Solved

Corrupt Boot sectors / incorrect MBR - xp will not boot

Posted on 2009-05-13
24
1,277 Views
Last Modified: 2013-11-05
hello all, new member and my first post - i've been struggling with this for weeks and now i'm turning to you for some help! basically I have a thinkpad t60 that will not boot.
Initially I got the black screen with an error "error loading operating system"
i think the computers main C partition was NTFS(55gb) and a second "recovery partition" FAT32(5gb).

If i plug the drive into a working computer - the main partition is displayed as unformatted.

I would very much like to get my files off this partition.

i tried a program called TESTDISK....the Analysis lists the first partition [NTFS] twice which which according to the testdisk wiki "points to a corrupted partition or an invalid partition table entry"
It also lists a second partition [FAT32] (the factory installed IBM recovery partition).

after being advised to run FIXBOOT and FIXMBR via the recovery console - I did so - and now when i attempt to boot i get black screen & the message "missing NTLDR"

in addition to that change - i now get different results from a TESTDISK scan....

it no longer shows the NTFS partition - but a new (and way too small) FAT12 partition and the "recovery partition"

can anyone help?
0
Comment
Question by:pnpcs
  • 12
  • 7
  • 4
24 Comments
 
LVL 30

Expert Comment

by:flubbster
ID: 24378002
I see you tried fixboot and fixmbr through recovery console. I would do all that again, but follow the steps here in the order listed pls.


Execute the following commands:

chkdsk /r  (will take a while to check the drive)
fixboot  (repairs the boot sector if damaged)
fixmbr ( repairs the master boot record if damaged)

attrib -h c:\ntldr
attrib -s c:\ntldr
attrib -r c:\ntldr

attrib -h c:\ntdetect.com
attrib -s c:\ntdetect.com
attrib -r c:\ntdetect.com

This step assumes that the CD is device "D". If not, use the proper drive letter. You can look at the mapped drives by typing "map" (without quotes) and hitting enter.

copy d:\i386\ntldr c:\ntldr
reply "Y" to overwrite
copy d:\i386\ntdetect.com c:\ntdetect.com
reply "Y" to overwrite

attrib +h c:\ntdetect.com
attrib +s c:\ntdetect.com
attrib +r c:\ntdetect.com

attrib +r c:\ntldr
attrib +h c:\ntldr
attrib +s c:\ntldr

exit recovery console and reboot.
0
 

Author Comment

by:pnpcs
ID: 24378466
finally looks like i've reached someone who knows what they're talking about:) Thanks for your quick reply.

I will try the steps you've outlined and report back soon - Thanks...
0
 

Author Comment

by:pnpcs
ID: 24379508
before I continue I should say that the Recovery Console is only giving me one option for the question: "which Windows installation would you like to log onto:"

that option is: 1: "D:\minint"

This appears to be the ThinkPad's "recovery partition"

presumably the choice I want to show up here is C:....

should I just choose D: and go ahead with your suggestion?

please advise, thank you!
0
 
LVL 30

Expert Comment

by:flubbster
ID: 24380107
You can try, but I am not sure if you will be able to access drive C.

First step will be chkdsk c: /r

If that works, then continue. If it says "C not found", then forget it. You need access to the C drive. You could try connecting it as an external drive on another pc and then running chkdsk. In place of C, use whatever drive letter it is.

Try to use the recovery console several times. Sometimes, it will eventually see the proper drive and finish the recovery console boot to C.
0
 

Author Comment

by:pnpcs
ID: 24380512
Okay, will try and post the result first thing in the morning!
Thanks again....
0
 

Author Comment

by:pnpcs
ID: 24382824
hi flubbster - here is the result of chkdsk c: /r

"The volume serial number is 0000-0000

The volume appears to contain one or more unrecoverable problems.
10344 kilobytes total disk space.
0 kilobytes are available.

4096 bytes in each allocation unit.
2586 total allocation units on disk.
0 allocation units available on disk.

D:\minint>"

It does appear to have somehow recognized C - but the size seems incorrect... shall I continue on with the rest of the commands?
0
 
LVL 11

Expert Comment

by:NaturaTek
ID: 24383160
I would be safe and pull the files off quickly as possible. Connect drive to a sata/ide to usb adapter, connect to a different working xp machine..pull data off. When you are having partition table errors, they get ugly. Preserve your data then attempt fixes. My opinion, take data off, delete the partition, recreate it, reformat, reinstall. I would run the drive's manufacturer low level format utility to rule out drive errors.

If you attempted to connect to another pc and just cant see any files, perhaps the progress so far crosslinked/corrupted partitions. Connect to a XP machine and use software like winternals disk commander, getdataback, etc, to find the data and pull it off.

There are nice utilities like http://findandmount.com/ but I advise with any tinkering until your data is off. Darn data is irreplaceable, everything else is.

I would verify the correct settings for your hard drive in bios, a client once changed it from automatic to some random manual settings that just screwed up the drive.

