is written to a blank floppy disk from which
the computer can be booted to perform the desired partitioning, resizing,
etc.
Help Commands:
HELP Show summary of help entries
NB: Type 'help COMMAND' for specific help
Data Recovery commands:
BOOTMENU Edit the boot loader menu
CHKDISK Check a filesystem for errors
DISKS Show the disk volumes in the system
FDISK Manage (i.e. partition) hard disks
FORMAT Create a new (empty) filesystem
LSDEV Display devices
MEM Show system memory usage
MOUNT Mount a filesystem
SYNC Synchronize all filesystems on disk
UMOUNT Unmount a filesystem
UNAME Print system information
File Commands:
CAT (or TYPE) Print a file's contents on the screen
CP (or COPY) Copy a file
FILE Show the type of a file
MORE Display file's contents, one screenful at a time
MV (or MOVE) Move a file (ren or rename have the same effect)
RM (or DEL) Delete a file
TOUCH Update a file or create a new (empty) file
Directory Commands:
CD Change the current directory
FIND Traverse directory hierarchies
LS (or DIR) Show the files in a directory
MKDIR Create one or more new directories
PWD Show the current directory
RMDIR Remove a directory
Manage Processes:
KILL Kill a running process
PS Show list of current processes
NM Show symbol information for a dynamic program or library
RENICE Change the priority of a running process
Miscellaneous Commands:
DEFRAG Defragment a filesystem
IMGBOOT The program launched at first system boot
KEYMAP View or change the current keyboard mapping
LOGOUT (or EXIT) End the current session
REBOOT Exit to real mode and reboot the computer
SHUTDOWN Turn off the computer
VSH Start a new command shell
Commands for Graphic Mode only:
COMPUTER Navigate the resources of the computer
CONFEDIT Edit Visopsys configuration files
CONSOLE Show the console window
DISPROPS View or change the display settings
FILEBROWSE Navigate the file system
PROGMAN View and manage programs and processes
SCREENSHOT Take a screenshot
VIEW Display a file in a new window
WINDOW Open a new command window
^ Top of Page
NOTES ON PARTITION RECOVERY
===========================
SIZE OF FILE ALLOCATION TABLE
=============================
The size of the File Allocation Table (FAT) can be calculated from
a single value, the Total Number of Allocation Units.
NB: Microsoft disk utilities commonly report the number of Clusters
in the partition as the "Total Number of Allocation Units".
FAT32 uses 32 bits (of disk space) to store the disk address of
each Allocation Unit (i.e. 4 Bytes, as there are 8 bits in a Byte).
Therefore:
Size of FAT (in Bytes) = Total Number of Allocation Units x 4
Size of FAT (in Sectors) = Size of FAT (in Bytes) / 512
Size of FAT region = Size of FAT (in Sectors) x 2
NB: In calculating Size of FAT region, the value calculated
in step 2, for Size of FAT (in Sectors), must first be
rounded-up to the next whole number.
SIZE OF PARTITION
=================
If the value for Sectors per Cluster is also known, the size of the
Partition can be calculated:
(a) Size of Data region (in Sectors) =
Sectors per Cluster x Total Number of Allocation Units
Sectors per Cluster -
The default values for Sectors per Cluster on a FAT32 partition:
Partition Sectors per
size in GB Cluster
------------ -----------
0 to 8 GB 8
8 to 16 GB 16
16 to 32 GB 32
32 to 126 GB 64
NB: These are the default values, but this value is selectable
by the user (within limits), so these values are not immutable.
But changing the default is beyond the ability of most users.
(b) Size of Partition (in Sectors) =
Size of Data region (in Sectors) + Size of FAT region (in Sectors) + 95
NB: 95 = 63 Hidden Sectors + 32 Reserved Sectors
USES OF DISK INVESTIGATOR
=========================
Here is an example of the output from Disk Investigator:-
Example Disk: SeaGate, 18 GB
Note - This hard disk has only a single partition.
Volume Label: M02GB2 Root DIR Sector: 18,560
Logical drive: D Root DIR Cluster: 2
Physical drive: 129 2nd Cluster Start Sector: 18,560
Total logical sectors: 37,961,532 Ending Cluster: 1,185,718
Cylinders: 2363 Media Descriptor: 248
Sectors per cylinder: 63 Root Entries: 0
Heads: 255 Heads: 255
Bytes per sector: 512 Hidden sectors: 63
File system: FAT32 Backup boot sector: 6
Sectors per Cluster: 32 Reserved sectors: 32
Number of copies of FAT: 2 FS Info sector: 1
Sectors per FAT: 9,264 Sectors per track: 63
Start sector for FAT1: 32 File system version: 0
Start sector for FAT2: 9,296 SerialVolumeID: 183F11F0
NB: I have highlighted the most useful values in colour
The following is an example of how to interpret the results produced by
the Disk Investigator program, and demonstrates some calculations that
can be carried out using those results:
Partition size
(a) Partition size in sectors:
Total logical sectors + Hidden sectors
= 37,961,532 + 63 = 37,961,595
(b) Partition size in Bytes:
Partition size in sectors x Bytes per sector
= 37,961,595 x 512 = 19,436,336,640
19,436,336,640 � 1,024 = 18,980,797.5 KB
19,436,336,640 � 1,024² = 18,535.93 MB
19,436,336,640 � 1,024³ = 18.10 GB
Data region (sectors)
Partition size in sectors:
Total logical sectors 37,961,532
Hidden sectors + 63
----------
Sectors in Partition = 37,961,595 37,961,595
==========
Less: Hidden sectors 63
Reserved region 32
FAT region : Sectors per FAT x
Number of copies of FAT
= 9,264 x 2 = 18,528 + 18,528
------
18,623 - 18,623
====== ----------
Data region (sectors) = 37,942,972
==========
Clusters
Number of Clusters:
Data region (sectors) � Sectors per Cluster
37,942,972 � 32 = 1,185,717.875 Clusters
NB: Rounded-up = 'Ending Cluster' = 1,185,718
File Allocation Table
FAT must be capable of addressing 1,185,718 clusters:
At 4 bytes per cluster = 1,185,718 x 4 = 4,742,872 bytes
� 512 = 9,263.421875 sectors
NB: Rounded-up = 'Sectors per FAT' = 9,264
Therefore FAT Region (FAT x 2) = 9,264 x 2 = 18,528 sectors
Note: FAT Region = FAT + Backup FAT
Calculation based on 'Ending Cluster'
Step 1: Divide 'Ending Cluster' by Sectors per Cluster
1,185,718 � 32 = 37,053.6875
NB: 'Ending Cluster' is the total number of clusters
NB: In this example, Sectors per Cluster = 32
Step 2: Round up to next whole number divisible by 4
37,053.6875 = 37,056
Step 3: Divide by 2, twice
37,056 � 2 = 18,528 sectors : Size of FAT Region (FAT + Backup FAT)
18,528 � 2 = 9,264 sectors : Size of FAT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Calculations based on Statistics (SeaGate, 18 GB, 1 Partition)
Based on a partition where 'Sectors per Cluster' = 32
FAT: 9,264 sectors
FAT Region: 18,528 sectors
Data Region: 37,942,972 sectors
1,185,718 clusters
Size of FAT
===========
Total sectors in partition 37,961,595
[Exact multiple of 16,065]
Less: Hidden sectors 63
Reserved sectors + 32 - 95
----------
=> Data region + FAT region = 37,961,500
Multiplied by Magic Number* x 0.0002440214921696982 * See below
----------
=> FAT (sectors) = 9,263.421875
==========
Size of FAT Region
==================
FAT (sectors), rounded-up = 9,264
Multiplied by 2 x 2
----------
=> FAT Region (sectors) = 18,528
==========
Size of Data Region
===================
Data region + FAT region = 37,961,500
Less: FAT region - 18,528
----------
=> Data region (sectors) = 37,942,972
==========
Number of Clusters
==================
Data region (sectors) 37,942,972
Divided by Sectors per Cluster � 32
----------
=> Number of Clusters = 1,185,717.875 (Rounded-up = 1,185,718)
==========
Magic Number Based on: FAT / DATA Region + FAT Region
============
If 'Sectors per Cluster' = 32 :
Size of FAT / ( Data Region + FAT Region ) = MAGIC NUMBER
9,263.421875 / 37,961,500 = 0.0002440214921696982
Partition size [excluding Hidden and Reserved] x MAGIC NUMBER = FAT size (Sectors)
37,961,500 x 0.0002440214921696982 = 9,263.421875
NB: Data Region + FAT Region = Total logical sectors - Reserved Sectors
= Partition size (excluding Hidden and Reserved)
Magic Number #2 Based on: FAT / Clusters
===============
If 'Sectors per Cluster' = 32 :
Size of FAT / Number of Clusters = Magic Number
9,263.421875 / 1,185,717.875 = 0.0078125008236044
Size of FAT (sectors) = Number of Clusters x Magic Number
9,263.421875 = 1,185,717.875 x 0.0078125008236044
Number of Clusters = Size of FAT (sectors) / Magic Number
1,185,717.875 = 9,263.421875 / 0.0078125008236044
Magic Number #3 Based on: Data Region / FAT Region
===============
If 'Sectors per Cluster' = 32 :
Magic Number = Data Region (Sectors) / FAT Region (Sectors)
= 37,942,972 / 18,528
= 2047.871977547496
Data region (Sectors) = FAT Region (Sectors) x Magic Number
= 18,528 x 2047.871977547496
= 37,942,972 sectors
FAT Region (Sectors) = Data region (Sectors) / Magic Number
= 37,942,972 sectors / 2047.871977547496
= 18,528
Magic Number #4 Based on: Data Region / FAT
===============
If 'Sectors per Cluster' = 32 :
Data Region (Clusters)* / FAT (Sectors)* = Magic Number * Actual
1,185,717.875 / 9,263.421875 = 127.9999865060664
FAT (Sectors)* = Data Region (Clusters)* / Magic Number * Actual
= 1,185,717.875 / 127.9999865060664
= 9,263.421875 sectors
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Further Calculations based on Example (SeaGate, 18 GB, 1 Partition)
Based on a partition where 'Sectors per Cluster' = 32
Size of FAT
===========
FAT (Bytes) [Actual size]:
4 bytes in FAT = 1 Cluster in Data Region
= 4 x Number of Clusters** ** Rounded
= 4 x 1,185,718
= 4,742,872 bytes* * Actual
Bytes / Bytes per Sector = Number of Sectors
= 4,742,872 bytes / 512 = 9,263.421875 sectors* * Actual
FAT (Bytes) [Size on disk, i.e. Rounded]:
= FAT (Sectors)** x Bytes per sector ** Rounded
= 9,264 x 512
= 4,743,168 bytes** ** Rounded
Size of FAT Region as Percentage
================================
If 'Sectors per Cluster' = 32 :
Data Region (Bytes) = Data Region (Sectors) x Bytes per Sector
= 37,942,972 x 512
= 19,426,801,664 bytes
FAT Region (Bytes) = FAT Region (Sectors) x Bytes per Sector
= 18,528 x 512
= 9,486,336 bytes
Data Region (Bytes) 19,426,801,664
FAT Region (Bytes) + 9,486,336
--------------
Total (Bytes) = 19,436,288,000
==============
Percentage occupied by FAT Region:
( FAT Region (Bytes) / Total (Bytes) ) x 100
= ( 9,486,336 / 19,436,288,000 ) x 100
= 0.0004880734428302359 x 100
= 0.0488073442830236 %
Size of FAT (Sectors):
Data Region (Bytes) + FAT Region (Bytes) [(Total logical sectors - 32) x 512]
x ( Percentage occupied by FAT Region / 2 ) = FAT (Bytes)
Step 1. Multiply Total Bytes by Percentage -
(( Total logical sectors - Reserved Sectors ) x 512 ) x ( Percentage / 2 )
(( 37,961,532 - 32 ) x 512 ) x ( 0.0488073442830236 / 2 )
( 37,961,500 x 512 ) x 0.0244036721415118
19,436,288,000 x 0.0244036721415118
= 474,316,800
Step 2. Divide by 100 -
474,316,800 / 100 = 4,743,168 bytes
Step 3. Convert to Sectors (i.e. divide by 'Bytes per Sector') -
4,743,168 / 512 = 9,264 sectors per FAT
Size of Data Region
===================
If 'Sectors per Cluster' = 32 :
Data Region (Clusters) = DATA Region (Sectors) / 32
= 37,942,972* / 32 * See above
= 1,185,717.875* * Actual
=> Rounded-up = 1,185,718 clusters** ** Rounded
Data Region (Sectors) = Data Region (Clusters) x 32
= 1,185,717.875* x 32 * Actual
= 37,942,972 sectors
(a) Size derived from FAT -
Data Region (Clusters) = ( FAT (Bytes) - 0.5 ) / 4
= ( 4,742,872 - 0.5 ) / 4
= 4,742,871.5 / 4
= 1,185,717.875 clusters* * Actual
= 1,185,718 clusters** ** Rounded
Data Region (Sectors) = ( FAT (Bytes) - 0.5 ) x ( Sectors per Cluster / 4 )***
= ( 4,742,872 - 0.5 ) x ( 32 / 4 )
= 4,742,871.5 x ( 8 / 1 )
= 4,742,871.5 x 8
= 37,942,972 sectors
*** 4 Bytes in FAT = 1 Cluster in Data Region
(b) Size derived from 'Total Logical Sectors' -
'Total logical sectors' excludes hidden sectors
Partition size, in sectors, MUST be exactly divisible by 16,065
[if using standard geometry] (i.e. must be cylinder aligned):
Cylinder size = Heads per Cylinder x Sectors per Head
= 255 x 63 = 16,065
By adding the 63 'Hidden sectors' to 'Total logical sectors',
it becomes an exact multiple of 16,065:
'Total logical sectors' + 'Hidden sectors':
37,961,532 + 63 = 37,961,595
37,961,595 � 16,065 = 2,363 [no remainder]
C-H-S = 2362-254-63
'Total logical sectors' =
Reserved region + FAT region + Data region
Data region + FAT region =
'Total logical sectors' - 'Reserved sectors' =
37,961,532 - 32 = 37,961,500
Therefore Data region is:
37,961,500 - ('Sectors per FAT' x 'Number of FATs')
37,961,500 - (9,264 x 2) =
37,961,500 - 18,528 = 37,942,972 sectors
Summary:
Total logical sectors 37,961,532 [excludes 'Hidden sectors']
less: Reserved Sectors 32
----------
37,961,500
less: FAT Region sectors 18,528 [FAT x 2 = 9,264 x 2]
----------
Data region (sectors) = 37,942,972
----------
Notes
=====
FAT (Sectors) = 9,263.421875* * Actual
= 9,264** ** Rounded
FAT Region (Sectors)*** = 9,264 x 2 *** This value can only be based on a
= 18,528 whole number of sectors in the FAT
^ Top of Page
RECOVER INDIVIDUAL FILES
========================
This procedure is for situations where the disk cannot be repaired,
e.g. due to a hardware fault, and the best that can be achieved is
to copy the files to an undamaged disk.
This is for cases where cloning the disk will not solve the problem,
because the actual structure of the file system itself is damaged.
This class of utilities typically work by re-building a facsimilie,
in RAM memory, of the hard disk's file structures (e.g. its File
Allocation Table and Directory Tree), after scanning the disk. It
can be an effective solution; but a full scan is a long process.
NB: Some of the utilities included can recover files deleted from
an undamaged disk (e.g. deleted by a virus, by a software bug,
or by accident).
TIRAMISU EASY RECOVERY
======================
Easy Recovery v6.10 -
This program works with ANY size of FAT32 hard disk up to 137GB
(the largest hard disk possible with 28-bit BIOS).
NB: Easy Recovery was known as Tiramisu in versions 1 to 5.
NB: Tiramisu version 3 (a.k.a. "Tiramisu for 32-bit FAT v3")
does not work on a hard disk larger than 8GB.
NB: Tiramisu version 5 does not work on a hard disk larger than
32GB, because it can NOT recognise a cluster size of 32k
(i.e. the maximum cluster size it can recognise is 16k).
Easy Recovery uses information held in the BIOS to identify the
file system. If that information is faulty, or not available, it
reports the File System Type as "Unknown": in that case, before
the program can analyze the partition for recoverable data, the
user must manually select the correct file system (i.e. FAT32).
Once the file system has been correctly identified, the program
is ready to begin the scan (at the 'Recovery Scan' screen).
On a FAT32 disk, data is stored in clusters. The Operating System
creates a table (the File Allocation Table, or FAT) to keep track
of the cluster(s) in which each file is stored. It also makes a
backup copy of the FAT, in case the original is damaged.
By default, Easy Recovery compares the two copies of the FAT
and uses the best information from each. If that default action
fails to locate all the files, there is an option to select one
FAT only instead (either FAT1 or FAT2).
If BOTH copies of the FAT are damaged, the option "Ignore FAT"
forces the program to rely solely on information in the files,
without refering to either copy of the FAT.
If none of the above actions recovers all the files, the option
"RAW" causes all the sectors on the disk to be read sequentially,
i.e. sector by sector. This will ONLY recover files which are
stored contiguously on the disk, or which occupy only one sector.
NB: A better option in this last event might be to try restoring a
backup copy of FAT1 or FAT2 (ideally on a clone of the disk).
LOST AND FOUND
==============
Lost and Found, v1.31
Lost & Found lets you recover and restore data after accidental
data loss, or from corrupted media caused by a disk crash or a
logical system failure. It will even recover data if the partition
has been reformatted or if the FAT tables have been destroyed!
As long as the disk is still spinning, Lost & Found can locate and
recover almost any file, anywhere on the disk.
NB: Other users have reported exceptional results! The program
recovered data in situations where Norton Disk Doctor and
ScanDisk.exe refused even to run.
*** Run Lost and Found ***
SET PATH=%path%;F:\LOSTFND
LF
LOADER LF
ACTIVE PARTITION RECOVERY
=========================
Active Partition Recovery, v3.0
SYNTAX -
-lba : Force LBA mode for access to all detected HDDs
-lba=N : Force LBA mode for access to particular HDD,
where N=[80h,81h,82h,83h]
-restoreMBR=N : Restore MBR sector from a backup file,
where N=[80h,81h,82h,83h]
-ignoreMBR=N : Do not load MBR information for this drive,
where N=[80h,81h,82h,83h]
NB: Allows you to scan a damaged partition
-imageN=PATH : Create an image of the physical drive,
where N=[80h,81h,82h,83h]
and PATH={drive}:\\{PATH}\\ (i.e. destination)
The IDE cables will accept up to four hard disks, two on each
cable: named Primary Master, Primary Slave, Secondary Master
and Secondary Slave; numbered respectively 80, 81, 82 & 83.
The program cannot handle a damaged partition of type "Unknown".
In that situation, start the program with the parameter
"-ignoreMBR", to force program to ignore the default partitions.
*** Set the PATH ***
SET PATH=%path%;A:\;F:\ACTPARTR
*** Read the Help file ***
EDIT APR.TXT
*** Run the Program ***
APR
*** Run the Program: Force LBA mode ***
APR -lba=80
APR -lba=81
APR -lba=82
APR -lba=83
*** Scan Disk #1 (Drive C:) ignoring its MBR ***
APR.EXE -ignoreMBR=80
*** Scan Disk #2 (Drive D:) ignoring its MBR ***
APR.EXE -ignoreMBR=81
NB: Press [TAB] key to switch to Long File Name view
MEDIA TOOLS
===========
Media Tools Professional, v5.0
In access mode "IDE DRIVE" the program has direct access to any IDE
drive on the system, and does not rely on the system BIOS. This
means you can see the entire capacity of any IDE drive, regardless
of whether the system BIOS has the ability to see the entire drive.
File Recovery Tree - Rebuilds FAT32 file system automatically
for hard drives and removable media. Recovers from accidental
format or deletion, corrupt or missing file system, virus or worm,
or files located in slack space from previous formats. Allows you
to recover data to another drive.
Boot Partition Repair - Rebuilds FAT boot sector and partition table
automatically from an IDE or SCSI hard drive and removable media,
giving you access to all files and directories.
Media Editor - Mounts DOS and Windows file systems (easy step-by-step
screenshots and directions). Then, once the file system is mounted,
the file system can be rebuilt automatically. (Note: Use this option
if "File Recovery Tree" does not produce the results you expect).
NB: Media Editor also lets you view, search for, and edit anything
within the file system on any media or operating system, without
any knowledge of Hex, through custom designed editing templates.
*** Run Media Tools ***
SET PATH=%path%;F:\M_TOOLS
MTL
GET DATA BACK FOR FAT
=====================
The program GetDataBack for FAT ("GetDataBack" FAT version)
can succeed in recovering data where other programs may fail.
GetDataBack includes a drive-imaging tool, which makes a replica
of the drive on a second hard disk. The recovery portion of the
program scans the image far more quickly than it could possibly
work through damaged sectors on a disk, resulting in a solid
solution for getting back all the missing data.
This is one of the best file recovery programs. It can recover the
directory names (a.k.a. "folder" names), as well as the files.
It can recover data from a hard drive or from a USB flash drive.
NB: USB flash drives ordinarily come pre-formatted as FAT, even if
intended for use on a WinXP system.
GetDataBack will scan, and do an extensive analysis, of the drive
you specify. But it can NOT scan the disk it's loaded from. A scan
may take several hours, but can usually retrieve most of the files.
SVEND'S UTILITIES: FP.SYS
=========================
FP.SYS (Find Partition), v1.5
Copyright Svend Olaf Mikkelsen, 2001
A device driver for DOS or Windows (Win95/98/ME) that adds
read-only drive letters for lost partitions.
SYNTAX -
Put this line in config.sys:
device=fp.sys [disk number]
Disks are numbered from 1. Default is disk 1.
If FP.SYS is not in the root of the boot drive, you must
add the full path to FP.SYS.
To abort loading, press ESC.
If a FAT32 partition is lost, you MUST boot with a DOS version
that recognises FAT32 (e.g. MS-DOS v8.0 [the WinME version]).
Notes -
1. To speed up disk access in pure DOS, Smartdrive (SMARTDRV.exe)
can be used. However, Smartdrive does not like it if write
attempts are made to read-only partitions.
2. If you use FP.SYS with Windows 95/98/ME, add the following
entry in the C:\WINDOWS\IOS.ini file:
[SafeList]
fp.sys
NB: If this is not done, all partitions will be in MS-DOS
compatibility mode. In some cases where a disk is not
read correctly in DOS or Windows, Windows will see the
disk differently in compatibility mode.
RECOMMENDATIONS -
Backup important data that you currently can access, to an
external disk, before recovery attempts are made.
Use FP.SYS when booting from floppy disk.
WARNINGS -
1. If partitions are overlapping, file copying can damage data.
If you are in doubt, only copy to an undamaged disk.
2. The target partition must NOT contain old deleted copies of
the lost files.
3. If you do not know the nature of the problem, do not write
to the damaged disk at all; and do not use FDISK on it!
*** Run DIR command after loading fp.sys ***
** (FP.SYS must be loaded in CONFIG.SYS) **
C:
DIR /W
D:
DIR /W
SVEND'S UTILITIES: FINDDIR
==========================
FINDPART for DOS, v4.72 (FINDPART FINDDIR)
Searches for sub-directories; and calculates the estimated
location of cluster number two, and cluster size.
NB: In this version of Svend's Utilities the FINDDIR function is
a switch (i.e. an option) in FINDPART, not a separate program
SYNTAX -
Disks are numbered from 1.
The report can be written to a file. File extension must be .txt
Note -
This program is NOT the best means of recovering files. It
FAILS if the file to be copied is not contiguous on the disk!
There are much BETTER recovery tools available (see above).
** Display the Help screen **
FINDPART FINDDIR
** Save the Help screen to a file **
FINDPART FINDDIR > F:\FINDDIR.TXT
** Search Disk 1 for Subdirectories **
** Saves report to a file **
FINDPART FINDDIR 1 F:\FINDDIR1.txt
** Search Disk 2 for Subdirectories **
** Saves report to a file **
FINDPART FINDDIR 2 F:\FINDDIR2.txt
SVEND'S UTILITIES: CYLDIR
=========================
CYLDIR, v5.5 (CYLDIR.EXE)
Lists lost directories in a FAT32 partition, and displays the
file names.
The correct DOS codepage must be loaded, before searching for
or copying files. This depends on the version of Windows 9x
which was used to create the Partition (as recorded in the
partition's Boot Sector: MSWIN4.1 means Windows 98SE/ME).
*** Set Code Page for a partition created by Windows ME ***
SET CODEPAGE=850
Copying speed is enhanced if himem.sys or smartdrv.exe are loaded
(in CONFIG.SYS and AUTOEXEC.BAT respectively).
Note -
This program is NOT the best means of recovering files. It
FAILS if the file to be copied is not contiguous on the disk!
There are much BETTER recovery tools available (see above).
SYNTAX -
Cyldir {disk number} {cylinder} {head} {sector} {FAT size}
{cluster size} {root} [copyfiles {Directory cluster}] [{logfile}]
- FAT size in sectors (from Ranish Partition Manager: PART.exe)
- Cluster size in KB (NB: If disk exceeds 32GB, must be 32KB)
- Root = Root cluster number (NB: Usually cluster 2)
- Logfile's extension must be .TXT
(a) LIST THE LOST FILES:
** Find the size of the FAT with FINDPART **
FINDPART FINDFAT ALL comprehensive F:\FAT_ALL.TXT
** Find the size of the FAT with Ranish Partition Manager **
SET PATH=%path%;F:\RANISH
PART.exe
To list lost (or deleted) files in Partition 1 on Disk 1
where the Partition uses 32K clusters (i.e. exceeds 32GB):
CYLDIR 1 0 1 1 ____ 32 2 F:\CDIR.TXT
Example -
From FINDPART FINDFAT you have this result for Disk 1:
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
260 0 33 1204 4 2 1204 0 0 0 981124 516
The CYLDIR command line is the disk number, followed by the first
6 numbers in the above line, followed by the file name CDIR.TXT:
CYLDIR 1 260 0 33 1204 4 2 F:\CDIR.TXT
(b) COPY THE LOST FILES:
Run CYLDIR.EXE from a floppy disk or an undamaged partition.
