Lab 2 - Hard Drives

Most people know that frequent oil changes will help keep their car run better and longer. However, they may never maintain their computer's hard drive. Like the engine in your car, a hard drive is a mechanical device, and should be placed on a maintenance schedule. A hard drives that is not maintained will run slower than it is designed to, it may crash and loss your data, and in a worst case scenario it may stop working completely.

In this lab you will run built-in Windows utility software that is designed to maintain, and repair hard drives. We will also introduce third-party hard drive utility software.

What you will need:

Hardware:
A PC with an internal EIDE, PATA or SATA hard drive. You can also use an external USB hard drive, or flash drive. The PC needs to be running Windows XP or Vista. This lab will not work with Mac or Linux systems.

Software:
Required: Built-in Windows utility programs, and a Windows Boot CD

Optional: CCleaner, and O&O Defrag or Smart Defrag

 

Hard Drive Maintenance

You should complete the following hard drive maintenance programs on a weekly basis. Some power users should run these programs on a daily basis. In this section we will use utility software to clean up, and defragment the hard drive.

I) Disk Cleanup
Many computer users have never cleanup their hard drive because they don't know how. Everyone should know how to clean up the trash on their computer. To open and use Disk Cleanup, complete the following command sequence:

My Computer => C: => Right Click and select Properties

Select Disk Cleanup and run the program.

Many computer users find that the Windows Disk Cleanup does not delete all of the their "junk". There are hard drive utilities that search for files that are rarely used, and then deletes them. For example, Internet Explorer (IE) keeps track of the pages on the Internet that you have visited, and stores them on your hard drive. A hard drive may have thousands of these files that take up hard drive space.

One of the best hard drive cleaners is a program called, CCleaner. This program is free to download: http://www.ccleaner.com/.

When you first open CCleaner you will notice that it does more than just clean hard drives. CCleaner can clean up the registry, and can delete unused programs.

Tip:
Run CCleaner after you have run Windows Disk Cleanup. On many hard drives, CCleaner will delete thousands of files that Windows Disk Cleanup left on the hard drive.

 

II) Disk Deframentation
Computer files become scattered on a hard drive under normal use. Over time your hard drive will have to "hunt" for files, and this will slow down your computer. You should defragment you computer once a week under normal use. Many power users defragment their hard drive(s) nightly. Fortunately there are programs available that defragment hard drives on a set schedule automatically, when the user is away from the computer.

To open the Windows Disk Defragmenter program go to:

C:\ => Right Click drive => properties, => tools tab => Defragment Now

As alternative you can open the Windows Disk Defragmenter through the Control Panel:

All Programs => Control Panel => Administrative Tools => Computer Management => Storage

Note:
It may take several hours to run this process on a highly fragmented hard drive.

 

There are many third-party programs that are designed to defragment hard drives. O&O Defrag and Smart Defrag, are two popular programs. Smart Defrag is free to download; O&O Defrag is a pay-to-use program.

O&O Defrag

The Windows Boot Order

To fix hard drives it is helpful to know how your computer boots (starts) up. The following step show the process that Windows computer goes through to start your computer and load the operating system.

  1. When a computer is powered on it immediately runs a program called the Power On Self Test (POST). The POST tests the computer's hardware including the RAM, CPU, video and I/O systems.
  2. After the computer has passed the POST, the computer's BIOS will read the MBR. The MBR tells the computer where the active partition is located. The active partition is where the operating system is stored.
  3. The active partition also contains a file called the NTLDR. The NTLDR is responsible for starting the Windows boot process.
  4. The NTLDR reads other system files included: NTDETECT.COM, BOOT.INI, BOOTSECT.DOS (for multi-OS booting) and NTBOOTDD.SYS (if you have a SCSI hard drive).
  5. The NTLDR then loads NTOSKRNL.EXE and HAL.DLL. These two files are Windows XP operating system, and they must be located in %SystemRoot%System32.
  6. Next, the NTLDR reads the registry, and chooses a hardware profile and enables the device drivers.
  7. The NTOSKRNL.EXE program takes over boot process. The NTOSKRNL.EXE starts WINLOGON.EXE that starts LSASS.EXE which display the Windows logon screen.

