repair disk file system

nobus
nobus used Ask the Experts™
on
hello experts
i am starting a self-educational project on a disk from an XP SP3 laptop, that starts to boot - then gives a blue screen, referring to Ram (which is  tested ok)
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
it does the same when you try to repair the file system
Disk diagnostics are OK, so i suppose it is an error in the file system
i KNOW i can do a fresh install -so don' tell me that or not loose my time on it, yes?

I was thinking of using Winhex for reading the disk sectors, but since i'm totally unfamiliar with this, i thought that maybe the EE-experts could guide me through the first steps, and provide some DO'S  and DONT's

you may answer with some links,  if they point"understandable" sites, so i can start this

i appreciate all help and answers
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2013

Commented:
Have you already tried repairing the file system using CHKDSK /f run from the Recovery Console (either already installed as a boot option or by booting from an XP CD) ?
Top Expert 2013

Author

Commented:
yes masqueraid - but that is NOT the goal here; i posted clearly : to find the cause of the blue screen and  educate myself to be able to read and use the NTFS disk info to correct problems

Commented:
Upload the minidump file.


Ded9
CompTIA Cloud+

The CompTIA Cloud+ Basic training course will teach you about cloud concepts and models, data storage, networking, and network infrastructure.

Top Expert 2013

Author

Commented:
@ ded : NO that is not my question
_

Commented:
Are these closer?

XP file structure (5 pages)
http://www.informit.com/articles/article.aspx?p=101731&rll=1

hard disk structure
http://www.ntfs.com/hard-disk-basics.htm
_

Commented:
DONT's
- don't do it!. It is soooooo easy to mess up.

But since this is the only way to learn...

DO'S
- make/use a copy/clone whenever possible. It's a lot easier to wipe and reclone if you make a booboo, then to fix a bad guess or bad edit on the only copy.
- understand the MBR, FAT table, and how to get the "next sector" link from a file. Without understanding these, you won't get far.
Top Expert 2013

Author

Commented:
coral, i'll look up the links - did you ever do it?
about Do's and DONT's : there is nothing to be kept, i can wipe the laptop clean

i am only looking for a bit of advice of someone who did this, to get started the right way
if you prefer other software for doing this - post them plse !
noxchoIT Product Manager
Top Expert 2009

Commented:
Hi nobus,

if the system starts booting and then goes to BSOD then there are 50/50 chances that problem could be caused by FS problems. We still need to narrow the problem to FS bottle neck by looking into BSOD exceptions (or minidump if you can get it).
As for the file system issues, we can look into the boot sector of the drive which is in most cases the culprit of non-bootable system although in such cases the startup process would not show any MS signs.
So let's start from BSOD. Which exception do you get?
Top Expert 2013

Author

Commented:
thanks noxcho for joining the team
i don't want to examine the bsod, just start with the boot sector, as i said i don't want to try to repair it with usual approaches, just self educate myself a bit by examining the files sytem data
noxchoIT Product Manager
Top Expert 2009

Commented:
ok, I think you own the same tool like I do: paragon drive backup 10 or hard disk manager 11 from the same company.
In both installed or boot CD based version of this tool you can right click on system partition and select there View\Edit sectors. And then save number of sectors to bin file. Could you please save the first 5 sectors of the partition and share them with me? I will look and if anything is wrong there explain and point you to it.

Commented:
Have you hit the F8 key numerous times during POST (Power up) and then selected the "Last Known Good Configuration" option? or have you booted into SAFE mode (after the first last known configuration attempt) and will it complete the boot in Safe Mode ??

In Safe Mode, you should be able to Start/Run/ MSCONFIG and then hit the "Launch System Restore" button and select a restoration point on a date you believe things were working.

Your blue screen problem appears to be a missing or corrupted setting.

Hope this helps.

Jeff
_

Commented:
>> ... other software for doing this

It's been a few years, but I mostly used Disk Investigator and one of the disk editors on an older version of UBCD. But Winhex is suppose to be pretty good:

http://www.softpedia.com/get/System/Back-Up-and-Recovery/Disk-Investigator.shtml
Top Expert 2013

Author

Commented:
noxcho : good idea - i could save the sectors to a file, but where is it saved?  i could not find it (sorry, never tried this)
@ Jeff : that is NOT what i want at all - read the question plse
@coral47 : thanks for the idea

Commented:
nobus

I read the question and it seemed that your system produced a blue screen on boot.

