Either GRUB or MYSELF crashed the XP boot sector

Alright, after I went through some effort and pain to enable myself to install 11.1 from the locally stored DVD ISO my complete joy didn’t last long.

I don’t recall the exact development last night that led to the screw-up situation - at one point I adjusted the GRUB menu (with Yast only) in terms of standard OS and time, at another point there was no booting at all (no bootcode whatsoever found). Which came first I don’t really know now. Nevertheless I managed to start the installed 11.1 system finally, creating a new bootloader which worked, too. Just that it had no XP entry. Since Yast’s bootloader segment didn’t detect the XP partition automatically I wrote an XP bootcode manually - rootnotverify (hd0,0),makeactive, chainloader +1. Well, now my XP NTFS partition is broken - “Unexpected clusters per mft record (-1)” = : - (

I guess in the progress I not only replaced the disk’s boot code, but accidentally also the XP’s partition boot code. GRUB itself is working fine, just that chosing XP just takes a circle back to the GRUB menu.

Okay, now here comes the real problem. I’m far away from home, won’t return any time soon and so I am without the XP installation CD to run fixmbr and fixboot. Of course I’ve researched on the net how to get around that and it seemed that the “Ultimate Boot CD” (UBCD) should be able to supply appropriate tools to do so. Well, I found something on there that should at least fix the master boot record, didn’t make any changes, though. What am I doing wrong? And which of the tools on there or anywhere else can do what XP’s fixboot usually does?

With one of the tools on there I was able to access the directories of that broken NTFS partition. Everything still seems in place. Since XP/NTFS is said to store a copy of the boot/first sector in the very last I copied that one with dd, with no change, though.

Since I can’t newly install XP right here, right now - don’t want to either, just hassle - I would really like to get the XP system up and running again without being to run the XP CD, especially something like fixmbr and fixboot. It wouldn’t matter if that disabled GRUB since I could install SUSE bootloader/GRUB from scratch.

Any hints?

Well, now my XP NTFS partition is broken - “Unexpected clusters per mft record (-1)” = : - (
with that error running XP’s fixboot will do no good.

The Volume Boot Record is made up with 2 parts. One part is XP’s boot code and it can be rewritten by fixboot. Its job is only to find and run NTLDR. The other part is the Bios Parameter Block ‘likely where your problem is’ and it is never rewritten. It is written during formatting only. The VBR’s backup is indeed on the last sector of partition but it could be wrong if the partition was ever resized or maybe moved. Some resizing software does not update the backup VBR or replace it to last sector.

‘testdisk’ has a function to check and rebuild the VBR. Be sure to read it’s How-To or Step by Step usage. At its 2nd menu , select ‘advanced’ option.
TestDisk - CGSecurity

Since XP/NTFS is said to store a copy of the boot/first sector in the very last I copied that one with dd, with no change, though
Are you sure that the correct ‘dd’ commands were used ? IF not post the used commands and the output of ‘fdisk -l -u’.

The way I normally have it done is 3 steps with basic commands. I’m sure there are other was also.

  1. dd if=/dev/sda of=sda1vbr bs=512 count=1 skip=‘last sector’
  2. xxd sda1vbr
  3. dd if=sda1vbr of=sda1 bs=512 count=1

1)=read backup VBR into file sda1vbr-the last sector is read from the ‘fdisk -l -u’
2)=display the backup VBR and have a look.
3)=if it looks OK write to the the first sector.

Some info on the VBR:
NTFS Boot Record Secrets

All we probably need is the contents of

/boot/grub/menu.lst

and a su terminal of

fdisk- l

(Identify the XP partition if you can please)
Your XP boot code is probably fine BTW.

All we need to solve the problem or all we need to state it unsolveable? = ; - )

Okay, now this is /boot/grub/menu.lst :

Modified by YaST2. Last modification on Di Apr 21 14:23:17 CEST 2009

default 3
timeout 8
gfxmenu (hd0,4)/boot/message
##YaST - activate

###Don’t change this comment - YaST2 identifier: Original name: linux###
title openSUSE 11.1
kernel (hd0,4)/boot/vmlinuz root=/dev/disk/by-id/ata-SAMSUNG_HM080HC_S0CCJ10LB72098-part5 resume=/dev/disk/by-id/ata
-SAMSUNG_HM080HC_S0CCJ10LB72098-part6 splash=silent showopts vga=0x317
initrd (hd0,4)/boot/initrd

###Don’t change this comment - YaST2 identifier: Original name: floppy###
title Diskette
rootnoverify (fd0)
chainloader +1

###Don’t change this comment - YaST2 identifier: Original name: failsafe###
title Failsafe – openSUSE 11.1
kernel (hd0,4)/boot/vmlinuz root=/dev/disk/by-id/ata-SAMSUNG_HM080HC_S0CCJ10LB72098-part5 showopts ide=nodma apm=off
noresume nosmp maxcpus=0 edd=off powersaved=off nohz=off highres=off processor.max_cstate=1 x11failsafe vga=0x317
initrd (hd0,4)/boot/initrd

title XP
rootnoverify (hd0,0)
makeactive
chainloader +1

The final XP entry I set up myself since GRUB hadn’t. The Linux entries are working fine. The XP is running in circle, meaning it’s switching to text mode where no error messages show up, then starts up the GRUB menu again.

