Solved

repair disk file system

Posted on 2011-09-06
56
568 Views
Last Modified: 2012-05-12
hello experts
i am starting a self-educational project on a disk from an XP SP3 laptop, that starts to boot - then gives a blue screen, referring to Ram (which is  tested ok)
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
it does the same when you try to repair the file system
Disk diagnostics are OK, so i suppose it is an error in the file system
i KNOW i can do a fresh install -so don' tell me that or not loose my time on it, yes?

I was thinking of using Winhex for reading the disk sectors, but since i'm totally unfamiliar with this, i thought that maybe the EE-experts could guide me through the first steps, and provide some DO'S  and DONT's

you may answer with some links,  if they point"understandable" sites, so i can start this

i appreciate all help and answers
0
Comment
Question by:nobus
  • 31
  • 17
  • 3
  • +3
56 Comments
 
LVL 62

Expert Comment

by:☠ MASQ ☠
ID: 36488218
Have you already tried repairing the file system using CHKDSK /f run from the Recovery Console (either already installed as a boot option or by booting from an XP CD) ?
0
 
LVL 91

Author Comment

by:nobus
ID: 36489148
yes masqueraid - but that is NOT the goal here; i posted clearly : to find the cause of the blue screen and  educate myself to be able to read and use the NTFS disk info to correct problems
0
 
LVL 30

Expert Comment

by:ded9
ID: 36489568
Upload the minidump file.


Ded9
0
 
LVL 91

Author Comment

by:nobus
ID: 36489986
@ ded : NO that is not my question
0
 
LVL 32

Expert Comment

by:_
ID: 36492065
Are these closer?

XP file structure (5 pages)
http://www.informit.com/articles/article.aspx?p=101731&rll=1

hard disk structure
http://www.ntfs.com/hard-disk-basics.htm
0
 
LVL 32

Expert Comment

by:_
ID: 36492174
DONT's
- don't do it!. It is soooooo easy to mess up.

But since this is the only way to learn...

DO'S
- make/use a copy/clone whenever possible. It's a lot easier to wipe and reclone if you make a booboo, then to fix a bad guess or bad edit on the only copy.
- understand the MBR, FAT table, and how to get the "next sector" link from a file. Without understanding these, you won't get far.
0
 
LVL 91

Author Comment

by:nobus
ID: 36493711
coral, i'll look up the links - did you ever do it?
about Do's and DONT's : there is nothing to be kept, i can wipe the laptop clean

i am only looking for a bit of advice of someone who did this, to get started the right way
if you prefer other software for doing this - post them plse !
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36494039
Hi nobus,

if the system starts booting and then goes to BSOD then there are 50/50 chances that problem could be caused by FS problems. We still need to narrow the problem to FS bottle neck by looking into BSOD exceptions (or minidump if you can get it).
As for the file system issues, we can look into the boot sector of the drive which is in most cases the culprit of non-bootable system although in such cases the startup process would not show any MS signs.
So let's start from BSOD. Which exception do you get?
0
 
LVL 91

Author Comment

by:nobus
ID: 36494657
thanks noxcho for joining the team
i don't want to examine the bsod, just start with the boot sector, as i said i don't want to try to repair it with usual approaches, just self educate myself a bit by examining the files sytem data
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36494825
ok, I think you own the same tool like I do: paragon drive backup 10 or hard disk manager 11 from the same company.
In both installed or boot CD based version of this tool you can right click on system partition and select there View\Edit sectors. And then save number of sectors to bin file. Could you please save the first 5 sectors of the partition and share them with me? I will look and if anything is wrong there explain and point you to it.
0
 
LVL 8

Expert Comment

by:JT92677
ID: 36496025
Have you hit the F8 key numerous times during POST (Power up) and then selected the "Last Known Good Configuration" option? or have you booted into SAFE mode (after the first last known configuration attempt) and will it complete the boot in Safe Mode ??

In Safe Mode, you should be able to Start/Run/ MSCONFIG and then hit the "Launch System Restore" button and select a restoration point on a date you believe things were working.

Your blue screen problem appears to be a missing or corrupted setting.

Hope this helps.

Jeff
0
 
LVL 32

Expert Comment

by:_
ID: 36496072
>> ... other software for doing this

It's been a few years, but I mostly used Disk Investigator and one of the disk editors on an older version of UBCD. But Winhex is suppose to be pretty good:

http://www.softpedia.com/get/System/Back-Up-and-Recovery/Disk-Investigator.shtml
0
 
LVL 91

Author Comment

by:nobus
ID: 36496807
noxcho : good idea - i could save the sectors to a file, but where is it saved?  i could not find it (sorry, never tried this)
@ Jeff : that is NOT what i want at all - read the question plse
@coral47 : thanks for the idea
0
 
LVL 8

Expert Comment

by:JT92677
ID: 36497294
nobus

I read the question and it seemed that your system produced a blue screen on boot.

