repair disk file system

hello experts
i am starting a self-educational project on a disk from an XP SP3 laptop, that starts to boot - then gives a blue screen, referring to Ram (which is  tested ok)
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
it does the same when you try to repair the file system
Disk diagnostics are OK, so i suppose it is an error in the file system
i KNOW i can do a fresh install -so don' tell me that or not loose my time on it, yes?

I was thinking of using Winhex for reading the disk sectors, but since i'm totally unfamiliar with this, i thought that maybe the EE-experts could guide me through the first steps, and provide some DO'S  and DONT's

you may answer with some links,  if they point"understandable" sites, so i can start this

i appreciate all help and answers
LVL 94
nobusbiljart fanAsked:
Who is Participating?
 
noxchoGlobal Support CoordinatorCommented:
Hi nobus, I need you to save and upload also MBR (Sector 0) of the HDD where you got the 5 sectors of partition from. The steps are almost the same. Right click on HDD - view/edit sectors etc.
Also in the root folder of the paragon program pls find fdisk.txt file and upload it here.
The boot sector of partition looks ok thus I am going to dig a bit deeper into this issue.
0
 
☠ MASQ ☠Commented:
Have you already tried repairing the file system using CHKDSK /f run from the Recovery Console (either already installed as a boot option or by booting from an XP CD) ?
0
 
nobusbiljart fanAuthor Commented:
yes masqueraid - but that is NOT the goal here; i posted clearly : to find the cause of the blue screen and  educate myself to be able to read and use the NTFS disk info to correct problems
0
Cloud Class® Course: SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

 
ded9Commented:
Upload the minidump file.


Ded9
0
 
nobusbiljart fanAuthor Commented:
@ ded : NO that is not my question
0
 
_Commented:
Are these closer?

XP file structure (5 pages)
http://www.informit.com/articles/article.aspx?p=101731&rll=1

hard disk structure
http://www.ntfs.com/hard-disk-basics.htm
0
 
_Commented:
DONT's
- don't do it!. It is soooooo easy to mess up.

But since this is the only way to learn...

DO'S
- make/use a copy/clone whenever possible. It's a lot easier to wipe and reclone if you make a booboo, then to fix a bad guess or bad edit on the only copy.
- understand the MBR, FAT table, and how to get the "next sector" link from a file. Without understanding these, you won't get far.
0
 
nobusbiljart fanAuthor Commented:
coral, i'll look up the links - did you ever do it?
about Do's and DONT's : there is nothing to be kept, i can wipe the laptop clean

i am only looking for a bit of advice of someone who did this, to get started the right way
if you prefer other software for doing this - post them plse !
0
 
noxchoGlobal Support CoordinatorCommented:
Hi nobus,

if the system starts booting and then goes to BSOD then there are 50/50 chances that problem could be caused by FS problems. We still need to narrow the problem to FS bottle neck by looking into BSOD exceptions (or minidump if you can get it).
As for the file system issues, we can look into the boot sector of the drive which is in most cases the culprit of non-bootable system although in such cases the startup process would not show any MS signs.
So let's start from BSOD. Which exception do you get?
0
 
nobusbiljart fanAuthor Commented:
thanks noxcho for joining the team
i don't want to examine the bsod, just start with the boot sector, as i said i don't want to try to repair it with usual approaches, just self educate myself a bit by examining the files sytem data
0
 
noxchoGlobal Support CoordinatorCommented:
ok, I think you own the same tool like I do: paragon drive backup 10 or hard disk manager 11 from the same company.
In both installed or boot CD based version of this tool you can right click on system partition and select there View\Edit sectors. And then save number of sectors to bin file. Could you please save the first 5 sectors of the partition and share them with me? I will look and if anything is wrong there explain and point you to it.
0
 
JT92677Commented:
Have you hit the F8 key numerous times during POST (Power up) and then selected the "Last Known Good Configuration" option? or have you booted into SAFE mode (after the first last known configuration attempt) and will it complete the boot in Safe Mode ??

In Safe Mode, you should be able to Start/Run/ MSCONFIG and then hit the "Launch System Restore" button and select a restoration point on a date you believe things were working.

Your blue screen problem appears to be a missing or corrupted setting.

Hope this helps.