If the option COPYFILES is used, it copies files from a lost
directory. The cluster numbers are saved in the log file.
The current directory must be empty, unless it's the Root
directory. NB: Copied files cannot be expected to be okay!
To speed up file copying, load HIMEM.SYS and SMARTDRV.EXE:
1: Load HIMEM.SYS in CONFIG.SYS
Syntax: device=himem.sys
2: Load SMARTDRV.EXE before running CYLDIR -
SMARTDRV.EXE 4096 16>nul
CYLDIR 1 0 1 1 ____ 32 2 COPYFILES ____ F:\CDIR.TXT
Note: Files are copied using their SHORT file names. A file,
LONGNAME.BAT, for renaming them to their Long File Names,
will automatically be created. A file named CYLDIR.LOG
records the names of files that are not readable or are
FDISK damaged. Files bigger than 2 GB cannot be copied.
Alternate usage: Cyldir {directory cluster} dir [{copy logfile}]
Cyldir {directory cluster} tree [{copy logfile}]
This is two additional ways to copy files from a lost partition.
Directories are relative to the current directory.
If 'tree' is specified, files in any subdirectories are copied.
If the target subdirectories already exist, they must be empty.
The main thing is to be certain that no copy of the lost files
is on the target partition. This could occur if partitions
overlap, or if old deleted copies of the lost files exist.
The logfile CDIR.TXT must exist in the current directory, or
in the Root of current partition. (Suggestion: Put CDIR.TXT
and CYLDIR.EXE in an empty directory and work from there.)
Up to ten {directory cluster}'s can be entered. If the Root
directory cluster number is entered with the 'tree' option, you
can add '+lost' to the command line to include lost directories,
i.e. those beginning with ? in CDIR.TXT
CYLDIR ____ tree +lost F:\COPYLOG.TXT
To stop the copy after the current directory, press ESC.
If run in pure DOS, a file LONGNAME.BAT for recreating long file
names is created in each directory, if there is enough free space.
To write a directory listing to CDIR.LST, use:
CYLDIR LIST
Choose directory cluster numbers in CDIR.TXT; or execute the
command 'cyldir list' and find the numbers in CDIR.LST.
*** Copy a single directory ***
(e.g. If the cluster number is 117: cyldir 117 dir)
CYLDIR ___ DIR
*** Copy an entire directory tree ***
(e.g. If the cluster number is 117: cyldir 117 tree)
CYLDIR ___ TREE
Example -
Disk: 1 Cylinders: 9729 Heads: 255 Sectors: 63 MB: 76317
-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 - 0C 63 42973812 20983 0 1 1 2674 254 63 B OK
2675 1 0B 63113322447 55333 2675 1 1 9728 254 63 R0 OK
0 - 0B 42973938113322447 55333 2675 1 1 9728 254 63 B OK
6200 1 0B 63 56661192 27666 6200 1 1 9726 254 63 R0 OK
0 - 0B 99603063 56661192 27666 6200 1 1 9726 254 63 B OK
-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
2675 1 33 13832 32 2 13832 0 0 0 080206 11160
6200 1 33 13830 16* 2*13830 0 0 0 2
Syntax:
CYLDIR + Disk number + first 6 numbers from lower table + F:\CDIR.txt
** Disk 1, Partition 2 **
cyldir 1 2675 1 33 13832 32 2 F:\cdir.txt
** Disk 1, Partition 4 **
cyldir 1 6200 1 33 13830 16 2 F:\cdir.txt
Note -
To speed up file copying, load HIMEM.SYS and SMARTDRV.EXE
1: Load HIMEM.SYS in CONFIG.SYS -
DEVICE=HIMEM.SYS
2: Load SMARTDRV.EXE before running CYLDIR -
SMARTDRV.EXE 4096 16>nul
ODI'S LFN TOOLS
===============
Odi's LFN Tools: LDIR.EXE v1.75
LCOPY.EXE v1.75
This is a means of copying files off a damaged HDD (one which,
although Windows will not run, is accessible in DOS) to a safe
destination (i.e. an undamaged disk), in DOS, while preserving
the Long File Names.
*** Set PATH to include LFN tools ***
SET PATH=%path%;F:\LFN
*** Directory Listing with Long File Names ***
** Pauses after each screen **
LDIR.EXE /P
NB: A damaged disk will crash the system if the DOS command DIR
is used, because the computer cannot determine the amount of
free disk space. LDIR can obtain a directory listing in that
situation, as it does NOT display the amount of free space!
*** LCOPY.EXE: Long filename version of COPY.EXE ***
** Copy file in DOS preserving its Long File Name **
SYNTAX -
LCOPY "[Source]" "[Destination]"
Example:
LCOPY "C:\PROGRA~1\MISC" "F:\DATA"
1. The file LCOPY.EXE must be located in the DOS path.
(Set the PATH in autoexec.bat, e.g. SET PATH=A:\;F:\)
2. The destination directory must already exist, and
must be a valid DOS directory name (i.e. in 8.3 format).
3. It is NOT necessary to define a name for the file in the
destination instruction.
4. If the long file name contains spaces, the source and the
destination must BOTH be enclosed in quotation marks.
5. The DOS wildcard *.* is not valid. The wildcard * must be
used instead.
6. The wildcard * must come BEFORE the first space in the long
file name for the source to be valid.
7. The switch /A copies ALL files, including HIDDEN files.
8. To copy only directory structure use: LCOPY . {dest} /S
NB: The destination {dest} must be a valid path, e.g. F:\
COPY all files in current directory to Floppy Disk in A
NB: Use of LCOPY.EXE preserves the Long File Names
*** Copy ALL files in current directory ***
LCOPY.EXE "*" A:\ /A
*** Include all SUBDIRECTORIES of current (the /S switch) ***
LCOPY.EXE "*" A:\ /A /S
COPY all files in current directory to RAM disk in F
NB: Use of LCOPY.EXE preserves the Long File Names
*** Copy ALL files in current directory ***
LCOPY.EXE "*" F:\ /A
*** Include all SUBDIRECTORIES of current (the /S switch) ***
LCOPY.EXE "*" F:\ /A /S
Note -
To provide a RAM disk in DOS, add this line to CONFIG.SYS:
device=ramdrive.sys /E 28672
NB: RAMDRIVE.SYS is included on WinME's Emergency Boot Disk
COPY all files in current directory to USB disk in F
NB: Use of LCOPY.EXE preserves the Long File Names
*** Copy ALL files in current directory ***
LCOPY.EXE "*" F:\ /A
*** Include all SUBDIRECTORIES of current (the /S switch) ***
LCOPY.EXE "*" F:\ /A /S
Note: USB access in DOS [USB 1.1 drivers for DOS]
To provide USB 1.1 access in DOS, add these lines to CONFIG.SYS:
device=USBASPI.SYS
device=DI1000DD.SYS
To connect both a USB 2.0 CD drive AND a USB 2.0 hard disk
simultaneously -
(a) Include the following lines, in this order, in CONFIG.SYS:
device=HIMEM.SYS
device=USBASPI.SYS /e
device=USBCD.SYS /d:USBCD001
device=DI1000DD.SYS
(b) Include the following line in AUTOEXEC.BAT:
MSCDEX /d:USBCD001
• Driver #1: USBASPI.SYS
ASPI Manager for USB mass-storage v2.24
Panasonic Communications Co 2000-2007
Syntax:
device=USBASPI.SYS [/e] [/o] [/u] [/v] [/w] [/r] [/l[#]]
[/slow] [/nocbc]
/e EHCI, for enabling EHCI add-on USB 2.0 controller
/o OHCI, for enabling OHCI add-on/onboard USB 1.1 controller
/u UHCI, for enabling UHCI onboard USB 1.1 controller
/v Verbose mode, useful for troubleshooting
/w Wait, displays message to prompt attaching of USB device
/r Resident, load as memory resident if USB floppy detected
/l# Luns, specify highest number of LUN assigned: default /L0
/slow Use SLOW mode, gives longer delays on scanning USB ports
/nocbc No CardBus Controller, disable detection on CardBus slots
You can specify more than one controller type (e.g. /o /e). Use
this feature to specify which port types to enable: limiting
the port types that are scanned for results in a faster startup.
These options work on Tiny Computers PC (Intel Celeron chipset):
device=USBASPI.SYS /v
device=USBASPI.SYS /o /v
device=USBASPI.SYS /e /v
device=USBASPI.SYS /o /e /v
• Driver #2: DI1000DD.SYS
ASPI Disk Driver v2.00
(c) 2001 NOVAC Co Ltd
USBASPI.SYS merely maps USB devices to an ASPI device. An
additional driver, DI1000DD.SYS, is needed to map the ASPI
mass storage to a DOS drive letter.
NB: DI1000DD.SYS version 1 only supported FAT16, but FAT32
support was added to version 2
Note -
1. If the files to be recovered are too large for a floppy,
or a USB pen drive, attach a second HDD to an IDE cable
2. LCOPY.EXE and other LFN utils could be held on Drive E:
(a RAM disk where rescue utils are stored for carrying
out data recovery on an IDE Hard Disk)
3. For other methods of providing USB access in DOS, see:
http://www.computing.net/answers/dos/usb-20-drivers-for-dos/13447.html
http://www.unet.univie.ac.at/~a0503736/php/drdoswiki/index.php?n=Main.USB
UNDELETE
========
This is a means of recovering files accidentally deleted.
A. Undelete files in DOS -
1. NORTON'S UNERASE FOR DOS
Recover deleted files using Norton's UNERASE for DOS (UNERASE.EXE)
which is one of the rescue tools included in -
(a) Norton Utilities 2001
(b) Norton Utilities 2002
(c) Disk 1 of the Norton Emergency Disks (a set of 4 floppy disks)
Syntax:
UNERASE [pathname] [/IMAGE|/MIRROR|/NOINFO] [/NOTRACK]
[/PROTECTED|/NOPROTECTED] [/LIST] [/G0] [/BW|/LCD]
pathname Name of file to recover.
/IMAGE Use Image recovery info (excludes Mirror info).
/MIRROR Use Mirror recovery info (excludes Image info).
/NOINFO Exclude both Image and Mirror recover info.
/NOTRACK Exclude Delete Tracking information.
/PROTECTED Only recover files protected by SmartCan,
Norton Protection, or Delete Sentry.
/NOPROTECTED Exclude files protected by SmartCan,
Norton Protection, or Delete Sentry.
/LIST List the erased files available for recovery.
/G0 Disable graphical mouse and all graphical characters.
/BW, /LCD Improve display on monochrome or LCD monitors.
NB: SmartCan, Norton Protection and Delete Sentry provide a type of
Recycle Bin for exclusively DOS-based systems; but it's one that
can't be used on a Windows 9x system.
Unless SmartCan, Norton Protection or Delete Sentry is installed,
the /LIST option will show only those files that can be recovered
using ordinary DOS methods.
*** Run Norton Unerase for DOS ***
UNERASE
*** List all Recoverable Files ***
UNERASE /LIST
*** Undelete a Specific file ***
NB: Insert the actual Path and Filename
UNERASE C:\RECOVER.ME
2. TESTDISK
Alternatively, recover deleted files using TestDisk:
See above, under heading TESTDISK.EXE
3. OTHER ALTERNATIVES IN DOS
Alternatively, do a Google search for other DOS undelete programs:
http://www.google.com/search?btnG=Google+Search&as_epq=DOS+unerase
http://www.google.com/search?btnG=Google+Search&as_epq=DOS+undelete
B. Undelete files in Windows -
Restoration v2.5.14
File undelete utility for Win98/ME/2000/XP (FAT/FAT32/NTFS partitions)
Restoration is a tool to undelete files. You can scan for all files
that may be recoverable, and limit the results by entering a search
term or extension. The program is small and standalone; it does NOT
require installation, and can run from a Floppy disk.
WINDOWS UTILITIES
=================
Boot from Hard Disk:
To use Windows tools to recover files from a damaged hard disk,
attach the damaged disk as the PRIMARY SLAVE on the IDE cable
and boot from an undamaged hard disk as the IDE Primary Master.
Boot from CD:
Alternatively, load Windows from a rescue CD.
An alternative to booting from a hard disk is to boot from a CD
(one which has all the necessary Operating System components to
be bootable), e.g. the Ultimate Boot CD burned to a CD-RW disc.
NB: Creating a bootable CD to run BartPE is NOT an option, as it
requires Windows XP.
^ Top of Page ___________________________ SECTION C: ERROR MESSAGES ___________________________
BLUE SCREEN OF DEATH
====================
A Blue Screen error does NOT usually indicate a fatal problem.
The Blue Screen of Death (also known as a STOP error) is the error
screen which is displayed by the Operating System on encountering
a system error during startup.
Although it's called the "screen of death", the system has been
halted to PREVENT damage occuring; a blue screen does not of
itself cause any damage.
It does NOT indicate a disk fault, as Windows was able to get
far enough along in the startup process to encounter a startup
error. The blue screen is in fact supplied by Windows.
In Windows 9x, a blue screen is the main way the Operating System
has of notifying the user of the presence of an incompatible
device driver. Fixing this is only a minor problem.
Alternatively, the blue screen might be caused by a hardware fault.
If so, it can be fixed by installing a repacement for the faulty
RAM, PSU or fan (all inexpensive items), as the case may be.
SAFE MODE -
It may be possible to start Windows, by booting into Safe Mode.
To do this, restart the computer, and repeatedly press F5 or F8
or CTRL (it varies, depending on the make and model of computer)
at intervals of one second during the initial loading process.
This starts Windows without loading any device drivers (i.e. it
by-passes any faulty drivers present), so enabling you to use
Windows (rather than DOS) to fix the fault that is causing the
blue screen error and the inability to start normally.
NB: If you are running Windows ME, and can boot into Safe Mode,
it might be possible to cure the fault by "rolling-back"
the system to an earlier state, using System Restore. That
will NOT always cure this type of fault (because the fault
has more than one possible cause), but may be worth trying.
DIAGNOSING THE CAUSE -
A blue screen can be caused by (1) incompatible device drivers,
(2) poorly written device drivers, (3) bugs in the kernel of the
Operating System, or (4) faulty hardware.
The most common cause is faulty or incompatible device drivers
(.DLL and .VXD files). On bootup Windows tries to load all
the .DLL and .VXD files in the computer: if it encounters one
it can't load, the system is halted and the blue screen shown.
Review any recently installed software, which may have installed
incompatible driver files, e.g. files that were written for WinXP.
Try uninstalling the software in question; or manually remove
the files it added to the disk: i.e. physically delete those files
from the disk, and remove all references to those files from the
Windows Registry (or replace the Registry with a backup copy).
Manually Removing the Files:
The usual cause of the Blue Screen is simply installing the wrong
device driver. Typically it will be caused by a WinXP file being
installed in a Win9x system. Delete or rename that file, in DOS,
using the following procedure.
NB: A driver file is one with the file extension .DLL or .VXD;
and just deleting or renaming the file(s) causing the problem
(and then rebooting) will normally be a complete cure.
The computer can usually be restored to normal working by deleting
the faulty or incompatible file(s) from the hard disk (or renaming
the file(s), e.g. from .DLL to .DL_), without having to make any
changes in the Registry. This should be tried first.
NB: It is poor tactics to delete a file physically, in case it turns
out to be the WRONG file. It is safer to merely rename it.
It may mean spending a lot of time in a trial-and-error process
of renaming one file at a time (in the directories C:\WINDOWS and
C:\WINDOWS\SYSTEM and C:\WINDOWS\SYSTEM32\DRIVERS), to establish
the identity of the faulty file(s).
A directory listing, at the DOS prompt, will list the files by date
(displaying a date for each file). The newest files are the ones
to suspect first!
It may be prudent to rename all files bearing the date that the
fault arose, in all three directories, then restart normally.
*** Directory Listing sorted by Date ***
DIR *.DLL /-W /P
DIR *.VXD /-W /P
NB: Working in DOS, the date you see in a Directory listing is the
"Modified" date (the date on which the file was last modified).
This is NOT its "Created" date (the date it was added to the
disk); so the files with the latest dates are NOT necessarily
the ones added by the suspect installation program.
Windows ME records a Bootup Log (as C:\BOOTLOG.TXT), on startup, if
the options BootMenu=1 and DisableLog=0 are set in the C:\MSDOS.SYS
file; so set those options and then restart the computer. This log
might record the last step taken before the STOP error occurs. If so,
the log may tell you which file the system was trying to load that
caused the fault: it will be the last entry in the log.
*** Routine to Edit MSDOS.SYS ***
C:
CD \WINDOWS\COMMAND
ATTRIB -R -H -S C:\MSDOS.SYS
EDIT C:\MSDOS.SYS
*** Routine to View the Boot Log ***
C:
CD \WINDOWS\COMMAND
ATTRIB -R -H C:\BOOTLOG.TXT
EDIT C:\BOOTLOG.TXT
Additionally, Windows ME keeps a copy of the previous bootup log,
in the file C:\BOOTLOG.PRV, which, being from before the Blue Screen
error, will be a complete startup log. A comparison with the latest
(partial) log might show which file the boot process crashed at.
*** Routine to View the Previous Boot Log ***
C:
CD \WINDOWS\COMMAND
ATTRIB -R -H C:\BOOTLOG.PRV
EDIT C:\BOOTLOG.PRV
Replacing the Windows Registry:
If it's necessary to make a change in the Registry, one way to
do so is to restore a known good working backup of the Registry
(i.e. replace the whole Registry). This can only be done in DOS.
By default, Windows 98/ME keeps up to 5 backup copies of the
Registry in the hidden directory C:\WINDOWS\SYSBCKUP
Every day, the first time Windows loads successfully a copy of
that valid Registry is saved there as a compressed .CAB file.
*** View details of the backups available ***
DIR C:\WINDOWS\SYSBCKUP\*.CAB /P /-W /OGD
*** Routine to restore the Windows Registry ***
NB: Follow the on-screen instructions in SCANREG
SET PATH=%path%;C:\WINDOWS\COMMAND
SCANREG /RESTORE
NB: It is NOT desirable to backup the current registry first,
because that would overwrite (i.e. destroy) one of the
existing backups: perhaps the very one that's needed!
It is also possible to manually extract a Registry backup
from a .CAB file, and copy it to the correct locations.
*** Routine to manually extract Registry from .CAB file ***
NB: Rename the .CAB file below to match the actual name
SET PATH=%path%;C:\WINDOWS\COMMAND
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.BAT /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.SYS /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.DAT /L C:\WINDOWS /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.INI /L C:\WINDOWS /Y
Blue Screen Error Number:
The Blue Screen usually displays a message and an error number,
like this:
number of error (parameter strings) name of error
All of this information is important in understanding the cause of
the fault. Dependant on the value of "number of error", all or some
of those parameters might contain information as to what went wrong.
List of STOP errors:
• STOP Code 0x1 to 0x5F
• PCSupport.about.com/od/findbyerrormessage/tp/stop_error_list.htm
Note:- I am not going into details here about STOP Error codes,
as the subject is usually unproductive. In my experience, Windows
rarely provides a useful error number; if it does, the best option
is to do a search at Google.com based on the error number indicated.
Hardware Faults:
Hardware faults can include faulty RAM memory, power supply issues,
overheating of components (e.g. due to failure of the cooling fan
on the CPU, or another fan inside the computer), hardware running
beyond specification limits, or other hardware faults.
If you have just made some hardware changes inside the computer,
the most likely cause is an insufficiently tightened cable, an
unattached cable, or some other fault related to the changes made.
Perhaps you failed to correctly attach a device, or inadvertently
loosened another cable while you were working. Perhaps you failed
to seat the new PCI Card or RAM module firmly enough in its slot!
Obviously you will only encounter hardware running beyond its
specification if you have been over-clocking the CPU. If so,
undo the changes you made.
If the cause is NOT a faulty installation of the new hardware,
the next step is to disable or remove the newly installed hardware
(and any accompanying software), as doing so may be a complete cure.
In the case of a fault in existing hardware, to cure the STOP error
fix the hardware fault: fit a replacement RAM memory module of the
same type, or a replacement Power Supply Unit (PSU) of the same type,
or a replacement for the faulty fan (as the case may be). Fan failure
will be obvious; if it is NOT a fan failure, suspect the RAM module
and the Power Supply Unit.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
USB Disk can cause Blue Screen:
A blue screen can also occur during a Windows session; e.g. if the
user ejects removable media (i.e. unplugs a USB device) while it is
being read from or written to, without following the correct
procedure.
NB: This commonly occurs with Microsoft Office, if the program is
not closed properly before unplugging a USB disk containing
dependent files.
Further Information:
For further information about STOP errors, read the following article:
http://en.wikipedia.org/wiki/Blue_Screen_of_Death
Suggestions for additional troubleshooting steps:
http://pcsupport.about.com/od/fixtheproblem/ht/stoperrors.htm
^ Top of Page
OTHER ERROR MESSAGES
====================
ERROR MESSAGE : "Disk / Partition Not Recognised"
=============
A possible cause might be the BIOS setting changing from LBA to
CHS, if it was previously set to AUTO, as a result of something
being altered in the first sector of the hard disk.
It's safer to set the BIOS to LBA before setting-up the disk,
which prevents this problem occuring. But even then, if the BIOS
is reset for any reason it will default to AUTO.
The change will confuse Windows; and where a switch between LBA
and CHS occurs, DOS programs (such as Partition Magic) may not
be able to see the Partitions.
Solution: Enter the BIOS screen, and set the hard disk option
to LBA (Logical Block Addressing).
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup.
NB: This is usually a non-fatal error message!
ERROR MESSAGE : "No boot device available" (or similar)
=============
The following errors all mean that none of the bootable devices,
specified in the bootable sequence set in the BIOS, contains the
signature bytes indicating a valid MBR in its 1st physical sector:-
"No ROM Basic - System Halted"; or "No boot device available, strike
F1 to retry, F2 for setup utility"; or "No boot sector on fixed disk,
strike F1 to retry boot, F2 for setup utility"; or "Non-System disk
or disk error, replace and strike any key when ready"; or "Disk Boot
Failure, Insert System Disk and Press Enter".
NB: This is usually a non-fatal error message!
Each partition table entry includes a Boot Indicator byte: these bytes
are at offset 446 (partition table entry #1 (01BE hex)), at offset 462
(partition table entry #2 (01CE hex)), at offset 478 (partition table
entry #3 (01DE hex)), and at offset 494 (partition table entry #4
(01EE hex)). These Boot Indicators are used to determine which partition
is active (i.e. bootable), by checking for the hex value 80; the other
Boot Indicators should all have a value of 00 (zero). If all four entries
are (for instance) 00 hex, bootup will fail.
Solution: Restore a backup copy of the boot disk's MBR sector guided by
the section "RESTORE A SECTOR" above.
Alternative Solution: Set the Primary partition of the boot disk to
"active" in the MBR, guided by the section "DISK STRUCTURE NOTES"
above, using a Disk Sector Editor.
Alternative Solution: Set the Primary partition of the boot disk to
"active" in the MBR, guided by the section "INSTALLING A HARD DISK"
below, using the FDISK.EXE program. WARNING: Careless use of the
FDISK program can cause fatal and irreversible damage to your files!
The Last Resort: Partition the hard disk (thereby DESTROYING all
files on it) guided by the section "INSTALLING A HARD DISK" below.
This should automatically set the Primary partition to "active".
ERROR MESSAGE : "Invalid partition table"
=============
The source of the error message is the MBR. More than one of the
Partition Table entries has its Boot Indicator byte set to a value
of 80 (hex); i.e. more than one partition is marked "active".
Solution: Set all but one of the boot disk's partitions as "inactive"
(i.e. non-bootable) guided by the section "DISK STRUCTURE NOTES" above,
using a Disk Sector Editor.
However, a thorough investigation of the MBR's partition table may
be necessary, guided by the section "DISK STRUCTURE NOTES" above,
as the actual problem may be more complex.
NB: This is usually a non-fatal error message!
ERROR MESSAGE : "Drive X is not formatted" (or similar)
=============
Windows typically reports that "Drive X is not formatted", or that
"The type of the file system is RAW".
This means the Boot Sector of the specified partition is damaged.
Replace the Boot Sector from a backup copy, guided by the section
"RESTORE A SECTOR" above; or repair it manually, guided by the
section "DISK STRUCTURE NOTES" above, using a Disk Sector Editor.
ERROR MESSAGE : "Error Loading Operating System"
=============
The source of the error message is the MBR. An error was returned
from the BIOS when the boot loader attempted to read the active
partition's Boot Sector into memory.
Solution: In many cases this will be due to a "soft" ECC error,
and can be repaired by re-writing the Boot Sector.
Replace the Boot Sector from a backup copy, guided by the section
"RESTORE A SECTOR" above; or re-write it manually, guided by the
section "DISK STRUCTURE NOTES" above, using a Disk Sector Editor.
ERROR MESSAGE : "Operating System Not Found" (or similar)
=============
Typically, you see the message "Operating system not found"
or "Missing operating system".
This error means the BIOS could not find an Operating System to
transfer control to. There are several possible causes.
In each case, in order to gain access to the computer to repair it
boot from a bootdisk: but only use a bootdisk which matches your
Operating System (i.e. if you have WinME on the hard disk, you
must use a WinME bootdisk); otherwise the fault will not be cured.