Now this is what fdisk -l -u is coming up with. The first partition is definately the XP partition.

Platte /dev/sda: 80.0 GByte, 80026361856 Byte
255 Köpfe, 63 Sektoren/Spuren, 9729 Zylinder, zusammen 156301488 Sektoren
Einheiten = Sektoren von 1 × 512 = 512 Bytes
Disk identifier: 0x00000000

Gerät boot. Anfang Ende Blöcke Id System
/dev/sda1 * 63 16386299 8193118+ 7 HPFS/NTFS
/dev/sda2 16386300 156280319 69947010 f W95 Erw. (LBA)
/dev/sda5 16386363 32772599 8193118+ 83 Linux
/dev/sda6 32772663 33832889 530113+ 82 Linux Swap / Solaris
/dev/sda7 33832953 50219189 8193118+ 83 Linux
/dev/sda8 50219253 103474664 26627706 b W95 FAT32
/dev/sda9 103474728 156280319 26402796 b W95 FAT32

If my XP boot code is supposed to be fine what could the cause?

Thanks for bearing with me.

I’m quite sure I’ve set up the partitions like they are when I got that harddisk two years ago. Almost definately they weren’t resized ever since I set up three small partition for operating systems plus one swap partition, the remaining space made up two data partitions.

I had read that it’s not reliable that the last NTFS contains a boot sector backup. But since I considered the boot sector to be broken/gone/GRUBed I thought it could possible help but not really worsen the situation to copy that last sector. Well, it didn’t get worse. Didn’t help either, though.

I will check if I can find that ‘Testdisk’ function about the VBR. I’m not sure if I should do that, yet.

Are you sure that the correct ‘dd’ commands were used ? IF not post the used commands and the output of ‘fdisk -l -u’.

Since I’m no expert at this matter I’m not sure. However I did put some research and thought to it before I dared to move stuff on this hardware level. This is what I did:

dd if=/dev/sda1 of=/dev/sda1 count=1 bs=512 seek=16386235 skip=0

The seek number is k-size*2-1. Now that I saw how you usually do this of course I understand it would’ve been good to have a look at the last sector content before actually copying it. Then again I probably wouldn’t be able to tell the difference between a good boot sector and a heap of random hexcode. = ; - )

The result of fdisk is included in my previous post. I hope I did the thinking and the calculation right.

Any idea on how to get done with the mess that I probably created on my very own?

Thanks! : )

dd if=/dev/sda1 of=/dev/sda1 count=1 bs=512 seek=16386235 skip=0
That code did not do what you wanted. seek is with the write function while skip is used with read. What you did is write the VBR to sector (I think)16386298. SDA1 start sector + end sector (63+16386235=16386298). The sectors listed with fdisk will be the absolute sector nu., from the beginning of hdd not from start of partition. You did luck out and wrote it to a unused sector. So the code should have been (I think, have not done it in one operation)‘dd if=/dev/sda of=/dev/sda1 count=1 bs=512 skip=1638235’

well the menu boot for xp should be

title Windows bootloader menu # <-- put whatever you want here
    rootnoverify (hd0,0)
    chainloader (hd0,0)+1

Which is kind of what you have.

Is it not possible to download something from M$ to restore MBR? Surely it must be?
Really can’t you live without windows - you should have access to all the files there.

Phew, have I been lucky or not? To do wrong on copying hardware sectors but to be so so lucky to write crap to one of the very few unused sectors on the harddrive? Beforehand I hadn’t even known that inbetween partitions there’s some tiny little space that’s unused.

Since I didn’t recall where I had learned it the way I did it I just googled the always identical part (“count=1 bs=512 seek=”) which brought me back to the page of origin. It’s at http://www.supergrubdisk.org/wiki/Windows_Partition_Boot_Deleted.

Since skip is skipping from start of input, when we don’t use the XP partition (sda1, start at block 63), but the whole harddisk (sda) wouldn’t we have to add the initial 63 blocks for the skip number - or just use if=/dev/sda1?

I feel lucky to not have worsened the situation. = : - )

One does need to be careful and know just what the partition software is showing, they all are not the same.

If you look at the raw data in the Partition Table the partition information is the start sector # offset from it’s partition table-“explain later” and the # of sectors. Linux ‘fdisk’ will convert all displayed sector #'s to absolute #'s ‘start of hdd’ so no more computation is needed.

(it’s partition table-“explain later”)==A hdd has only one Master Partition Table (MPT) and an Extended Partition Table (EPT) for each extended logical volume. The MPT & EPT look very much alike, They are on the first track (MPT -first tract of hdd /EPT -first track before each logical volume) but use only the first sector while the rest of the sector’s are normally unused. The EPT will only have 2 partition entries where the MPT may have 4.

