Symantec.com > Norton > Support > Solutions Library


 

Unmarking bad clusters with Disk Editor

Situation:
If a disk utility marks the hard disk with a large number of bad clusters, you can unmark them with the Norton Utilities Disk Editor.

Solution:
IMPORTANT
This document explains an advanced technical procedure using Disk Editor. Symantec does not provide technical support for this document. Use the information presented here at your own risk.


CAUTION:
To get data from the area of the disk that was marked with bad clusters, you can try to recover the data yourself, or you can use a data recovery service. You should not attempt the following procedure if you are going to use a data recovery service.

Marking bad clusters as available
The Disk Editor program is located on the Emergency Disk 2 that came with Norton Utilities, or on a Rescue disk that you created. If you can access Norton Utilities on your hard disk, you may also run it from there.

To unmark bad clusters and attempt to recover the data from the area that was marked bad:
  1. To load Disk Editor, change to the drive and directory where Disk Editor is located and enter:

    diskedit c: /w

    Replace C: with the letter of the drive that you are trying to repair.
  2. To begin searching for clusters marked as bad, press Alt+F1 to view the first File Allocation Table (FAT).
  3. Press Ctrl+S to display the Search Dialog Box.
  4. Press Tab to change to the Hex area and enter:

    F7 FF

    F7 FF is the hexadecimal equivalent of BAD. For FAT 32 drives, use F7 FF FF 0F instead.
  5. Disk Editor will find a "F7 FF" or "F7 FF FF 0F" entry in the FAT. This entry will be marked <bad>. The entry is either a bad cluster, or is a good cluster that has been marked as bad.
    • If this is the only bad cluster you want to mark as good, continue with step 8 (to mark the cluster as available and then rerun Norton Disk Doctor).
    • If the cluster is truly bad (there is physical damage to that area on the hard drive), then it is likely the next entries in the FAT will NOT be marked as bad. If you find an isolated bad cluster, then press Ctrl+G to continue searching. Repeat the search until you find the beginning of an area with a large number of entries marked <bad>.
    • If the cluster is a good cluster, but has been marked as bad, then this will be the first cluster of a large number of entries, all of which are marked as bad. How many have been marked as bad was determined by what marked them. If, for example, the hard drive was incorrectly configured, and you allowed a program such as ScanDisk or Norton Disk Doctor to fix all the bad clusters, then all the remaining clusters have been marked as bad.
  6. To select the bad clusters, press Ctrl+B to begin marking. This is similar to marking text in a word processor.
  7. Press the Down Arrow key to select the entries one line at a time. Continue until you reach the end of the entries marked <bad> or until you reach the end of the FAT (the numbers in the lower left corner will stop changing). Use the Right Arrow and Left Arrow keys to move the selection within a particular row.

    CAUTION:
    It is important that you select only entries that are marked <bad>. If you select entries that are not marked as bad, you may lose data.
  8. To mark the bad clusters as good (available), select Fill from the Edit Menu (press Alt+E, F).
  9. In the Fill dialog box (note the important warning in this box), make sure that Unused is selected and that the Synchronize FATs box is checked, and then click OK. If Unused is not one of the options, select 00 instead.
  10. When Disk Editor is finished, the blocks will be marked as available.
  11. If you are NOT going to try to recover any data, then reboot the computer and run Norton Disk Doctor. This will clean up lost clusters and allocation errors.
  12. If you ARE going to try to recover the data, then do NOT run Norton Disk Doctor at this time. Instead, use the following methods to recover your data. If you do run Norton Disk Doctor at this time, you will have many new files on your hard drive, which contain your data in pieces. This would greatly decrease the chances of getting your data back.

Recovering lost data
To recover data from the area of the disk that was marked as bad, use the procedure in the Norton Utilities Users Guide to attempt to find the clusters that make up the file. For Norton Utilities 8.0, this procedure is titled "Lifting Clusters from a Physical Disk" and begins on page B-28. For Norton Utilities for Windows 95, this procedure is titled "Extracting Clusters From a Physical Disk" and begins on page A-28.

In both cases, after you have found the beginning cluster of the file, the next step is to find the remaining clusters. Since the file allocation table entries have been destroyed for these files, you do not have a known file size to use for each file. In the manual, skip the section called "Method one: Finding the rest of the clusters with the file size" (page B-32 or A-31), and instead, use "Method two: Finding the rest of the clusters without the file size (page B-34 or A-34).

Anything written to the hard disk can potentially overwrite the clusters that make up these lost files. So when you save the data, save to a different hard drive, or to floppy disks.

After you have corrected the bad clusters and retrieved any data you want to save from the area that was marked as bad, run Norton Disk Doctor to clean up any lost clusters or allocation errors.

How to retest for bad sectors
Once you have recovered your data, and remarked the clusters as usable, you can run a test to determine whether those clusters are still seen by the operating system to be bad.

One of these tests is the format command, run by typing FORMAT /C. This command will format the entire partition, wipe out your data, and remark bad clusters as bad. If some or all of your recovered bad sectors are still actually bad, this command will mark them as bad. Another test is described in a Microsoft document, How to Cause ScanDisk for Windows to Retest Bad Clusters, Article Number Q127055, available on the Microsoft web site at: http://support.microsoft.com/support.

Caution:
Do NOT run these tests before recovering your data: they will make your data inaccessible by normal means and may make the data totally unrecoverable, even by a data recovery company.


Document ID: 1996895403524765
Last Modified: 10/02/2000
Date Created: 08/14/1996
Operating System(s): Windows 95, Windows NT 4.0
Product(s): Norton Utilities 2001 v5.0 - Win9x/Me, Norton Utilities 2001 v5.0 - WinNT/2000