The Type #1 error -
The translation setting in BIOS has changed from LBA to CHS,
causing the bootstrap loader to translate sector addresses
differently (i.e. incorrectly). As a result, the location
of the Boot Sector is not where it is expected to be.
For disks of 528MB (504MiB) to 8.4GB (7.9GiB), reverse the
translation mode (i.e. set it to LBA again).
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup.
In other cases, rebuild the MBR's partition table (e.g. from
backups). Note: The command FDISK /MBR (the "fixmbr" command)
will rebuild a standard MBR, except the Partition Table bytes.
If there then is a remaining boot problem, it can be corrected
by rebuilding the Boot Sector (e.g. from a backup, guided by the
section "RESTORE A SECTOR" above; or re-write it manually, guided
by the section "DISK STRUCTURE NOTES", using a Disk Sector Editor).
NB: In WinXP, that error on a FAT32 disk (not an NTFS disk)
can be fixed with the "fixboot" command; e.g. FIXBOOT C:
The Type #2 error -
On startup, the BIOS (Basic Input Output Self-test) sends a signal
to anything with a ROM chip to make sure it's there.
Once that hardware check is complete, the boot process is handed over
to the bootstrap loader (for Win9x the loader is IO.SYS), which finds
the Master Boot Record (MBR) and tries to load the Operating System;
but the latter is not found.
Boot to a DOS prompt, by using a bootable floppy disk. Then -
1. Use FDISK.EXE to check that the partitions are intact:
FDISK /STATUS
NB: Do NOT use any other FDISK command in this situation!
All other FDISK commands are dangerous to your files.
2. Then run SCANDISK.EXE (Scandisk for DOS) to check the disk:
SCANDISK C: /CHECKONLY /SURFACE
NB: Do NOT allow SCANDISK to make any changes to the disk!
3. If all seems well, at the A: prompt type SYS C: to make the drive
bootable (this copies key Operating System files to Drive C):
A:
CD \
SYS C:
You should then be able to boot into Windows. (If not, you may have
faulty hardware: see HARDWARE FAULTS.)
The Type #3 error -
This error message can be generated if the MBR Sector is corrupt.
Boot to a DOS prompt, by using a bootable floppy disk.
Replace the MBR Sector with a backup copy, guided by the section
"RESTORE A SECTOR" above; or repair it manually, guided by the
section "DISK STRUCTURE NOTES" above, using a Disk Sector Editor.
The Type #4 error -
This error message can be generated if none of the Partition Table
entries in the MBR Sector has its Boot Indicator byte set to a value
of 80 (hex), i.e. no partition is marked "active". It indicates that
no bootable partition was found.
This is the other side of the error message "Invalid partition table"
(above), which indicated that too many of those entries were marked
"active". This time, none are; so the solution is similar.
Solution: Boot to a DOS prompt by using a bootable floppy disk. Then,
in the MBR, set the partition table entry for Drive C as "active"
(i.e. bootable), by altering the value of its Boot Indicator byte to
80 (hex) guided by the section "DISK STRUCTURE NOTES" above, using a
Disk Sector Editor.
Alternative Solution: Replace the MBR Sector from a backup, guided by
the section "RESTORE A SECTOR" above.
In either case, a thorough investigation of the MBR and the Boot Record
is essential, guided by the section "DISK STRUCTURE NOTES" above, to
learn the cause of the error, as the actual problem may be more complex.
ERROR MESSAGE : Hangs at "Verifying DMI Pool Data"
=============
The Desktop Management Interface (DMI) is a method of managing
Windows 9x computers. The main component of DMI is the Management
Information Format Database or MIFD (the DMI Pool Data): this
contains all the information about the computer and its components.
Any changes to the motherboard BIOS settings, the hard disks, or
the hard disk settings will all alter this pool data: the message
"Verifying DMI Pool Data" will appear. If the system then hangs
(a condition which can persist even if you remove the new hardware
in question!) try this:
1. Switch on mains power and start the computer.
2. Access the BIOS screen. [Press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup]
3. Disable both the Internal and External CPU Caches: these are
in either the "BIOS Features" or "Advanced Settings" options
of the BIOS screen.
4. Save the BIOS changes, then restart the PC with a bootable
floppy disk. On startup, the screen should read -
Verifying DMI Pool Data
Update Successful
and the system should then continue loading normally.
5. After the system successfully loads, re-start the PC and
access the BIOS screen.
6. Enable the External CPU Cache in the BIOS.
Note: For optimal system performance, this feature
MUST be enabled!
7. Save the BIOS changes, then restart the PC with a bootable
floppy disk. On startup, the screen should read -
Verifying DMI Pool Data
Update Successful
and the system should then continue loading normally.
Alternatively:
1. Switch off the mains power (but do NOT unplug the PC from
the wall socket). Then disconnect the power connector and
the IDE cable from each hard disk.
2. Switch on at the mains, then start the computer.
3. Access the BIOS [Press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup]:
then set each hard disk's type as "None" or "Not Installed";
then load the BIOS defaults; then load the SETUP defaults.
4. Save the BIOS changes, then restart using a bootable floppy.
5. Shutdown the PC after the memory count is displayed.
6. Reconnect the power connector and IDE cable to each hard disk.
7. Restart the PC and enter the BIOS (as described above);
then use the BIOS to Auto-Detect the hard disk(s).
Ensure that LBA Mode is enabled for EVERY hard disk.
8. Save the BIOS changes, then reboot using a bootable floppy.
9. Restart the system. On startup, the screen should read -
Verifying DMI Pool Data
Update Successful
and the system should then continue starting normally.
If the above fails to solve the problem, reset the system BIOS
by removing the motherboard's battery for a few seconds (or by
opening the "Clear CMOS" Jumper on the motherboard for a few
seconds), to clear the stored contents in the CMOS chip.
As a last resort, reset the system BIOS by doing a flash-upgrade
of the BIOS firmware settings (in the motherboard's EEPROM chip),
by downloading a BIOS Upgrade program from the motherboard
manufacturer's website and running it at the DOS prompt.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
ERROR MESSAGE : "Invalid system disk"
=============
This message means there are no startup files on the active
partition (i.e. C:). Either the startup files are corrupt,
or the drive has bad sectors.
A. Corrupt Startup Files -
To repair corrupt startup files, start the computer using
a bootable floppy disk (e.g. from http://www.bootdisk.com).
NB: The floppy disk MUST contain the same version of DOS that is
installed on the PC being repaired. So to repair a PC running
Windows ME, the boot floppy MUST be a Windows ME boot disk
(e.g. the Windows ME Emergency Boot Disk).
Install the System Files on Drive C:-
1. Use FDISK.EXE to make sure the partitions are intact:
FDISK /STATUS
2. Then run SCANDISK.EXE (Scandisk for DOS) to check the disk:
(NB: Do NOT allow SCANDISK to make any changes to the disk)
SCANDISK C: /CHECKONLY /SURFACE
3. If all seems well, at the A: prompt type SYS C: (to install
the system files on Drive C):
A:
CD \
SYS C:
B. Bad Sectors -
Methods of recovering from bad sectors (a.k.a. "bad blocks")
(1) Clone the Hard Disk:
(a) Clone the Hard Disk using GHOST.EXE -
Copy the affected disk to a new hard disk using a disk cloning
program that can tolerate bad sectors, e.g. Norton's GHOST.
[Note: Most cloning programs CANNOT cope with bad sectors!]
Norton's GHOST for DOS v8.3 (GHOST.EXE) can clone an entire disk
(but it only works with IDE disks, not SATA or SCSI or USB).
It can clone a disk to a smaller one, provided the contents
(i.e. data) on the source disk do not exceed the capacity of
the destination disk: i.e. if the difference is just free space.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
To run GHOST for DOS v8.3 with the option to ignore bad sectors,
use the option -FRO
Note: Norton Ghost 2003 is notorious for creating corrupt image
files, due to faulty compression, although it's okay for
normal (i.e. uncompressed) disk-to-disk direct cloning.
(Norton's Ghost for DOS v8.3 does NOT have this fault!)
Syntax -
MODE=COPY
Copies the contents of one disk to another (file-by-file)
MODE=PCOPY
Clones a partition to another partition (byte-by-byte)
SRC=Source
Drive number, or Drive number and Partition number
DST=Destination
Drive number, or Drive number and Partition number
SRC and DST examples in PCOPY mode:-
1:2 means the 2nd partition on the 1st disk
2:1 means the 1st partition on the 2nd disk
Examples -
1. Copy disk 1 to disk 2:
GHOST.EXE -clone,mode=copy,src=1,dst=2
2. Clone the 2nd partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=pcopy,src=1:2,dst=2:1
*** To clone a bootable Hard Disk on a new Hard Disk ***
** Copy Partition 1 of Disk 1 to Partition 1 of Disk 2 **
GHOST.EXE -clone,mode=pcopy,src=1:1,dst=2:1 -FRO -PMBR
Alternative, if Disks 1 and 2 each have only 1 partition:
GHOST.EXE -clone,mode=copy,src=1,dst=2 -FRO -PMBR
Options that may be useful for troubleshooting:
-FRO : Forces Ghost to continue cloning even if the
source contains bad sectors
-FX : Forces Ghost to eXit to DOS after the operation
is complete
-FFATID : Changes the partition ID of the DESTINATION to the
recommended partition ID for that FAT32 partition
[The partition ID is stored in the partition table]
-PMBR : Specifies that the Master Boot Record of the
DESTINATION disk be preserved when performing
a Disk-to-Disk or Image-to-Disk operation
Other command line options are summarised at:
• http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082612540625
• http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082413392025
*** Display Ghost's help screen ***
GHOST /?
GHOST -?
*** Display details of all Drives detected ***
GHOST -dd
*** Save details of all Drives detected ***
GHOST -dd > drives.txt
(b) Clone the Hard Disk using COPYR.EXE -
Another DOS program which can copy a hard disk that has bad
sectors is COPYR.EXE (build 13).
This program has several limitations:
1. It ONLY works if the faulty disk is connected to the computer
by the IDE cables, not if the disk is conected by USB or SATA.
2. It ONLY works if the faulty disk uses Logical Block Addressing
(LBA), not if it uses CHS addressing. A disk larger than 8GB
will always use LBA; but a smaller disk could be using CHS.
3. The faulty disk MUST support direct memory access (DMA).
Cloning is carried out in Ultra-DMA mode, with transition to PIO
mode for reading bad sectors (requiring both LBA mode and DMA).
On starting COPYR.EXE, the screen will display a menu consisting
of a choice of disks, possible operations, and explanations.
Moving is by using the arrow keys. The ENTER key selects an item.
The ESC key exits the program.
Select the source disk to be copied, then press ENTER: information
will now be displayed on screen about that disk. The next disk you
select is marked as the destination: the copy will be created on it.
Then choose either "Start copy" or (if copying part of a disk) "Set range".
WARNING -
Never start Windows with BOTH source and clone attached
to the IDE cables, as that will cause a fault! The clone
must NOT be attached to the same computer, except in DOS.
See: http://thestarman.pcministry.com/asm/mbr/mystery.htm
NB: It may be okay if one of them is attached through a USB
port (i.e. as an external disk), or attached through a
SATA controller (i.e. as either an internal or external
SATA disk); but not if both are on the IDE cables!
The fault can be prevented by manually zeroing the six bytes
DA to DF (bytes 218 to 223) in sector CHS 0-0-1 (LBA sector 0)
[the MBR sector], the "mystery bytes", before starting Windows.
NB: It is believed these bytes are a serial number, that
Windows uses to identify the different IDE disks; so
it can't cope if two IDE disks have the same number.
Zeroing these bytes forces Windows to re-allocate a
new serial number to the disk, on the next bootup,
thereby preventing a clash of disk addresses.
Alternatively, when the cloning is completed do NOT let Ghost
"reset" the computer. Rebooting to Windows will CAUSE the fault!
Instead, shutdown the computer, then remove the source disk; then
install the CLONE as IDE Primary Master BEFORE booting to Windows.
The fault may cause the following errors:
1. Windows may refuse to start.
Restart in DOS, and use Norton's Disk Editor (above) to
set all six of the "mystery bytes" to 00 (zero hex), in
sector CHS 0-0-1 (LBA sector 0) of the destination disk.
2. Windows may WIPE the system registry.
The registry can be restored in DOS from the backups in
C:\WINDOWS\SYSBCKUP by using the following commands (and
then carrying out the on-screen instructions):
SET PATH=%path%;C:\WINDOWS\COMMAND
SCANREG /RESTORE
3. Windows may change the Volume Identifier on the destination
disk, setting it as non-bootable (as it's not the IDE Primary
Master). When installed as Primary Master, it then can't boot.
Use PowerQuest's Partition Table Editor (above) to set the
Primary DOS partition on the disk to "active" (i.e. bootable).
Note: If the hard disk does NOT have bad sectors, the cloning
program DiscWizard (below) is easier to use than Ghost.
DiscWizard, from Seagate, is for setting up a new Seagate
disk; but the cloning utility (called 'Copy a Partition')
works with ANY make of disk: it was designed to copy
whatever existing disk the user had, onto his new Seagate
disk, as a byte-by-byte copy (in order that the copy would
be bootable if the original was, by preserving all settings).
The program Data Lifeguard Tools for DOS v11.2, from
Western Digital, can also clone a hard disk (below).
The program Media Tools Professional v5.0 can also clone
a hard disk (below).
The program HDClone v3.6 can also clone a hard disk (below).
(2) HDD Regenerator:
HDD Regenerator v1.31 repairs bad sectors on a HDD. It can
regenerate the magnetic surface, at least temporarily.
*** Create bootable floppy containing DOS version ***
** Requires one 1.44MB floppy disk in Drive A: **
SET PATH=%path%;F:\HARDWARE\REGEN
REGEN.EXE
Clone the repaired HDD immediately, because this
type of repair is only a temporary solution!
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
(3) The Norton DiskEdit method (in Windows):
Step 1: Edit the registry to make Scandisk check bad clusters
(a) START > RUN > REGEDIT
(b) Go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Applets\Check Drive
(c) Double click on "Settings" in the right-hand pane
(d) There are four pairs of digits: change last pair to 04
Step 2: Go to START > RUN and type SCANDSKW then click on "Thorough"
and uncheck "Automatically Fix Errors"
Step 3: Wait while it slowly goes through the surface scan. When it
finds bad clusters, it will test them; if it cannot find a
problem with them, it will tell you so, and tell you the
cluster number. Write down the number of each bad cluster,
but select "Leave the cluster marked bad".
NB: Microsoft says that if you select "Clear the Bad
Cluster" it will remove the "bad" marker. It doesn't!
NB: If there are any clusters that Scandisk sees as bad,
and agrees that they are bad, it's time to back up your
files and buy a new disk.
Step 4: Exit to DOS, and run Norton's DISKEDIT
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Step 5: Press the ALT and T keys simultaneously, then select
"configuration...", then uncheck the Read-Only box,
then click "OK"
Step 6: Press the ALT and F1 keys simultaneously, to view
the first FAT (there are 2 FATs)
Step 7: Using the cluster numbers you wrote down, page down to
find them (using the PgDn key); they'll be marked {Bad}
Step 8: Select the word "Bad" by using Tab and arrow keys,
then enter "0" (zero)
Step 9: Press the CTRL and W keys simultaneously, to write
the changes to disk, then press ESC to exit
Step 10: Run CHKDSK.EXE to check that the system no longer
shows any bad clusters
This method of repairing bad sectors is, of course, unsafe
if the sector(s) are GENUINELY bad! Do NOT use this repair
if SCANDISK tells you, in Step 3, that any sector is bad!
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
(4) Use ScanDisk for DOS to fix the bad sectors (in DOS):
SET PATH=%path%;%RAMD%:\;E:\;C:\WINDOWS\COMMAND
SCANDISK C: /SURFACE
SCANDISK D: /SURFACE
NB: Not practical if the bad sector is in the System Area!
NB: This "solution" will result in data loss, as ScanDisk
will make changes to the disk in remapping bad sectors
or marking damaged sectors as bad. Try this only AFTER
recovering all recoverable data using other tools.
(5) Format the Hard Disk:
As a last resort, start the computer using a bootable floppy disk
containing FORMAT.COM and then at the A: prompt type FORMAT C:
(if Drive C: is the damaged partition).
NB: ALL DATA ON THE DISK WILL BE DESTROYED!! Copy all files
on the damaged disk to another disk first, to save them!
(Use the procedures at RECOVER INDIVIDUAL FILES, above)
FORMAT.COM will display a warning when it finds bad sectors.
It will try to re-map them (i.e. swap them for valid sectors
from the reserve sector pool); if it cannot re-map them,
it will mark them as bad so that they cannot be used.
Note: See also SPINRITE v6.0, below
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
CMOS BATTERY DEAD
=================
The CMOS battery on the motherboard maintains the BIOS settings
while the computer is disconnected from mains power.
It's typically a lithium/manganese-dioxide battery of type CR2032
that looks like a one-inch silver coin.
When the battery fails: the computer loses its BIOS settings, so
it will not boot. At startup it displays a blank screen with the
cursor in the top left-hand corner, flashing.
Solution: Fit a new battery on the motherboard, then enter the
BIOS setup program and manually input the correct BIOS settings
(which are hardware-dependent, so vary from one PC to another).
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
Backing up the BIOS -
Before the battery fails, make a backup copy of the BIOS settings
by entering the BIOS setup program and writing down the settings
you see in the various setup menus.
NB: To enter the BIOS, press the appropriate key (e.g. DEL)
(on some systems, F1 or F2 or F11) repeatedly at startup.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
^ Top of Page __________________________________ SECTION D: DISK HARDWARE REPAIRS __________________________________
Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics
WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
unless the electricity is switched OFF at the wall power socket!
DISK SURFACE FAULTS
===================
SPINRITE v6.0
=============
SpinRite tests and repairs a hard disk, byte by byte. It tests whether
data can be read from and written to each sector on the disk; and then
tries to recover data from any unreadable sectors.
Similar to ScanDisk, but much more thorough.
It has 5 levels, level 2 (for routine maintenance) being quite fast,
and level 5 (for data recovery from a damaged disk) being very slow.
Serial number: WS2YNDQ4VNW2M-C
Notes -
Spinrite is best avoided, for these reasons:
A. In my tests, SpinRite v6.0 could NOT recover data from a damaged FAT
on a crashed hard disk, nor could it access the affected sectors!
B. At level 2 and higher, it writes to the failing disk! It does NOT fully
disable automatic sector re-allocation, so it does end up writing data
to the disk, which is VERY bad. Level 1 is the only safe level to use.
C. It can get stuck at the first failing sector, attempting access for hours
without moving on. You could have retrieved all the recoverable data from
the disk, and gone back to the bad sector later. By the time it gives up,
the failing disk hardware could be fully shot.
D. Sometimes, instead of getting stuck, it flies right past a sector, stating
(in effect) that some, but not all, of the data was copied from the sector,
and allows the disk to re-allocate the sector, so the rest of the data in it
(that part which wasn't copied) is permanently lost.
E. Because it forces reallocation after a sector is "recovered", it can run out
of remappable sectors. All disks have only a limited number of sectors set
aside just for remaps, and it is quite possible to run out of them.
NORTON'S DISK EDITOR
====================
It is possible to manually recondition ALL the affected sectors
using Norton's DiskEdit. Like SpinRite, it CANNOT read 99% of
affected sectors; but DiskEdit successfully reconditions them,
i.e. restores them ALL to normal use, which SpinRite cannot do.
NB: This solution works if the fault is a "soft" ECC error, but
NOT if the fault is physical damage to the magnetic surface.
The trick is to have DiskEdit access each affected sector (i.e. each
inaccessible sector), one by one; and you manually write a pattern of
512 bytes of new data (ANY data!) to the affected sector. This new
data, once written, makes the sector accessible normally again.
NB: Although "accessing" an inaccessible sector sounds impossible,
DiskEdit will go to such a sector (e.g. if you scroll down the
screen using the PgDn key), and try to read it; but will report
that it can't be read, and will display 512 zeros (00 hex).
If you then type 512 random characters (or even just 1 character)
into the sector, then try to leave the sector, DiskEdit will (if
the sector is not physically damaged!) save those new characters
to that sector, which will then be accessible normally.
All the data which was originally in the sector is lost, but you
have restored the sector to normal use. It now contains the data
you typed in (e.g. 1 character and 511 zero's) in its 512 bytes.
With a damaged FAT, once every sector of the entire FAT has been
repaired in this way it is then possible to copy a backup of the FAT
to those sectors (successfully), and so copy files off the disk!
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
NORTON'S DISK DOCTOR
====================
NDD.EXE from Norton Utilities 2001 (v5.0)
Diagnoses (and repairs) damaged disks.
(NB: Norton Utilities 2001 recognises FAT32 and disks exceeding 32GB)
SYNTAX -
NDD [d:][d:]... [/C|/Q|/DT] [/R[A]:pathname] [/X:drives] [/FIXSPACES]
[/NOCOMP] [/NOHOST] [/G0] [/BW|/LCD]
NDD [d:][d:]... /REBUILD [/G0] [/BW|/LCD]
NDD [d:][d:]... /UNDELETE [/G0] [/BW|/LCD]
NDD /UNDO [/G0] [/BW|/LCD]
/C Complete test, including surface test.
/Q All tests except surface test.
/DT Only perform the surface test.
/R[A]:pathname Write (or Append) report to pathname.
/X:drives Exclude drives from testing.
/FIXSPACES Repair filenames with embedded spaces.
/NOCOMP Do not test compression structures.
/NOHOST Do not test host drive of compressed volumes.
/REBUILD Rebuild an entire disk that has been destroyed.
/UNDELETE Undelete a partition that was previously skipped.
/UNDO Undo repairs made in a prior session.
/G0 Disable graphical mouse and all graphical characters.
/BW, /LCD Improve display on monochrome or LCD monitors.
*** Run Norton Disk Doctor: ALL disks ***
SET PATH=%path%;F:\NDD
NDD.EXE
*** Complete test, including Surface scan: Specified Disk only ***
SET PATH=%path%;F:\NDD
NDD C: /C
NDD D: /C
NDD E: /C
*** Test, excluding Surface scan: Specified Disk only ***
SET PATH=%path%;F:\NDD
NDD C: /Q
NDD D: /Q
NDD E: /Q
WARNING: Do not allow Disk Doctor to make any changes to the disk
(unless you use its UNDO function to enable you to reverse
all changes), because Disk Doctor is not 100% reliable!
It is a useful tool for diagnosing what the fault(s) are; but
its repair functions make too many (unwarranted) assumptions,
so treat it with caution.
SEATOOLS DESKTOP
================
SeaTools Desktop v3.02 (a.k.a. SeaTools Disc Diagnostic, Desktop Edition)
The setup program SEATOOLD_EN.EXE creates a bootable floppy disk
in Drive A. The disk loads its own operating system instead of DOS or
Windows, so will always work, regardless of the Operating System in
your computer.
The program can repair bad sectors. It achieves results that no other
program can match, and fixes faults where "SeaTools for DOS" fails.
SeaTools Desktop v3 has the following drawbacks -
(1) It hogs 100% of the system's resources. Therefore, moving from one
on-screen button to another (e.g. from Help to Cancel), while the
program is running, is VERY difficult.
(2) It stops after finding 250 bad sectors. If there are more than this,
it will have to be run more than once (perhaps many times); and
every time it can take up to half an hour to reach the damaged area
on the hard disk, if it's a large disk.
(3) It automatically proceeds (having found bad sectors) to identify
which file they belong to. If there are more than 250 bad sectors
from a single file, this wastes much time; but there's no option
to make it ASK before proceeding to identify the affected file.
SCANDISK.EXE
============
Run the DOS utility ScanDisk, with Surface Scan option enabled,
to fix the disk faults.
This is a last resort. It makes changes to the disk surface,
by re-mapping or marking "bad" the bad sectors, which reduce
the chance of recovering lost data from the disk!
NB: Do not do this until AFTER recovering all recoverable data
using other tools!
*** Display ScanDisk's options ***
SCANDISK /?
*** Run ScanDisk with Surface scan ***
SCANDISK /SURFACE
NB: ScanDisk will default to the settings in SCANDISK.INI
(if present), unless other options are explicitly set!
(The INI file is at C:\WINDOWS\COMMAND\SCANDISK.INI)
HARDWARE INFORMATION DATABASE
=============================
The files DRVIDX.BIN and DRVDATA.BIN in C:\WINDOWS\INF contain
the Driver Information Database.
At system startup, each hardware device attached to the computer
reports a hardware ID to Windows, which checks to see whether
that ID is recorded in those two files. If it is not, Windows
rebuilds those two files. It also records the ID details in the
Windows Registry, but it is those two files which contain the
pointers to the location (on the hard disk) of the driver files
used by each hardware device.
Those two files can contain incorrect information. For example,
when the software for a device is upgraded, if the new driver
files are installed to a different location, or have different
names to the older ones, the two files will continue to point
to the old drivers. This can be cured by deleting the two files,
to force Windows to rebuild them on the next bootup.
*** Examine Hardware Information Database for changes ***
Check whether the file dates have changed recently!
DIR /-W C:\WINDOWS\INF\DRVIDX.BIN
DIR /-W C:\WINDOWS\INF\DRVDATA.BIN
*** Make backup of Hardware Information Database ***
REN C:\WINDOWS\INF\DRVIDX.BIN DRVIDX.BI_
REN C:\WINDOWS\INF\DRVDATA.BIN DRVDATA.BI_
*** Rebuild the Hardware Information Database ***
DEL C:\WINDOWS\INF\DRVIDX.BIN
DEL C:\WINDOWS\INF\DRVDATA.BIN
REBOOT COLD
^ Top of Page
INSTALLING A HARD DISK
======================
This section is a guide to installing a hard disk.
You will need to do this if an existing hard disk shows signs
of developing a hardware fault (e.g. bad sectors are reported,
or the disk is making unusual noises during normal operation).
