Boot partition:

Boot partition:
io.sys msdos.sys ntldr bootlog.txt
Other partitions: _restore recycled
Note:
For Fat16/Fat32 partition, fixboot can effectively restore damaged boot sector of partition.
For NTFS partition, even if boot sector is correct but MFT (Main File Table) is corrupted,
symptoms are the same. We recommend you download the demo version of Partition Table Doctor
to determine whether boot sector of partition was corrupted.
Mostly, scandisk that originally in operation system will destroy more than they retrieve. Please
stop scandisk after logging on.
In addition, you may use WinHex to recover DBR
WinHex is powerful in disk editor. With backup DBR in WinHex to recover the DBR sector is
convenient and fast. But for its strong specialization of WinHex we recommend that you choose
easy-to-use software tool for integrity and correctness of the data.
4.The FAT table recovery
CIH destroys data backwards from partitions. In this case, system data in the former part may be
destroyed and lost. If FAT2 is still intact, we may make FAT2 to cover FAT1. Usually we use
DiskEdit and WinHex. Regarding to other forms of destruction such as format and so on, we
usually make use of tool software to scan the whole disk, seldom manual recovery; because there
are even dozens of trillions sectors a partition has several trillions. Depending on the manual
analysis is impossible. For some extremely important data file, we can also recover manually.
Recover FAT by DiskEdit
After recovering DBR of FAT, if part of FAT1 is damaged while FAT2 remains intact (It is the
most situation when destroyed by CIH), we may use FAT2 to cover FAT1. The specific method is
to find the start sector of FAT2 and then start searching the start sector of DATA (if it is FAT16,
search FDT). By this way, we can figure out the length of FAT table. According to length and the
start sector of FAT2, we may know the start sector of FAT1. Copy FAT2 to the damaged FAT1, we
can finally recover the whole partition.
Recover FAT by WinHex
Principle of recovering FAT by WinHex is the same as that by DiskEdit. After recovering DBR,
we can make FAT2 to cover FAT1. After finding FAT2, we begin searching the start sector of
DATA (if it is FAT16, search FDT). The division is distinct, because the conclusion part of FAT
must be 0 regions, otherwise there is not any free space (even so, in ordinary circumstances, there
is still a bit of space in FAT after scanning DATA area. So the end of the last sector must be 0 too.).
While at the beginning of DATA region or FDT region it mustn’t be 0. No matter there is fixed
FDT, the system always begins from second cluster. If there is FDT, it follows closely FAT2, and
its file registration must exist; if there is not, then begins from data area where some data must
exists. Thus we may figure out the length of the FAT table, and then the start sector of FAT1
according to the length and the start sector of FAT2. Copy FAT2 to the damaged FAT1 we can
finally recover this partition.