Recovery Guides: step-by-step DiskPatch operations:
Disk Editor.

A list of terms used in this page and their explanation can be found here.

 
Problem :  N/A
Symptoms :  N/A
Solution :  N/A
 
Why do we need this?

The Disk Editor allows you to edit the disk and its partitions on a sector level. Needless to say, this is only useful if you know what you're doing: you need to know a little something about disks and partitions before you'll be able to use the disk editor. The editor that is included in DiskPatch is relatively simple; most of its functions are connected to DiskPatch's recovery functions. As such you can look at the disk editor as an extension of some of the automated functions, allowing you to go a little beyond the automated repairs if needed.
Some of the more interesting functions of the disk editor are:
  • exporting and importing sectors (saving a part of the disk to file: could be handy for backup purposes, or when you need to send a 'part of the disk' to someone through email for remote support)
  • editors for several types of sectors: partition tables, boot sectors and raw sectors
  • browse helpers: after the disk has been scanned you can use certain keys to move around the disk, allowing you to find 'significant sectors' with ease

As the disk editor can be used for many things, we'll hi-lite some of the functions in the following guide.
 
Things you need to know before we start:
  • In the world of disks and data recovery we start counting disks at 0 (zero). So the first disk is 'disk 0', the second disk is 'disk 1', etc.
  • If you use the bootable CD/DVD you will need to find a target location for the files that DiskPatch creates when it's running; they can't be saved to the CD/DVD. You will either need a FAT formatted partition somewhere that can hold the files, or you can use a FAT formatted USB stick/key or USB disk to receive the files (read more here on how to prepare a USB key). DiskPatch will ask you where to save the files if the files can not be saved to the current location.
  • Use the cursor keys to navigate the menus, use the <Enter> key to select an option, use the <Escape> key to abort or leave a menu.
  • If you analyze the disk before starting the disk editor, it will be much easier to find sectors of interest: you can use navigation keys to jump to these sectors immediately. For instance, you can jump to the boot sector for each partition that is found on the disk by using the <ctrl up / ctrl down> keys. We call this 'recovery assisted browsing'.
    Analyze the disk by running the 'create support analysis log' function from the 'Support' menu.

Here we go:

Start DiskPatch and select the disk.


example: your screen will differ. Find more information on how to select a disk here.

After selecting the disk, the menu will expand, showing actions that can be performed for the selected disk.
The selected disk will be marked in high intensity blue in the disk list (disk 0 in our example).
Note: the disk editor will offer additional browsing functions if the disk is analyzed before starting the disk editor. Analyze the disk now (by selecting 'create support analysis log' from the support menu) and start the disk editor after the analysis has completed. The following examples assume you have analyzed the disk.

Now select 'Utilities', then 'Disk editor'.
DiskPatch will ask you if you wish to create an undo file (recommended), if this option is enabled.
Enter a description or leave the default suggested text. Press <Escape> at this point to skip creating the undo file (not recommended).

If the disk was not analyzed before starting the disk editor, the following message will be displayed. Read more here (you can still use all the disk editor functions, but 'recovery assisted browsing' is not available).

The disk editor will now start. The main display looks like this:

When the disk editor is started the first sector on the disk (the MBR) is displayed. This is always the starting point when the disk editor is started. From here you can go just about anywhere, by using the disk editor's navigation keys and other functions.
We will now show some examples of disk editor functions and browsing.
   
Disk editor examples: browsing/navigating using the disk editor's navigation keys
 
From the disk editor's main screen you can press <F1> to display a help screen, which will list the navigation keys:

Press any key to close the help screen.
Use <down> and <up> (the cursor keys) to browse through all sectors that were found during the analysis (these are sectors that contain information that can be used to reconstruct the partition tables and/or damaged boot sectors). You can use this to quickly find an important sector, and glance over them to get an idea of their state.
Let's go to the first sector that DiskPatch has found during the analysis and see why DiskPatch thinks it's of interest: press <down> once. The display will change and display the sector. Please note that in our example the first 'sector of interest' is probably a different sector than the one that will be displayed in your case. In our example it's a FAT32 boot sector:

The information bar above the displayed sector contains information on what it is we're looking at here:
'Current sector' tells us that we're looking at sector 63 on the disk.
'Item: 1/15 BS/FAT32' tells us that we're looking at the 1st item of 15, and that it's a BS (boot sector) for a FAT32 type partition. For a detailed explanation of this display read the corresponding part of the manual.