NB: In that situation you must replace the disk immediately,
because it will shortly fail altogether.
The procedure is: firstly, install an undamaged hard disk on one
of the IDE cables (alongside the existing disk); then, secondly,
copy all the files from the existing disk to the new disk.
This will typically involve buying a new hard disk (e.g. from
http://www.Amazon.co.uk). Be sure to buy one that has at least
as much disk space as the disk that it's intended to replace;
you can't copy all the files from a 40GB disk onto a 20GB disk!
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
CONNECTING THE HARD DISK
========================
You must disconnect all the hard disks except the new one, so
that you don't accidentally partition or format the WRONG disk:
doing so would DESTROY all your files on the disk in question!
NB: Disconnecting all the hard disks except the new one ensures
that the new disk will be identified as Drive C.
If you create more than one partition, with all other disks
disconnected, the second partition will be Drive D (and any
further partitions will be Drive E, Drive F, Drive G, etc).
An IDE (or E-IDE) hard disk has two cables attached to it:
• A 40-pin data cable, or ribbon cable, called the IDE cable
• A 4-pin power cable
The new disk MUST be attached to the primary IDE cable (the one
plugged into the primary IDE connector, which typically has the
words "PRIMARY IDE" printed beside it on the motherboard).
The secondary IDE cable will typically be connected to a CD
or DVD drive. It is NOT necessary to disconnect this.
The new disk MUST be attached to the IDE cable as Master. The
Master connector on the cable is coloured black, and is at
the END of the cable: plug this connector into the new disk.
There is usually also a Slave connector on the IDE cable:
this is coloured grey, and is in the middle of the cable.
Do NOT attach any disk to this while setting the new disk up.
A power connector must also be plugged into the new disk. This
is typically a 4-pin connector (called a Molex connector), that
is attached at its other end to the Power Supply Unit (PSU).
Hardware Jumpers -
An IDE hard disk has a jumper "block", usually comprising 5 pairs
of pins (i.e. 10 pins in all). A tiny connector (called a "jumper")
is used to connect two of the pins together, to set the electronics
on the disk to function as a single disk, a master, or a slave.
The hard disk's casing will have a printed label gummed to it,
containing a diagram that shows which two pins to attach that
connector to, in order to produce the desired setting.
When setting up a new disk, with no other IDE hard disks attached,
the new disk will function as a SINGLE (sometimes this setting is
called "SINGLE OR MASTER"). Normally, this setting conveniently
happens to be the only one for which the jumper is NOT needed!
NB: This is so the disk cannot become completely inaccessible
where a jumper is not available (e.g. is missing or lost).
A 3.5 inch IDE/E-IDE hard disk (the standard type used in a desktop
computer) uses a jumper of one-tenth of an inch in size (0.1 inch);
sometimes marketed by their foreign equivalent size (2.54mm).
NB: As in the Screw Set manufactured by Psylins Computer
(ASIN B000JGG8ZQ) (Item model number: CMP-SCREWKIT10)
NB: This type of jumper is sold under a wide variety of descriptions
such as "jumper pins", "miniature pin jumpers", "mini jumpers",
"mini jumper shunts", "jumper caps", or "standard jumper caps".
NB: Some hard disks (such as Seagate SCSI drives) require a jumper of
a non-standard size called a "low profile" jumper.
A laptop computer uses 2.5 inch hard disks, which typically require a
smaller size of jumper: sold as (for example) 2mm micro jumper shunts.
PARTITIONING AND FORMATTING
===========================
The following procedure will (a) partition and (b) format a
hard disk. This will DESTROY all data on the disk, so is only
suitable for initially setting-up a new (blank) disk.
NB: You must NOT create any partition larger than 127.53 GB
as Windows 95/98/ME will malfunction on such a partition.
The hard disk manufacturer will typically provide a setup program
to use instead of DOS tools FDISK.EXE & FORMAT.COM [Steps 1 & 2
below], and which includes a disk cloning utility [Step 3 below]:
• Seagate provides DiscWizard Starter Edition
• Western Digital provides Data Lifeguard Tools v11.2 for DOS
Alternatively, use Partition Magic v8.05 (see below).
If you CANNOT use such a program, proceed as follows.
STEP 1: Partition the hard disk
To use a hard disk, it must first be partitioned. This is done
by the DOS program FDISK.EXE (the Fixed Disk partitioning tool).
For a hard disk to be accessible in Windows ME, which uses the
FAT32 file system, the partitioning MUST be done using a FAT32
version of FDISK (i.e. the version that comes with Windows ME).
NB: An alternative to FDISK is Ranish Partition Manager v2.40
(PART.EXE) (a 32bit version for a Hard Disk exceeding 8GB)
Firstly, create a bootable Windows ME floppy disk:
1. Go to: START > SETTINGS > CONTROL PANEL > ADD/REMOVE PROGRAMS
2. Select the STARTUP DISK tab, put a blank 3.5 inch floppy disk
in Drive A, then follow the on-screen instructions.
NB: This is also known as a "Windows ME Emergency Boot Disk".
NB: If you intend to use the hard disk with Windows 98, or
with Windows 98 Second Edition, you MUST use a bootable
floppy disk from that version of Windows instead.
To run the FDISK program, insert the bootable floppy disk into
Drive A, then start the computer. (If necessary, enter the BIOS
screen to set the boot-up sequence to boot first from Drive A.)
At the DOS prompt, type FDISK then press the ENTER key. This
will start the FDISK program.
To create a single partition occupying the entire disk:
At the first screen, answer YES when asked if you wish to enable
large disk support; you MUST answer [Y] on that screen, in order
for FDISK to create a FAT32 partition structure.
At the next screen, select: "Create DOS Partition or Logical DOS
Drive".
At the next screen, select: "Create Primary DOS Partition".
At the next screen, FDISK asks how large you want the partition
to be. If you do not enter a number, it will make the partition
as large as it can; so to make the partition fill the entire disk,
just press ENTER to continue.
NB: As well as creating the partition, FDISK will make it Active
(i.e. bootable).
The partitioning process will take a few minutes, but you'll see a
visual display of progress on screen.
And that's all you need to do to create a single partition that uses
all the space on the hard disk; so once the partitioning process has
finished successfully, press ESC to exit FDISK.
The Rules of FDISK -
The first physical disk must be the boot disk. And that disk
must contain a Primary DOS partition, which must be the first
partition on the disk (apart from the "Non-DOS partition").
A disk must have only one Primary DOS partition (i.e. type 0C).
That partition must be set as "active", if it is to be capable
of booting (i.e. starting) the computer; but only a partition on
the first physical disk is allowed to be active (i.e. set to 80).
NB: In practice, FDISK will therefore not permit a disk to be
set "active" (bootable) unless it is the IDE primary master
In addition to one Primary partition, a disk may also have one
Extended partition (i.e. type 0F).
The Extended partition can comprise a single partition, or can
be divided into several partitions. In either case, a partition
which is contained within an Extended partition is called a
Logical partition (i.e. type 0B).
Only the FIRST physical disk must have a Primary DOS partition.
Second or subsequent IDE disks can have either a Primary DOS
partition or an Extended partition, i.e. as the first partition.
DOS (and Windows) assign drive letters in the following order,
beginning with the IDE disks, starting with drive letter C -
• First, all Primary partitions (each disk has at most one)
• Second, all Logical partitions (each disk can have many).
NB: Thus *all* Primary DOS partitions will be assigned a drive
letter before *any* Logical partitions!
NB: Drive letters A and B are reserved for floppy drives.
The IDE disks are treated in the following order -
- IDE disk 0 (IDE Primary Master)
- IDE disk 1 (IDE Primary Slave)
- IDE disk 2 (IDE Secondary Master)
- IDE disk 3 (IDE Secondary Slave)
If there are any non-IDE hard disks present (e.g. SATA disks
or external USB disks), they are assigned drive letters AFTER
letters have been allocated to ALL the partitions on all the
IDE disks; and typically in this order -
- Disk(s) attached to PCI slot 1
- Disk(s) attached to PCI slot 2
- Disk(s) attached to PCI slot 3
Example -
Settings used to partition Western Digital WD800JB 80GB HDD
using Microsoft's FDISK.EXE (1 Mbyte = 1,048,576 bytes):
Mbytes available on disk: 76,317 Mbytes [80GB]
Values entered in FDISK:
• Primary DOS Partition 10,000 Mbytes
• Extended Partition 66,315 Mbytes
• 1st Logical Partition 100%
Undocumented FDISK -
See http://www.bharucha.com/tp701/fdiskSecrets.html
Check the Outcome -
After you have partitioned the disk, but BEFORE you format it:
1. Run the FDISK /STATUS command, to check the result of the
partitioning; and
2. Run the FDISK program (type FDISK) to check that the Primary
partition is marked as "Active" (the letter A is displayed
against the active partition), if the disk is to be bootable.
NB: You can't install an Operating System on the disk unless
that partition is first set as "active" (i.e. bootable).
Note -
For background information on partitioning a hard disk as
FAT16 or FAT32 see: http://www.mdgx.com/secrets.htm#FDPT
(NB: Includes many partitioning tools for DOS and Win9x)
STEP 2: Format the hard disk
Use the FORMAT.COM program (which is included on the bootable
floppy disk) to format the partition you've just created.
With the computer booted to DOS, to format the new partition
(as Drive C), at the A: prompt type this -
FORMAT C:
The formatting process takes a few minutes, but you see a visual
display of progress on screen.
Until the FORMAT command has executed, and completed, the C: drive
does not exist. Any attempt to change directory to C: will fail, and
the command DIR C: will also fail, since no drive exists until after
the formatting process has created it.
Sometimes it is necessary to type the format command as -
FORMAT C: /S
instead, so try that if the other doesn't work. This latter transfers
System files, to make the disk bootable. (NB: This means you are almost
certainly using the WRONG type of bootable floppy disk!)
The hard disk is now partitioned as a single FAT32 partition, and is
formatted as drive C:, so it is now possible to install Windows on it.
Note: If the disk can't be successfully formatted, the PC might have
a faulty motherboard (since the disk controller chip on some
boards supplements the on-disk electronics).
Options -
FORMAT /c : Causes FORMAT to retest bad Clusters; otherwise FORMAT
will mark the Clusters as bad but will NOT retest them.
FORMAT /s : Prepares a partition to make it active (bootable), by
transfering System files.
FORMAT /u : Does a unconditional format, which DESTROYS every byte
of data on the disk by overwriting it. (Afterwards do
the SYS C: command to install system files, then do a
thorough SCANDISK check to fix any disk errors.)
WARNING: You CANNOT unformat a disk formatted using the /U option!
WARNING: The use of FORMAT /S /U makes the disk UNREADABLE.
Do NOT use these two switches TOGETHER on ANY drive!
STEP 3: Install Windows 98/ME
Use a cloning program (e.g. Seagate's DiscWizard Starter Edition,
Western Digital's Data Lifeguard Tools for DOS, or Norton's GHOST)
to make a byte-by-byte copy on the new disk of a bootable partition
on another hard disk attached to the IDE cables.
NB: Norton's Ghost cannot clone its "source" partition, i.e. the
partition on which it's installed or from which it's running!
[Run it in DOS, instead of Windows, to avoid this limitation]
NB: The copying process involved in cloning a hard disk typically
takes up to 20 minutes per MegaByte (i.e. 3� hours for a 10GB
disk) if cloning from IDE Primary Master to IDE Primary Slave
The process is much faster if cloning from IDE to a SATA disk
[The fastest program, HDClone, takes only 5 minutes for 10GB]
NB: Windows ME creates a backup copy of the partition information
in the file C:\Suhdlog.dat (a hidden file) at the end of a
successful installation. Therefore, after cloning a disk NEVER
try to uninstall Windows ME from the clone! That will write the
partition information in Suhdlog.dat into the clone's MBR sector
- which will destroy the disk, because it is NOT the disk onto
which WinME was originally installed, therefore its partition
information is different from that contained in Suhdlog.dat!
Alternatively, insert a Windows installation CD in the CD-ROM drive,
and install Windows 9x from that CD.
In this latter case, you also need a valid Microsoft serial number
(called a "Product Key"). [See the Batch file]
NB: A Google search will find a serial number on the internet,
but there should be one printed on the CD's documents.
NB: Type the serial number! Do NOT copy-and-paste it, or the setup
program will reject it (a crude anti-piracy ploy).
Windows 98/ME also requires a "Product ID". This is NOT the same
thing as the "Product Key"! [See the Batch file]
The installation CD can be either a full install of Win 98/ME,
or an upgrade version. An upgrade version won't work, if there
is no existing operating system on the hard disk, unless you
insert a setup CD or floppy for an earlier version of Windows 9x
when the upgrade version asks for that.
The one other thing that FDISK can do is show you the current
partition information (i.e. the current state of the hard disk) -
FDISK /STATUS
For a more visual explanation of the FDISK program screens,
look at this site -
http://fdisk.radified.com
It explains in detail how to use the various FDISK options.
PRELIMINARY STEP: Zero-filling the hard disk
Before re-using a hard disk which was NOT previously blank, it is
prudent to delete all information from that disk, otherwise rogue
data on the disk may cause errors. The zero-filling process
eliminates any problem data, allowing normal partitioning to occur.
NB: Only an entire Disk can be zero-filled, not a Partition
NB: To save time, the Seagate program (below) has an option
to write zeros to only the first and last million bytes
First, use FDISK to delete the partition information. Run FDISK;
at stage 2 it offers the option to delete the existing partitions.
After doing so, use the command FDISK /STATUS to check that all the
partition information has been successfully deleted.
Next, use the command FDISK /MBR to wipe the master boot record clean
(or at least the part of sector CHS 0-0-1 which it does wipe clean).
Next, do a 'zero fill' of the disk: this process writes zeros to
every byte on the disk. You can get the program from the website of
the disk's manufacturer. For a Seagate disk, go to their website; etc.
It usually isn't a separate program. Manufacturers typically offer
a disk management program with many functions, only one of which is
writing zeros to the drive, so just download whatever they offer by
way of disk tools: the zeroing option should be in there somewhere.
You will need one 3.5 inch floppy disk for this step.
NB: Seagate's DiscWizard Starter Edition includes this function,
in the "Utilities" section of the program. (That program is
NOT limited to Seagate disks! It works with Western Digital
disks, and thus may work on other manufacturers' disks too!)
If the program does not offer a zero-filling option explicitly, use
any tool that offers to blank, or fill, or low-level format the disk.
NB: It is in fact impossible to low level format a modern disk,
but most manufacturers offer tools that do something similar,
to which they like to give that description.
Once the zero-filling is complete (which can take several hours for
a large capacity disk), partition and format the disk (as above).
^ Top of Page
CLONING A HARD DISK
===================
CLONING A DISK
==============
Cloning is a copying routine that creates a byte-by-byte copy of the
source disk or source partition.
The copy is identical to the original in every way.
Note: Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics.
Note: WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
DATA LIFEGUARD
==============
Management program: Data Lifeguard Tools for DOS, v11.2
This program provides functions which replace FDISK.EXE and
FORMAT.COM and GHOST.EXE (above), for Western Digital disks.
The program creates a bootable Rescue Disk on a 3.5 inch floppy
disk in Drive A. [The program requires one 3.5 inch floppy disk]
Create the Rescue Disk, then use it to start the computer.
The Data Lifeguard program will run automatically at startup;
its menus include an option to copy (i.e. clone) a hard disk,
the option "DRIVE-TO-DRIVE COPY".
*** Create bootable Data Lifeguard rescue disk ***
SET PATH=%path%;F:\DATALI~1
DLGSET~1.EXE
Warning: The Rescue Disk can be created in a Windows session,
but must boot the system to DOS to create a clone.
Do NOT try to create a clone with Windows running!
Program options -
1. VIEW INSTALLATION TUTORIAL
Instructions on how to connect your new hard disk to the computer
2. SETUP YOUR HARD DRIVE
Setup a hard disk already connected to your computer
[NB: This is an alternative to using FDISK.EXE & FORMAT.COM]
3. DRIVE-TO-DRIVE COPY
Copy a partition from one disk to another
[NB: A cloning utility, making a byte-by-byte copy]
[NB: This is an alternative to using GHOST.EXE or HDCLONE.EXE etc]
4. HARD DRIVE INFORMATION
Jumper Settings and other technical information about your hard disk
Note -
The drawback with Data Lifeguard Tools (both the DOS and Windows version)
is that you must fully partition a disk in a single session, because it
DELETES all existing partitions (thereby destroying all data on them) if
instructed to partition any un-partitioned space.
DISK WIZARD STARTER EDITION
===========================
Disk Wizard Starter Edition (DWSE) (English version).
DiscWizard is a Seagate program, for setting up a new Seagate
IDE disk; but the cloning utility (called 'Copy a Partition')
works with ANY make of disk: it is designed to copy whatever
existing IDE disk the user has, onto his new Seagate disk, as
a byte-by-byte copy (in order that the copy will be bootable
if the original is, by preserving all settings).
The program creates a bootable Rescue Disk on one 3.5 inch
floppy disk in Drive A.
Create the Rescue Disk, then use it to start the computer. The
DiskWizard program will run automatically at startup; its
menus include an option to copy (i.e. clone) a hard disk.
*** Create DiscWizard Starter Edition v10.32 ***
SET PATH=%path%;F:\DWSE\v10_32
DWSE_EN.EXE
*** Create DiskWizard Starter Edition v10.45 ***
SET PATH=%path%;F:\DWSE\v10_45
DWSE_EN.EXE
Warning: The Rescue Disk can be created in a Windows session,
but must boot the system to DOS to create a clone.
Do NOT try to create a Clone with Windows running!
NORTON GHOST
============
Norton's GHOST for DOS v8.3 (GHOST.EXE) can clone an entire disk,
but it only works with IDE disks: not SATA or SCSI or USB.
NB: Some versions of Norton GHOST, that run under Windows, will
clone non-IDE disks. It's only GHOST for DOS that will not.
NB: To clone a non-IDE disk where Windows is inaccessible, use
HDClone Professional (see below).
It can clone a disk to a smaller one, provided the used space
(i.e. data) on the source disk does not exceed the capacity of
the destination disk: i.e. if the difference is just free space.
NB: Norton Ghost 2003 is notorious for creating corrupt image
files, due to faulty compression, although it is safe for
normal (i.e. uncompressed) disk-to-disk direct cloning.
(Norton's Ghost for DOS v8.3 does NOT have this fault!)
PCOPY mode must be used if the new disk is to be bootable.
Syntax -
MODE=COPY
Copies the contents of one disk to another (file-by-file)
MODE=PCOPY
Clones a partition to another partition (byte-by-byte)
SRC=Source
Drive number, or Drive number & Partition number
DST=Destination
Drive number, or Drive number & Partition number
SRC and DST examples in PCOPY mode:-
1:2 means the 2nd partition on the 1st disk
2:1 means the 1st partition on the 2nd disk
Examples -
1. Copy disk 1 to disk 2:
GHOST.EXE -clone,mode=copy,src=1,dst=2
2. Copy the 1st partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=copy,src=1,dst=2
3. Clone the 1st partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=pcopy,src=1:1,dst=2:1
4. Clone the 2nd partition of disk 1 on
the 1st partition of disk 2:
GHOST.EXE -clone,mode=pcopy,src=1:2,dst=2:1
Options that may be useful for troubleshooting:
-FRO : Forces Ghost to continue cloning even if the
source contains bad sectors
-FX : Forces Ghost to eXit to DOS after the operation
is complete
-FFATID : Changes the partition ID of the DESTINATION to the
recommended partition ID for that FAT32 partition
[The partition ID is stored in the partition table]
-PMBR : Specifies that the Master Boot Record of the
DESTINATION disk be Preserved when performing
a Disk-to-Disk or Image-to-Disk operation
Other command line options are summarised at:
http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082612540625
http://service1.symantec.com/SUPPORT/on-technology.nsf/docid/1998082413392025
*** Display Ghost's help screen ***
GHOST /?
GHOST -?
UNDISKER.EXE
============
Undisker v1.2 can clone an entire IDE Hard Disk.
This is a Windows program. It cannot be used to clone the
boot drive (because Windows constantly makes random writes
to the boot partition); but it can clone any other partition.
It can create the clone on any disk attached to the system,
including a USB drive or other external disk on a USB port.
Its main purpose is to create .ISO image files (compressed or
uncompressed), including disk images, on a recordable CD/DVD.
*** Run Undisker ***
SET PATH=%path%;F:\UNDISKER
UNDISKER.EXE
MEDIA TOOLS
===========
The program Media Tools can also clone an IDE disk.
ACRONIS TRUE IMAGE
==================
The program Acronis True Image can also clone an IDE disk.
XCOPY32.EXE
===========
An alternative means of copying an existing partition (e.g. Drive C:)
to a new hard disk (e.g. Drive D:) is to use XCOPY32.EXE (a program
which is part of MS-DOS 8 included with Windows ME).
This does NOT create a true clone of the source partition; but in an
emergency it provides a reliable means of copying all the files on a
partition if no other software is available (e.g. no internet access).
*** Set Path ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Copy all files on Drive C: to Drive D: ***
C:
CD \
XCOPY32 *.* D:\ /S/E/R/C/H/K/Y
OTHER SOFTWARE
==============
Details of a number of free Cloning and Imaging programs, for
making and restoring a hard disk backup, are given on-line at
http://www.thefreecountry.com/utilities/backupandimage.shtml
NB: Some of these are NOT suitable for use with FAT32 disks,
or will NOT run on Windows 98/98SE/ME.
THE "MYSTERY BYTES"
===================
NEVER start Windows with both the source disk and clone attached
to the IDE cables. A clone disk must NOT be attached (by the IDE
interface) to the same computer as the disk of which it's a copy,
as that will cause a fault!
A full explanation of the "mystery bytes" fault, including symptoms,
is set out above, under OTHER ERROR MESSAGES ("Invalid system disk").
The fault can be cured by manually zeroing the six bytes DA to DF
(bytes 219 to 224) in sector CHS 0-0-1 (LBA sector 0) [the MBR sector]
on the CLONE disk, the "mystery bytes"; e.g. using Norton's DiskEdit.
See: http://TheStarman.pcministry.com/asm/mbr/mystery.htm
VOLUME IDENTIFIER
=================
Windows may change the Volume Identifier on the clone disk to
non-bootable, if the clone is installed as IDE Primary Slave
for the cloning operation. So when it's then installed as the
Primary Master it won't boot!
To avoid this, when cloning is complete do NOT let the cloning
program "reset" the computer, as booting immediately to Windows
is what causes this fault! Instead, shutdown the computer, then
remove the source disk and install the CLONE disk as the IDE
Primary Master, before booting to Windows.
CLONING SATA, SCSI OR USB DISK
==============================
The only program which can clone a FAT32 disk connected by a
Serial-ATA (SATA), or an SCSI, or a USB connection in Win9x is
HDClone Professional v3.6 (the Professional edition of HDClone v3.6).
NB: The program can also clone a disk connected on the IDE interface.
The bootable floppy disk version does not load DOS or Windows. It
starts the computer using its own (proprietory) Operating System.
NB: The other cloning programs can all clone a Parallel-ATA (PATA)
disk, i.e. an IDE disk, in DOS. But none of them can clone a
disk connected by a Serial-ATA (SATA) or SCSI or USB connection
in DOS, only in Windows (i.e. using a Windows 9x device driver):
which results in a file-by-file copy, not a byte-by-byte clone.
NB: On a Windows 9x computer (manufactured between c.1998 and 2001),
the motherboard will NOT have either USB 2.0 or Serial-ATA (SATA).
Those facilities can be added, by fitting a USB 2.0 and/or SATA
PCI card in an empty PCI slot on the motherboard.
HDClone can clone either an entire disk or a partition on the disk.
Note:
Detailed instructions on the use of this program are set out below
(at HARD DISK EXCEEDING 137GB: CLONING). The procedure described
there will also work for a hard disk smaller than 137GB.
Warnings:
1. HDClone can only be run safely after a COLD boot. It is
NOT safe to run the program after a warm reboot; i.e. HDClone
must NOT be run using the start option "Restart" or "Stand by".
The computer must be started from a switched-off state!
2. After cloning, the computer will malfunction if both the source
and the clone partition have the same Volume Serial Number in
their respective Boot Sectors. So it's ESSENTIAL to select the
HDClone option "Patch Boot Code", to force the program to give
the clone a different serial number (if both clone and source
will ever be conected to the same computer at the same time).
NB: The fault will occur however the partitions are attached,
i.e. even if one is on a disk connected to the IDE cables
and the other is on a disk attached to a PCI card (e.g. as
a USB or SATA device), because it's caused simply by more
than one partition having (in effect) the same address.
NB: The fault can be cured by editing either partition manually,
e.g. using DE.EXE v1.04 (PTS disk editor). Bytes 68 to 71
(4 bytes) in the partition's Boot Sector must be altered: the
new number (a hexadecimal number) can be ANY number, provided
it is not the same as the Volume Serial Number of any other
partition (i.e. "drive") attached to the computer.
You can enter a new hexadecimal number there yourself. But the
safest action is to change each of those bytes to zero; Windows
will then allocate a new number to that partition on the next
reboot, automatically (thus avoiding any possible problem).
The PTS disk editor can function even on a hard disk exceeding
137GB. I've used it successfully on a 500GB disk, while booted
to Windows (running Windows ME); so it is certainly capable of
correctly accessing any hard disk of up to 512GB.
For a detailed analysis of the contents of the Boot Sector
on a FAT32 partition, see "Disk Structures" (above).
^ Top of Page
HARD DISK EXCEEDING 137GB
=========================
For additional technical details concerning a disk
exceeding 137GB see Compatible hardware with Windows 9x
Whenever you open the computer's case, take the appropriate
anti-static precautions to avoid harming the electronics
WARNING - Danger of death! You must NOT open the computer's case
unless the electricity is switched OFF at the wall power socket!
