findpart/editpart help, please! Ran fixboot from Rec Console on 200G disk

  • Thread starter Thread starter MartyEgan
  • Start date Start date
M

MartyEgan

Here's how I got where I am:

System is a few months old HP Pavilion, with a single 200Gig SATA
drive. It came from the store with 2 partitions - a "Recovery
Partition" of about 6 Gig, and another partition of about 180Gig where
WinXP Home was installed. I upgraded WinXP Home to WinXP Pro by running
an in-place upgrade. Applied Service Pack 2. Everything seemed to work
fine.

The system became infected with numerous spyware, etc, and I had to
clean it up. I used the MS Antispyware. I booted into Safe Mode and ran
the MS Antispyware scan. The following day, my wife said it wasn't
working. I wasn't able to boot, with an error - "Windows could not
start because of an error in the software. Please report this problem
as : load needed DLLs for kernel. Please contact your support person to
report this problem.".

I booted into BartPE (built with from a SP2-slipstreamed WinXP Pro disk
amd UBCD from ubcd4win.com), and wanted to see the event logs, so I
looked for them in %systemroot%\system32\config where they are
normally. They weren't there. This seemed quite odd to me. However,
most everything else looked normal - including that my personal data
files were where I expected them to be.

Booted with my original "non-slipstreamed" Windows XP Pro CD, loading
the SATA drivers by pressing F6 during startup of the CD. I tried to do
a repair, but was not allowed. The only thing I could do was format the
partition where "C:" was, because it was labeled with "(Unknown)". I
then booted into the Recovery Console using the same CD, and ran
"fixboot", hoping to fix the partition. (Duh! I didn't know about the
48-bit LBA issues then. I suspect that the 48-bit LBA issues are why it
was labeled "(Unknown)", right?)

Afterwards, the 180Gig volume appears to be only 10Meg, and FAT12
instead of ~180Gig an NTFS. The directory listing on the drive (using
BartPE again) shows a bunch of odd characters, but no files of mine.

I tried looking at it with Partition Magic 8, but that wasn't helpful.
I haven't modified the drive since the goof with "fixboot".


Here's what I've done so far using findpart. I'm not sure where to go
from here. I've tried to delete the incorrect partition table entries
(see output below), but it appears not to be working. What am I doing
wrong? What should I do? Any help sincerely appreciated!




# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # first run of findpart # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK




# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # ran this command # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #
findpart 2 843 2 * 00 843 0 1 844 89 12 842 25841 240 63 42
Click to expand...
Editpart, version 4.2. Copyright Svend Olaf Mikkelsen, 2005.
Disk 2 Cylinder 843
Entry 2:
--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
843 2 00 0 0 0 0 0 0 0 0 0 NB
OK





# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # reran findpart after reboot # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

findpart 2
Click to expand...

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK


# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # ran this command # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #
findpart 2 0 3 - 00 2810 0 1 2879 239 63 0 25841 240 63 42
Click to expand...
Editpart, version 4.2. Copyright Svend Olaf Mikkelsen, 2005.
Disk 2 Cylinder 0
Entry 3:
--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 3 00 0 0 0 0 0 0 0 0 0 NB
OK





# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # reran findpart after reboot # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #


C:\DataRecovery\findntfs_fntfs165>findpart 2

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK

What should I do now? Please help!
 
MartyEgan said:
Here's how I got where I am:
Click to expand...
System is a few months old HP Pavilion, with a single
200Gig SATA drive. It came from the store with 2 partitions
- a "Recovery Partition" of about 6 Gig, and another partition
of about 180Gig where WinXP Home was installed.
Click to expand...

What was the story with that service pack wise ?
I upgraded WinXP Home to WinXP Pro by running an in-place
upgrade. Applied Service Pack 2. Everything seemed to work fine.
Click to expand...
The system became infected with numerous spyware, etc, and
I had to clean it up. I used the MS Antispyware. I booted into
Safe Mode and ran the MS Antispyware scan. The following
day, my wife said it wasn't working. I wasn't able to boot,
Click to expand...