You can run these inspector programs in Windows, maybe in DOS mode as well, but it seemed to me that you were describing two problems, one to fix the blue screen, and another to teach yourself about NTFS file systems with some software.

Botton line: I did read the question, and it could have been interpreted as a broken WIndows system AND a learning about NTFS question combined into one question.

Will these disk analysis programs allow you to figure out what driver is missing that is causing the blue screen?  I doubt it.

Have fun.

0
 
LVL 46

Expert Comment

by:noxcho
ID: 36498805
Nobus, did you find View/Edit Sectors? It is available when you get to the full mode of the product (no difference which one you use but not the free one). Right click on partition - there in context menu you can find View/Edit sectors. Then in the hex view window at the right upper corner you can see Save and Load options.
0
 
LVL 91

Author Comment

by:nobus
ID: 36501019
yes i found view/edit, and i could save the 5 sectors as said - but was UNABLE to find where the ****file is..
so WHERE is it, so i can copy it ? ? on the c: drive, or must i connect an USB stick?
0
 
LVL 91

Author Comment

by:nobus
ID: 36501023
@JT : with all respect, but i posted :
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36501392
Ah, that is your problem. But you can point it to the folder where you can save it to. Look the attached screen shot.
Backup-sectors.png
0
 
LVL 91

Author Comment

by:nobus
ID: 36501819
ok thanks - i must have overlooked it
(i'm starting to be a big overlooker..)
0
 
LVL 91

Author Comment

by:nobus
ID: 36518640
hello, here the 5 sectors (had to postpone this a couple of days)
i had to rename it to txt (bin not allowed)
dump-from-sector-0--5-sectors-.txt
0
 
LVL 91

Author Comment

by:nobus
ID: 36553393
hello noxcho ??
0
 
LVL 8

Assisted Solution

by:JT92677
JT92677 earned 100 total points
ID: 36555213
You wrote:
@JT : with all respect, but i posted :
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
--------------------

Are you having any luck figuring out why Windows produces a blue screen ??

Perhaps you'll need to copy the disk sectors where you think there is a problem to another disk, then fix the system so it works correctly, then compare the fixed sectors with the problem sectors to see if a difference is related to the blue screen.

It still seems quite a challenge to diagnose a boot problem simply by investigating the contents of a disk that won't boot correctly, but I'm following this to find out how you do it, or even if it's possible.

What you may need is a hardware assisted debugger that lets you step through system calls, etc.

See: http://msdn.microsoft.com/en-us/windows/hardware/gg463016

Jeff
 
0
 
LVL 91

Author Comment

by:nobus
ID: 36578633
i'm still waiting for noxcho's response
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36583733
Hi nobus, sorry for my silence. I am currently in Spain enjoying my vacations time. Not much I can do from iPad device. On Sunday I'll get to my PC and will post my update.
0
 
LVL 91

Author Comment

by:nobus
ID: 36585300
ok - tx for the info noxcho  -take your time, and enjoy!
0
 
LVL 91

Author Comment

by:nobus
ID: 36592167
i saw you are back noxcho - waiting for your answer
0
 
LVL 46

Accepted Solution

by:
noxcho earned 400 total points
ID: 36592275
Hi nobus, I need you to save and upload also MBR (Sector 0) of the HDD where you got the 5 sectors of partition from. The steps are almost the same. Right click on HDD - view/edit sectors etc.
Also in the root folder of the paragon program pls find fdisk.txt file and upload it here.
The boot sector of partition looks ok thus I am going to dig a bit deeper into this issue.
0
 
LVL 91

Author Comment

by:nobus
ID: 36592675
here sector 0 attached
could not find any file in X:  as asked (in the root folder of the paragon program pls find fdisk.txt file )
dump-from-sector-0--1-sectors-.txt
dump-from-sector-0--5-sectors-.txt
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 46

Expert Comment

by:noxcho
ID: 36592737
nobus, I think you attached wrong file instead of fdisk.txt (it is in C:\Program Files\Paragon\Drive Backup or any other tool by paragon\Program directory).
0
 
LVL 91

Author Comment

by:nobus
ID: 36592886
i run it from cd, not from disk - does that change anything?in c\program files -there is of course no mention of paragon
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36592967
From CD (if you are referring to WinPE) you have also a chance to get the log file. Simply run once the program thus to see the disk layout. Then start File Transfer Wizard (in Tools - FTW) and browse for X: drive. There find the Paragon directory and Program folder. In this folder the file should be created.
0
 
LVL 91

Author Comment

by:nobus
ID: 36594522
i found the paragon directory; but not the file
FYI i run DB9 server edition from cd
i start it, click on disk editor to view sectors, then use FTW to scroll to the directory
or did i miss a step ?
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36595050
Hmm I think the problem is that you use version 9. I am using version 10. Get a copy of latest version it is still free for you.
0
 
LVL 91

Author Comment

by:nobus
ID: 36595306
ok -i'll download server version 11
or do you want me to use another?
0
 
