Chapter Two: Advanced Hard Drive Data Recovery

Preparing a Hard Disk Drive to Store DOS Files

O/S Independent Operations:

! Low-Level Format (performed by the manufacturer of the disk drive.)

! Physically install disk drive in computer.

! Run Set-Up program to enter drive geometry into Configuration RAM.

Specify which Operating System(s) will reside on the disk drive:

! Run MS-DOS FDISK to Create a Partition Table and Master Boot Record (MBR)

O/S specific High-Level format:

! The MS-DOS FORMAT command creates the:

Q DOS Boot Record (DBR)

Q File Allocation Table (FAT)

Q Root Directory

Low-Level Format

The first disk structure created is the low-level format. Also called a hardware-level format, physical-format, or controller format. Viewed at the Hardware Layer, a hard disk is a three-dimensional object. To specify a unique location on the hard drive one must specify the:

! Cylinder Number

! Head Number

! Sector Number

The Low-level format:

! Divides each surface of the platters into a specified number of concentric tracks. The total number of tracks is a function of the design of the physical drive and cannot be modified. Typical hard drives have a density of 2,800 to 3,500 tracks/inch.

! Each track is sub-divided into a specified number of sectors. Each sector holds 512 bytes. The number of sectors/track is a function of the data encoding method utilized by the controller.

! The low-level format is destructive. All data is overwritten.

! Bad sectors are flagged in the Sector ID Header. Some controllers use spare sectoring which reserves a spare sector/track. The spare is substituted for a bad sector via the sector defect marker and vector contained in the Sector ID Header.

Use Norton Calibrate to fix sector problems.

Error Detection and Correction

Two fields are used to verify the integrity of the hard disk data:

Sector ID Header CRC

! The Sector ID Header is written during the low-level format. During the course of normal operation this ID is never rewritten.

! The CRC (Cyclic Redundancy Check) is a polynomial equation used to verify the contents of a field. The contents of the Sector ID Header is entered into the CRC equation and the result is written into the Sector ID Error Checking Field.

! Upon reading the Sector ID Header, the controller generates a new CRC and compares it to the CRC read from the Sector ID Error Checking Field.

! A CRC mismatch indicates a corrupted Sector ID Header. The controller re-reads the Sector ID Header several times before passing a "Sector Not Found" completion code to the BIOS.

! Consecutive Sector ID Header CRC errors indicate a corrupted low-level format, and at the very least, partial data loss.

Data Field ECC

! The CRC mechanism detects errors, but provides no means to correct them. The ECC (Error Correcting Codes) is a sophisticated, controller-level algorithm. It not only detects data errors, but also corrects a specified number of consecutive bad data bits.

! The Data Field is protected by an ECC. After the controller write a sector of data, it computes and writes ECC information in the following field.

! Upon reading a sector of data, the controller regenerates the ECCs to verify the data. And, If needed, to repair corrupt data bits.

! The ECC circuitry is a function of the hard disk controller. The extent of ECC repair is a function of the disk interface technology, data encoding method, and the design of the disk controller.

MS-DOS and ECC Errors

Assuming that the Section ID Header is valid, a read sector request results in one of three completion codes (responses) from the disk controller:

! Valid Data - The operation yielded a sector of valid data.

! Corrected Data - The operation yielded a sector of valid data. But, ECC was needed to repair the raw data.

! Data Read Error - Even after several read/repair attempts, the data continues to have uncorrectable errors.

The first and third responses are self-evident; the second demands greater explanation.

! The degradation of magnetic data is progressive. When ECC is invoked to repair the data, it's likely that the data will continue to degrade beyond repair.

! In response to an ECC corrected data completion code, a pro-active O/S dynamically copies the sector buffer into an unused sector on the hard drive and marks the current sector as bad.

! In response to ECC corrected data completion code, MS-DOS does nothing. It simply ignores the impending danger. The data continues to degrade beyond repair.

! Norton's Calibrate (part of the Norton Utilities) is a non-destructive hard disk drive diagnostic and preventive maintenance program. It verifies the integrity of each sector by writing complex, worst-case test patterns and performing a read-after-write verification. In response to an ECC correction completion code, Calibrate marks the sector as a bad and moves the repaired data to a new sector. Every 3 months, Level 3.

