How to clean an MBR and recover drive partitions

Last Updated on July 17, 2017 by Dave Farquhar

Sometimes it’s necessary to recover drive partitions because you accidentally repartitioned a drive you didn’t mean to, or because your MBR got infected or otherwise trashed. Here’s how to recover them, for free.

Infecting MBRs with malware is popular with virus writers again. And I fully expect chaos to ensue, because that’s what happened the last time there was more than one virus floating around that infected MBRs. They quit doing it for a good reason.

So here’s how to clean up the mess when an MBR gets infected, or when multiple infections blitzes the MBR and the hard drive loses the ability to boot, just displaying a message like Missing Operating System or Operating System Not Found.

We’ll be using the Gparted Live CD. Many Linux live CDs have the proper tools, but GParted works well and it’s a small download. You can try to use another Linux live CD, and it will work fine, but the icons might not all be where I say they are.

There are several symptoms of a corrupt MBR. The most infamous is the dreaded Missing Operating System or Operating System Not Found at boot time. I’ve seen virus infections and improper shutdowns cause this problem. In either case, the cure is the same.

You’ll also want to do this procedure if a Windows-based antivirus tool, such as GMER, found an infected MBR. Even if the computer still boots normally.

To get started, boot Gparted off CD or USB media (of course). Use the defaults unless you know a good reason not to.

Click the little icon along the top that looks like a computer monitor to open a terminal window. We’re going to be using the command line a lot.

Find your drive and existing partitions

First, enter the command fdisk -l to list all the partitions (if any remain) on the disk, and find out what the partitions are named, Unix-style (usually /dev/sda1, but it can vary).

Recover the MBR and partition table

Now it’s time to manipulate the MBR and partition table. Open another terminal window by clicking the computer monitor-like icon again. Inside this window, enter the command testdisk.

Testdisk will ask you about logging options. I usually pick No Log. Next, it will ask you to choose a disk. Usually /dev/sda is what you want. If not, you probably know by now, based on the output of the first command. Next, it will ask what kind of disk it is. Choose Intel for a normal PC. Choose Mac if it’s an Apple Macintosh. And if you have something else, chances are you aren’t reading this anyway.

Now Testdisk gives you several options. First, choose Delete to wipe out the corrupt MBR and partition table. It will ask for confirmation. Hit Y to continue, then hit Y again to confirm. It will say you’ll have to reboot for the change to take effect. Answer OK. It will tell you this several times as we step through this process, but you should be able to ignore it.

Now choose Analyse to recover the partition(s) you just blew away. Select Quick Search. Testdisk will then ask if it should look for partitions created under Vista, and advise you to say yes if unsure. Say yes. It should locate your partition pretty quickly. Confirm that it matches what you saw in fdisk’s output in the other terminal window. If it does, highlight it with the arrow keys, then hit enter. Select Write to write the partition table to the disk, then answer Y, then confirm.

Now choose MBR Code to write a standard MBR to the disk. Answer Y, Y, then OK to confirm.

You’re done. Select Quit, then Quit to exit Testdisk.

Click the icon in the lower left, where the Windows start menu normally is, and select Logout to reboot.

Scan for viruses

You can skip this step if the MBR was corrupted due to power failure or improper shutdown. But if you rebuilt the MBR due to infection, scan the machine with the Bit Defender live CD and the Kaspersky antivirus live CD. You might want to use Microsoft Standalone System Sweeper to the mix too. This prevents you from re-infecting the MBR as soon as you boot Windows. Nothing catches everything, but hopefully between those three you’ll get the system healthy again.

It takes about five minutes to rebuild the MBR and recover drive partitions. The virus scans will take a lot longer.

And you’re done

There’s usually no need to pay for expensive commercial software to rebuild your MBR or recover drive partitions. Best of luck to you. In case you ever need it, I also have a nifty trick for recovering corrupt SSDs that failed due to power failure.