BIOS CONSIDERATIONS
===================
The BIOS on a Windows 9x computer, manufactured before 2001, uses
28-bit LBA. This provides only enough LBA addresses to address a
disk not exceeding 137GB (using the largest possible cluster size
that is valid in MS-DOS and Windows 9x, i.e. 32KB clusters).
The BIOS can thus only recognise the first 137GB of disk space.
If a larger disk is attached, it may appear to be a 137GB disk.
But even if it appears to be larger, writing to the disk above
the 137GB barrier will fail (and may corrupt the entire disk).
48-bit LBA Addressing:
To avoid disk corruption you MUST upgrade the hardware to
48-bit LBA, by employing one of the following solutions:
(a) Install a PCI Card containing a BIOS which recognises
a larger disk (i.e. a BIOS which uses 48-bit LBA),
and attach the disk to that. These PCI Cards typically
support only SATA disks.
NB: See INSTALLING A HARD DISK EXCEEDING 137GB, below
(b) Upgrade the motherboard BIOS to recognise a disk exceeding
137GB (e.g. download a BIOS upgrade from the motherboard
manufacturer's website, buy a customised BIOS upgrade from
R Loew, fit the free LLXX patch, or buy a new motherboard).
NB: See TECHNICAL NOTES, below
(c) Install DDO (Dynamic Disk Overlay) software, which
replaces the standard Boot Loader program in the MBR
with one which is compatible with 48-bit addressing
(available, for example, from Rudolph Loew).
NB: See TECHNICAL NOTES, below
(d) Install the Intel Application Accelerator program, if
the motherboard has a compatible Intel chipset.
NB: See INTEL APPLICATION ACCELERATOR, below.
(e) Install a PCI Card (ATA-133 or ATA-166) that overlays
the BIOS and maps as an SCSI device (manufactured
by companies which include Maxtor and Promise).
These Cards work because they map as an SCSI device,
which does not have the size limitation of IDE drives.
You must buy a Card which comes with Windows 95B/98/ME
driver files. Some list drivers for Windows ME only,
but these work in Windows 95B and Windows 98 too.
You can boot from a disk connected to such a Card, if
the computer's BIOS allows booting from SCSI devices.
You have to disable the on-board primary IDE controller,
but you can still use the on-board secondary IDE port.
NB: Pre-2001 motherboards cannot boot from SCSI devices,
because the older BIOS programs don't support that.
Non-bootable PCI Cards map as an SCSI secondary device
in Windows 95B/98/98SE/ME.
DOS and Windows:
Even if the computer is fitted with 48-bit LBA hardware,
Windows 98/98SE/ME and DOS (the software) can only function
correctly on a drive (i.e. partition) smaller than 126 GB.
NB: The traditional solution is to divide a disk larger than
126 GB into several partitions, each smaller than 126 GB
NB: One way for those versions of Windows to function on a
larger partition is to install Rudolph Loew's unofficial
versions of the files ESDI_506.pdr and VFAT.vxd (which
are patched to support a partition exceeding 126 GB).
INSTALLING A HARD DISK EXCEEDING 137GB
======================================
How to install a Serial-ATA (SATA) hard disk larger than 137GB,
for use as additional storage in Windows 9x (e.g. as Drive D):-
Step 1: Buy a SATA Hard Disk
A SATA disk not exceeding 512GB can be used as additional storeage
on a Windows 9x system (e.g. a 500GB WD Caviar Blue WD5000AAKS).
NB: It cannot be installed as Drive C (the bootable drive), because
a pre-2001 Windows 9x motherboard cannot boot from a SATA disk.
NB: A SATA disk is the safest choice on a Windows 9x system, because
a Win9x motherboard normally has no SATA ports! Thus there is no
possibility that the disk could ever be accidentally connected to
the motherboard (which doesn't support disks exceeding 137GB).
Step 2: Buy a PCI Card
Purchase a PCI card that has a 48-bit LBA controller, which provides
essential support for a hard disk larger than 137GB (for example a
StarTech PCI SATA Controller Card, ASIN B001ZC561U, with its 48-bit
VIA VT6421 chip).
NB: The StarTech PCI SATA Controller Card is compatible with an older
(e.g. 1998) model PC, as it uses PCI 2.2 and provides driver files
for Windows 9x; and it provides scope for future expansion, for it
includes an e-SATA port (which will accept external SATA devices).
A CD containing the essential Windows 98 driver files will typically be
included with the PCI card. This software is needed for the motherboard
to recognise the new device (i.e. the 48-bit LBA chip on the PCI Card).
NB: The CD included with the StarTech ASIN B001ZC561U PCI Card contains,
in a subdirectory, the driver files VIAMRAID.mpd and VIAMVSD.VXD
(which install in C:\WINDOWS\SYSTEM\IOSUBSYS) and VIAMRAID.INF
(which installs in C:\WINDOWS\INF\OTHER).
If the PCI card is SATA-I, but the disk is SATA-II, set the disk to run
at SATA-I speed: by using a mini jumper pin to force the disk to emulate
a SATA-I disk. On a WD5000AAKS disk, jumper pins 5 and 6 using a 2.54mm
mini jumper pin (e.g. Psylins Computer CMP-SCREWKIT10, ASIN B000JGG8ZQ).
Step 3: Buy a Drive Caddy (or Adapter Brackets) [Optional]
Purchase a Serial-ATA (SATA) Drive Drawer (e.g. StarTech caddy DRW110SAT
ASIN B0000E2Y7T), to fit into an empty 5.25 inch drive bay. It holds the
SATA hard disk, and connects to the PCI card's internal SATA port.
NB: For maximum flexibility, the StarTech DRW110SAT caddy accepts both
SATA-I and SATA-II hard disks.
NB: The StarTech ASIN B001ZC561U PCI card comes with a SATA data cable,
for connecting the PCI card to the caddy, so it is not necessary to
buy a SATA data cable separately.
Step 4: Installation Procedure
With the mains power switched OFF, plug the PCI card into a PCI socket,
but do NOT install the caddy or the hard disk. On startup, the computer
will detect the PCI card and ask for the driver CD. Insert it, then
navigate to the location of the Windows 9x drivers.
NB: For the StarTech ASIN B001ZC561U PCI card -
(a) If your CD drive is Drive D, the driver files will be at:
D:\Windows\VIAStor\driver\Raid\win9x
(b) It is NOT necessary to run the included RAID program
if your computer will only have a single SATA disk.
(NB: The RAID functions manage multiple SATA disks)
(c) In Windows 9x, it is NOT necessary to run the SETUP.EXE
program in the CD's root directory.
Then continue with a normal startup. Once the desktop appears, check
in Device Manager (Start > Settings > Control Panel > System), under
"SCSI controllers", for the entry "VIA VT6421 RAID Controller".
Then shutdown the computer normally. With the mains power turned OFF,
install the drive caddy (containing the hard disk): connect the caddy
to a 4-pin Molex power connector, and to a (red) SATA data cable;
then connect that red cable to the PCI card's internal SATA port.
NB: If you are not installing a caddy, connect the Molex conector and
the data cable directly to the hard disk.
NB: The hard disk(s) attached to the IDE interface must NOT be jumpered
to use "cable select", because that can cause a fault on bootup
when using IDE disks and SATA disks in the same computer.
Set the hardware jumper pin on the IDE boot disk (e.g. Drive C)
to SINGLE or MASTER (as appropriate to the printed instructions on
the hard disk's label) if only one IDE disk is attached. Otherwise,
set the IDE boot disk to MASTER and the other IDE disk to SLAVE,
and connect both to the Primary IDE cable; the MASTER must be
attached to the end of the cable, and the SLAVE to the middle.
A faulty IDE cable (40-pin ribbon connector) can cause the same
fault on bootup, even if the hardware jumper pin is correctly set.
Then start the computer normally. The hard disk is not yet partitioned,
or formatted, so Windows cannot yet "see" it. The next step therefore
is to partition and format the new hard disk.
NB: You cannot use the DOS tools FDISK.EXE or FORMAT.COM for this step,
because when a computer is booted to DOS there is no means for it
to access a SATA disk, since no DOS drivers for SATA exist.
NB: If you bought a Western Digital hard disk, their website provides a
downloadable program called "Data Lifeguard Tools for Windows". Use
it to partition and format the new disk in Windows; create several
120GB partitions, as Windows 9x CANNOT use one larger than 127.53GB.
NB: "Data Lifeguard Tools for Windows" can also copy files from an
existing disk to the new disk (e.g. copy the entire Drive C to
the new disk). Alternatively, you can use XCOPY32.EXE (above).
HARD DISK EXCEEDING 137GB: PARTITIONING
=======================================
The following is a more flexible, though also more complicated, method
for partitioning a hard disk larger than 137GB.
PARTITION MAGIC v8.05 -
Open Partition Magic v8.05 in Windows.
The program has an option to set existing disks (containing your data)
as READ ONLY. This is an ESSENTIAL precaution, to avoid accidentally
destroying one of your existing partitions! To do this, go to:
General > Preferences
Then create a Partition (smaller than 127.53GB) on the new hard disk.
NB: Windows 98/98SE/ME will malfunction if a partition is larger than
that; the actual maximum is 136,935,522,304 Bytes (130,591.89 MB)
(which is 127.5311431884765625 GB).
The program allows you to specify the exact size of the partition
to be created. It also allows you to either partition all the space
on the new disk immediately, or to leave some space unpartitioned
(i.e. to be partitioned in a later session); this is more flexible
than the options in "Data Lifeguard Tools for Windows".
NB: If the new hard disk is marked as "Removeable" (in Device Manager)
Partition Magic won't recognise it!
NB: To re-use a SATA disk that has held data previously, it is prudent
to remove all traces of the old (unwanted) data by writing zeros
to the SATA disk before beginning any partitioning, e.g. with
Western Digital's program "Data Lifeguard Diagnostics for Windows".
Set Drive letter (using Device Manager), in Windows:
NB: Do so ONLY when all partitions have been created (because
if a hard disk is marked as "Removable", in Device Manager,
Partition Magic v8.05 won't recognise it!)
NB: Set up all removable disk drives (i.e. all partitions on the
SATA disk) so that they're the last drives on the system!
[This is the purpose of reserving specific drive letters for
the partitions on the SATA disk: in this way the permanent
disks (i.e. the IDE disks) will remain as drive C:, D: & E:
even when the SATA disk is connected to the computer.]
HARD DISK EXCEEDING 137GB: CLONING
==================================
The following is a more flexible, though also more complicated, method
for cloning (i.e. copying) an existing partition onto a new hard disk
larger than 137GB.
HDCLONE PROFESSIONAL v3.6 -
The setup program creates a working copy of HDClone Professional v3.6
on a blank floppy disk in Drive A.
Using HDClone Professional v3.6 in practice -
Step 1:
Insert the bootable floppy disk containing HDClone into Drive A,
then start/restart the computer.
NB: The computer must be set, in the BIOS, to boot from Drive A
(the floppy drive) before Drive C. To enter the BIOS, press
the appropriate key (e.g. DEL) (on some systems, F1 or F2 or F11)
repeatedly at startup.
NB: You must create the partition structure on the new disk before
running HDClone, as it has no ability to create partitions.
Step 2:
In the opening screen, select the copy method: Partition to Partition
To do so, use the mouse: select "Partition" as the source, and then
"Partition" as the target.
NB: The hard disk is not copied in its entirety. Only the contents of
one individual partition is copied.
This copy is executed sector by sector, therefore (relative to the
beginning of each partition) the individual sectors are moved to
the same address. However, in contrast to the drive-to-drive mode,
the individual sectors are not at the same absolute address in
relation to the complete (target) hard disk.
Such a copy is therefore not directly usable, but only after it has
been copied back, or been adapted to the changed absolute position
on the hard disk (as to which see "Adjust Target", below).
Step 3:
Select the Source partition (i.e. on an EXISTING disk).
NB: Copying takes about 3 minutes per 10MB
(20MB = 5 min; 80MB = 25 min)
Step 4:
Select the Target partition (i.e. on the NEW disk).
Step 5:
Select the Options (e.g. verify copy, smart copy).
NB: To do a byte-by-byte copy, set "Smart copy" to OFF.
NB: Selecting "Verify" (verifying the copy) will double
the time involved, because a 2nd pass is required.
Step 6:
Confirm the selections, and begin the copying process.
NB: For "Auto Expand" select OFF. (This option will only appear
if the Target partition is larger than the Source.)
Step 7:
Adjust the Target disk; i.e. allow HDClone to make certain
adjustments to the target disk (in the final screen).
HDClone automatically sets parameter values that are optimal.
These usually ONLY need to be confirmed; a manual change of
the preset parameters is needed only in exceptional cases.
NB: This means accepting ALL the suggested adjustments! It
is NOT necessary to change any of the proposed settings;
and in practice it's essential not to change any of them!
NB: The following notes assume that the Target disk is a 500GB
SATA disk, used in a pre-2001 Windows 9x computer, with an
older BIOS that cannot boot from a SATA disk. These notes
do NOT apply in any other case.
(a) GEOMETRY -
Geometry used : The geometry of the Target (i.e. clone) disk
must be set as LBA (Large Block Addressing).
NB: A FAT32 disk larger than 8GB must use
LBA (including a disk larger than 137GB)
(b) MBR -
Adopt partition ID : Use the same partition type as on the Source disk.
NB: This option is only offered for the Primary DOS
partition of the Target disk. In other cases it
is greyed-out.
NB: Type 0C (FAT32 LBA) is normal for a Primary DOS
partition on a FAT32 disk. Do NOT set any other
partition type for the Primary DOS partition of
the Target disk. See DISK STRUCTURE NOTES above.
Adjust partition size: Set the size of the Target partition to the
exact size of the Source partition.
NB: This guarantees that the clone (Target)
partition will be the same size as the Source
(will have the exact same number of Sectors);
so it will be as close a match as possible
to the Source partition, in every way.
NB: This will cause an option to pop-up,
offering to resize the Target to match
the size of the Source, if they differ.
Adjust CHS layout : Use the CHS values set in 'Geometry used' for
adjusting the MBR & Boot Sector of the Target.
NB: This option is normally greyed-out
(because CHS is not used if the
Target disk is larger than 8GB)
Reset disk signature : Reset the Target disk's unique media signature.
This sets bytes DA to DF [Disk Serial Number] in
the Target's MBR (see "DISK STRUCTURE NOTES" above)
to a different ID number than the Source disk.
NB: This is an ESSENTIAL step! It would be fatal
to use the unique ID signature of the Source disk
on the Target disk: they would effectively *both*
have the same "address", causing the computer to
crash on startup.
(c) BOOT SECTOR -
Adjust offset : Adjusts the partition's start address (in the
boot sector of the Target partition).
NB: This is an ESSENTIAL adjustment! The Target
partition will NOT be accessible by Windows
if this adjustment is not made.
Patch boot code : Avoids boot problems on older hardware.
NB: What this does is unclear; but there is NO
possibility of the Target (SATA) disk ever
being used to boot the system, as a pre-2001
m/board BIOS cannot boot from a SATA disk!
So it is safe to allow this: any changes
made will have NO practical consequences.
Change Volume ID : Create a new ID for the Target partition.
This is ESSENTIAL if the source and target
partitions are to be used in the same PC!
A Volume (partition) serial number is randomly
generated each time you format the partition.
(NB: A simple DIR command in DOS displays the
8 character Volume Serial Number [xxxx-xxxx])
This serial number must be different on
every partition present in the computer, as
Windows uses these ID numbers to identify
(i.e. differentiate between) the partitions.
NB: The hard disk also has a serial number,
one that is hardcoded to the hardware,
but this is NOT a reference to that.
NB: This is NOT a reference to the Volume label
(i.e. the 11 character Partition name).
HARD DISK EXCEEDING 137GB: TROUBLESHOOTING
==========================================
A Serial-ATA hard disk attached to a PCI Card can stop being
recognised by Windows, after a successful install and a period
of successful use, due to a conflict in the Windows Registry.
NB: This type of Registry error usually arises as a result of
installing an additional hard disk, after the SATA disk.
The symptom of the fault is that Windows hangs during bootup with
the SATA disk attached, but starts normally if it is not attached.
In that situation, start the computer using the HDClone Professional
floppy disk. If the SATA disk is recognised by HDClone the fault is
a Registry error (rather than, say, a faulty SATA data cable).
Typically, the Registry key HKEY_LOCAL_MACHINE\Enum has conflicting
hardware settings: one of the Drive Letters has been allocated to
more than than one disk. Examine its subkeys (using REGEDIT.EXE),
and re-allocate the Drive Letters such that none are used twice.
NB: The SATA disk's registry key is in HKEY_LOCAL_MACHINE\Enum\SCSI
and the keys for the IDE disks are in HKEY_LOCAL_MACHINE\Enum\ESDI
This fault can only occur when (a) the same Drive Letter is allocated
to more than one partition, and (b) *both* of the affected partitions
are marked as non-removable.
NB: Where a disk is marked in the Registry as removable, Windows can
resolve any conflict automatically, by reallocating its Drive
Letter(s), but is not capable of that with a non-removable disk.
In HKEY_LOCAL_MACHINE\Enum reallocate the Drive Letters manually
so none is used twice, if the SATA disk is to be non-removable.
An alternative solution is to mark the SATA disk as removable. On
each bootup, Windows will then allocate it Drive Letters not in use
by the IDE disks. The procedure is:
1. In the sub-key for the SATA disk, create a new BINARY value;
2. Name it REMOVABLE;
3. Give it the value 01 (hex).
INTEL APPLICATION ACCELERATOR
=============================
Intel Application Accelerator is a disk driver for hard disks larger
than 137 GB on Intel motherboards. It works ONLY with Intel chipsets.
IAA version 2.2.0.2126 does NOT correctly support disks larger than
128 GB in Windows 98SE. The disk size is reported correctly, but
read and write attempts above 128 GB fail.
This fault seems to be corrected in IAA version 2.3.0.2160.
This fault may apply to other Windows versions too.
Note: The Intel Application Accelerator is not compatible with the
Intel 875P, 865G/P/PE, 852/855 GM/GME, 855MP, 848P or 815EM chipset,
the Intel 440 chipset family, or any earlier Intel chipsets; and is
also not compatible with any Intel 900 series Express Chipset families.
NB: See http://www.intel.com/support/chipsets/iaa/sb/CS-009312.htm
TECHNICAL NOTES
===============
Overcoming the 137 GB Barrier -
The methods of overcoming the 137 GB barrier (imposed by a
28-bit motherboard) include:
(a) Installing a 48-bit LBA hard disk controller (i.e. fitting
a new motherboard with a 48-bit LBA controller, or a PCI
Card with a 48-bit LBA controller) to attach the disk to.
For example, connect the hard disk to the computer using
a USB 2.0 port or a SATA port, by adding a PCI card that
uses 48-bit LBA. The 137 GB barrier is a limitation
of the motherboard's IDE controller.
(b) Installing Dynamic Disk Overlay (DDO) software, replacing
the standard MBR loader code (e.g. OnTrack's Disk Manager)
[as was done to overcome capacity barriers at 540MB, 8GB].
(c) On a m/board with a compatible Intel chipset, installing
a free program called the Intel Application Accelerator
which provides a 48-Bit LBA ATA/ATAPI controller driver
(IntelATA.mpd) that replaces the Windows 98/ME/2000/XP
ATA controller driver (ESDI_506.PDR).
(d) The Loew's driver patch and the LLXX driver patch both
replace the Windows 98/ME driver file ESDI_506.PDR
(and Loew's patch also replaces VFAT.vxd) - see below.
Size Limits for Windows Partition -
FAT32 uses 28 bits (not 32 bits), which allows for a maximum
partition size of 8 TB. However, the volume boot record (VBR)
(a.k.a. partition boot record or PBR) has a 32-bit field for
storing the total number of sectors in the partition, which
results in an actual partition size limit of 2 TB.
Research by R Loew has established that a fault in the file
VFAT.vxd (the Windows 9x protected mode filesystem driver)
prevents it from working correctly above 1 TB.
He has developed a patch to fix that fault. So the partition
size limit of FAT32, under Windows 9x, is 1 TB unless you buy
his patched version of VFAT.vxd, when it becomes 2 TB.
However, you will also need to buy a patched version of the
file ESDI_506.pdr from him, in order for Windows 9x to exceed
the design limit of 127.53 GB in the original ESDI_506.pdr file.
A freeware patch for Windows 98SE, by a different developer,
for ESDI_506.pdr only (not VFAT.vxd) is at:
http://www.mdgx.com/files/BHDD31.ZIP
A freeware patch for Windows ME, by a different developer,
for ESDI_506.pdr only (not VFAT.vxd) is at:
http://www.mdgx.com/files/ME48BLBA.EXE
Further Information -
There is a wealth of technical detail about this topic at:
http://www.msfn.org/board/index.php?showtopic=129027
^ Top of Page
ANTI-STATIC PRECAUTIONS
=======================
Whenever you open the computer's case, take the appropriate
precautions
|
WARNING - Danger of death! You must NOT open the computer's case unless the electricity is switched OFF at the wall power socket! |
And be careful not to touch anything inside the computer's case
except after first taking the following anti-static precautions
to avoid static electrical damage to the delicate electronics
READ THESE PRECAUTIONS IN FULL BEFORE PROCEEDING
You MUST follow these ESSENTIAL safety precautions:
1. Shut down the computer, and SWITCH OFF the mains power at
the wall socket. You will DIE if you don't do this!!!
2. If the computer has a 2-pin mains plug, UNPLUG the computer
from the wall socket. With the mains power cable unplugged,
immediately before touching anything inside the computer earth
yourself by touching unpainted bare metal on a central heating
radiator pipe or a cold water pipe, as such pipes are normally
connected to ground. Do this for yourself AND for your tools.
NB: Do this every time before touching anything inside the computer;
because, as you move about, contact with carpets and clothing
generates more static electricity on the surface of your body.
NB: If the computer is NOT a Desktop model (e.g. a laptop), you
MUST proceed as though it has only a 2-pin mains plug, as
non-Desktop power supplies are frequently not earthed.
3. If you are in the United Kingdom, Australia, New Zealand or some
other country that uses a third (earthing) pin in mains power plugs,
and the computer has a 3-pin mains plug, switch OFF the mains power
but DON'T unplug the computer from the wall socket: the 3rd pin
is an Earth connector, which grounds the chassis (the metal case)
of the computer. Also, immediately before touching anything inside
the computer, touch an unpainted bare metal part of the chassis
(the casing) with your bare hand. The metal casing is connected to
earth (through the wall socket), so your body is thereby earthed,
draining any static electricity from your body: half a second and
it's gone. Do this for yourself AND for your tools.
NB: Do this every time before touching anything inside the computer;
because, as you move about, contact with carpets and clothing
generates more static electricity on the surface of your body.
NB: Alternatively, rest your bare forearm on an unpainted
bare metal part of the casing continuously (so leaving
both of your hands free); or wear an anti-static strap.
NB: If the computer is NOT a Desktop model (e.g. a laptop), you
MUST proceed as though it has only a 2-pin mains plug, as
non-Desktop power supplies are frequently not earthed.
4. Don't let any part of your clothing touch anything inside the
computer, as clothes can carry a large static electric charge.
It is therefore best to roll your sleeves up.
5. While working inside the computer don't scuff around on the carpet
or slide in and out of a chair, as that will cause a build-up of
static electricity.
6. You must also take these precautions when handling any component
that you unplug from the computer, or intend to install in it,
such as a hard disk, or a PCI card, or a RAM memory module.
Warning:
NEVER OPEN THE COMPUTER UNLESS THE POWER IS OFF AT THE WALL SOCKET
If you didn't know that, you shouldn't be attempting this repair!
^ Top of Page ______________________________________ SECTION E: RESTORING PRE-CRASH STATE ______________________________________
CHECKING DISK AFTER A REPAIR
============================
After repairing a Hard Disk, it is prudent to check it for Disk Errors
(to establish whether any further errors still need to be fixed)
SCANDISK
========
(a) ScanDisk for DOS
If Windows cannot load, use the DOS version of Microsoft's
ScanDisk (a.k.a. ScanDisk for DOS).
NB: The option /CUSTOM forces the program to use the settings
in the customised file SCANDISK.INI in C:\WINDOWS\COMMAND
NB: Do NOT allow SCANDISK to make any changes to the disk!
*** Set PATH ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Run ScanDisk for DOS ***
SCANDISK C: /CHECKONLY /SURFACE
SCANDISK D: /CHECKONLY /SURFACE
SCANDISK E: /CHECKONLY /SURFACE
(b) ScanDisk for Windows
If Windows can start, use the Windows version of Microsoft's
ScanDisk (a.k.a. ScanDisk for Windows) instead of, or as well as,
the DOS version.
NB: Do NOT allow SCANDISK to make any changes to the disk!
*** Set PATH ***
SET PATH=%path%;C:\WINDOWS
*** Run ScanDisk for Windows ***
SCANDISKW C:
SCANDISKW D:
SCANDISKW E:
NORTON DISKEDIT
===============
When Norton's DiskEdit 2002 first accesses a partition (i.e. drive)
it spends 2 or 3 minutes scanning that partition. When the scanning
completes, the details of any disk errors found are displayed.
NB: The errors found can thereafter be viewed by going to -
INFO > ERROR INFO
NB: If there are too many directories on the partition, then,
depending upon the amount of installed RAM memory, allowing
the scan to complete will crash DiskEdit and the computer.
(This can be avoided by aborting the scan part-way through)
NB: On scanning a partition, no error information is normally
displayed: i.e. no message pops-up saying there are NO disk
errors! Only if a fault is found does a message appear.