Physical Hard Drive Installation

Internal disk drives require connections to:

! DC Power: +5V for the electronics and +12V the spindle motor. When the drive's spindle motor doesn't rotate, substitute a different power connector.

! Logic Cables: Flat ribbon cable connects the drive to the controller or system board interface electronics. The number and size of cables is a function of the disk drive interface specification.

! Drive Activity LED: Usually connected to the hard disk interface card.

Run Set-Up Program to Configure Drive Geometry

The POST determines these parameters from the CMOS configuration RAM:

! The drive's geometry: the total number of cylinders, heads, and sectors/track.

! The LZ (landing zone) or parking track: used by manual head parking programs.

! The write pre-compensation track: only used in older technology (ST-506 or ESDI) disk drives to compensate for the increase in the data's linear velocity on the inner tracks.

BIOS Drive Types and Parameter Limitations

The BIOS contains a proprietary drive parameter table. It typically lists about 47 drive geometrics each identified with a arbitrary Type-Number. To enter drive parameters run Set-Up:

! Scroll through the drive parameters list and select the type-number with the matching geometry.

! In the absence of a matching drive type, go the last drive entry: User-Defined. A User-Defined drive type enables the manual entry of a drive's geometry.

! In the IDE section, in this chapter, we consider two additional ways that IDE drives may be configured in newer BIOS ROMs.

INT-13: DOS Disk Services Interrupt

INT-13 is the DOS disk services request interrupt. It has the following maximum drive geometry:

! 1,024 Cylinders (10-bit cylinder pointer)

! 16 Heads (4-bit head pointer)

! 63 Sectors/Track (6-bit sector pointer)

Theoretically, the largest capacity disk drive that INT-13 support is:

1,024 Cylinders X 16 Heads X 63 Sectors/Track X 512 Bytes/Sector = 528-Mb

Hard Drive Sector Translation

Most new drives have greater than 1,024 cylinders and employ sector translation. This technique translates the drive's physical characteristics into a logical geometry which fall within the DOS INT-13 parameters.

Example: A drive has a physical geometry of 1,806 cylinders, 2 heads, and 48 sectors/track. To fall within INT-13 specifications the hard drive controller translates the geometry so the drive appears has 903 cylinders, 4 heads, and 48 sectors/track. The translated geometry, not the true physical geometry is entered into the CMOS Configuration RAM.

Breaking the INT-13 524-Mb Limitation

INT-13 is specified to support a maximum of 16 heads:

! There are actually 8-bits reserved for the head pointer. Providing a theoretical maximum of 256 heads.

! DOS and BIOS does not check to ensure that the head value falls between 0-15.

! On-Track's Disk Manager (and other third-party DOS disk management packages) provide a device driver that exploits this 256 head loop-hole. This increases the INT-13 disk capacity to a maximum of 8-Gb.

Partition Table & MBR

The BIOS is O/S independent. Upon power-on or a hardware reset the POST determines the system configuration, initializes and tests the specified devices, and boots the O/S from either a floppy or hard drive.

Every hard drive must have a valid Partition Table/MBR. It resides in the first physical sector: Cylinder-0, Head-0, Sector-1.

! The Partition Table is a static data structure. It translates the physical disk drive defined in the BIOS into a logical disk drive that may be accessed by a specific O/S.

! The MBR (Master Boot Record) is a small program which launches the O/S boot record loader specified in the partition table.

Recall that the primary activity of an O/S is to manage and allocation disk storage. The partition table

! The partition table divides the physical drive into one or more logical partitions.

! Each disk partition designates a unique range of cylinders and the O/S to which they are assigned.

! To boot from the hard drive, one (and only one) partition may be designated as the active partition.

! The POST examines the partition table to identify the active partition.

! Finally, the POST executes the MBR program.

! The MBR activates the boot record from the active partition. This launches the O/S boot process.

Multiple Partitions

! Although it only consumes one sector, all of Track-0 (Cylinder-0, Head-0, Sectors 1-N) is reserved for the partition table. The first O/S partition starts on Track-1 (Cylinder-0, Head-1, Sector-1).