0
 

Author Comment

by:pnpcs
ID: 24383473
Hi NaturaTek, thanks for your feedback - my single goal here is to get my data back :)!
I have already tried the software you've suggested (winternals disk commander, getdataback) plus a few more. all of them can see the file structure of my useless 5gb "recovery partition" but not the file structure of the main NTFS C partition (55gb).
they almost always do correctly identify the size and it's mere existence though.

my belief is that once the partition geometry / boot sector / MBR are corrected I will be fine....

I have reset BIOS to the default.

the FindandMount utility you've suggested looks like it might be worth a shot....

0
 
LVL 11

Expert Comment

by:NaturaTek
ID: 24383622
I hear you. Data is our life. There are tons of utilities out there to help you. You said you tried winternals, getdataback and more? I always had successes with them, I let the scan the drive RAW and it takes hours, depending on size. Once done, you should see a menu on left showing you files/directories. Theres a boot CD out there with nice recovery programs on it, but I can't post name, since a post I mentioned it,  and it was edited with a warning to me.
Other is http://www.partition-recovery.com/
http://www.devhood.com/Tools/tool_details.aspx?tool_id=749
http://www.diydatarecovery.nl/mbrtool.htm
http://www.diydatarecovery.nl/dp_manual/guide_ptrepair.htm
many more out there.

A handful of possibilities may have caused your issue. Spyware/virus, installation of 3rd party boot loader, corruption, even physical defects on the drive (the worst one) can cause issues.

If the data is extremely important and you have good budget, I go with drivesavers.com
0
 

Author Comment

by:pnpcs
ID: 24383650
hmm.. maybe I did not choose the RAW method..

Which utility do you suggest I use the RAW scan with?

I have the boot CD of which you speak.
0
 
LVL 11

Expert Comment

by:NaturaTek
ID: 24384523
Ontrack has the RAW mode..in getdataback, choose 'systematic file damage'. I would do a quick scan with each or any..see if you can see the directories, if not, a more thorough scan.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:pnpcs
ID: 24384869
i'll give Ontrack a shot in RAW mode. I've done quick scans with all of them - no directories for C:

Thanks - I will report back...
0
 

Author Comment

by:pnpcs
ID: 24389752
It did not take *that* long for Ontrack to do the RAW scan - but now it's doing something called "building tree" and it's been  h o u r s. . .  it's a 55gb partition - how long should I wait until i assume it's just "stuck"?
leave it overnight?

0
 
LVL 11

Expert Comment

by:NaturaTek
ID: 24392027
I would just leave it alone
http://support.ontrack.com/cgi-bin/ontrack.cfg/php/enduser/std_adp.php?p_faqid=1006&p_created=1113489943&p_sid=h1JKxQxj&p_accessibility=0&p_redirect=&p_lva=&p_sp=cF9zcmNoPTEmcF9zb3J0X2J5PSZwX2dyaWRzb3J0PSZwX3Jvd19jbnQ9MTcsMTcmcF9wcm9kcz00NCZwX2NhdHM9MCZwX3B2PTEuNDQmcF9jdj0mcF9wYWdlPTEmcF9zZWFyY2hfdGV4dD1yYXcgcmVjb3Zlcnk*&p_li=&p_topview=1

Perhaps your drive developed a bad sector or more. If a few bad sectors landed right on the mbr or partition table, this also could screw things up entirely.

Raw recovery goes thru everything. It can take up to 2days. It may even get locked up. You'll kinda know if the operation froze up, but for the most part, leave it alone if you see any activity.

After the raw recovery, you'll see thousands of entries. Then becomes the tedious task of finding what you need. Me, I would just search for *.docx, *.doc, *.jpg, *.mp3 or file extensions of what you need. If it gives you the option of saving the recovery do so to another drive/location.

Its always good to have a extra machine to do recovery work at your home lab.
0
 
LVL 11

Expert Comment

by:NaturaTek
ID: 24392116
I think your hard drive might just be failing. Couldnt tell you for sure.
I would stick it out for 2 days max on the raw recovery, if you do not see anything budge, consider it locked up.

If you are doing this work on your personal machine, maybe take it to a diff computer in your home where it could work untouched for a couple of days.
If frozen, I would restart another scan, go thru some of scan options in the Ontrack menu. Maybe attempt the raw recovery scan again but see if you can scan for specific files. If so, do a scan with just the option of *.doc, just to see how far it gets.

Testdisk http://www.cgsecurity.org/wiki/TestDisk is also on that 'cd'. It can help rebuild the master partition table from a mirror and other tasks. However if your drive is indeed bad sectored some where or other increasing defect, all the working and software in the world won't do anything. The only you can do on your own is data recovery and pull off what you can, it's time consuming depending on your equipment and how bad the drive is.

Getdataback and ontrack or top 2 choices and both have good scan options. Getdataback took nearly 16 hours on a scan, which the drive itself had many bad sectors. Fortunately none of the important data resided in the bad sectors and able to pull it all off. But it was a task.