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
Warning:
The function "Advanced Recovery Mode" in Norton DISKEDIT 2002
does not work properly.
To access that option, select "Physical disks" then go to:
Tools > Advanced Recovery Mode
The function reports an incorrect value for "Sectors per Cluster".
NORTON DISK DOCTOR
==================
Norton's Disk Doctor 2002 can scan a partition (i.e. drive), to
check it for disk errors. Five different tests are run.
NB: The option /Q causes all tests to run except surface scan.
NB: For details of all options available in this program, see
below (under "NORTON'S DISK DOCTOR").
*** Diagnose a Partition ***
SET PATH=%path%;F:\NDD
NDD C: /Q
NDD D: /Q
NDD E: /Q
Warning -
1. StarMan recommends that NDD should NOT be used on a system
with many logical drives (especially if the system dual boots
Windows 98 and Windows NT/2000/XP, sharing a FAT32 drive).
2. If you run NDD, never use the option FIX unless you save
all changes to an Undo file! It is not entirely reliable.
CHK IDENTIFIER
==============
One of the problems running Scandisk is that if it finds FAT chains
without any corresponding files, it creates its own set of files:
typically in the format file0001.chk, file0002.chk, etc.
When there are only a few files it is possible to guess what they are
and rename the extension accordingly, but when there are hundreds or
thousands of these files the task becomes a nightmare.
Flobo's CHK identifier can help, as it reads each file and determines
its file type. It is able to rename the files (as e.g. File0001.xls,
File0002.doc, etc) so that you can quickly open the files and use them.
CHECK HARD DISK FOR ERRORS
==========================
1. Boot to DOS (using a bootable floppy disk)
2. Run SCANDISK for DOS:-
C:\WINDOWS\COMMAND\SCANDISK.EXE C: /CHECKONLY /SURFACE
C:\WINDOWS\COMMAND\SCANDISK.EXE D: /CHECKONLY /SURFACE
C:\WINDOWS\COMMAND\SCANDISK.EXE E: /CHECKONLY /SURFACE
3. Run Norton's DiskEdit 2002:-
F:\NORTON\DISKEDIT.EXE C:
F:\NORTON\DISKEDIT.EXE D:
F:\NORTON\DISKEDIT.EXE E:
NB: Running this program in DOS automatically causes it to
scan the Drive being loaded for faults. If it finds no
faults, it doesn't tell you; but if any faults are found
it pops up a warning message.
4. Run Norton's Disk Doctor:-
SET PATH=%path%;F:\NDD
NDD C: /Q
NDD D: /Q
NDD E: /Q
Options: /C = All tests including Surface Scan
/Q = All tests except Surface Scan
^ Top of Page
WINDOWS UTILS TO CLONE DIRECTORIES
==================================
XXCOPY.EXE
==========
XXCOPY v2.85.7
The Windows program XXCOPY.EXE can clone individual directories,
as part of the process of restoring a computer to its pre-crash
state.
Those utilities which can clone an entire disk (e.g. GHOST.EXE)
(see above) will only partially restore the pre-crash state:
even the most recent backup of the damaged disk will not be
entirely up-to-date!
XXCOPY can add to the cloned disk files (or entire directories)
from other backup sources, while preserving the file dates
(Created, Modified, & Accessed).
*** Clone a Directory ***
XXCOPY "D:\Misc\" "C:\Misc\" /H /KS /E /TTA0 /TCA /TCC /TCW /ZE
Note -
The only usable version of XXCOPY is v2.85.7 as it does NOT suffer
from the nag screens and restrictions that afflict other versions!
Syntax
Directory path:
A directory address containing spaces must be put in quotation marks
(otherwise the first space encountered will cause XXCOPY to abort).
The following switch checks the destination directory:
/I If copying more than one file but destination does not exist,
assumes the destination must be a directory (no prompting).
Note: If the destination specifier ends with a backslash,
that declares a directory and implicitly sets the /I switch.
The following switches use file attribute bits:
/H Copies hidden and/or system files also.
/H0 Excludes hidden and/or system files (default).
/Ho Copies hidden and/or system files only.
/R Overwrites read-only files.
/K0 Keeps H-bit and S-bit, sets A-bit, clears R-bit (default).
/K Keeps the source attributes including read-only (same as /KS).
/KS Keeps the source attributes including the read-only bit.
/KD Keeps the attributes of the destination (overwritten) file.
/KN Sets the destination attributes to normal (only /A).
The following switches deal with subdirectories:
/S Copies directories and Subdirectories, except empty ones.
/E Copies directories and subdirectories, including Empty ones.
/T Creates directory Tree, but does not copy files: copies
all directories including empty ones (implicitly sets /E).
The following switches control timestamps:
/TTA Touches (modifies) timestamp of Last Access of source.
/TTA0 Preserves timestamp of Last Access of source (default).
/TCA Copies the timestamp of Last Access from source to dest.
/TCA0 Uses current time for destination's Last Access (default).
/TCC Copies the timestamp of Create Time from source to dest.
/TCC0 Uses current time for destination's Create time (default).
/TCW Copies the Last Write time from source to dest (default).
/TCW0 Uses current time for destination's Last Write time.
NB: In Windows 9x, this ONLY works with Files. It does
not work with Directories. To make a genuine
clone of the disk, use e.g. Norton's Ghost (above).
Batch File Options:
Source is current directory -
"."
Example:
XXCOPY "." "C:\My Documents\"
No screen output, no log file -
/oD0
CLONE Switch -
XXCOPY "C:" "D:" /CLONE /ED
/CLONE Duplicates a directory or an entire partition. This switch
is a shortcut for: /KS/H/E/R/Q/Y/BI/ZY/ZE/oD0
NB: Really, an incremental backup, not a clone. The existing
files on the target will be updated, but *only* if they
have changed; and any new files (i.e. those not present
at all on the target) will be added.
This is NOT a byte-by-byte clone of the Partition: any
new directories will have the CURRENT date; in Win9x,
the date/time stamps of a directory can NOT be recreated
(unlike those of a file).
Options:
/KS Keep attributes of Source file
/H include Hidden & system files
/E include even Empty subdirectories
/R overwrite Read-only files in the destination
/Q Quiet (no screen display, no log file)
/Y suppress the prompt before overwriting
/BI copy all files in source that are different from
files in destination in either filetime or size
/ZY delete extra files or subdirectories in destination,
with no confirmation prompt
/ZE disable all Environment variables (e.g. COPYCMD /Y)
/oD0 no screen output, no log file
The following switches control empty directories:
/ED0 Deletes an empty directory (default action).
/ED Preserves a directory even if it becomes empty.
/ED{n} Preserves only n levels of empty directories.
Note: These ONLY work in file/directory removal
operations (/Z, /RC, /RS, /RD, /RX or /CLONE)
XXCOPY cannot copy a Disk, only a Partition. And it is necessary
to first use FDISK.EXE and FORMAT.COM to create and format the
target Partition (for instructions, see above).
Backup the Windows Directory
This routine backs up and restores key Operating System
directories, using an Incremental Backup to enable them
to be more easily kept up to date.
Syntax -
/BI Backup Incrementally: Only copy files which are
different, either by time or by size. It adds files
which have been altered since the last backup
(overwriting the previous backup of those files).
The option /BI compares files using both DATE and TIME
The option /Y suppresses the prompt to overwrite an
existing file
The option /ZY deletes extra files or subdirectories in the
destination (ones not in the source), with NO confirmation prompt!
Files to Exclude -
Exclusion specifier syntax (consists of up to 3 parts):
For file: [ dir_spec\ ] [ *\ ] [ ftemplate ]
For directory: [ dir_spec\ ] [ *\ ] [ dtemplate ]
NB: The option *\ specifies that the exclusion applies also
to all subdirectories of the specified directory
Create a text file named exclude.txt and copy-and-paste into it
the following:
// Excluded subdirectories:
"C:\Windows\Desktop\*\"
"C:\Windows\History\*\"
"C:\Windows\Recent\*\"
"C:\Windows\TEMP\*\"
"C:\Windows\Temporary Internet Files\*\"
// Excluded Files:
"C:\Windows\wiaservc.log"
"C:\Windows\WIN386.SWP"
"C:\Windows\Sti_Event.log"
"C:\Windows\Sti_Trace.log"
"C:\Windows\Cookies\index.dat"
Backup the Windows directory -
The following command will create a backup of the entire Windows
directory, including all sub-directories (even if empty).
The files will retain their "Created" and "Last Modified" dates.
*** Backup the Windows directory ***
(NB: Excludes some uncopiable or undesirable files, as above)
XXCOPY /BI /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /Y "C:\WINDOWS\" "C:\WinBak\" /E /EXexclude.txt /ZY /ED
Log file
To record XXCOPY errors in a Log (and save the Log in the root
directory of Drive C:), add the following to the command line:
/on:c:\error.log
TOTAL COMMANDER
===============
Total Commander v7.04a
This program will NOT run under DOS, only under Windows.
It has two useful directory cloning tools.
1. The DirCpy Plugin
It can copy a directory, retaining the date/time stamp
of the source directory, using the DirCpy plug-in from
http://physio-a.univ-tours.fr/tcplugins/dircpy.htm
How to install DirCpy:
1. Unzip dircpy.wcx into any directory
(e.g. put it in C:\Program Files\DirCpy)
2. In Total Commander, go to: Configuration > Options
3. Click on 'Packer'
4. Click the button "Configure packer extension WCXs"
5. Type any extension (you'll never use it) into the box
at top right, e.g. DirCpy
6. Click on 'new type', and select the file dircpy.wcx
in the directory to which you unzipped it (NB: Its
address will then display in the 'Associate With' box)
7. Click OK
How to use DirCpy:
1. Start Total Commander
2. In the left-hand window, select the source directory
(by right-clicking on it so that it turns RED)
3. In the right-hand window, select the destination directory
4. Go to: Files > Pack (or press Alt & F5); then in the 'Packer'
box, select the bottom radio-button, i.e. the drop-down
combo box; then in that combo box select the option DirCpy
5. In the 'Packer' box, click the button "Configure";
then tick "Preserve Date" and "Preserve Attributes"
to preserve the date & attributes of the source directory;
then click on "OK".
6. Tick the option "Also pack path names (only recursed)"
7. Tick the option "Recursively pack subdirectories"
8. Ignore the display line that starts "DirCpy:" and ends
in a file name. That file will NOT be created at the
destination; only the Path will be used at the destination
9. Then click on OK. This starts the process of creating
the selected directory structure at the destinaton.
(NB: No files are copied, so the process takes about 1 sec)
Notes:
- The "Preserve date" option is valid on Windows 9x in
version 1.03 or later of DirCpy.
- Under Windows 9x, the "Preserve date" option requires
the file Wc32to16.exe (installed by the Total Commander
installation routine), and you will be prompted for its
location at the first use. It is in the Total Commander
directory (e.g. C:\Program Files\Total Commander).
- XXCOPY can NOT preserve the date of a source directory
in the copy, so it is necessary to use Total Commander
to create the directory tree before copying any files.
- Options changed in the "Pack files" DialogBox are saved
in the Windows registry.
2. Automates XXCOPY
Total Commander automates part of the process of running XXCOPY:
- No source directory needs to be defined; and
- It stores, and recalls, the latest command line.
Useful XXCOPY commands:
A. Standard Command Line (to copy Files only) -
XXCOPY /H /R /KS /TTA0 /TCA /TCC /TCW /V2 "." "F:\BACKUP\"
B. Include Subdirectories -
XXCOPY /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /S "." "F:\BACKUP\"
C. Newer Files only (in Current directory only) -
XXCOPY /BN /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /Y "." "F:\BACKUP\"
D. Files only (in current directory only); prompts if OLDER file
at destination; skips files at destination that are NOT older;
automatically copies files that DON'T exist at destination -
XXCOPY /BN /H /R /KS /TTA0 /TCA /TCC /TCW /V2 "." "F:\BACKUP\"
E. Same as option D, but also DELETES files in the Destination
directory that don't exist in the Source directory -
XXCOPY /BN /H /R /KS /TTA0 /TCA /TCC /TCW /V2 /ZY "." "F:\BACKUP\"
FILE MANAGER (WINFILE.EXE)
============
This program will NOT run under DOS, only under Windows.
Windows 98/ME comes with an alternative file manager (i.e. other
than Windows Explorer), that can manage a FAT32 disk: the 16-bit
File Manager.
It provides 16-bit disk access if EXPLORER.EXE (which provides
32-bit disk access) is unavailable. So if Windows will not start
even in Safe Mode, try replacing Explorer with File Manager.
NB: File Manager is a 16-bit program! All files are shown with
their short (8.3 format) filenames. All files copied using
it will lose their Long File Names.
To run File Manager, edit SYSTEM.INI at the DOS prompt. In the
[boot] section replace the line SHELL=EXPLORER.EXE with the line
SHELL=WINFILE.EXE then save the changes and restart the computer.
*** Edit SYSTEM.INI ***
SET PATH=%path%;A:\
EDIT C:\WINDOWS\SYSTEM.INI
*** Run 16-bit File Manager in Windows ***
C:\WINDOWS\WINFILE.EXE
Note:
The program DOS Shell (included in all versions of MS-DOS up to
MS-DOS v6.22) is very much like a DOS version of File Manager.
But to use DOS Shell it might be necessary to boot the system
using an MS-DOS v6 bootdisk (instead of a Windows 9x bootdisk).
This would NOT be wise, as MS-DOS v6 does NOT understand FAT32.
^ Top of Page ________________________________ SECTION F: MISCELLANEOUS TOOLS ________________________________
DOS UTILS
=========
Note: For a guide to working at the DOS Prompt, see Command Prompt Basics
DOSKEY
======
*** Set PATH to include DOSKEY ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Run DOSKEY ***
DOSKEY
Useful DOSKEY commands:
F7 : Lists command history of current session
UP / DOWN ARROW : Recall previous/next commands
Note:
DOSKEY.COM is NOT on a standard Windows ME Emergency Boot Disk!
(NB: It is found at C:\WINDOWS\COMMAND on a WinME hard disk)
MENU GUI IN DOS
===============
A file manager program with a GUI gives a visual representation
of the file tree, simplifying finding files and recovery utils
where Windows is unavailable due to a system crash.
A. DOS NAVIGATOR (DN.EXE)
DOS Navigator v6.40
This (open source) program is the most sophisticated GUI for DOS
in the known universe.
*** Run DOS Navigator ***
SET PATH=%path%;F:\DOS_NAV\DN
DN
B. DISK MANAGER (DISKMAN4.EXE)
Disk Manager v4.01 (2002)
*** Run Disk Manager ***
DISKMAN4
*** Run Disk Manager in Windows (i.e. in Console Mode) ***
DISKMAN4 CONSOLE
C. DOS file editor (EDIT.EXE)
Recognises a hard disk of any size recognised by DOS.
*** Run the program ***
SET PATH=%path%;A:\
EDIT A:\AUTOEXEC.BAT
To see a visual representation of the Directory tree go to:
FILE > OPEN
Note: LAPLINK PRO (LLPRO.EXE)
LAPLINK PRO is a 16-bit program, so is NOT suitable to use with
a hard disk larger than 2GB, as it can ONLY access the first 2GB
of the disk.
It is NOT safe to use to copy any files on a FAT32 disk, as it
does not support Long File Names. Any file copied with it will
have only its 8.3 filename re-created at the destination.
Therefore ONLY use it to VIEW the Files & Directories, to locate
their whereabouts on Disk.
*** Set PATH to include LLPRO ***
SET PATH=%path%;C:\LLPRO
*** Run LAPLINK PRO 16bit File Manager ***
LLPRO
MEMORY USAGE
============
A. MEM.EXE -
MEM.EXE for DOS is an MS-DOS program included with Windows ME
in the directory C:\WINDOWS\COMMAND
In order to diagnose the cause of a program's failure to run
at the DOS prompt, it is essential to know the size of that
program and the amount of free space remaining in Memory.
*** Report on Conventional & Upper Memory with MEM.EXE ***
SET PATH=%path%;C:\WINDOWS\COMMAND;A:\
MEM /A /C /P
** Summary of Memory **
MEM /D /P
MEM /D /P > Memory_1.txt
** Comprehensive report on Memory **
MEM /C /P
MEM /C /P > Memory_2.txt
B. MI.COM -
*** Report on Memory Information with MI.COM ***
Syntax:
MI [parameters...]
/A - All conventional memory details listed
/C - Conventional memory only; ignore EMS and Ext.
/D - Device driver list
/E - Ignore MI*OPT=[parameters] in environment
/F - Filter (i.e. hide) unprintable characters
/H - List the EMS and XMS handles
/N - No pause at full screen
/O - Other display format
/Q - Quick summary only
/V - List the 'hooked' vectors
/? - Display this command line help
*** Memory Information ***
MI
MI /N > miReport.txt
*** Summary of Conventional memory ***
MI /C
MI /C /N > miSumary.txt
*** Comprehensive details of Conventional memory ***
MI /A
MI /A /N > miDetail.txt
EDIT THE REGISTRY
=================
Although the Registry Editor (REGEDIT.EXE) is a Windows program,
it can also run in DOS. Registry keys can be exported (e.g. for
editing), imported, deleted or read in DOS.
NB: For Windows ME only! (The Windows 98/98SE registry is slightly
different, and the Windows 95 registry is COMPLETELY different)
WARNING: Always ensure you have a FULL BACKUP of your system before
making any change to the Windows Registry. If anything goes wrong,
you could lose all your data and also have to reinstall Windows.
SYNTAX -
/E Export from Registry into .REG file
filename.reg Name of file which the data will be exported to
or imported from
regpath Path name of registry key to be exported,
e.g. "HKEY_CLASSES\ROOT\*\shell"
/T:classes Specify location of the CLASSES.DAT file (Optional)
/L:system Specify location of the SYSTEM.DAT file (Optional)
/R:user Specify location of the USER.DAT file (Optional)
NB: See also http://www.robvanderwoude.com/regedit.html
NB: See also http://techsupt.winbatch.com/ts/T000001029F18.html
*** Set PATH for using RegEdit.exe ***
SET PATH=%path%;C:\WINDOWS
A. Export a registry key in DOS
Export a registry key to a .REG file:
REGEDIT /E filename.reg regpath [ /L:system | /R:user | /T:classes]
REGEDIT /E F:\EXPORT.REG "HKEY_LOCAL_MACHINE\DummyTree"
REGEDIT /E F:\EXPORT.REG "HKEY_USERS\DummyTree"
REGEDIT /E F:\EXPORT.REG "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DummyTree"
NB: Once exported, the key can be read or edited (using any text
editor to open the .REG file, which is a plain text file),
then put back into the registry using the import command below.
NB: Another reason for exporting a key (i.e. saving a copy of it
as a file) is to make a backup of the key before deleting it.
B. Import a registry key in DOS
Import (merge) a .REG file into the registry:
REGEDIT filename.reg [ /L:system | /R:user | /T:classes ]
REGEDIT F:\IMPORT.REG
To suppress the prompts, use the /S switch:
REGEDIT /S F:\IMPORT.REG
NB: It is NOT necessary to specify the location of the .DAT files
if they are in the default Windows directory, C:\WINDOWS
C. Delete a registry key in DOS
Option #1
Delete a key from the registry:
REGEDIT /D regpath [ /L:system | /R:user | /T:classes ]
REGEDIT /D "HKEY_LOCAL_MACHINE\DummyTree"
REGEDIT /D "HKEY_USERS\DummyTree"
REGEDIT /D "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DummyTree"
Option #2
First, create a .REG file to import: containing a delete instruction,
followed by an instruction to re-create an empty key.
Example: Delete all hardware devices, to enable the Windows plug-n-play
wizard to do a complete hardware re-install on reboot -
REGEDIT4
[-HKEY_LOCAL_MACHINE\Enum]
[HKEY_LOCAL_MACHINE\Enum]
Second, import (merge) that .REG file into the registry:
REGEDIT F:\DELETE.REG
Option #3
Delete multiple keys in DOS:
ECHO REGEDIT4 > temp.reg
ECHO. >> temp.reg
ECHO [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] >> temp.reg
ECHO. >> temp.reg
ECHO [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] >> temp.reg
ECHO. >> temp.reg
ECHO [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] >> temp.reg
ECHO. >> temp.reg
ECHO [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] >> temp.reg
ECHO. >> temp.reg
C:\WINDOWS\REGEDIT.EXE temp.reg
DEL temp.reg
D. Delete one item from a registry key in DOS
First, create a .REG file with (for example) these contents:
REGEDIT4
[HKEY_USERS\DummyTree]
"ValueToBeRemoved"=-
Second, import (merge) that .REG file into the registry,
as at C above.
Example:-
ECHO REGEDIT4 > temp.reg
ECHO. >> temp.reg
ECHO [HKEY_USERS\DummyTree] >> temp.reg
ECHO "SubKeyName"=- >> temp.reg
ECHO. >> temp.reg
C:\WINDOWS\REGEDIT.EXE temp.reg
DEL temp.reg
E. Read a registry key in DOS
*** Step 1: Export the Registry Key to a file ***
REGEDIT /E F:\EXPORT_1.REG "HKEY_LOCAL_MACHINE\DummyTree"
REGEDIT /E F:\EXPORT_2.REG "HKEY_USERS\DummyTree"
REGEDIT /E F:\EXPORT_3.REG "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DummyTree"
*** Step 2: Read the file ***
EDIT F:\EXPORT_*.REG
REPLACE THE REGISTRY
====================
Extract the Windows Registry from a backup .CAB file, in DOS,
overwriting the current Registry.
NB: For Windows 98 / 98SE / ME only!
*** Set Path ***
SET PATH=%path%;C:\WINDOWS\COMMAND
*** Extract all Registry files to their required locations ***
NB: Rename the .CAB file to match the actual filename!
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.BAT /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.SYS /L C:\ /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.DAT /L C:\WINDOWS /Y
EXTRACT C:\WINDOWS\SYSBCKUP\RB001.CAB *.INI /L C:\WINDOWS /Y
SEARCH FOR A FILE
=================
To find a file using DOS, the following routine will search all the
folders on the specified Partition for FILENAME.EXT -
*** Search DOS Partition (e.g. Drive C) ***
** (Specify the file you're looking for) **
C:
CD \
DIR FILENAME.EXT /S
An alternative to the 3rd line of that routine is -
DIR FILENAME.* /S
SAVE FILES TO DRIVE F
=====================
*** Save output data to Drive F: (USB Pen Drive) ***
** NB: Check that the USB disk is Drive F: **
** STEP 1: Make a destination directory at Drive F: **
MD F:\DATA
** STEP 2: Copy all output files to Drive F: **
Options -
/V Verify file was written correctly
/Y Suppress prompt to overwrite if file already exists
COPY *.* F:\DATA /V /Y
SAVE FILES TO A NETWORK COMPUTER
================================
PURPOSE: To provide a convenient way of rescuing your files
without needing to open the computer's case and fit a new
hard disk; and where the computer has no USB ports, or any
USB pen drives available are too small to hold all the files;
and where the files to rescue are too many to conveniently
fit on a set of 1.44MB floppy disks, or are individually too
large to fit on a single floppy disk.
This is a procedure for data rescue where Windows can't start,
but will not work if the data structures on the source computer
are damaged (e.g. if the MBR, Boot Sector or FAT is corrupt).
WARNING: This method may not be suitable for rescuing files
from a FAT32 disk, because: (a) all files copied will lose
their Long File Names; and (b) this method uses MS-DOS v6.22
(a FAT16 version of DOS, which does not understand FAT32).
Procedure:
Connect the computers together. Connect their Serial ports
using a serial "null modem" cable, or connect their Parallel
ports (i.e. their printer ports) using a "Laplink" cable.
NB: Not all Serial cables are suitable. This must be the
special "cross-over" type (called a "null modem" cable).
Using the MS-DOS v6.22 programs INTERLNK.EXE and INTERSVR.EXE
files can now be copied between the computers at the DOS prompt
(copying files from the SOURCE computer to the TARGET computer).
So, prepare two bootable 1.44MB floppy disks using MS-DOS v6.22.
Put the line DEVICE=A:\INTERLNK.EXE in the CONFIG.SYS file on the
floppy disk for the TARGET computer and start it using that floppy.
Then put the line INTERSVR in the AUTOEXEC.BAT file on the other
floppy disk, and use it to start the SOURCE computer. Finally,
on the TARGET computer type INTERLNK to activate the connection
and view details of the available resources on the other computer.
See also: http://www.customcodeinc.com/Olddos/Oldcmds/oldcmds_64.asp
NB: Both computers must be started up using an MS-DOS v6.22
bootable floppy disk, e.g. from BootDisk.com
Syntax -
A. INTERLNK Syntax
DEVICE=[drive:][path]INTERLNK.EXE [/DRIVES:n] [/NOPRINTER]
[/COM[:][n|address]] [/LPT[:][n|address]] [/AUTO] [/NOSCAN]
[/LOW] [/BAUD:rate] [/V]
Options:-
[drive:][path]
Specifies the location of the INTERLNK.EXE file.
/DRIVES:n
Specifies the number of redirected drives. By default the number
is 3. If you specify 0 then Interlnk only redirects printers.
/NOPRINTER
Specifies that printers are not redirected. By default, Interlnk
redirects all available printer ports.
/COM[:][n|address]
Specifies a serial port to be used to connect. The n parameter
specifies the number of the serial port, or the address parameter
the address of the serial port. If you omit both n and address,
Interlnk searches all the serial ports and uses the first port
which it finds that is connected to the other computer. If you
specify the /COM switch and omit the /LPT switch, it searches
only for serial ports. By default, it scans all the serial and
all the parallel ports.