! Most DOS-based PCs have a single, boot-able DOS partition which (with the exception of Track-0) spans the entire physical drive.

! Many notebook computers have a small non-DOS partition to support the Suspend/Resume function.

FDISK - The DOS Partition Program

! Partition a hard drive by creating one or more DOS partitions.

! Specify the type of DOS partition.

O BigDOS - The standard DOS partition. It originated with COMPAQ DOS 3.31 and MS-DOS 4. A BigDOS partition has a theoretical 2-Gb limitation.

O Extended - Enables the creation of multiple logic DOS drives from a single physical drive. Used to subdivided extremely high capacity disk drives into several more manageable logical disk drives.

! Set the active (boot-able) partition.

! Examine and delete existing partitions.

*** Caution ***

FDISK performs a high-level format on approximately the first 8 tracks of the disk drive. This ensures that if the drive previously held data, all of the O/S file pointers will be erased and not interfere with the new O/S.

The DOS High-Level Format Command

DOS Format is a logical, or high-level disk formatter. It prepares a DOS disk partition to support the DOS FAT file system. Each DOS partition on a hard drive must be formatted separately.

Format creates three data structures:

! DBR (DOS Boot Record)

! FAT (File Allocation Table), 2 copies

! Root Directory, 512 file entries

The optional /S (System files) parameter creates three files:

! IO.SYS and MSDOS.SYS: The System Boot Files. They must be the first two files in the Root Directory and are created with the System and Hidden file attributes. This ensures that they are not moved by a disk optimization program or accidently erased. These files are called IBMDOS.COM in IBM's PC-DOS.

! COMMAND.COM is the default DOS Command Interpreter. The command interpreter can appear anywhere in the root directory, or as specified by the SHELL command in CONFIG.SYS.

DBR

The DBR occupies the first logical sector of the DOS partition. When DOS is the first (or only partition) the DBR is written to Cylinder-0, Head-1, Sector-1. Like the partition table, the DBR has two independent parts:

! A static data structure which transforms the physical range of cylinders as specified in the DOS partition into logical values used by the higher-level portion of DOS to manage and allocate disk storage. Most of these values get copied into the BIOS Parameter Block which resides in low RAM.

! A DOS booter that loads and executes IO.SYS, the DOS bootstrap program.

DIS visualizes hard disk sectors in two different ways.

! The lower part of DOS understands physical drive sectors as designated by a three dimensional coordinate: Cylinder, Head, and Sector Number.

! To simplify the management of the disk drive the upper part of DOS employs logical sector addressing. This technique views all of the sectors in the partition sequentially, on one long string.

! Although physical sector numbering starts with the number 1, logical sector numbering starts with the number 0.

Consider a drive with 850 cylinders, 2 heads and 17 sectors/track. It has a total of:

850 x 2 x 17 = 28,900 sectors

Logical sector addressing assigns translates the three-dimensional drive into a string of 28,900 sectors:


                   Physical Sectors                  Logical Sectors          

             Cylinder-0, Head-0, Sectors                  0-16                
                         1-17                                                 

             Cylinder-0, Head-1, Sectors                  17-33               
                         1-17                                                 

             Cylinder-1, Head-0, Sectors                  34-50               
                         1-17                                                 

                         ...                               ...                

            Cylinder-849, Head-1, Sectors            28,882 - 28,899          
                         1-17                                                 



The File Allocation Table

Instead of micro-managing each 512-byte sector on the hard drive, DOS groups sectors together in more efficient storage units, called Clusters or DOS Allocation Units.


             Partition Size in Mega Bytes      Cluster Size in Kilo Bytes     

                      0 to 15.9                             4                 

                     16 to 127.9                            2                 

                     128 to 255.9                           4                 

                     256 to 511.9                           8                 

                         512+                              16                 



The FAT is the third data structure on the disk drive.

! It starts at logical Sector-1 in the DOS partition.

! Contains one 16-bit entry for each cluster on the disk drive.

Each cluster entry has one of the following 16-bit values:

! 0000h - Signifies that the cluster is available for use.

! 003h - FFEFh - The cluster represented by this FAT entry is in use by a file. The actual entry points to the next cluster in the file chain.