In your case working with first physical primary partition.
'dev/sda1 * 63 16386299 ’
if=/dev/sda1 skip=0
if=/dev/sda skip=63
would both read the VBR
or
if=/dev/sda1 skip=6386236
if=/dev/sda skip=6386299
would both read the backup vbr

dev/sda6 32772663 33832889
/dev/sda7 33832953 50219189
if you notice in the above space between sda6 stop sector and sda7 start sector is where sda7’s extended partition table is.

That’s definately true. Mistakes made on this hardware level could turn out devastating, maybe even fatal to the system.

I think I understood what you explained, at least mostly.

In your case working with first physical primary partition.
'dev/sda1 * 63 16386299 ’
if=/dev/sda1 skip=0
if=/dev/sda skip=63
would both read the VBR
or
if=/dev/sda1 skip=6386236
if=/dev/sda skip=6386299
would both read the backup vbr

Wouldn’t the skip to read the backup vdr have to be minus one to skip all sector up to the start of the final sector which usually holds what we’re looking for? If we skip the whole partition length we might read the first block after the partition which would surely do no good to be used as replacement for a destroyed vbr.

dev/sda6 32772663 33832889
/dev/sda7 33832953 50219189
if you notice in the above space between sda6 stop sector and sda7 start sector is where sda7’s extended partition table is.

Got it. So that’s why there’s 64k inbetween all extended (logical?) partitions. So the 364k the beginning of the whole extended partition at sda2 (includes sda5 to sda9) is made up out of the 64k for the first logical partition’s (sda5) EPT with the other, bigger part probably being the table that forms that kind of virtual, non-accessible extended partition (sda2)?

Far away from considering myself a partition expert now I know at least which thread to come back to in future times of similar problems. = : - )

Wouldn’t the skip to read the backup vdr have to be minus one to skip all sector up to the start of the final sector which usually holds what we’re looking for? If we skip the whole partition length we might read the first block after the partition which would surely do no good to be used as replacement for a destroyed vbr.

little more confusion-the first sector is 0 not 1. Depending on the software in use keep in mind that 1 track=64 sectors (sector 0 tho 63), just more info for confusion.
That is another reason that I always look at the raw data with ‘dd’ to read and ‘xxd’ to convert/display or a hex edit for both the write to sector and the copy from sector.

So that’s why there’s 64k inbetween all extended (logical?) partitions.
not sure about the byte size but there is one track (64 sectors * 512 bytes) with only the first sector in use for the EPT.
Some times linux will install GRUB stage1 into the first EPT ‘the one listed in the MPT’ and keep MS boot code in the MBR.
Not sure if the correct name is EPT (Extended partition table), but it would seem logical.

Yes and it’s what finally now is in place and working, too.

Is it not possible to download something from M$ to restore MBR? Surely it must be?

Well, no, I don’t think so. I’ve been looking around for solutions quite a bit before posting. Tinysoft surely doesn’t expect their clients to be interested in other operating systems and true multiboot environments which always inherit the risk of not achieving what you want to combine right away.

Really can’t you live without windows - you should have access to all the files there.

[/QUOTE]

Yes and no. Personally I could do without wind*. As a matter of fact it’s been just the last six years within a 25 year long period of owning computers at home that I’ve been touching wind* without every now and then being forced to. Hehe, I’ve been downloading Linux to a dozen or so diskettes way back in 1993 or 94.

But…

There’s some small tools I regularly use that seem to exist just for TOOP (that other operating system) like for scheduled audio recordings from external sources directly to MP3, internet stream recording and the likes. With Suse I don’t even have a clue why VLC or other video players currently just pop up with playing an audio blurb at most just to disappear again. Also, firefox looks quite gruesome, compared to wind*, let alone its functionality. It seems to me that it takes up lots more space on my naturally pixel limited laptop display so pages have to be scrolled much more. Also, playing back videos on youtube and the likes (flash) is possible but not even half as good and fluent as the flash-players on TOOP screen it. On and on and on. Really, I’d much prefer a world without it but at least I am able to consider XP a universal operating operating system which is quite much in terms of this company. Seems that afterwords they’ve lost it again, hehe. Oh, and as much I’m happy to see that 11.x enables WLAN out of the box I have to say that connecting, holding, failure detecting and reconnecting through WLAN on Linux is more painfull and less reliable compared to TOOP. Time will tell…

Anyway, in the meantime I have managed to overcome the problem of boot failure combined with the large distance to the original wind* install disk. I’ve been able to get my hands on a XP OEM-CD. While it seems to be a true OEM cd that even refused to boot on my machine I found a brillant tool from german computer mag c’t. Called “c’t Slipstreamer”. It eats a XP OEM-CD along with a downloaded XP service pack and then combines both to non-OEM XP cd that already includes the service pack. That one worked well, enabled fixmbr and fixboot through the recovery console and enabled access to my machine and its partitions again. To repair/re-install GRUB afterwords was just a matter of time then.

Thanks for the advice! = : - )