You can continue browsing through the list of interesting sectors by pressing <down> or <up>; it's basically a guided tour through everything the analysis has found.
 
Another way to look at some interesting sectors is to use the 'partition start location' navigation keys. This will take you to the first sector of all partitions that were found. It's a convenient way to hop from boot sector to boot sector for all partitions (damaged or intact) that are on the disk.
Use the <ctrl up> and <ctrl down> keys to go through the partition list and display the boot sector.
Let's try this: press <ctrl down> to move to the first partition. The display will change and display the sector. Our example shows the following:

We are, again, at sector 63. There's a bit of additional information available now:
the information bar at the top says 'BS for PL entry 1', which means we're looking at the BS (boot sector) for PL (partition list) entry 1 (the first partition that is in the list that DiskPatch builds based on what's found on the disk). This text will be displayed in red if the location is not a valid boot sector location; this usually means you're looking at an illegal partition (maybe remnants of old partitions, or other 'false positives').
In the status bar we see additional information (displayed in yellow) about this partition, such as its type and size. This will help you recognize the partition and determine if this is a partition of interest.
 
This concludes the browsing/navigating using the disk editor's navigation keys example. Click here to return to the example index.
 
Disk editor examples: browsing/navigating using the disk editor's functions
 
There's another way to navigate the disk, this time by using the data that's in the currently displayed sector. If, for instance, we're looking at a sector that contains a partition table, we can order the disk editor to display that sector as a partition table and use it as navigation tool. Let's try this:
If you just started the disk editor you'll be at sector 0 (the MBR). If not, press <ctrl home> to get to the start of the disk:

Press <F5> to let the disk editor display the current sector as a partition table:

As you can see, our example shows 2 entries (2 partitions) in the partition table. You can now press 1 - 4 to move to the start location for that entry. Let's try: press <1> to move to the start location for the first entry:

We've arrived at the boot sector location for the first partition on the disk.
 
Now we'll go to the start location for that second partition that was in the MBR's partition table. First, move back to the start of the disk by pressing <ctrl home>. Now press <F5> again to display the partition table:

This time, press <2> to move to the start location for the second entry. Since the second entry describes an extended partition, we're moved to the location that holds an EPBR record (think of this as a mini partition table that defines the logical partitions). In our example it looks like this:

Since this is basically also a partition table, we can press <F5> again to display it:

Now press <1> to move to the start location for the first entry in this table:

We've arrived at the boot sector location for the second partition on the disk.
Note that in this case we had to make 2 jumps to get here: the first jump from the MBR to the EPBR record, the second jump from the EPBR record to the boot sector location.
 
This concludes the browsing/navigating using the disk editor's functions example. Click here to return to the example index.
 
Disk editor examples: finding and editing a boot sector
 
Use one of the described methods to arrive at the boot sector location. We'll describe (in short) how to use the editor's navigation tools to get to the boot sector we wish to edit:

- go to the start of the disk (press <ctrl home>)
- press <F5> to display the MBR as a partition table
- press <1 - 4> to select the partition whose start location (boot sector location) you wish to see
  Remember: if the partition is an extended you'll need to press <F5> again.
- you should now be at a boot sector location

Press <F10> to display the disk editor menu:

Now select 'Edit as boot sector'. As you can see, you can also press <F3> from the disk editor's main screen.
Our example is a FAT32 boot sector so we'll select 'Edit as FAT32 boot sector'. You need to select the correct boot sector type yourself, so make sure you have that information beforehand (that's why using 'recovery assisted browsing' is so convenient, it will tell you what type of information you're looking at).

The boot sector editor will start, using the FAT32 boot sector template:

As you may or may not be able to see, this is a perfectly healthy boot sector. If you wish to make changes you can do so by pressing <F10> and selecting 'Edit'.

You can now edit the values. Press <enter> to move to the next line, press <escape> to abort the editing.

The editing function will end when the last value has been entered. You can then press <F10> again to select another option, like 'Exit and save'.
 
This concludes the finding and editing a boot sector example. Click here to return to the example index.

http://www.diydatarecovery.nl