Presumably you could boot after completing the antispywhere scan ?
with an error - "Windows could not start because of
an error in the software. Please report this problem
as : load needed DLLs for kernel. Please contact
your support person to report this problem.".
Click to expand...
I booted into BartPE (built with from a SP2-slipstreamed WinXP Pro
disk amd UBCD from ubcd4win.com), and wanted to see the event
logs, so I looked for them in %systemroot%\system32\config where
they are normally. They weren't there. This seemed quite odd to me.
However, most everything else looked normal - including that my
personal data files were where I expected them to be.
Click to expand...
Booted with my original "non-slipstreamed" Windows XP
Pro CD, loading the SATA drivers by pressing F6 during
startup of the CD. I tried to do a repair, but was not allowed.
The only thing I could do was format the partition where
"C:" was, because it was labeled with "(Unknown)".
Click to expand...

So its likely it was corrupt by then, before you had written to it.
I then booted into the Recovery Console using the
same CD, and ran "fixboot", hoping to fix the partition.
(Duh! I didn't know about the 48-bit LBA issues then.
I suspect that the 48-bit LBA issues are why it was
labeled "(Unknown)", right?)
Click to expand...

Not likely, as long as you havent written to the drive without
48-bit LBA support, it shouldnt have produced that.
Afterwards, the 180Gig volume appears to be only 10Meg, and FAT12
instead of ~180Gig an NTFS. The directory listing on the drive (using
BartPE again) shows a bunch of odd characters, but no files of mine.
Click to expand...
I tried looking at it with Partition Magic 8, but that wasn't helpful.
I haven't modified the drive since the goof with "fixboot".
Click to expand...
Here's what I've done so far using findpart. I'm not sure where to
go from here. I've tried to delete the incorrect partition table entries
(see output below), but it appears not to be working. What am I
doing wrong? What should I do? Any help sincerely appreciated!
Click to expand...

I'd run the hard drive manufacturer's diagnostic
on the drive to see if the drive is just dying.

Check the SMART data with Everest too.
 
C:\DataRecovery\findntfs_fntfs165>findpart 2

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK

What should I do now? Please help!
Click to expand...

I only read the quoted text, since I cannot fully concentrate right
now.

It seems as the fixboot program wrote a 10 MB FAT12 partition at the
location of the 184548 MB NTFS partition.

It may be possible to mostly repair the partition by copying the
backup boot sector to the boot sector, but I cannot suggest that.

It may be possible to copy the files from the 184548 MB NTFS partition
using this command:

findpart findntfs 2 843 0 1 backupboot 377954640 copy

This command should be run in an empty subdirectory in a partition
with room for the files.
 
Sorry, I left out that I already salvaged files by using findntfs.

Now I'm just hoping to fix the partition so I can repair Windows and
not have to reinstall. Part of it is the challenge, part expediency.

So, given that my current findpart output is below. What commands do I
run to correct the partition table? The entries in the third section
of output are the correct partitions. Thanks again.

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK
 
Sorry, I left out that I already salvaged files by using findntfs.

Now I'm just hoping to fix the partition so I can repair Windows and
not have to reinstall. Part of it is the challenge, part expediency.

So, given that my current findpart output is below. What commands do I
run to correct the partition table? The entries in the third section
of output are the correct partitions. Thanks again.

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK
Click to expand...

The partition table is correct.

If only the boot sector (first 512 bytes) of the 184548 MB NTFS
partition is damaged, the partition can be repaired by copying the
backup boot sector at CHS 25839/239/63 to the boot sector at CHS
843/0/1.

I assume the disk is still disk number 2 to Findpart.

To retrieve the current wrong boot sector:

findpart getsect 2 843 0 1 1 wrong.bin noheader

Then verify that the wrong.bin file contains the string "FAT12" using:

edit /64 /r wrong.bin

To retrieve the backup boot sector:

findpart getsect 2 25839 239 63 1 good.bin noheader

Then verify that the good.bin file contains the string "NTFS".


Now, if you do *not* use the force parameter, you cannot do it wrong.

set findpart=edit
findpart putsect 2 843 0 1 good.bin 25841 00000000 checkfile wrong.bin


This Findpart command will only write 1 sector (512 bytes) to a disk
with 25841 cylinders, where the current content of CHS 843/0/1 matches
the file wrong.bin.

Note that from the Findpart findings, we do not know if the partition
is internally OK, except for the boot sector.

Findpart did not report a FAT at the partition, but I cannot be
certain that more than the wrong boot sector was not written to the
partition.
 
Thanks! I can see that partition again!

I still have two issues with what I see in my findpart output.

In the first section of the output, what are these two entries? It
looks to me like the first line shows a partition of ~500Meg at the end
of the disk. I can't see any such partition, and the computer didn't
have one when I brought it home from the store. The second line "No
jump", I don't understand. What does that mean?