This might be a reason data recovery can be up to 3,000$  

If it was a clicking sound or the drive cant spin up/start, no matter, you wont be able to do anything. Hardware recovery is what you need. Driversavers is reputable. What they do is find an identical drive and remove your platters and place it in the working one. If the logic board is bad, they replace that. Or they could simply remove your platters and place it on their machine that slowly reads  thru everything.

Give it a couple more shots with ontrack/getdataback, redo the scan if frozen, try systematic file scan in getdataback. Retry ontrack with wild card search.
0
 
LVL 30

Expert Comment

by:flubbster
ID: 24394265
Once you reach the point where you believe you have all the data you want.... or can get, play a bit. Download Testdisk and try using it to repair the drive.

http://www.cgsecurity.org/wiki/TestDisk

Also, GParted is a great Linux-based program that allow mou8nting, unmounting, converting, sizing, etc of partitions. It can be used to reapir and re-allocate ntfs partitions.

http://gparted-livecd.tuxfamily.org/
0
 

Author Comment

by:pnpcs
ID: 24394481
Hi flubbster,

i am running thru some of the very lengthy scans to see if they return anything useful - afterwards, depending on the results I intend to follow your first advice with the seris of commands via Recovery Console. Or do you suggest Testdisk after the file scan attempts?

Thanks for your help - I am still optimistic

0
 
LVL 30

Expert Comment

by:flubbster
ID: 24394517
If you can boot to the recovery console such that C is at least recognized, I would definitely try the commands I initially posted. meanwhile, take a look at the links I just posted so that you can get familiar with the programs. Perhaps even go ahead and download and create the CD's where needed.
0
 

Author Comment

by:pnpcs
ID: 24396710
hi flubbster - the only option i get in Recovery Console is D:\minint
does this mean I should not try the commands you first posted?
I do have bootable CD's for both testdisk and gparted.

what's your suggested course of action?

0
 
LVL 11

Expert Comment

by:NaturaTek
ID: 24396957
pnpcs,

Like I previously mentioned, if your drive is corrupt, partition table..You wont be able to see anything at all from recovery console. The only thing you can try from there is fixmbr.
If you connect the drive to another pc, you cant even see your c drive correct? Just the d. You also tried connecting the drive to another pc to see ifyou can pull your data and C doesnt show? The C partition is what's corrupted, fixmbr it's the only thing you can do from recovery console to help you at this moment, but I think you've tried that. You can run chkdsk, but that is only going to do the D drive thats intact. You can't chkdsk C if the partition table/mbr is corrupted not even displaying it.

The testdisk link is in my previous post. See if it can replace the MFT from a mirror. Allow it to rewrite a standard mbr code. If your drive is affected by bad sectors, any partition/mbr work is a gamble. The best thing to do is run recovery software to see if you can recover anything. Testdisk, partitionrecovery, fixmbr are a few of standard tools that remedy most issues. Try running the manufacturers drive tool (included in that cd) and let it run a full scan to detect errors. Assume your drive is in error state at this point. What matters is taking the data off.

Wish I could be of more help.
0
 

Author Comment

by:pnpcs
ID: 24399409
hi NaturaTek

actually - i DO see the C partition when I connect it to another computer - sometimes it is labeled as E: with 2 partitions (both with the correct sizes). I can even see it in my Macbook's Disk Utility...

but i can only browse the file structure of the small ibm "recovery partition" - when i click on the main one inside of a working windows computer - it tells me it is "unformatted" and asks if i want to format it... (i don't!)

0
 
LVL 11

Accepted Solution

by:
NaturaTek earned 500 total points
ID: 24400301
You can see it on another pc? Something is corrupted. I would work from that pc to the drive, tried the testdisk, here are examples http://www.cgsecurity.org/wiki/Data_Recovery_Examples

On that cd you should also see Diskpatch, http://www.diydatarecovery.nl/DiskPatch.htm  read what it does (actually I just confirmed it, its on cd)

Run that utility.
Read thru these
http://www.diydatarecovery.nl/dp_manual/default.htm
http://www.diydatarecovery.nl/dp_manual/ptable_repair.htm
http://www.diydatarecovery.nl/dp_manual/bs_repair.htm
http://www.diydatarecovery.nl/dp_manual/guide_ptrepair.htm
http://www.diydatarecovery.nl/dp_manual/guide_mbrrefresh.htm
http://www.diydatarecovery.nl/dp_manual/guide_surfacescan.htm

Your problem lies in Corrupt boot sector, Corrupt partition or corrupt MFT. Do a scan and log it with diskpatch and post the log here. Again, if corruption is due to a bad sector recovery is tricky. I still say scan with getdataback, and pull off what you can. It's just time consuming.
0
 

Author Comment

by:pnpcs
ID: 24401981
those are the best 2 utilities I've seen. hanks. I will do the reading and let you know & post the log files....
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

In this article we have discussed the manual scenarios to recover data from Windows 10 through some backup and recovery tools which are offered by it.
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now