! FFFFh - The EOF (End of file maker.) indicates the last cluster occupied by a file.

! FFF7h - One or more of the sectors assigned to this cluster is bad; so the entire cluster is flagged as bad. DOS marks bad clusters during the high-level format by using information from the Sector ID Header. Disk utilities like Norton's Disk Doctor also mark bad clusters.

FAT Fundamentals

Consider this sample 2 entry FAT for a disk drive with 40-Kb of data space employing 2-Kb clusters. (To facilitate understanding this example uses decimal instead of hexadecimal FAT numbering.)


   2       3        4        5       EOF      EOF      11       0       BAD       0     

  12       13       18       15       16      17      EOF      EOF       0       BAD    




     In File's                                                                    
  Directory Entry                                                                 

     File Name         Size in Bytes      Starting Cluster      Cluster Chain     

OUTLINE.ATS                8,493                  1             1, 2, 3, 4, 5     

NET.BAT                     154                   6                   6           

EXPENSE.WKS                9,603                  7           7, 11, 12, 13, 18   

TODAY.DOC                  7,124                 14             14, 15, 16, 17    



Cross Linked Files

Consider what happens when the FAT gets damaged and one of the cluster entries gets corrupted.

! The pointer for the fifth cluster in OUTLINE.ATS ha been corrupted so it now points to cluster 12 instead of cluster 5.

! Cluster 12 ia already in-use by EXPENSE.WKS.


   2       3        4        12      EOF      EOF      11       0       BAD       0     

  12       13       18       15       16      17      EOF      EOF       0       BAD    



When the FAT entries of two files assert ownership of the same cluster (or cluster chain) those files are said to be cross-linked.

How are cross-linked files detected?

! The directory entry specifies the size of the file and the DBR specifies the cluster size of the disk drive.

! The cluster chain is invalid when a file contains the incorrect number of clusters.

! When DOS attempts to open a file with the incorrect number of clusters it generates a file read error.

! DOS maintains two copies of the FAT. If the primary FAT is corrupted, DOS employs the secondary FAT to resolve any conflicts. However, DOS may perform this action without alerting the user or repairing the primary FAT.

DOS File System Diagnostic Programs

CHKDSK

! CHKDSK is the most basic DOS file system diagnostic program. It ensures logical consistency between each directory entry and its associated cluster chain in the FAT.

! It repairs cross-linked files by simply truncating the file with the incorrect cluster chain length.

! Lost Cluster Chains. A lost cluster chain doesn't have a corresponding directory entry. CHKDSK will convert each lost chain to a file or return the associated clusters to free status.

SCANDISK

! Introduced in DOS 6.0. Scandisk is a comprehensive logical disk structure diagnostic and repair program.

! In addition to much more reliable tools for fixing cross-linked files, it also includes a Read-Only surface scan for finding ECC errors, moving data, and marking bad clusters.

Norton's Disk Doctor and PC Tool's Disk Fix

! The premier disk repair programs.

! Provide the most comprehensive and reliable logical drive diagnostics and repair.

! Are integrated with other disk diagnostics to provide Physical Layer and DOS Layer support.

File Defragmentation

DOS allocates space for a new file by starting at Cluster-2 and scanning the FAT for the first free cluster. It continues to scan the FAT and allocate clusters until the file has been assigned sufficient disk space.

! Optimally the file is allocated contiguous or sequential clusters.

! However, DOS assigns clusters in the order in which they appear in the FAT. A fragmented file is formed from non-contiguous clusters.

! This induces extraneous head movement which reduces the data through-put and causes extra wear-and-tear on the drive's head carriage assembly.

! DOS 6.0 Defrag, Norton's SpeedDisk, and PC Tool's Compress are disk drive optimization programs. (aka disk defragmentation programs) They re-allocate cluster assignments so that every file consists of a non-fragmented cluster chain.

! A non-fragmented FAT ensures a consistent data through-put rate and minimal head movement.

The most compelling reasons to defragment disk drives are:

! FATs that contain only continuous files are much less likely to become corrupted.

! If a file cluster chain becomes broken or cross-linked with another file, a well-optimized FAT provides the best chance at repairing the corruption without data loss.