LVL 46

Assisted Solution

by:noxcho
noxcho earned 400 total points
ID: 36595308
I prefer HDM11Server. Use it.
0
 
LVL 91

Author Comment

by:nobus
ID: 36595328
ok -i'll download the trial
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36595344
Hmm trial has no WinPE. You can get easily full version as well. All EE experts can get it as far as I know.
0
 
LVL 91

Author Comment

by:nobus
ID: 36595516
>>  All EE experts can get it as far as I know.  <<  that's how i got it; good you remember me of it; will do so
0
 
LVL 91

Author Comment

by:nobus
ID: 36708758
ok - i downloaded the hdm 11 server and installed it
but when i select the file transfer wizard, it locks up ...
note that it is on a clean disk, with a fresh W7 install + only Office and drivers
i tried the hdmserver recovery cd - but it has not the same functionality
0
 
LVL 91

Author Comment

by:nobus
ID: 36708878
ok - it is running now, and i made the recovery cd - also working
HDM 11 running from disk C: now, i looked in c:\program files\paragon\Hard Disk Manager 11 Server but did not see fdisk.txt
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36709011
Hi nobus, did you look into C: while booting from CD or while working from installed copy?
Also to create the WinPE you do not need to install anything. WinPE as far as I got it came always in self burning ISO file packed into burning shell with .exe extension. Did you download all files sent to you by Paragon?
Once you boot to WinPE CD for HDM11 - select Full Mode there where you see the disk layout - there press on Tools - FTW - search in X: directory. X: is the RAM device to which WinPE loads usually.
0
 
LVL 91

Author Comment

by:nobus
ID: 36710338
i made the standalone CD from the installed one - it seems ok now
the downloaded cd was a rescue cd (while it DID say HDM11 Server rescue cd...)
but up to now - i simply can't find fdisk.txt somewhere  -starnge
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36710617
Yes, because it is generated in WinPE IMHO. I checked it and yes, it is generated only in WinPE environment. Linux/DOS which you have does not create this log.
0
 
LVL 91

Author Comment

by:nobus
ID: 36711030
what do you suggest me to do then ?
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36712523
Download WinPE - boot from it - select full scale mode - thus to run the engine of the tool one time and let the log create. Then use the FTW to extract it.
0
 
LVL 91

Author Comment

by:nobus
ID: 36714825
which winpe file?  there are lots, and the hdm11 winpe was not what i needed
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36715098
Wait. What files did you get with HDM11 download email? How many links were there in the mail? I have two links.
0
 
LVL 91

Author Comment

by:nobus
ID: 36716064
ok i have :
Component Paragon Hard Disk Manager 11 Server - Windows Installation Package
Component Paragon Hard Disk Manager 11 Server - WinPE based Recovery CD Image
 so you mean the second one, yes -  i'll download and try that then (maybe i was sidetracked, and downloaded  a wrong one)
0
 
LVL 91

Author Comment

by:nobus
ID: 36716070
and that is the file :  Paragon-201-SEE_WinPERCD_10.0.17.13908_000.exe
0
 
LVL 91

Author Comment

by:nobus
ID: 36716072
..which i was using the last time
0
 
LVL 46

Assisted Solution

by:noxcho
noxcho earned 400 total points
ID: 36716571
Yes, I meant this one: Component Paragon Hard Disk Manager 11 Server - WinPE based Recovery CD Image
Look attached video example. I changed the extension from .exe to .png.
Download the file and change the extension back. Double click and look the video.
winpe.png
0
 
LVL 91

Author Comment

by:nobus
ID: 36718287
tx for the video noxcho - that helps
here the file (at last) :-))
fdisk.txt
0
 
LVL 91

Author Comment

by:nobus
ID: 36890329
here the other file you need  attached -renamed to txt
fsdump-110930-0840-0-0x3f.txt
0
 
LVL 46

Expert Comment

by:noxcho
ID: 36890608
 nobus, I am unable to download it. Interrupts after 3.4MB finished. Can you use some file sharing service or FTP for it?
0
 
LVL 91

Author Comment

by:nobus
ID: 36890890
maybe it got corrupt -i'll post it again
fsdump-110930-0840-0-0x3f.txt
0
 
LVL 91

Author Closing Comment

by:nobus
ID: 36917779
i will close out this question - tx to Jt92677 and noxcho
JT posted first to use the disk sectors and compare them - noxcho supported me further so i could start

and for everyone : no i did not analyse it yet (not too much time) but now i know where to start at least
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

So many times I have seen the words written in a question "if only I could show you" or " I know how hard it is for you since you can't see it" in any zone. That has inspired me to write about this tool in windows 7 called "Problem Steps Recorder…
OfficeMate Freezes on login or does not load after login credentials are input.
This Micro Tutorial will teach you how to the overview of Microsoft Security Essentials. This is a free anti-virus software that guards your PC against viruses, spyware, worms, and other malicious software. This will be demonstrated using Windows…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now