/LPT[:][n|address]
Specifies a parallel port to be used to connect. The n parameter
specifies the number of the parallel port, or the address parameter
the address of the parallel port. If you omit both n and address,
Interlnk uses the first parallel port it finds that is connected
to the other computer. If you specify the /LPT switch and omit the
/COM switch, it searches only for parallel ports. By default, it
scans all the serial and all the parallel ports.
/AUTO
Causes INTERLNK.EXE to be loaded only when a connection with the
other computer is detected. By default, Interlnk is loaded even
if it can't establish a connection with the other computer.
/NOSCAN
Loads the INTERLNK.EXE device driver, but prevents it establishing
a connection to the other computer. By default, it tries to establish
a connection with the other computer as soon as Interlnk loads.
/LOW
Loads INTERLNK.EXE into conventional memory, even if upper memory
is available. By default, INTERLNK.EXE is loaded into upper memory
if the upper memory area is available.
/BAUD:rate
Sets a maximum data rate for serial communication. Valid values are
9600, 19200, 38400, 57600 and 115200. The default is 115200.
/V
Prevents conflicts with the computer's timer. Include this switch if
you are using a serial cable and one of the computers stops running
when you use Interlnk to access a drive or a printer port.
B. INTERSVR Syntax
When INTERSVR.EXE is loaded on a computer, it suspends all operations
on that computer, and gives control of that computer to Interlnk.exe
running on the other computer.
INTERSVR.EXE /X=drives /com:X /lpt:X
/X=drives specifies the letter of the drive(s) to be redirected.
By default, all drives are redirected.
By default, all available serial and parallel ports are scanned and
Intersvr uses the first port it finds that's connected to the other
computer. If you want to force a connection to a particular port,
use one of the following switches:-
/COM specifies a serial port be used to connect
/LPT specifies a parallel port be used to connect
CREATE A RAM DISK
=================
XMSDSK.EXE is an XMS RAMdisk driver that can create a disk drive
in system memory (i.e. RAM memory). It lasts only so long as the
computer is powered up; and all contents are also lost on reboot.
The extra storage may be useful for temporarily holding recovery
tools and/or rescued files.
It has the advantage of being able to create a larger RAM disk
than the native Windows ME driver RAMDRIVE.SYS (which can only
create a RAM disk up to 32MB). XMSDSK.EXE can create a RAM drive
of any size, i.e. can utilise the full size of your system's RAM
(building the RAM drive out of XMS memory space).
NB: MS-DOS can run without any XMS memory available to it;
it requires only 1MB of Conventional and EMS memory.
Example -
This example creates a 50MB RAM disk as Drive Z
** Add the following line in CONFIG.SYS on the boot floppy **
lastdrive=z
** Add the following line in AUTOEXEC.BAT on the boot floppy **
xmsdsk 51200 Z: /t /y
PATH
====
*** Restore the original PATH settings ***
PATH ;
SET PATH=%DOSpath%
^ Top of Page
WINDOWS ME EMERGENCY BOOT DISK
==============================
This is a customised startup configuration for a Windows ME
Emergency Boot Disk (EBD): the bootable start-up floppy disk
created by Windows ME.
To create this floppy disk, start Windows ME then go to:
START > SETTINGS > CONTROL PANEL > ADD/REMOVE PROGRAMS
and click on the tab "Startup Disk".
Note -
The additional batch (.BAT) files referred to below concerning
hard disk repair or data recovery are present on a standard
Windows ME Emergency Boot Disk (except where noted otherwise).
Note -
Some of the device drivers referred to below must be manually
copied to the start-up floppy disk. Sources for those files
are cited below (PROGRAM DOWNLOAD SOURCES).
Alternatively, here is a download link to an Image File which will
create this customised Windows ME Emergency Boot Disk: Click here
(NB: Use UNDISKER.EXE to create the floppy disk)
Note -
The routines below are for Disk 1 with 2 Partitions (C: and E:),
Disk 2 with 1 Partition (D:), and a USB Disk (F:). The USB Disk
(a non-bootable pendrive) contains certain program files which
are required in the routines (because an IDE disk might fail,
so all rescue programs are stored on the USB disk); but these
programs could be placed on ANY working IDE disk. Sources for
these files are cited below (PROGRAM DOWNLOAD SOURCES).
Note -
These CONFIG.SYS and AUTOEXEC.BAT files will need to be edited
in order to work, if the rescue programs are not on Drive F:
CONFIG.SYS
==========
[menu]
menuitem=QUICK, Minimal Boot (Maximum DOS Memory)
menuitem=UNDELETE, Undelete Files
menuitem=BSOD, Restore Registry
menuitem=DOSNAV, DOS Navigator GUI, with USB
menuitem=CD, DOS with RAM Disk, with CD-ROM
menuitem=USB, DOS with RAM Disk, with CD-ROM and USB
rem menuitem=NOCD, DOS with RAM Disk, without CD-ROM or USB
menuitem=HELP, Advice on running WinME, with RAM Disk and CD-ROM
menuitem=DISKEDIT, Norton's DiskEditor (Norton Utilities 2002) for FAT32
menuitem=TIRAMISU, Tiramisu Easy Recovery v6, with USB support (HDD exceeding 32GB)
menudefault=QUICK,60
menucolor=7,0
rem NB: Only 9 menu entries can be displayed!
[QUICK]
rem No device drivers loaded
rem Maximises the amount of free Conventional memory in DOS
[UNDELETE]
rem USB drivers for DOS:
devicehigh=USBASPI.SYS /o /e /v
devicehigh=DI1000DD.SYS
[BSOD]
[DOSNAV]
rem DOS Navigator v6.40 and USB
devicehigh=USBASPI.SYS /o /e /v
devicehigh=DI1000DD.SYS
[CD]
devicehigh=oakcdrom.sys /D:mscd001
rem device=btdosm.sys
rem device=flashpt.sys
rem device=btcdrom.sys /D:mscd001
rem device=aspi2dos.sys
rem device=aspi8dos.sys
rem device=aspi4dos.sys
rem device=aspi8u2.sys
rem device=aspicd.sys /D:mscd001
rem
rem RAM Disk driver (16MB RAMdisk):
devicehigh=ramdrive.sys /E 16384
[USB]
rem USB drivers for DOS:
rem
rem ASPI Manager for USB mass-storage v2.24
rem Panasonic Communications Co 2000-2007
devicehigh=USBASPI.SYS /o /e /v
rem
rem Syntax -
rem /u UHCI, for enabling a USB 1.0 controller (NB: Obsolete)
rem /o OHCI, for enabling a USB 1.1 controller (Motherboard and PCI Card)
rem /e EHCI, for enabling a USB 2.0 controller (PCI Card USB 2.0 ports)
rem /v Verbose mode, useful for troubleshooting
rem /w Wait, displays message to prompt attaching of USB device
rem /r Resident, load as memory resident if USB floppy detected
rem /l# LUNs, specify highest number of LUN assigned: default /L0
rem /slow Use SLOW mode, gives longer delays on scanning USB ports
rem /nocbc No CardBus Controller, disable detection on CardBus slots
rem
rem You can specify more than one controller type (e.g. /o /e). Use
rem this feature to specify which port types to enable: limiting
rem the port types that are scanned for results in a faster startup.
rem
rem These options work on my PC:
rem device=USBASPI.SYS /v
rem device=USBASPI.SYS /o /v
rem device=USBASPI.SYS /e /v
rem device=USBASPI.SYS /o /e /v
rem
rem DI1000DD ASPI Disk Driver v2.00
rem (c) 2001 NOVAC Co Ltd
devicehigh=DI1000DD.SYS
rem
rem RAM Disk driver (28MB RAMdisk):
devicehigh=ramdrive.sys /E 28672
rem NB: This driver CANNOT create a 32MB RAMdisk
rem NB: Maximum of 64 files can be placed in RAMdisk
rem
rem CD-ROM driver:
devicehigh=oakcdrom.sys /D:mscd001
[NOCD]
rem RAM Disk driver (16MB RAMdisk):
devicehigh=ramdrive.sys /E 16384
[HELP]
device=oakcdrom.sys /D:mscd001
device=btdosm.sys
device=flashpt.sys
device=btcdrom.sys /D:mscd001
REM device=aspi2dos.sys { Delete these files to provide disk space
REM device=aspi4dos.sys { on this floppy for essential USB drivers
device=aspi8dos.sys
device=aspi8u2.sys
device=aspicd.sys /D:mscd001
rem
rem RAM Disk driver (16MB RAMdisk):
devicehigh=ramdrive.sys /E 16384
[DISKEDIT]
rem Do NOT load HIMEM.SYS, as it will *conflict* with
rem the internal memory manager in this version of DOS
[TIRAMISU]
rem USB drivers for DOS:
devicehigh=USBASPI.SYS /o /e /v
devicehigh=DI1000DD.SYS
rem NB: Recovered files can be copied to the USB 8GB pen drive
rem
rem RAM Disk driver (28MB RAMdisk):
devicehigh=ramdrive.sys /E 28672
rem NB: This driver CANNOT create a 32MB RAMdisk
rem NB: By default, Tiramisu uses the RAMdisk as the swap area
rem
rem *** Load Tiramisu Easy Recovery v6.10 (HDD exceeding 32GB) ***
rem NB: There are NO device drivers for this version of Easy Recovery!
[COMMON]
files=40
buffers=10
stacks=9,256
lastdrive=z
dos=high,umb
device=display.sys con=(ega,,1)
rem The next 4 lines are country-specific settings for the United Kingdom (Code Page 850)
country=044,850,country.sys
install=mode.com con cp prepare=((850) ega.cpi)
install=mode.com con cp select=850
install=keyb.com uk,,keyboard.sys
AUTOEXEC.BAT
============
@echo off
cls
SET DIRCMD=/W/P/O
\hibinv.exe
call \checksr.bat
IF "%config%"=="QUICK" GOTO QUICK
IF "%config%"=="UNDELETE" GOTO UNDELETE
IF "%config%"=="BSOD" GOTO BSOD
IF "%config%"=="DOSNAV" GOTO DOSNAV
IF "%config%"=="DISKEDIT" GOTO DISKEDIT
::Load RAM Drive...
set EXPAND=YES
set LglDrv=27 * 26 Z 25 Y 24 X 23 W 22 V 21 U 20 T 19 S 18 R 17 Q 16 P 15
set LglDrv=%LglDrv% O 14 N 13 M 12 L 11 K 10 J 9 I 8 H 7 G 6 F 5 E 4 D 3 C
cls
call setramd.bat %LglDrv%
path=%RAMD%:\
set temp=%RAMD%:\
set tmp=%RAMD%:\
copy command.com %RAMD%:\ > NUL
set comspec=%RAMD%:\command.com
copy extract.exe %RAMD%:\ > NUL
copy readme.txt %RAMD%:\ > NUL
::
IF "%config%"=="TIRAMISU" GOTO TIRAMISU
:ERROR
IF EXIST ebd.cab GOTO EXT
echo Please insert Windows Millennium Edition Startup Disk 2
echo.
pause
GOTO ERROR
:EXT
%RAMD%:\extract /y /e /l %RAMD%: ebd.cab > NUL
echo The diagnostic tools were successfully loaded to drive %RAMD%:
echo.
IF "%config%"=="NOCD" GOTO QUIT
::
::Load CD-ROM driver...
rem Next line can be disabled to save memory
LH %ramd%:\MSCDEX.EXE /D:mscd001 /L:%CDROM%
::If MSCDEX doesn't find a drive...
rem Next line can be disabled to save memory
IF ERRORLEVEL 1 SET CDPROB=1
::
IF "%config%"=="USB" GOTO USB
IF "%config%"=="HELP" GOTO HELP
::
GOTO QUIT
:QUIT
call fixit.bat
rem clean up environment variables
set CDPROB=
set CDROM=
set LglDrv=
GOTO END
:QUICK
SET PATH=C:\WINDOWS\COMMAND
DOSKEY
GOTO END
:UNDELETE
echo.
::Load Mouse
F:\MOUSE.EXE
::Norton Unerase for Win95
F:\UNERASE.EXE
GOTO END
:BSOD
A:\BSOD.BAT { Omitted: Has nothing to do with data recovery
GOTO END
:DOSNAV
echo.
::Load Mouse
F:\MOUSE.EXE
::Include USB Disk in PATH...
SET PATH=C:\;F:\;A:\
::Launch DOS Navigator v6.40
F:\DOS_NAV\DN.COM
GOTO END
:DISKEDIT
echo.
::Load Mouse
LH F:\MOUSE.EXE
::Launch Norton Disk Editor (662KB)
SET PATH=F:\NORTON\2002
LH F:\NORTON\2002\DISKEDIT.EXE
::Launch Norton Disk Doctor (642KB)
rem SET PATH=F:\NDD
rem LH NDD.EXE
GOTO END
:TIRAMISU
echo.
::Load Mouse
F:\MOUSE.EXE
echo.
path=%ramd%:\;A:\
::Load Tiramisu Easy Recovery v6.10 (HDD exceeding 32GB)
F:
CD \TIRAMISU\EASYRE~1.10
xbios /P- /Z /I /M /V=2
substtoz VDISK
echo.
echo Your RAM Disk is %ramd%
echo Copying files to RAMdisk, please wait...
copy EASYREC.EXE %ramd%:\
%ramd%:\EASYREC %ramd%:\ /y
copy ER.BAT %ramd%:\
%ramd%:
LOADASPI
RDRINT13 /V=0
call ER.BAT
GOTO END
:USB
echo.
::Load Mouse
F:\MOUSE.EXE
::Load SmartDrive
F:\SMARTDRV.EXE 4096 16>nul
::Include USB Disk in PATH...
SET PATH=%path%;C:\;F:\;A:\
GOTO END
:HELP
cls
call HELP
GOTO END
:END
^ Top of Page
CALCULATORS
===========
NORTON DISKEDIT
===============
Norton's DiskEdit 2002 includes a calculator with the ability
to Add, Subtract, Multiply & Divide in Decimal, Hex and Binary;
plus the ability to convert between Decimal, Hex and Binary.
In DiskEdit, go to: TOOLS > CALCULATOR
*** Run Norton DiskEdit 2002: FAT32, HDD exceeding 32GB ***
** (DISKEDIT.EXE in Norton Utilities 2002) **
SET PATH=%path%;F:\RECOVERY
MOUSE
SET PATH=%path%;F:\NORTON\2002
DISKEDIT
BATCH FILES
===========
A WinME batch file (i.e. an MS-DOS 8.0 batch file) has NO arithmetic
functions, as those were not added to the MS-DOS "SET" command until
Windows 2000.
^ Top of Page
CALCULATE LBA PARTITION
=======================
CALC.EXE
========
The script below will calculate the LBA sector numbers (i.e. the
disk geometry) for a FAT32 partition, on a disk larger than 8GB.
The markers /* and */ operate to comment-out whatever is enclosed
between them. Nothing between those markers will be executed when
the script is run.
The script identifies the disk location (or "field") in which a
particular value belongs. For example, the field "Sectors Before"
in Partition Table entry No.1 in the Master Boot Record (MBR) is
written as follows:
MBR: 1,"Sectors Before"
Some of the Print commands [print("")] included in the script are
only there to generate an empty line, to make the output easier to
read.
The command -q (Quit) causes the program to exit when the script
has finished running, and is case sensitive.
The script will run under either DOS or Windows. However, it can
crash Windows in some circumstances, so is safer to run under DOS.
To run it, copy-and-paste the script into a file named GEOMETRY
(8 characters, no filetype); then type the following commands
at the DOS prompt:
*** Display the output on Screen ***
SET PATH=%path%;F:\CALC
CALC GEOMETRY -q
*** Save the output to a file ***
[NB: Use a filename that identifies the Partition]
SET PATH=%path%;F:\CALC
CALC GEOMETRY -q >> DRIVE_C
CALC GEOMETRY -q >> DRIVE_D
CALC GEOMETRY -q >> DRIVE_E
*** View the output file ***
EDIT DRIVE_C
EDIT DRIVE_D
EDIT DRIVE_E
Extended Partition:
In an Extended partition, the value "relative sectors" in the
2nd entry of an EBPR Partition Table is relative to the start
of the entire Extended partition - NOT to the start of the
current Logical partition!
This means the 2nd and 3rd Logical partitions (if present) will
contain relative sector values in Entry No.2 that are relative to
the start (i.e. partition) sector of the 1st Logical partition.
NB: The value "relative sectors" is the number of sectors from
the Partition Table sector of the *1st* Logical partition
to the end sector of the *current* Logical partition.
Ultimate Calculator v1.8:
A similar calculation can be done using Ultimate Calculator v1.8
(UCALC.EXE) (a shareware program).
Repairing a Partition Table:
The safest way to make changes to a disk's Partition Table is
the user-friendly program PowerQuest Partition Table Editor
(PTEDIT.EXE) (see above).
The script adopts the technical expressions used in PTEDIT.EXE
so as to make it easy to insert values produced by the script
into a disk's Partition Table using PTEDIT.
Disk with Multiple Partitions:
Join together the output files for all Partitions on the disk;
because, combined, they make up the entire disk.
This is a much more flexible solution than attempting to create
a single script to calculate the values for every possible disk
configuration, as there can be an unlimited number of Partitions.
NB: In practice the entire system can have up to a maximum of
24 partitions, on all hard disks attached, numbered C: to Z:
(provided no CD or DVD drive is attached), as Drive A: and B:
are reserved for floppy disks.
*** Merge several files into a single destination file ***
(NB: One file for each of the partitions on the hard disk)
COPY DRIVE_C+DRIVE_E DISK_1
Where a disk has *more* than one Logical partition, the value in
the MBR for the total size of the Extended partition ("Sectors")
will be the size of ALL the Logical partitions added together
(the value "Sectors" from entry 1 in *each* E-MBR/E-BPR).
Note - This script includes sample data: to demonstrate how it
is intended to work, it shows specimen values for partition data
derived from some disks of mine. This is only for illustration -
you must use the ACTUAL values for your actual disk.
Usually, only the values in RED will need input from you.
*** Script Begins ***
/* CALCULATE GEOMETRY OF FAT32 IDE */
/* =============================== */
/* SAVE OUTPUT: Predefined Variables (Decimal) */
/* Calculate to 2 decimal places only */
scale = 2
/* Set Input and Output to either Decimal or Hexadecimal */
/* (NB: PTEDIT.EXE uses decimal, so set this to Decimal) */
/* Output is Decimal (base 10) */
ibase = 0xA /* Input = base 10 */
obase = 0xA /* Output = base 10 */
/* Output is Hex (base 16) */
/* ibase = 0xG */ /* Input = base 16 */
/* obase = 0xG */ /* Output = base 16 */
/* INPUT: User-entered Variables (Disk Data) */
/* *** Identification of Disk and Partition *** */
print("DISK NAME/NUMBER: _______________ (Drive _:)
");print("
")
/* *** Size of Disk (Sectors) (User-entered Variable) *** */
/* (From MBR: 1 "Sectors Before" + 1 "Sectors" + 2 "Sectors") */
SizeOfDisk = 00 + 00000000 + 000000000
/* WD 80GB (Drive C, E) = 63 + 20482812 + 135813510 = 156296385 */
/* WD 80GB (Drive D) = 63 + 156296322 = 156296385 */
/* Notes:
Track 0 + Size of Primary Partition + Size of Extended Partition */
/* *** Heads per Cylinder (0-254) *** */
/* (NB: A mandatory value for all FAT32 disks) */
HeadsPerCylinder = 255
/* WD 80GB (Drive C and E) = 255 */
/* WD 80GB (Drive D) = 255 */
/* *** Sectors per Track (1-63) *** */
/* (NB: A mandatory value for all FAT32 disks) */
SectorsPerHead = 63
/* WD 80GB (Drive C and E) = 63 */
/* WD 80GB (Drive D) = 63 */
/* INPUT: User-entered Variables (Partition Data) */
/* *** Sectors Before Partition *** */
/* (From MBR "Sectors Before" and EBPR "Sectors Before") */
/* (or from Tiramisu's Easy Recovery v6) (or search with DISKEDIT) */
SectorsBefore = 00000000 + 00
/* WD 80GB, Primary DOS (Drive C) = 63 + 0 */
/* WD 80GB, Logical #1 (Drive E) = 20482875 + 63 */
/* WD 80GB, Primary DOS (Drive D) = 63 + 0 */
/* Notes:
Primary DOS = MBR, 1 "Sectors Before" + 0
Logical #1 = MBR, 2 "Sectors Before" + EBPR, 1 "Sectors Before"
(NB: Each partition is preceeded by 1 Head (63 sectors) for
system data, e.g. Track 0 prior to the Primary partition)
(NB: A Logical partition is also preceeded by other partitions) */
/* *** Start of Partition: Boot Sector *** */
/* (From MBR "Sectors Before" and EBPR "Sectors Before") */
StartSector = SectorsBefore
/* WD 80GB, Primary DOS (Drive C) = 63 + 0 */
/* WD 80GB, Logical #1 (Drive E) = 20482875 + 63 */
/* WD 80GB, Primary DOS (Drive D) = 63 + 0 */
/* Notes:
A partition starts 63 sectors after its Partition Table sector
(and the first sector of a partition is always its Boot Sector) */
/* *** Size of this Partition (sectors) *** */
/* (From MBR "Sectors" or EBPR "Sectors") */
SizeOfPartition = 00000000
/* WD 80GB, Primary DOS (Drive C) = 20482812 */
/* WD 80GB, Logical #1 (Drive E) = 135813447 */
/* WD 80GB, Primary DOS (Drive D) = 156296322 */
/* Notes:
Primary DOS = From MBR : 1,"Sectors"
Logical #1 = From EBPR: 1,"Sectors" */
/* *** End of Partition *** */
EndSector = StartSector + SizeOfPartition
/* WD 80GB, Primary DOS (Drive C) (LBA) = 20482874 */
/* WD 80GB, Logical #1 (Drive E) (LBA) = 156296384 */
/* WD 80GB, Primary DOS (Drive D) (LBA) = 156296384 */
/* Notes:
Check this using Tiramisu's Easy Recovery v6 */
/* *** Sectors per Cluster in this Partition *** */
/* (From Boot Sector: "Sectors per Cluster") */
SectorsPerCluster = 00
/* WD 80GB, Primary DOS (Drive C) = 16 */
/* WD 80GB, Logical #1 (Drive E) = 64 */
/* WD 80GB, Primary DOS (Drive D) = 64 */
/* Notes:
If partition is less than 8GB : 8 sectors per cluster
If partition is 8GB or larger: 16 sectors per cluster
If partition is 16GB or larger: 32 sectors per cluster
If partition is 32GB or larger: 64 sectors per cluster */
/* *** Number of Hidden Sectors in this Partition *** */
/* (From Boot Sector: "Hidden Sectors") */
HiddenSectors = 00
/* WD 80GB, Primary DOS (Drive C) = 63 */
/* WD 80GB, Logical #1 (Drive E) = 63 */
/* WD 80GB, Primary DOS (Drive D) = 63 */
/* Notes:
In practice this number is always 63. Although any number might
legitimately be used, I've never seen an IDE disk use any other.