Jeff
0
 
_Commented:
>> ... other software for doing this

It's been a few years, but I mostly used Disk Investigator and one of the disk editors on an older version of UBCD. But Winhex is suppose to be pretty good:

http://www.softpedia.com/get/System/Back-Up-and-Recovery/Disk-Investigator.shtml
0
 
nobusbiljart fanAuthor Commented:
noxcho : good idea - i could save the sectors to a file, but where is it saved?  i could not find it (sorry, never tried this)
@ Jeff : that is NOT what i want at all - read the question plse
@coral47 : thanks for the idea
0
 
JT92677Commented:
nobus

I read the question and it seemed that your system produced a blue screen on boot.

You can run these inspector programs in Windows, maybe in DOS mode as well, but it seemed to me that you were describing two problems, one to fix the blue screen, and another to teach yourself about NTFS file systems with some software.

Botton line: I did read the question, and it could have been interpreted as a broken WIndows system AND a learning about NTFS question combined into one question.

Will these disk analysis programs allow you to figure out what driver is missing that is causing the blue screen?  I doubt it.

Have fun.

0
 
noxchoGlobal Support CoordinatorCommented:
Nobus, did you find View/Edit Sectors? It is available when you get to the full mode of the product (no difference which one you use but not the free one). Right click on partition - there in context menu you can find View/Edit sectors. Then in the hex view window at the right upper corner you can see Save and Load options.
0
 
nobusbiljart fanAuthor Commented:
yes i found view/edit, and i could save the 5 sectors as said - but was UNABLE to find where the ****file is..
so WHERE is it, so i can copy it ? ? on the c: drive, or must i connect an USB stick?
0
 
nobusbiljart fanAuthor Commented:
@JT : with all respect, but i posted :
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
0
 
noxchoGlobal Support CoordinatorCommented:
Ah, that is your problem. But you can point it to the folder where you can save it to. Look the attached screen shot.
Backup-sectors.png
0
 
nobusbiljart fanAuthor Commented:
ok thanks - i must have overlooked it
(i'm starting to be a big overlooker..)
0
 
nobusbiljart fanAuthor Commented:
hello, here the 5 sectors (had to postpone this a couple of days)
i had to rename it to txt (bin not allowed)
dump-from-sector-0--5-sectors-.txt
0
 
nobusbiljart fanAuthor Commented:
hello noxcho ??
0
 
JT92677Commented:
You wrote:
@JT : with all respect, but i posted :
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
--------------------

Are you having any luck figuring out why Windows produces a blue screen ??

Perhaps you'll need to copy the disk sectors where you think there is a problem to another disk, then fix the system so it works correctly, then compare the fixed sectors with the problem sectors to see if a difference is related to the blue screen.

It still seems quite a challenge to diagnose a boot problem simply by investigating the contents of a disk that won't boot correctly, but I'm following this to find out how you do it, or even if it's possible.

What you may need is a hardware assisted debugger that lets you step through system calls, etc.

See: http://msdn.microsoft.com/en-us/windows/hardware/gg463016

Jeff
 
0
 
nobusbiljart fanAuthor Commented:
i'm still waiting for noxcho's response
0
 
noxchoGlobal Support CoordinatorCommented:
Hi nobus, sorry for my silence. I am currently in Spain enjoying my vacations time. Not much I can do from iPad device. On Sunday I'll get to my PC and will post my update.
0
 
nobusbiljart fanAuthor Commented:
ok - tx for the info noxcho  -take your time, and enjoy!
0
 
nobusbiljart fanAuthor Commented:
i saw you are back noxcho - waiting for your answer
0
 
nobusbiljart fanAuthor Commented:
here sector 0 attached
could not find any file in X:  as asked (in the root folder of the paragon program pls find fdisk.txt file )
dump-from-sector-0--1-sectors-.txt
dump-from-sector-0--5-sectors-.txt
0
 
noxchoGlobal Support CoordinatorCommented:
nobus, I think you attached wrong file instead of fdisk.txt (it is in C:\Program Files\Paragon\Drive Backup or any other tool by paragon\Program directory).
0
 
nobusbiljart fanAuthor Commented:
i run it from cd, not from disk - does that change anything?in c\program files -there is of course no mention of paragon
0
 
noxchoGlobal Support CoordinatorCommented:
From CD (if you are referring to WinPE) you have also a chance to get the log file. Simply run once the program thus to see the disk layout. Then start File Transfer Wizard (in Tools - FTW) and browse for X: drive. There find the Paragon directory and Program folder. In this folder the file should be created.
0
 
nobusbiljart fanAuthor Commented:
i found the paragon directory; but not the file
FYI i run DB9 server edition from cd
i start it, click on disk editor to view sectors, then use FTW to scroll to the directory
or did i miss a step ?
0
 
