A NTFS bootsector is NOT (like FAT16/32 ones) 512 bytes long, it is 8192 bytes (16 sectors) long.
See here
http//
and here
http//
(completely unrelated, but maybe useful for a quick backup)
It is possible that something is wrong in the "other" sectors.
jaclaz
The additional sectors you mention are for the bootstrap code, as he is not attempting to boot the drive, this should not be relevant.
So after further analysis the MFT appears to be intact. I go to the first cluster designated as the MFT in the boot sector and it is indeed, intact.
There are sectors after the boot sector and before the MFT that are not intact but I didn't believe that they should have any effect.
This problem literally only occurs when I write the boot sector to the destination drive. There's got to be something that I'm missing.
Thanks for everyone's help and advice so far. I posted this because it was a good puzzle. The data recovery itself has gone fine but the sector problem is killing me.
Does the system Blue-Screen or just re-boot / hang ( black screen ) ?
Do you get the Windows boot logo?
also the bootsector is 512 bytes, the $Boot file is much larger ( the boot loader)
The system does not blue screen, it just crashes. There is no minidump of the occurrence. On restart I do get the Windows Boot Logo.
I conclude there's some other issue; I'd say that the $Boot is corrupt - maybe because the first 512 bytes ( the VBR ) don't match the rest of $Boot? Try to comapre the resulting $boot file with another $Boot file.
The additional sectors you mention are for the bootstrap code, as he is not attempting to boot the drive, this should not be relevant.
Well, theoretically yes, but since the problem does happen, it means that theory must be revised…. unsure
It is possible that, just like it does for the MBR signature on first connection of a "non NT based OS drive", XP checks something or tries to write something and crashes on it.
jaclaz