Fix winXP boot ... WAS: recover mbr / partition table

Hello all,

I managed, with a little help from testdisk, to restore both partition tables. The second partition on the array is just extra stuff on an ext4 file system … it mounts … it’s all good.

As for the first partition on the device, it’s ALMOST good.

I used testdisk to restore the partition table and rebuild it’s boot sector. I then pushed grub back into the mbr. I made the array the default target in the bios and updated menu.lst (SuSE equivalent of grub.conf). I am able to boot both FC13 and openSUSE, which reside on a different array. I am able to mount the NTFS partition normally, that is mount it from FC13/OS113, which is normal for me. Things seem to be intact.

When I choose “M$ windoZe XP” from the grub menu, I get an error … it simply says “Disk Error” .

Any help greatly appreciated … and please keep in mind that I don’t have access to my XP install disk … it could be years before I know which box it’s hiding in … And if it’s useful, I have fully working xp instances in VMWare and a fully functional WINE environment.

… and I’m really having fun now …

original thread: HELP … recover mbr / partition table - FedoraForum.org

I think without a XP CD this is going to be difficult. I would look at getting your hands on a CD, even if you have to borrow one. I don’t now much about windows, but probably you will need the same version CD. Eg; If you have XP Pro, you will likely need the same CD. If you PM me what you have, I might be able to help. And you may use the CD to re-install so long as you have a valid key. But I only have some versions.

On 2010-08-09 07:36, oxala wrote:
>
> Hello all,
>
> I managed, with a little help from testdisk, to restore both partition
> tables. The second partition on the array is just extra stuff on an ext4
> file system … it mounts … it’s all good.
>
> As for the first partition on the device, it’s ALMOST good.
>
> I used testdisk to restore the partition table and rebuild it’s boot
> sector. I then pushed grub back into the mbr. I made the array the
> default target in the bios and updated menu.lst (SuSE equivalent of
> grub.conf). I am able to boot both FC13 and openSUSE, which reside on a
> different array. I am able to mount the NTFS partition normally, that is
> mount it from FC13/OS113, which is normal for me. Things seem to be
> intact.

You will have to post your partition list from “fdisk -l” and the menu.lst file, so that we get an idea.

> When I choose “M$ windoZe XP” from the grub menu, I get an error … it
> simply says “Disk Error” .

Looks to me a windows error not liking something.

>
>
> Any help greatly appreciated … and please keep in mind that I don’t
> have access to my XP install disk … it could be years before I know
> which box it’s hiding in … And if it’s useful, I have fully working xp
> instances in VMWare and a fully functional WINE environment.

Have a look at the boot sector of that xp and the real one outside. See if they at least look similar.

>
> … and I’m really having fun now …
>
> original thread: ‘HELP … recover mbr / partition table -
> FedoraForum.org’ (http://forums.fedoraforum.org/showthread.php?t=249621)

You could try at least posting a summary here…


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” GM (Elessar))

You could try at least posting a summary here…

No one ever replied … so there is nothing to summarize :frowning:

Hello again Carlos,

Some info for you and anyone else who might be interested:

[root@dolphin]# fdisk -l /dev/mapper/ddf1_AR01

Disk /dev/mapper/ddf1_AR01: 249.9 GB, 249865782272 bytes
1 heads, 1 sectors/track, 488019106 cylinders, total 488019106 sectors
Units = cylinders of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

             Device Boot      Start         End      Blocks   Id  System

/dev/mapper/ddf1_AR01p1 * 64 251674290 125837113+ 7 HPFS/NTFS
/dev/mapper/ddf1_AR01p2 251674291 488006498 118166104 83 Linux

menu.lst

##CWight
title Fedora (2.6.33.6-147.2.4.fc13.i686)
root (hd1,0)
kernel /vmlinuz-2.6.33.6-147.2.4.fc13.i686 root=/dev/mapper/dolphin-root2 ro rd_LVM_LV=dolphin/root2 rd_MD_UUID=224aa24a:8d2b2d73:4fa6bae4:438fc5b1 rd_LVM_LV=dolphin/swap rd_NO_LUKS rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us showopts rhgb quiet
initrd /initramfs-2.6.33.6-147.2.4.fc13.i686.img

###Don’t change this comment - YaST2 identifier: Original name: linux###
title openSUSE 11.3
root (hd1,0)
kernel /vmlinuz-2.6.34-12-default splash=silent quiet showopts vga=0x31a
initrd /initrd-2.6.34-12-default

###Don’t change this comment - YaST2 identifier: Original name: windows###
title M$ WindoZe XP
rootnoverify (hd0,0)
makeactive
chainloader +1

Carlos wrote:

Have a look at the boot sector of that xp and the real one outside. See if they at least look similar.