<snip from findpart output, full output below>
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B
No jump 0 1 1
</snip>



Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
0 - 07 12746160377954640184548 843 0 1 25839 239 63 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 OK OK
 
Thanks! I can see that partition again!

I still have two issues with what I see in my findpart output.

In the first section of the output, what are these two entries? It
looks to me like the first line shows a partition of ~500Meg at the end
of the disk. I can't see any such partition, and the computer didn't
have one when I brought it home from the store. The second line "No
jump", I don't understand. What does that mean?

<snip from findpart output, full output below>
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B
No jump 0 1 1
</snip>



Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
0 - 07 12746160377954640184548 843 0 1 25839 239 63 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 OK OK
Click to expand...

The "No jump" indicates that the first two bytes of the boot sector is
not a jump instruction. Some operating systems then will not access
the partition, even if the data in the boot sector are OK.

There is a FAT32 partition, which may contain 188 MB of data, inside
the NTFS partition. Since the partition is not in the partition
tables, it is not a problem unless data in the FAT32 partition are
lost. Do not ask me why the partition is there, but it is.

Assuming the content of the 516 MB partition was not overwritten, you
can make a listing for your own use like this:

findpart chsdir 2 2810 0 1 files files-a.txt

If files were to be copied from the 516 MB partition, nothing of
course should be written to the NTFS partition.

The NB in the BS field is a result of the partition being one sector
smaller than according to the partition table. That is as it should
be.
 
Svend Olaf Mikkelsen said:
The "No jump" indicates that the first two bytes of the boot sector is
not a jump instruction. Some operating systems then will not access
the partition, even if the data in the boot sector are OK.

There is a FAT32 partition, which may contain 188 MB of data, inside
the NTFS partition. Since the partition is not in the partition
tables, it is not a problem unless data in the FAT32 partition are
lost. Do not ask me why the partition is there, but it is.

Assuming the content of the 516 MB partition was not overwritten, you
can make a listing for your own use like this:

findpart chsdir 2 2810 0 1 files files-a.txt

If files were to be copied from the 516 MB partition, nothing of
course should be written to the NTFS partition.
Click to expand...
The NB in the BS field is a result of the partition being one sector
smaller than according to the partition table. That is as it should be.
Click to expand...

Then why the Nota Bene if that's OK?
 
Joep said:
To annoy you.
Click to expand...

That's what I thought but didn't want to express right off, Joepie.

I get the impression that Svend has build in several pittfals lately
so that he will be the only one be able to use his own software and
explain the results.
 
I mean to annoy *you* specifically, not people in general, Frusto Rienstra

Folkert Rienstra said:
To annoy you.
Click to expand...

That's what I thought but didn't want to express right off, Joepie.

I get the impression that Svend has build in several pittfals lately
so that he will be the only one be able to use his own software and
explain the results.
 
Joep said:
I mean to annoy *you* specifically, not people in general, Frusto Rienstra
Click to expand...

Since *I* am the only one ever trying to explain the results of findpart
here. *I* am the 'people in general' Joepie.
He obviously doesn't need to do it for you since you already never had
a clue on the output of findpart, nor displayed any interest in knowing.
 
I just want to say thanks for the help I received. You folks are
awesome!

Svend - I hope you make lots of money in your day job, or are
independently wealthy, because you give a LOT of free help to a LOT of
people on a VERY important subject.

Joep - I commend you and the company you work for. Instead of just
pitching your products when someone posts a request for help to Usenet,
you offer assistance in the right spirit. If I meet anyone who needs a
commercial product to do what your products do, I'll recommend you most
strongly.

Thanks to everyone else who helps in this forum!

Marty Egan
 
MartyEgan said:
I just want to say thanks for the help I received. You folks are
awesome!

Svend - I hope you make lots of money in your day job, or are
independently wealthy, because you give a LOT of free help to a LOT of
people on a VERY important subject.

Joep - I commend you and the company you work for.
Click to expand...
Instead of just pitching your products when someone posts a request
for help to Usenet,
Click to expand...

Yup, it's almost a week ago that he last did that (pitch his products).
Meanwhile he has at least offered a whopping 0 times to help.

When he finally did, 6 days later, he greeted the OP with "You don't
have a clue what you're doing, do you?" which was obviously quite helpful.
 
Back
Top