The IDE Hard Disk Drive Interface

Previous PC disk technologies such as ST-506 and ESDI were implemented as:

! A hard disk controller card installed in an expansion slot.

! A simple, dumb hard disk drive.

IDE integrates the controller and disk drive into a single unit.

IDE Characteristics

! The controller and disk drive are integrated into a single unit optimized for speed and storage density.

! Complies with the ANSI X3T9.2 ATA (AT Attachment interface) standard which defines a specific register-set and 40-pin connector for intelligent disk drives.

! BIOS compatible disk controller resides at I/O address 1F0h and emulates ST-506 disk drive.

! WD-1003 register set compatible with the original disk controller chip set used in the PCAT.

IDE System Interface Electronics

! Generic system boards interface to IDE drives with a simple, inexpensive, multifunction I/O card.

! Premium system boards have integrated IDE interface electronics.

IDE Performance Improvements

! An 80486-33Mhz system with a standard IDE drive has a data transfer rate in the range of 600 to 650-Kbytes/second.

! A software-only solution is device drivers such as On-Track's Drive Rocket ($19.95) which supports the IDE multiple-block read mode. For compatible drives the data transfer rate is increased by 25% to 75%.

! To improve the data transfer rate higher-performance IDE drives have an integrated RAM cache and rotate at 5,400 RPMs.

! High-Performance, 32-bit IDE interface adapters are available for the VL- and PCI-Local bus. With a device driver the data transfer rate can be increased by a factor of 2 to 4 times.

! The local bus IDE interface may be integrated onto the system board. This is especially important for good disk performance in notebook computers.

! When upgrading to a local bus IDE interface with a system board that has an imbedded IDE interface, remember to run the set-up program to disable the existing on-board IDE port.

IDE Low-Level Format

! Most hard drive manufacturers claim not only that IDE drives can not be low-level formatted in the field, but any such attempt may virtual destroy the drive.

! Drive Pro, from Micro House, has an alternative to low-level IDE format called Erase First Ten Cylinders. This operation doesn't rewrite the Sector ID Header information, but merely zeros out the data sectors. This simple operation often corrects many apparent Hardware Layer drive faults.

IDE CMOS Set-Up

New system BIOS ROMs support IDE specific inquiry routines.

! Many new BIOS ROMs support an IDE Auto-Detect option. This operation determines the geometry of the IDE drive and enters it into the CMOS RAM as a Type47, User Defined.

! Other new BIOS ROMs specify in the CMOS RAM that the drive is Auto-SCAN. Each time the POST initializes the disk system it dynamically determines the drive geometry.

Hard Drive Diagnostics and Recovery Software

Hard disk drive troubleshooting occurs at two levels:

! Hardware/BIOS layers used to verify the drive's basic functionality.

! O/S Layer used to verify the data structures and data which are specific to a particular operating system.

Hardware-Layer Hard Drive Diagnostics

At the Hardware Layer the hard disk drives perform three basic functions:

! Rotate the disk platters at a precise and constant speed.

! Seek the head carriage assembly to a specified cylinder.

! Convert data to magnetic fields (write) and reconvert magnetic fields into data (read)

Diagnostics programs such as OnTrack's Disk Manager and MicroHouse's Drive Pro test:

! Controller and drive electronics

! Linear and butterfly seek/read

! Random read and Write/Read operations

! ECC verification

The Norton Utilities

The Norton Utilities is the premier collection of MS-DOS and Windows hard drive utilities to repair existing problems and perform preventative maintenance.

The Rescue Diskette

A rescue diskette is a bootable DOS diskette that contains copies of critical static data structures and diagnostic programs. A rescue diskette can be created when the Norton Utilities are loaded or at any time by running the Rescue program. Each computer must have its own, unique Rescue Diskette which contains many data files and diagnostic programs including:

! It's used as a troubleshooting Vanilla Boot diskette. It contains an absolute minimal CONFIG.SYS and AUTOEXEC.BAT needed to boot the computer and access system resources. This includes critical device drivers such as a disk compression software, disk drivers, and the mouse driver.