I really don’t understand what I am supposed to look at … sort of like telling a *nix newb, “make sure your fstab isn’t foobared” … if it’s not *nix, I’m a little lost! I vaguely understand that the boot sector is the stuff MS puts at the beginning of the disk … but I really don’t know what I’m looking for or how to look.

Thanks,

cwight

On 2010-08-09 12:36, oxala wrote:
>
>> You could try at least posting a summary here…
>
> No one ever replied … so there is nothing to summarize :frowning:

I don’t understand.

You have just posted here, today, a post for help, one of your systems does not boot.
If you want us to help you, you will have to tell us things…

How the problem started, what you did, what’s your setup…


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” GM (Elessar))

Hello again Carlos,

There were no responses to my first problem. The first problem was that the entire partition table on /dev/mapper/ddf1_AR01 was removed when I attempted to boot “Super Grub Disk” from a usb stick. The array looked like a brand-new, not even formatted at the factory disk. I booted “Super Grub Disk” only for testing; I did not have any prior problem. Using testdisk, I recovered the partition table well enough to have complete access to all the disk contents. So my problem is no longer that the array lacks a partition table. That is fixed. I started a new thread to see if anyone knows how to specifically address the “Disk error” message when trying to boot windows as well as to have a new thread title, since no-one ever responded to the original issue.

I hope my explanation has not caused more confusion … it’s a rather convoluted story … :slight_smile:

On 2010-08-09 18:06, oxala wrote:
>
> Hello again Carlos,
>
> There were no responses to my first problem. The first problem was
> that the entire partition table on /dev/mapper/ddf1_AR01 was removed
> when I attempted to boot “Super Grub Disk” from a usb stick. The array
> looked like a brand-new, not even formatted at the factory disk. I
> booted “Super Grub Disk” only for testing; I did not have any prior
> problem. Using testdisk, I recovered the partition table well enough to
> have complete access to all the disk contents. So my problem is no
> longer that the array lacks a partition table. That is fixed. I
> started a new thread to see if anyone knows how to specifically address
> the “Disk error” message when trying to boot windows as well as to have
> a new thread title, since no-one ever responded to the original issue.
>
> I hope my explanation has not caused more confusion … it’s a rather
> convoluted story … :slight_smile:

Ok.

Well, I think that message comes from windows itself booting, and failing for some reason. I’m no
longer a windows expert, ten years of almost no usage.

I told you to compare two boot sectors for windows, I believe you have one in your virtual install
you mentioned. Just dd it to a file, do an hexdump -C and do a visual compare. That’s all we can do.
For really looking at it you need a dis-assembler, boot sector knowledge, BIOS knowledge, and
windows knowledge.

If it seems very different… perhaps you can try to overwrite the bad one with the good one (after
making a backup). In fact, do a backup image of that windows. You should have one already, if you
don’t have the install disk handy… windows is prone to hang or be destroyed by viruses, so it is
better to be able to recover. Best thing is an image you can simple use to recreate the install in
15 minutes.


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” GM (Elessar))

Hello Carlos,

Thanks! If I get unlazy enough … I’ll try what you suggested with the boot sector comparison; it could be interesting; it could lead to an interesting hack-a-fix attempt - have hex-editor, will travel :). The best advice I’m getting here as well as from friends locally … “Find your xp cd and use windows restore”. I guess it was somewhat naive of me, or just plain silly, to think someone here might know some magic trick! It’s like trying to reinstall grub without any access to … uhh … grub!

Thanks again!

cwight

On 2010-08-10 09:36, oxala wrote:
>
> Hello Carlos,
>
> Thanks! If I get unlazy enough … I’ll try what you suggested with
> the boot sector comparison; it could be interesting; it could lead to an
> interesting hack-a-fix attempt - have hex-editor, will travel :). The
> best advice I’m getting here as well as from friends locally … “Find
> your xp cd and use windows restore”.

Maybe a windows expert or hacker would know.

It is just a simple loader, once upon the time I knew how it worked :slight_smile:

The first bytes are a jump instruction, then some data about the partition, and finally a bit of
code, that loads what it finds at some fixed, hardcoded sectors into ram at some fixed address,
using bios calls. Then it jumps to that just loaded code.

Simple :slight_smile:

No, truly, it is simpler than grub. It is ancient!

But of course, you need to know coding. I can’t do it, no patience. Perhaps there are automated
repair tools that can do it. Dunno.

Easiest: use the original cd! :wink:


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” GM (Elessar))

then some data about the partition,
Some info is at:
How NTFS Works: Local File Systems
NTFS.com Partition Boot Sector on PC hard drives.

/dev/mapper/ddf1_AR01p1 * 64 251674290 125837113+ 7 HPFS/NTFS
normally a partition would start at sector #63 not 64, but I have no idea if the hdd being in an array setup would change that (?). To tell the truth have no idea what an array is or its use.