Hard Drive Repair

Maintaining your hard drive will help avoid computer crashes and data loss. However, there are times when critical systems files are corrupt or missing, and your hard drive won't boot your computer. This is know as a software crash. Software crashed are often caused when a computer has crashed repeatedly due to a virus, or other operating system failures. Fortunately most software crashed can be repaired.

Hard drives are mechanical devices. When a mechanical part of a hard drive fails it is known as a hardware crash. Unfortunately, most of the time it is impossible to retrieve data from a hard drive with a mechanical failure. You must rely on backup file systems to recover lost files.

In this section we will focus on recovering data after a software crash has occurred.

Check Disk

One of the best hard drive repair programs is "Check Disk", and is built into the Window Operating System.

To Open Check Disk:

My Computer => C: => Right Click => Properties => Tools => Error Checking => Check Now...

Check both boxes before running Check Disk. Unlike all other hard drive utility Windows software, Check Disk will not run when you select start. Check Disk needs to run before the computer's operating systems loads. This allows Check Disk to examine the hard drive and move or delete files that are in the wrong place, or are corrupt. After you have checked the boxes and select Start, restart the computer. Check Disk will run automatically when the computer boots up.

 

The Master Boot Record (MBR)

If your computer fails to boot due to a corrupt MBR, you will need to boot the computer with a Windows CD, and then go into the recovery mode. Before you dive and start repairing the hard drive it is a good idea to know where the hard drive places its boot files.

A critical boot file on Windows-based computers is called the Master Boot Record (MBR). The MBR holds the information that identifies where the operating system is located on the hard drive. When the computer "boots up" it reads the MBR, adn then locates the operating system. The hard drive then opens the operating system and boots (loads) it into RAM. If the hard drive has multiple partitions, the MBR stores a "master partition table" that stores information about each partition.

The MBR is always located at cylinder 0, head 0, and sector 1, which is the first sector on a hard drive.

It is important to know that the MBR is NOT the operating system. The MBR simply lets the boot up process where to locate the operating system on the hard drive. If a hard drive has multiple operating systems, then the MBR will prompt the user to select one during the boot process:

 

Recovery utility programs: fixmbr, fixboot

Two utility programs that are commonly used to repair hard drives are: fixmbr, and fixboot.

fixmbr
The fixmbr command is designed to repair a master boot record (MBR)

Syntax
fixmbr C:

Caution:
The master boot record is a favorite target of virus programs. The fixmbr can damage the partition tables if a virus is present. If you suspect that a virus is on the computer run antivirus software before you use the fixmbr command.

 

fixboot
The fixboot command writes a new partition boot sector to the system partition.

Syntax
fixboot C:

Hard Drive Recover Steps:
1) Start the computer with a Windows boot CD, and press "R" to enter the recovery mode.

 

2) Run fixmbr

 

2) Run fixboot

 

If fixmbr and fixboot do not repair the hard drive there is still hope. Run the following commands from the Recovery Console.

FIXMBR C:
FIXBOOT C:
COPY CDDrive:\I386\NTLDR C:\
COPY CDDrive:\I386|NTDETECT.COM C:\
BOOTCFG /rebuild

What is happening with these command:

  1. fixmbr rebuilds the MBR
  2. fixboot writes a new partition boot sector
  3. The ( COPY CDDrive:\I386\NTLDR C:\ ) command copies the NTLDR (boot up system file) from the CD to the hard drive.
  4. The ( CCOPY CDDrive:\I386|NTDETECT.COM C:\ ) command copies the NTDETECT.COM (boot up system file) from the CD to the hard drive.
  5. The ( BOOTCFG /rebuild ) command is used to detect the boot configuration information*.

* The BOOTCFG /rebuild command scans your hard disks for Microsoft Windows NT 4.0, Microsoft Windows 2000, and Windows XP installations, and then add them to an existing boot.ini file. The boot.ini file contains the location of the Windows XP operating system on the computer.