Note: This post is intended for hardcore geek consumption. Do not proceed to consume article unless your geek level is over 9000, and that you also have no adverse allergies from exposure to heavy IT technical jargon.
Now onto the geeky experience…
I was previously using a Gigabyte motherboard system, which contains 2 Winchester hard disk drives (HDD)s (1x 320GB, and 1x 1TB). Unfortunately, after 5 years of faithful service to me, the 320GB HDD died due to proliferation of bad sectors, and for some weird reason also took down the motherboard with it.
As I have already backed up all my critical data into the 1TB HDD a couple of weeks before the failure (thanks Microsoft Windows Vista for giving me an early warning on disk failure), I took out the backup HDD and fitted it into a brand new system. But alas, the 1TB HDD now showed up on the new BIOS having a maximum capacity of only 32MB! Upon booting into 64-bit Windows 8, the HDD shows as having 32MB of raw data without any valid file system.
Just so you know, sending the HDD back to the manufacturer for a 1-to-1 replacement was the last thing on my mind, as I really desired to recover my backup data in the HDD. And the service center do not provide data recovery services as part of the HDD warranty.
Identifying the Cause
After checking online for what could have caused this horrendous reverse-evolution of the hard disk size, the most probable issue for my situation could be that the Gigabyte motherboard’s bug of accidentally adjusting the HDD’s Device Configuration Overlay (DCO) while trying to create a Host Protected Area (HPA) during the failure. It is no wonder both my BIOS and Operating System (OS) now report a wrong size for the HDD. 😡
Undoing the Changes to DCO & HPA
Fortunately for me, there is a plethora of free software online to help reset the DCO back to factory settings (i.e. reset my HDD back to the proper 1TB size). At the same time, unfortunately, for me, all of them are compiled only for 32-bit OS systems, and refuse to work in 64-bit Windows. This means I can’t run any of the free software in my current OS environment.
To bypass this limitation (short of re-installing a 32-bit OS), a LiveCD could be used to boot the system into a RAMDisk environment to run the relevant software for resetting the HDD’s DCO. After having reviewed several online forums and sources, I decided to try out the Ultimate Boot CD LiveCD, which seems to have received a relatively large fan base.
After several unsuccessful tries, I managed to discover that the following configuration managed to get the software working:
- unplug all the hard disk drives except for the HDD under “operation”
- ensure the HDD mode in the BIOS is IDE
- boot up the LiveCD, and select Hard Disk Diagnostics -> MHDD32
- inside MHDD32, select the HDD and use the “NHPA” command to reset the DCO to factory settings
- plug back all the hard disk drives, switch HDD mode to your preferred mode
- boot back into Windows 8
Inspecting the MBR and Partition Table
According to most guides online, everyone solved their problems after having removed the HPA and resetting the DCO. However, in my case, the BIOS now shows correctly that the HDD has a physical capacity of 1TB, but Windows 8 still shows the HDD as 32MB of raw data!
This is shown above as Disk 2 having only 32MB of raw data. At this point, I suspected that the MBR and partition tables in the HDD has been overwritten (and/or corrupted) by the buggy HPA operation. Using Windows 8’s DiskPart, I tried to see if I could find more useful information. (Note that you will need to run Command Prompt as Administrator mode for DiskPart to work)
As seen above, DiskPart is able to detect that my HDD has a maximum capacity of 1TB, but contains a partition that contains 32MB of raw data. In other words, the partition table only contains 1 partition of 32MB, and no entries on the rest of the non-partitioned space. This implies strongly that my partition table is corrupted.
Using a free software HxD to view the damaged MBR of the HDD. Note that you will also need to run HxD as Administrator mode to be able to view the raw data of the HDD.
In the image above, the partition table can be found in 4 blocks of 16 bytes starting from offset 0x1BEh. Upon inspecting the partition table, it shows that there is only 1 partition entry, and the entry has a sector size of 0x0000FE6E (65134 sectors ~ 32MB).
Worried that my original NTFS partition has also suffered from corruption, although I didn’t show in the snapshot, I managed to locate the start of the NTFS file system at sector 63. This suggests that the NTFS partition may jolly well still be intact! 🙂
Fixing the MBR and Partition Table
After having confirmed that the MBR and partition table have been corrupted, I went to try out the “bootrec” program that is available under the Recovery Command Prompt of Windows 7 and 8 boot disc. However, upon typing “bootrec /fixmbr”, the program only targets the HDD that contains a valid Windows bootable partition and refuses to check my HDD’s MBR. (Note that “fixmbr” program only exists within Windows Vista and earlier.)
Not to fret, Windows still has a “bootsect” program that can help to repair the MBR of a damaged HDD. As shown above, I tried 2 different command variants of bootsect, and bootsect reports that it successfully updated bootcode on one volume. Sounds good, doesn’t it? Let’s have a look on what has changed via HxD.
Okay, apparently, bootsect really does what it reported. It updated the bootcode in the MBR to one that is compatible with Windows Vista and later. However, if you take note of the partition table at offset 0x1BEh, nothing has changed. The partition table is still wrong and the HDD still shows up as 32MB of raw data in Windows 8.
Upon checking further online for tools to automate the repairs of lost partitions, I discovered mention of a Linux based software called “TestDisk” that is very frequently recommended as one of the always-go-to-tool for fixing lost partitions. Apparently, Ultimate Boot CD already packaged this inside the LiveCD. Good stuff! 😀
So, I did the following to repair the partition table:
- boot using the Ultimate Boot CD LiveCD
- selected Parted Magic
- boot into Parted Magic GUI (default choice)
- run Start Bar -> System Tools -> TestDisk
- used TestDisk to search for lost partitions. Gladly, TestDisk found my NTFS partition header
- wrote the new partition table using TestDisk
- reboot system into Windows 8
And Ta-da! My NTFS partition shows up as 1TB and can be accessed again! All my archive data is back, safe and sound! 🙂
Thanks for reading. I hope this post will be useful to everyone who might have met with the same HDD issues as I did. 🙂