noxchoGlobal Support CoordinatorCommented:
Hmm I think the problem is that you use version 9. I am using version 10. Get a copy of latest version it is still free for you.
0
 
nobusbiljart fanAuthor Commented:
ok -i'll download server version 11
or do you want me to use another?
0
 
noxchoGlobal Support CoordinatorCommented:
I prefer HDM11Server. Use it.
0
 
nobusbiljart fanAuthor Commented:
ok -i'll download the trial
0
 
noxchoGlobal Support CoordinatorCommented:
Hmm trial has no WinPE. You can get easily full version as well. All EE experts can get it as far as I know.
0
 
nobusbiljart fanAuthor Commented:
>>  All EE experts can get it as far as I know.  <<  that's how i got it; good you remember me of it; will do so
0
 
nobusbiljart fanAuthor Commented:
ok - i downloaded the hdm 11 server and installed it
but when i select the file transfer wizard, it locks up ...
note that it is on a clean disk, with a fresh W7 install + only Office and drivers
i tried the hdmserver recovery cd - but it has not the same functionality
0
 
nobusbiljart fanAuthor Commented:
ok - it is running now, and i made the recovery cd - also working
HDM 11 running from disk C: now, i looked in c:\program files\paragon\Hard Disk Manager 11 Server but did not see fdisk.txt
0
 
noxchoGlobal Support CoordinatorCommented:
Hi nobus, did you look into C: while booting from CD or while working from installed copy?
Also to create the WinPE you do not need to install anything. WinPE as far as I got it came always in self burning ISO file packed into burning shell with .exe extension. Did you download all files sent to you by Paragon?
Once you boot to WinPE CD for HDM11 - select Full Mode there where you see the disk layout - there press on Tools - FTW - search in X: directory. X: is the RAM device to which WinPE loads usually.
0
 
nobusbiljart fanAuthor Commented:
i made the standalone CD from the installed one - it seems ok now
the downloaded cd was a rescue cd (while it DID say HDM11 Server rescue cd...)
but up to now - i simply can't find fdisk.txt somewhere  -starnge
0
 
noxchoGlobal Support CoordinatorCommented:
Yes, because it is generated in WinPE IMHO. I checked it and yes, it is generated only in WinPE environment. Linux/DOS which you have does not create this log.
0
 
nobusbiljart fanAuthor Commented:
what do you suggest me to do then ?
0
 
noxchoGlobal Support CoordinatorCommented:
Download WinPE - boot from it - select full scale mode - thus to run the engine of the tool one time and let the log create. Then use the FTW to extract it.
0
 
nobusbiljart fanAuthor Commented:
which winpe file?  there are lots, and the hdm11 winpe was not what i needed
0
 
noxchoGlobal Support CoordinatorCommented:
Wait. What files did you get with HDM11 download email? How many links were there in the mail? I have two links.
0
 
nobusbiljart fanAuthor Commented:
ok i have :
Component Paragon Hard Disk Manager 11 Server - Windows Installation Package
Component Paragon Hard Disk Manager 11 Server - WinPE based Recovery CD Image
 so you mean the second one, yes -  i'll download and try that then (maybe i was sidetracked, and downloaded  a wrong one)
0
 
nobusbiljart fanAuthor Commented:
and that is the file :  Paragon-201-SEE_WinPERCD_10.0.17.13908_000.exe
0
 
nobusbiljart fanAuthor Commented:
..which i was using the last time
0
 
noxchoGlobal Support CoordinatorCommented:
Yes, I meant this one: Component Paragon Hard Disk Manager 11 Server - WinPE based Recovery CD Image
Look attached video example. I changed the extension from .exe to .png.
Download the file and change the extension back. Double click and look the video.
winpe.png
0
 
nobusbiljart fanAuthor Commented:
tx for the video noxcho - that helps
here the file (at last) :-))
fdisk.txt
0
 
nobusbiljart fanAuthor Commented:
here the other file you need  attached -renamed to txt
fsdump-110930-0840-0-0x3f.txt
0
 
noxchoGlobal Support CoordinatorCommented:
 nobus, I am unable to download it. Interrupts after 3.4MB finished. Can you use some file sharing service or FTP for it?
0
 
nobusbiljart fanAuthor Commented:
maybe it got corrupt -i'll post it again
fsdump-110930-0840-0-0x3f.txt
0
 
nobusbiljart fanAuthor Commented:
i will close out this question - tx to Jt92677 and noxcho
JT posted first to use the disk sectors and compare them - noxcho supported me further so i could start

and for everyone : no i did not analyse it yet (not too much time) but now i know where to start at least
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.