Pierre's field guide to CIH recovery
( © DataRescue SA 1999)



So you have been hit by CIH - tough luck - let's see if we can help you out of there. First of all, boot your PC with a system disk. If the PC was using FAT-32 ( it i always the case if you have partitions bigger than 2 GB on Win 95 or Win 98), you must boot from a Win 95 OSR 2 or Win 98 installation disk. Norton Utilities' recovery disks are ideally suited to the task. We'll assume you have them, or if you choose to use another disk editor, I'll assume that you know what you do.

The damage inflicted by CIH is simple : the first 2048 sectors of the drive is overwritten with garbage. If the drive has 63 sectors per track, the corruption will begin on track 0 and end in the middle of track 31

  FAT-16 and one single C: partition FAT-16 and several partitions
  Really bad news here - if 2048 sectors have been erased, your first track (often 64 sectors nowadays), the boot sector, both FAT (each a maximum of 256 sectors), the root directory and some data have been wiped.- Tiramisu from Ontrack and Lost&Found by Powerquest may allow you to recover unfragmented files. Note that each and every file smaller than your cluster size ( usually 16 kilobytes or 32 kilobytes nowadays ) is recoverable. Same as above as far as the first partition is concerned. However, the other partitions are intact. Search for them with disk editor (tools - find object) and, once you have located them, read the partition recovery guide
  FAT-32, initial partition smaller than 1 GB
  This is not as bad as a single partition under FAT-16 since only part of the second FAT as been corrupted. It may very well be possible to recover many of your files. The recovery should proceed along the lines of the next case, except that less data will be recovered. Read on.
  FAT-32 and the initial partition was bigger than 1 GB

Your drive is fully recoverable ! The process is not going to be easy, but it is possible. Don't format or repartition your drive. The process is straightforward

1) rebuild your partition table
2) restore valid boot sectors
3) use fat two to restore fat1

You also have to understand the boot sector structure of FAT-32. It has been greatly expanded.

Knowing the default cluster size will help you


Partition Size Cluster Size  
up to 8 GB 4K up to 2^21
up to 16 GB 8K up to 2^21
up to 32 GB 16K up to 2^21
more than 32 GB 32 K  
  And here is the infamous extended BPB structure
size comment example
3 bytes jump instruction (jumps top boot code) 3 bytes
8 bytes oem name mswin 4.1
begin of BPB32
1 word bytes per sector 200h
1 byte sectors per cluster 8
1 word number of reserved sectors - number of sectors before first FAT (not all are used on current implementations). Two sectors are used for the primary boot sector, two sectors are used for a backup copy of the boot sector and other sectors may be used for a FS Info Sector 02dh
1 byte number of file allocation tables 2
1 word number of root directory entries 0000
1 word total number of sectors 1 word
1 byte media descriptor byte F8h
1 word numbers of sector per fat 0000
1 word number of sectors per track 3Fh
1 word number of heads FFh
1 dword number of hidden sectors 3Fh
1 dword big number of sectors if total number of sectors = 0 003E8200h
1 dword big number of sector per fat FA0h
1 word extended flags 0000h
1 word file system version 0000h
1 dword start cluster of root dir 00000002h
1 word file system info sec 0001h
1 word backup boot sector 0006h
6 words reserved 0000 (all)
end of BPB
1 byte drive number (80h -> C:) 80h
1 byte reserved  
1 byte boot signature (29h if extended boot signature record) 29h
1 dword boot sector volume ID 311AOBEDh
11 bytes volume ID (no name)
8 bytes file system type (FAT 12 or FAT 16) FAT32


If you are willing to make a few assumptions, fixing a FAT-32 drive is quite easy. Govind Rammurthy of MicroWorld has developed a CIH recovery program that assumes some values to be constant (while they theoretically could be variable, it seems they are fairly constant in current implementations). You might want to give this program a try. Get it here. Save it on a Windows 98 Boot Floppy, boot the trashed machine, run and follow the instructions if any.

Quickest Way

The quickest way to recover from CIH trashed drive - and teh way we use in house - is as follow

1) Install the disk in a booting windows 98 machine
2) rebuild partition table
3) rebuild extended boot sector (1st copy is enough)
4) set the first 4 bytes of the first FAT to 00000000

When Windows 98 detects that the first fat is corrupted, it automagically uses the second FAT.


DataRescue 45 quai de la Dérivation 4020 Liège (Belgium)
tel 32-4-3446510 fax 32-4-3446514
Please send us your questions or comments.