(NB: Every partition is preceeded by 1 Head (63 sectors) for
system data, e.g. Track 0 prior to the Primary DOS partition) */
/* *** Number of Reserved Sectors in this Partition *** */
/* (From Boot Sector: "Reserved Sectors") */
ReservedSectors = 00
/* WD 80GB, Primary DOS (Drive C) = 32 */
/* WD 80GB, Logical #1 (Drive E) = 32 */
/* WD 80GB, Primary DOS (Drive D) = 32 */
/* Notes:
In practice this number is always 32. Although any number might
legitimately be used, I've never seen an IDE disk use any other. */
/* *** FS Info Sector *** */
/* (From Boot Sector: "FS Info Sector") */
FSInfoSector = 1
/* WD 80GB, Primary DOS (Drive C) = 1 */
/* WD 80GB, Logical #1 (Drive E) = 1 */
/* WD 80GB, Primary DOS (Drive D) = 1 */
/* *** Backup Boot Sector *** */
/* (From Boot Sector: "Backup Boot Sector") */
BackupBootSector = 6
/* WD 80GB, Primary DOS (Drive C) = 6 */
/* WD 80GB, Logical #1 (Drive E) = 6 */
/* WD 80GB, Primary DOS (Drive D) = 6 */
/* *** Starting sector of 2nd FAT in this Partition (LBA) *** */
/* (NB: Find this sector using Norton's DISKEDIT (2002):
Object > Drive > Physical Disks > Tools > Find Object > FAT) */
StartingSectorFAT2 = 00000
/* WD 80GB, Primary DOS (Drive C): FAT2 = 10087 */
/* WD 80GB, Logical #1 (Drive E): FAT2 = 20499547 */
/* WD 80GB, Primary DOS (Drive D): FAT2 = 19172 */
/* Notes:
SectorsBefore + ReservedSectors + SizeOfFAT - 1 = LBA
[NB: See notes on File Allocation Table] */
/* *** Starting sector of Root Directory Table (LBA) *** */
/* (NB: A percentage, common to all FAT32 disks) */
MagicNumber = 0.01561
Sectors = SizeOfPartition - ReservedSectors
SizeOfFATs = INT(((Sectors/SectorsPerCluster)*MagicNumber)+0.99)
/* OUTPUT: Perform Calculation */
/* *** Partition *** */
print("Partition -
")
/* *** Start of Partition *** */
print("Start of Partition: LBA ")
StartSector
/* *** End of Partition *** */
print("End of Partition : LBA ")
EndSector
/* *** Boot Sector (LBA) *** */
print("Boot Sector: LBA ")
SectorsBefore
/* *** FSInfo Sector (LBA) *** */
print("FSInfo Sector: LBA ")
SectorsBefore + FSInfoSector
/* *** Boot Data Sector (LBA) *** */
print("Boot Data Sector: LBA ")
SectorsBefore + 2
/* *** Backup Boot Sector (LBA) *** */
print("Backup Boot Sector: LBA ")
SectorsBefore + BackupBootSector
/* *** Backup FSInfo Sector (LBA) *** */
print("Backup FSInfo Sector: LBA ")
SectorsBefore + BackupBootSector + 1
/* *** Backup Boot Data Sector (LBA) *** */
print("Backup Boot Data Sector: LBA ")
SectorsBefore + BackupBootSector + 2
/* *** File Allocation Tables *** */
SizeOfFAT = StartingSectorFAT2 - (SectorsBefore + ReservedSectors)
print("Size of FAT (Big Sectors Per FAT): ")
SizeOfFAT
print("Starting sector of first FAT : LBA ")
SectorsBefore + ReservedSectors
print("Starting sector of second FAT: LBA ")
StartingSectorFAT2
/* *** Root Directory Table *** */
print("Start of Root Directory Table: LBA ")
StartingSectorFAT2 + SizeOfFAT
/* *** Root Directory Table : Automatic Method *** */
print("Start of Root Directory Table (Automatic Method): LBA ")
(BootSector + ReservedSectors + SizeOfFATs)
/* *** Data Area (User files) *** */
print("Starting sector of Data Area : LBA ")
StartingSectorFAT2 + SizeOfFAT + SectorsPerCluster
/* *** Data Area : Automatic Method *** */
print("Starting sector of Data Area (Automatic Method) : LBA ")
(BootSector + ReservedSectors + SizeOfFATs + SectorsPerCluster)
/* *** Hidden Sectors *** */
print("Hidden Sectors in this Partition : ")
HiddenSectors
/* *** Big Total Sectors *** */
print("Big Total Sectors in this Partition: ")
SizeOfPartition
/* *** Number of Clusters in this Partition *** */
print("Number of Clusters: ")
(SizeOfPartition-ReservedSectors-(SizeOfFAT*2))/SectorsPerCluster
/* *** Total Disk Space in this Partition (in KB) *** */
print("Total Disk Space in this Partition (KB): ")
((SizeOfPartition-ReservedSectors-(SizeOfFAT*2)) / SectorsPerCluster) * (SectorsPerCluster/2)
print("
");
/* *** Total Disk Space in this Partition (in MB) *** */
print("Total Disk Space in this Partition (MB): ")
((SizeOfPartition-ReservedSectors-(SizeOfFAT*2)) / SectorsPerCluster) * (SectorsPerCluster/2) / 1024
print("
");
/* *** Total Disk Space in this Partition (in GB) *** */
print("Total Disk Space in this Partition (GB): ")
((SizeOfPartition-ReservedSectors-(SizeOfFAT*2)) / SectorsPerCluster) * (SectorsPerCluster/2) / 1048576
print("
");
/* *** Cluster Size *** */
print("Cluster Size in KB: ")
(SectorsPerCluster/2)
print("Cluster Size in Sectors: ")
(SectorsPerCluster)
/* *** Sanity Test of this Partition ***
(NB: Number of Cylinders in partition; MUST be a whole number) */
print("Sanity test of this partition: ")
scale = 8
SizeOfPartition / ( SectorsPerHead * HeadsPerCylinder )
print("*Test is failed if that result is not a whole number!
");print("
");
/* *** Disk size in MegaBytes *** */
print("Disk size in MegaBytes : ")
SizeOfDisk / 2048
/* *** Size of Disk: *** */
print("Total Sectors on Disk : ")
SizeOfDisk
/* *** Unpartitioned Space *** */
print("Sectors after Partition : ")
SizeOfDisk - ( SectorsBefore + SizeOfPartition )
/* Note:
If space AFTER the partition exceeds 1 cylinder (16,065 sectors)
there is probably *another* partition present on this disk! */
print("
");
/* *** C-H-S values for Disk *** */
print("C-H-S values for Disk : ")
print("C - Cylinders : ")
trunc( SizeOfDisk / ( SectorsPerHead * HeadsPerCylinder ) )
print(" H - Heads : ")
HeadsPerCylinder
print(" S - Sectors : ")
SectorsPerHead
/* Notes:
1. This does not calculate the actual values, but merely assigns
mandatory values to 'Heads' and 'Sectors'.
2. There will be a small area of unpartitioned space at the end
of the disk, not enough to form another complete Cylinder. */
*** Script Ends ***
ANALYSING PARTITION INFORMATION
Here is an example of the output from PTEDIT32.EXE -
0c-80-0-1-1-1006-254-63-63-16187392
NB: This is from an 8GB USB disk
Analysis of output string -
0c : Partition Type
80 : ID Signature of hard disk
0-1-1 : CHS start sector
1006-254-63 : CHS end sector
63 : Hidden sectors
16,187,392 : Total sectors on disk
Sanity Checks -
The following is a method for Sanity Checking the output string. This method
does NOT, by itself, provide a foolproof test of a partition's validity; but
it can detect some of the more obvious errors.
1. Partition Type:
This is VALID if the partition type is 0C, as that
is an LBA type (so no CHS information is required).
Where only the LBA values will be read from the disk,
it is NOT important what the size of the disk is, as
LBA (unlike CHS) can function on disks larger than 8GB.
2. ID Signature:
This is VALID if the ID Signature is 80 hex, as that
indicates a hard disk. This is so EVEN where the disk
is a removeable USB disk.
Any value other than 80 hex will normally be invalid
(unless the disk is a 1.44MB floppy disk).
3. Partition Size:
a. Calculate LBA End sector, from CHS values:
1006-254-63 = 1006 x 255 x 63 = 16,161,390
254 x 63 = 16,002
63 = 63 16,177,455
----------
NB: The result must be equal to:
( End Cylinder + 1 ) x 16,065
Example, based on the above:
1006 + 1 = 1007 x 16,065 = 16,177,455
NB: If disk size exceeds 8GB the CHS values
for 'End sector' will be invalid, being
merely large drive placeholders.
b. Calculate LBA Start sector, from CHS values:
0-1-1 = 0 x 255 x 63 = 0
1 x 63 = 63
1 = 1 64
---------- ----------
c. Subtract b from a: = 16,177,391
d. Add Hidden Sectors: 63
----------
= 16,177,454
e. Adjust for LBA (add 1): 1
----------
Size of Partition (sectors) = 16,177,455
==========
This is valid if, but ONLY if, 'Size of Partition (sectors)' is -
a. Less than total sectors on disk, and
b. An exact multiple of 16,065
NB: Sectors per Cylinder = 16,065
(255 Heads x 63 Sectors = 16,065)
NB: If the CHS end sector is xxxx-254-63 that
is CERTAIN to be the correct end value
(if the disk is using standard geometry
and the disk size does not exceed 8GB)
because it ends on a Cylinder boundary.
^ Top of Page
CONVERSION CALCULATIONS
=======================
FORMULAS
========
• Number of Sectors in Partition:
Number of sectors in partition = (LBA End Sector) - (LBA Start Sector) + 1
Notes: 1. LBA End Sector is CHS End converted to LBA
2. LBA Start Sector is CHS Start converted to LBA
3. This formula is only valid for a disk smaller than 8GB.
CHS values on a larger disk are artificial (maximum) values;
a disk CANNOT have a Cylinder number greater than 1023.
A CHS value can't exceed 1023-254-63 (due to the INT 13 barrier)
(i.e. the CHS Interrupt 13 size limit); the maximum value is 8GB
• End Sector:
End Sector = (LBA Start Sector) + (LBA Number of Sectors) - 1
CONVERT C-H-S TO LBA
====================
The following script uses CALC.EXE to convert a disk sector address
from a C-H-S value to an LBA value.
The script will run under either DOS or Windows. However, it can
crash Windows in some circumstances, so is safer to run under DOS.
To run it, copy-and-paste the script into a file named CONVERT
(7 characters, no filetype); then type the following commands
at the DOS prompt:
*** Display the output on Screen ***
SET PATH=%path%;F:\CALC
CALC CONVERT -q
*** Save the output to a file ***
SET PATH=%path%;F:\CALC
CALC CONVERT -q >> CHStoLBA.TXT
*** View the output file ***
EDIT CHStoLBA.TXT
*** Script Begins ***
/* CONVERT C-H-S TO LBA:
*** Formula to convert any C-H-S value to LBA ***
(Cylinder x Heads per Cylinder x Sectors per Head)
+ (Head x Sectors per Head) + (Sector - 1) = LBA */
print("Enter no. of Cylinders : ")
read( Cylinder )
print("Enter no. of Heads : ")
read( Head )
print("Enter no. of Sectors : ")
read( Sector )
print("LBA = ")
(Cylinder*SectorsPerHead*HeadsPerCylinder)+(Head*SectorsPerHead)+(Sector-1)
*** Script Ends ***
CONVERT LBA TO C-H-S
====================
The following script uses UCALC.EXE to convert a disk sector address
from an LBA value to a CHS value.
The script will run under either DOS or Windows. Unlike CALC.EXE,
it does NOT crash Windows.
To run it, copy-and-paste the script into a file named LBAtoCHS
(8 characters, no filetype); then type the following commands
at the DOS prompt:
*** Save the output to a file ***
SET PATH=%path%;F:\UCALC
UCALC /NODEF < LBATOCHS
*** View the output file ***
EDIT CHS.TXT
*** Script Begins ***
; CONVERT LBA to C-H-S:
; INPUT: Configuration
; *** Set appearance of Prompt (for Prompt and Answer) ***
PROMPT ""
PROMPTA " ="
; *** Calculate to 8 decimal places only ***
FIX = 8
; *** Set Printer to Off ***
PRINT OFF
; INPUT: User-entered Values
; *** Enter LBA Sector Number ***
LBA = 0 ; LBA Sector Number
; *** Disk Geometry ***
SectorsPerHead = 63 ; Sectors per Head
HeadsPerCylinder = 255 ; Heads per Cylinder
; OUTPUT: Calculation Begins
var_1 = LBA + 1 ; Add 1
var_2 = SectorsPerHead ; Sectors per Head
var_3 = HeadsPerCylinder ; Heads per Cylinder
var_4 = var_2 * var_3 ; Sectors per Cylinder
var_5 = INT( var_1 / var_4 )
var_6 = INT( var_5 ) ; Cylinders (Integer)
var_7 = var_1 - ( var_6 * var_4 ) ; Remainder
var_8 = var_7 / var_2
var_9 = INT( var_8 ) ; Heads (Integer)
var_10 = var_7 - ( var_9 * var_2 ) ; Sectors (Integer)
; OUTPUT: Save to File
; *** Append Output to file named CHS.TXT ***
WRITE "CHS.TXT"
; LBA Sector Number:
(LBA)
; CHS Address:
; C - Cylinders :
(var_6)
; H - Heads :
(var_9)
; S - Sectors :
(var_10)
; *** Close the file CHS.TXT ***
CLOSE "CHS.TXT"
; *** EXIT to DOS ***
EXIT
*** Script Ends ***
^ Top of Page
WINDOWS CALCULATIONS
====================
XLS FILES
=========
I am releasing the following Excel (.xls) spreadsheets, which require:
(a) Windows 9x or later; and (b) Microsoft's Excel 97 or later.
They are not intended to be used under DOS. They provide a means of
carrying out the above calculations in a more convenient way, but they
require a working Windows PC.
Each of the Spreadsheets provides tools for calculating some aspect
of a hard disk's geometry, and can be used to test-out possibilities
"on the fly". But the Spreadsheets are a work-in-progress, and may need
modifying (perhaps substantially), so they might or might not be useful.
Note: The following programs can open an Excel 97 .XLS file -
Spread32 or these Freeware tools
Spreadsheet for calculating FAT32 Geometry -
http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/GEOMETRY.xls
Spreadsheet for FAT32 Disk exceeding 8GB (not exceeding 137GB) -
http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/FAT32_HDD_exceeding_8GB.xls
Spreadsheet for FAT32 Disk not exceeding 8GB -
http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/FAT32_HDD_not_exceeding_8GB.xls
Spreadsheet for FAT32 Disk (General) -
http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/DISK.xls
CHS and LBA spreadsheet (13 sheets) -
http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/CHS_LBA_v2.xls
Note: These are specialist tools by Jaclaz from www.boot-land.net
^ Top of Page ______________________________ SECTION G: SOFTWARE SOURCES ______________________________
PROGRAM DOWNLOAD SOURCES
========================
No files are hosted on this site
|
ATIS.EXE Acronis True Image, v8.1 (ATIS.UHA) (DOS & Windows version) Source: Hiren's Boot CD v9.6 (Hiren_s_BootCD_9.6.rar) (Hiren's.BootCD.9.6.iso) http://www.google.com/search?btnG=Google+Search&as_epq=Hiren_s_BootCD_9.6.rar Alternative source page: http://www.shared2u.com/index.php?do=search Search for: Hiren (NB: The site requires you to register (free), AND log-in, in order to download files) APR.EXE (a.k.a. PR.EXE)Active Partition Recovery, v3.0 (ACTPARTR.CAB) Source: Utility CD v13.00 (UTILCDv13.rar) (UTILCDv13.iso) Source page: http://www.google.com/search?q=UTILCDv13&btnG=Search BEEBLEBROX.EXEBeeblebrox Partition Table Editor for Windows, v1.0: http://web.archive.org/web/20060223003044/.../~codyb/beeblebrox9xsetup.zip BIOS.EXEMatthias Bockelkamp's BIOS utility, v1.35.1 http://www.bockelkamp.de/software/discontinued/bios1351.zip Homepage: http://www.bockelkamp.de/software/ Alternatives: • ftp://ftp.elf.stuba.sk/pub/pc/utildiag/bios1351.zip • http://info.elf.stuba.sk/packages/pub/pc/utildiag/bios1351.zip CALC.EXETimothy C Frenz's Infinite Precision Calculator, v2.2 ftp://ftp.simtel.net/pub/simtelnet/msdos/calculte/calc_v22.zip Alternative: ftp://ftp.eunet.bg/pub/simtelnet/msdos/calculte/calc_v22.zip CHK IDENTIFIERFlobo's CHK identifier (Demo version) (untested) 1.06MB FloboRecoverySoft.com's FloboCHKIdentifierDemo.rar Alternative (Freeware): http://www.majorgeeks.com/CHK-Mate_d4110.html CMOS.COMCharles Dye's CMOS save and restore program, v0.93 ftp://ftp.sac.sk/pub/sac/utilmisc/cmos93cd.zip COPYR.EXEVasiljev Alexey's HDD cloning program for DOS, build 13 (Size 45 KB) Source: The Ultimate Boot CD at http://www.UltimateBootCD.com Download page: http://www.ultimatebootcd.com/download.html File Info: http://www.filetransit.com/view.php?id=29519 CYLDIR.EXESvend's CYLDIR, v5.5 http://www.partitionsupport.com/cyldir55.zip DE.EXEPTS (PhysTechSoft) Disk Editor for FAT32 HDD exceeding 32GB, v1.04 http://thestarman.pcministry.com/tool/dl/PTSDE104.ZIP http://reimagery.com/fsfd/bin/disk1/ptsde104.zip DISKEDIT.EXENorton's Disk Editor for DOS, v7.0 (1993) (for FAT16) http://www.cse.msstate.edu/~dampier/6273labmanual/Storage%20Media/diskedit/DISKEDIT.EXE http://www.cse.msstate.edu/~dampier/6273labmanual/Storage%20Media/diskedit/DISKEDIT.HLP http://www.cse.msstate.edu/~dampier/6273labmanual/Storage%20Media/diskedit/NLIB100.RTL DISKEDIT.EXENorton's Disk Editor, from Norton Utilities 2002 (for FAT32) http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.EXE http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.HLP http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.ICO http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/DISKEDIT.PID DISKMAN4.EXEDisk Manager, v4.01 Source: The Ultimate Boot CD at http://www.UltimateBootCD.com Download page: http://www.ultimatebootcd.com/download.html DLGSETUP11_DOS.EXEWestern Digital's Data Lifeguard Tools for DOS, v11.2 http://down1.driversdown.com/Storage/dlgsetup11_dos.exe ftp://files.akl.lt/users/mantas/hard%20disk%20tools/Dlgsetup11_dos.exe DOSLFN.EXEHenrik Haftmann's LFN driver for DOS, v0.34d & v0.40e v0.34d: http://adoxa.110mb.com/doslfn/doslfnm.zip v0.40e: http://sta.c64.org/dosprg/doslfn.zip DWSE_EN.EXESeagate's DiscWizard Starter Edition (English) Version 10.32.05 (requires 1 floppy disk) - ftp://ftp.km.ru/v01/Soft/Utility2/DWSE_EN.EXE Version 10.45 (requires 2 floppy disks) - http://www.google.com/search?q=%22dwse_en.exe%22&btnG=Search Version DiscWizard 2003 (for Windows) (10MB) - http://karman3.elte.hu/~bazse/dl/win/sys/hd/discwizard2003_en.exe FINDBAD.EXESvend's FINDBAD, v1.6 http://www.partitionsupport.com/fbad16.zip FINDPART.EXESvend's FINDPART for DOS, v4.72 http://www.partitionsupport.com/fpart472.zip GHOST.EXENorton's Ghost for DOS, v8.3 (HDD Cloning utility) http://www.google.com/search?q=%22GHOST.exe+8.3%22&btnG=Search Note: The most up to date version is GHOST.EXE for DOS v8.3.0.1335 HD Clone, v3.6 Free Edition (HDD Cloning utility for Windows 9x) (IDE only)http://www.google.com/search?as_epq=HDClone+3.6&btnG=Google+Search HD Clone, v3.6 Professional (HDD Cloning utility for Windows 9x) (IDE, SATA, USB)http://www.google.com/search?as_epq=HDClone+3.6+Professional&btnG=Google+Search http://www.google.com/search?as_epq=HDClone.Professional.v3.6.2-DOA&btnG=Google+Search LCOPY.EXEOdi's COPY for long file names, v1.75 (English) http://ftp3.ie.freebsd.org/pub/sourceforge/.../lfntools/1.75/lfn-1.75-en.zip LDIR.EXEOdi's DIR for long file names, v1.75 (English) http://ftp3.ie.freebsd.org/pub/sourceforge/.../lfntools/1.75/lfn-1.75-en.zip LF.EXELost and Found, v1.31 (LOSTFND.CAB) Source: Utility CD v13.00 (UTILCDv13.rar) (UTILCDv13.iso) http://www.google.com/search?q=UTILCDv13&btnG=Search&as_qdr=all Version 1.06: http://computersnewbie.blogspot.com/2009/07/pc-first-aid-tools.html MTL.EXEMedia Tools Professional, v5.0 (MEDITOOL.CAB) Source: Utility CD v13.00 (UTILCDv13.rar) (UTILCDv13.iso) http://www.google.com/search?as_qdr=all&q=UTILCDv13&btnG=Search MBRScan.EXENobumichi Kozawa's MBR Scan for DOS, v1.12 (English) http://my.vector.co.jp/.../download/http/0/103907/pack/dos/util/disk/mbrs112.zip MBRutilD.EXEPowerQuest's MBR Utility for DOS, (c) 2002 ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/head.zip MBRWizD.EXEMBR Wizard for DOS, (c) 2002-2006 Roger Layton Version 1.52: http://mbrwizard.com/download2.php?f=MBRWizD.zip Version 1.53: http://archives.mysteryfcm.co.uk/system/misc/mbrwiz/mbrwiz153.zip Version 2.0b: http://archives.mysteryfcm.co.uk/system/misc/mbrwiz/beta/mbrwizd2.0.zip Source: http://mbrwizard.com/download.php MI.COMMemory Information tool (English) http://www.uwe-sieber.de/files/mi_e.zip NDD.EXENorton Disk Doctor for DOS, from Norton Utilities 2002 (FAT32) http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/NDD.EXE http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/NDD.HLP NORTON UTILITIESNorton Utilities 2002 http://www.currybeast.com/ftp/Tools/Norton%20Disk%20Doctor%202002/NU/ NTFS98FULL.EXENTFS for DOS and Windows 98 http://78.108.77.254/install/!HDD_Utils/!NTFS for DOS & Win98/ PART.EXERanish Partition Manager, v2.40 http://www.ranish.com/part/part240.zip PARTINFO.EXEStar-Tools Partition Information program, v1.04 http://www.star-tools.de/english/pub/partitionstar.zip Partition Logic, v0.69http://visopsys.org/files/partlogic/partlogic-0.69-img.zip RawWrite: http://visopsys.org/files/visopsys/rawwritewin-0.7.zip Source: http://partitionlogic.org.uk Partition Magic, v8.05 (Partition.Magic.8.05.rar) (Windows 9x)http://www.google.com/search?btnG=Google+Search&as_epq=partition+magic+8.05 PTCALC.EXEPT Calc, PowerQuest's Partition Table Calculator for Win9x (CHS to LBA) ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/ptcalc.zip PTEDIT.EXEPowerQuest's Partition Table Editor for DOS, v1.0 ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/ptedit.zip PTEDIT32.EXEPowerQuest's Partition Table Editor for Windows, v1.0 ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/PTEDIT32.zip REBOOT.COMReboot v1.0 (for DOS), (c) 1987 Strange Software Ltd ("What Micro?" Toolkit) http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/reboot.zip RESTORATION.EXERestoration, v2.5.14 Download link: http://files.snapfiles.com/localdl936/REST2514.EXE Download page: http://www.snapfiles.com/get/restoration.html SEATOOLD_EN.EXESeaTools Desktop, v3.02 (English) http://www.google.com/search?btnG=Google+Search&as_epq=seatoold_en.exe Alternative: ftp://192.35.246.12/pub/util/hard-drive/seagate/seatoold_en.exe SERCOPY.COMSerial Copy, (c) 1996 Future Publishing http://clitheroekid.ihostfull.com/utils/FAT32/toolkit/SERCOPY.COM SHOW.COMText Viewer for DOS v1.4, (c) 2001 Horst Schaeffer http://home.mnet-online.de/horst.muc/int/show14.zip Note: Can handle files too large for MS-DOS's EDIT.COM Website: http://home.mnet-online.de/horst.muc/main.htm Sleuth KitBrian Carrier's Sleuth Kit for 32-bit Windows, v3.0.1 http://en.sourceforge.jp/projects/sfnet_sleuthkit/.../sleuthkit-win32-3.0.1.zip/ Further info: http://www.sleuthkit.org SRCFAT.COMSRCFat v1.3, (c) 2001 The WOrm (Save the FAT) http://www.zelja.com/AdminHeaven/Boot/TECHW0RM.ZIP TESTDISK.EXETestDisk for DOS, v6.10 - http://www.cgsecurity.org/testdisk-6.10.dos.zip TestDisk for DOS & Windows 9x/ME, v6.11 - http://www.cgsecurity.org/testdisk-6.11.3.dos.zip http://reimagery.com/fsfd/bin/disk1/testdisk-6.11.3.dos.zip Further info: http://www.cgsecurity.org/wiki/TestDisk TOTALCMD.EXETotal Commander for Windows, v7.02a (Shareware) http://download.oldapps.com/Total_Commander/tcmdr702a.exe Total Commander for Windows, v7.04a (Shareware) http://www.druk-reklama.com/pub/tcmdr704a.exe Further info: http://www.oldapps.com/Total_Commander.php UCALC.EXEUltimate Calculator, v1.8 (Shareware) http://www.nfbnet.org/files/spreadsheets/UCALC18.ZIP UNDISKER.EXEUndisker, v1.2 (Trial version) ftp://ftp.sac.sk/pub/sac/utildisk/undsk12.zip Further info: http://www.undisker.com USB 1.1 drivers for DOS -Info: www.computing.net/answers/dos/usb-20-drivers-for-dos/13447.html USBASPI.SYS : Panasonic's ASPI Manager for USB mass-storage v2.24 http://glennmcc.org/download/usb-dos/panasonic-f2h_usb/f2h_usb.zip or here Di1000DD.SYS : ASPI Disk Driver v2.00, (c) 2001 NOVAC Co Ltd http://glennmcc.org/download/usb-dos/dosusb1/mhairu.zip or here Note: Do NOT use the usbaspi.sys in mhairu.zip, it is an older one! XMSDSK.EXEAdjustable XMS RAMdisk Driver for DOS http://www.hiren.info/download/dos-files/xmsdsk.zip XVI32.EXEChristian Maas's Hex Editor, v2.51 http://www.handshake.de/user/chmaas/delphi/download/xvi32.zip XXCOPY.EXEXXCOPY for Windows, v2.85.7 http://www.xxcopy.com/download/xxfw2857.zip |
Due to the age of this page, some links are bound to be dead.
Use this last link in those cases.
In addition to the individual files, this last link leads to a zip file
containing ALL of the software mentioned in this section.
^ Top of Page DATA RECOVERY LINKS =================== How Computers Boot-Up: http://duartes.org/gustavo/blog/post/how-computers-boot-up Tools for Hard Disk Partition Management: http://reimagery.com/fsfd/disk1.htm Disk Partitioning, Formatting, Backup & Recovery Tools: http://www.mdgx.com/secrets.htm#FDPT Forums / Help: Forums for sharing Computer-related problems and requesting help Ultimate Boot CD's links page (linking to the individual programs): http://www.ultimatebootcd.com/index.html Useful DOS programs: http://www.hiren.info/downloads/dos-files Windows 98 operating system files: http://www.google.com/search?q=Win98+rar Windows ME operating system files: http://www.google.com/search?q=WinME+rar Compatible Hardware for Windows 9x: MSFN Forums - Topic 107001: Compatible Hardware Recovery Tools for NTFS partition: NTFS - New Technology File System
>>> Wayback Machine <<<
Best viewed with
Internet Explorer 8
or Firefox
This page optimised for Windows 9x
Internet Explorer 8
or Firefox
This page optimised for Windows 9x
© 2009, STEPHEN POPPITT