! Copies of AUTOEXEC.BAT, CONFIG.SYS, SYSTEM.INI, and WIN.INI.

! A snapshot of the three static data structures: the CMOS Configuration RAM, Partition Table/MBR, and DBR. In the event of corruption or deletion, they can be restored without data loss.

! NDD (the Norton Disk Doctor) repairs logical damage to the DOS file structure.

! Calibrate is used mainly used as a preventive maintenance tool, but it is also used to troubleshoot intermittent disk problems. It verifies the operational integrity of the disk subsystem and tests each sector's reliability.

! Disk Editor provides access to every data structure or raw data on the disk drive. It's extremely powerful and potentially dangerous. DiskEdit is used when automated tools can't repair a problem.

! NDIAGs is Norton's hardware diagnostic program. It tests the major hardware subsystems. Norton sells a set of three loop-back plugs to test the operation of serial and parallel ports.

! SpeedDisk is a fast and flexible disk defragmentation program. It reallocates file clusters to ensure that all of the files on the drive are contiguous.

! DOS FDISK with the /MBR option is used to rewrite the MBR.

Using Image or Mirror to save Dynamic Data Structure

The Rescue diskette has snapshots of the static data structures: CMOS RAM, Partition Table/MBR, and the DBR. It's updated in the rare event that the CMOS Configuration RAM is changed or a DOS upgrade occurs. The FAT and Root Directory are dynamic data structures; they change every time a file is created or modified. Norton's Image is used to track dynamic data structures.

! Image is a program in the Norton Utilities.

! The DOS 5.0 version of IMAGE was called MIRROR. It was removed in DOS 6.0 and functionally replaced by the UNDELETE /T command.

! Saves the disk's DBR, FAT and Root Directory to a Read-Only, System file.

! Most often placed in AUTOEXEC.BAT to ensure that it is executed every time the system is booted.

! The most critical use of the image data is by the NDD or ScanDisk. The success of NDD to repair file structures and individual files is greatly enhanced when repairing a disk drive with low fragmentation and recent image data.

System Boot Sequence Troubleshooting Flow Charts

POST Boot Process

This flow chart follows the general flow of the POST as it determines the system configuration and executes the MBR.

DOS Hard Drive Boot Process

This flow chart starts with the loading of the DBR and follows the flow until C: prompt is displayed. Standby Power Supply from APC.

Hard Drive Data Structures Lab:

Objective:

To determine the symptoms and error messages associated with a corrupt MBR, Partition Table, and DBR. Use the Norton Rescue, Disk Doctor, and FDISK /MBR programs to restore access to the disk drive with no data loss.

Software:

DOS versions 5.0 or 6.2

Norton Utilities ver 8.0

Diskettes:

A blank diskette used to create Rescue Diskette. Do not exchange Rescue Diskettes or trust the Rescue Diskette that is currently with your system; make a new one as specified in the following procedures.

Procedures From DOS:

1. Boot from the hard drive and run Rescue. Choose Create Rescue Diskette. Examine the programs and files that are placed on the rescue diskette.

2. Boot from the Rescue Diskette. Execute NDD A:/Q to verify the diskette; the /Q specifies the Quick test which skips the surface check. Use the /Q option for the rest of this lab.

3. Eject the Rescue Diskette and reboot the system. Run Norton DiskEdit. Use the mouse or Alt key to access the menu.

a. Choose Object-Partition Table to examine the partition table.

b. Choose Object-Boot Record to examine the DBR.

c. Choose Object-FAT 1 to examine a FAT and track a cluster chain.

d. Choose Object-Directory to examine the root directory and DOS boot files. Drive 128.

4. Corrupting the MBR - Program Code.

a. Choose Object-Partition Table and then View-As Hex. The hexadecimal values that constitute the Partition Table and MBR are displayed. The offset of the cursor from the beginning of the sector is displayed (in decimal and hexadecimal) in the lower-right corner.

b. Corrupt the first four bytes of the MBR program code by moving the cursor to offset 0 hex and overwriting FA, 33, C0, 8E with 00s.

c. Write the changes to the disk by Pressing ESC, Write, Enter.

d. Exit DiskEdit by Pressing ESC, Yes, Enter.

e. Reboot the computer. Observe the symptoms and/or any error message. Is this what you expected? Why?

f. Reboot the system with the Rescue Diskette.

g. Can you access the C: drive? Why? Yes.

h. Run NDD C: Does it detect/fix the problem? No! Why?

5. Restoring a corrupt MBR

a. Method One: If you have a Rescue Diskette: boot with the Rescue Diskette and Run Rescue, Choose Restore. Tab to the Partition Table box check box and select it by pressing the Space Bar. Tab to Restore and press Enter.

b. Method Two: If you don't have a Rescue Diskette: Boot from a diskette (use the Rescue Diskette for this example) and Run FDISK /MBR.

6. Corrupting the MBR--Checkerboard Marker

a. Boot from the C: drive and run DiskEdit.

b. Choose Object-Partition Table and then View-As Hex.

c. Find the MBR checkboard pattern (55 AA) between offset 60 hex and 80 hex. The values 55 AA mark the end of the MBR program code.

d. Overwrite the 55 AA with 00.

e. Write the changes to the disk by Pressing ESC, Write, Enter.

f. Exit DiskEdit by Pressing ESC, Yes, Enter.

g. Reboot the computer. Observe the symptoms and/or error message. Is this what you expected? Why?

h. Reboot on the Rescue Diskette.

i. Can you access the programs and data on the C:? Why? Yes

j. Run NDD C: Does it detect/fix the problem? Why?

k. Repair the MBR using either the Rescue Diskette or FDISK.

7. Corrupting the Partition Table--Removing the DOS Partition.

a. Boot from the hard drive and run DiskEdit.

b. Choose Object-Partition Table.

c. With the BigDOS partition highlighted,press the space bar several times to set the partition type to unused.

d. Write the changes to the disk by Pressing ESC, Write, Enter.

e. Exit DiskEdit by Pressing ESC, Yes, Enter.

f. Reboot the computer. Observe the symptoms and/or error message (none) message. Is this what you expected? Why?

g. Reboot on the Rescue Diskette.

h. Can you access the programs and data on the C:? Why? (No, no partition)

Desktop system users, remember that there are two hard drives installed in your system--

a 208-Mb IDE and a 52-Mb SCSI.

i. Run NDD C: Does it detect/fix the problem? Why?

8. Corrupting the Partition Table-Removing the bootable Partition.

a. Boot from the hard drive and run DiskEdit.

b. Choose Object-Partition Table.

c. Press Tab to highlight the Boot Column. Press the space bar to change Yes to No.

d. Write the changes to the disk by Pressing ESC, Write, Enter.

e. Exit DiskEdit by Pressing ESC, Yes, Enter.

f. Reboot the computer. Observe the symptoms and/or error message. Is this what you expected? Why? "This Basic was aborted because this machine has no ROM Basic."

Historical Footnote:

The original PC was equipped with the BASIC programming language in ROM and used a 40-column TV display.

g. Reboot on the Rescue Diskette.

h. Can you access the programs and data on the C:? Why? (Stoned virus turns off this partition)

i. Run NDD C: Does it detect the problem? Why? An alternative is to run FDISK and select choice 2. Set Active Partition.

When will we ever rid ourselves of backward compatibility? What is the financial benefit?

9. Corrupting the DBR--Checkerboard Marker

a. Boot from hard drive and run DiskEdit.

b. Choose Object-Boot Record. Then View-As Hex.

c. Move the cursor to the end of the DBR sector, offset 1 FE hex.

d. Overwrite the 55 AA checkerboard with 00.

e. Write the changes to the disk by Pressing ESC, Write, Enter.

f. Exit DiskEdit by Pressing ESC, Yes, Enter.

g. Reboot the computer. Observe the symptoms and/or error message. Is this what you expected? Why?

h. Boot on Rescue diskette.

i. Can you access the programs and data on the C:? Why?

j. Run NDD C: Does it detect/fix the problem? Why?

k. If the Disk Doctor fix doesn't work, try booting off the Rescue Diskette and run Rescue. Select Restore and press Enter. Press Tab twice and the Space-Bar to check the Boot Records Box. Press Tab twice to highlight Restore and then Enter.