You can run these inspector programs in Windows, maybe in DOS mode as well, but it seemed to me that you were describing two problems, one to fix the blue screen, and another to teach yourself about NTFS file systems with some software.

Botton line: I did read the question, and it could have been interpreted as a broken WIndows system AND a learning about NTFS question combined into one question.

Will these disk analysis programs allow you to figure out what driver is missing that is causing the blue screen?  I doubt it.

Have fun.

noxchoIT Product Manager
Top Expert 2009

Commented:
Nobus, did you find View/Edit Sectors? It is available when you get to the full mode of the product (no difference which one you use but not the free one). Right click on partition - there in context menu you can find View/Edit sectors. Then in the hex view window at the right upper corner you can see Save and Load options.
Top Expert 2013

Author

Commented:
yes i found view/edit, and i could save the 5 sectors as said - but was UNABLE to find where the ****file is..
so WHERE is it, so i can copy it ? ? on the c: drive, or must i connect an USB stick?
Top Expert 2013

Author

Commented:
@JT : with all respect, but i posted :
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
noxchoIT Product Manager
Top Expert 2009

Commented:
Ah, that is your problem. But you can point it to the folder where you can save it to. Look the attached screen shot.
Backup-sectors.png
Top Expert 2013

Author

Commented:
ok thanks - i must have overlooked it
(i'm starting to be a big overlooker..)
Top Expert 2013

Author

Commented:
hello, here the 5 sectors (had to postpone this a couple of days)
i had to rename it to txt (bin not allowed)
dump-from-sector-0--5-sectors-.txt
Top Expert 2013

Author

Commented:
hello noxcho ??
Commented:
You wrote:
@JT : with all respect, but i posted :
Goal : to find the cause of the blue screen - and note that i ran windbg, but since it refers to ram it does not help
          educate myself to be able to read and use the NTFS disk info to correct problems
--------------------

Are you having any luck figuring out why Windows produces a blue screen ??

Perhaps you'll need to copy the disk sectors where you think there is a problem to another disk, then fix the system so it works correctly, then compare the fixed sectors with the problem sectors to see if a difference is related to the blue screen.

It still seems quite a challenge to diagnose a boot problem simply by investigating the contents of a disk that won't boot correctly, but I'm following this to find out how you do it, or even if it's possible.

What you may need is a hardware assisted debugger that lets you step through system calls, etc.

See: http://msdn.microsoft.com/en-us/windows/hardware/gg463016

Jeff
 
Top Expert 2013

Author

Commented:
i'm still waiting for noxcho's response
noxchoIT Product Manager
Top Expert 2009

Commented:
Hi nobus, sorry for my silence. I am currently in Spain enjoying my vacations time. Not much I can do from iPad device. On Sunday I'll get to my PC and will post my update.
Top Expert 2013

Author

Commented:
ok - tx for the info noxcho  -take your time, and enjoy!
Top Expert 2013

Author

Commented:
i saw you are back noxcho - waiting for your answer
IT Product Manager
Top Expert 2009
Commented:
Hi nobus, I need you to save and upload also MBR (Sector 0) of the HDD where you got the 5 sectors of partition from. The steps are almost the same. Right click on HDD - view/edit sectors etc.
Also in the root folder of the paragon program pls find fdisk.txt file and upload it here.
The boot sector of partition looks ok thus I am going to dig a bit deeper into this issue.
Top Expert 2013

Author

Commented:
here sector 0 attached
could not find any file in X:  as asked (in the root folder of the paragon program pls find fdisk.txt file )
dump-from-sector-0--1-sectors-.txt
dump-from-sector-0--5-sectors-.txt
noxchoIT Product Manager
Top Expert 2009

Commented:
nobus, I think you attached wrong file instead of fdisk.txt (it is in C:\Program Files\Paragon\Drive Backup or any other tool by paragon\Program directory).
Top Expert 2013

Author

Commented:
i run it from cd, not from disk - does that change anything?in c\program files -there is of course no mention of paragon
noxchoIT Product Manager
Top Expert 2009

Commented:
From CD (if you are referring to WinPE) you have also a chance to get the log file. Simply run once the program thus to see the disk layout. Then start File Transfer Wizard (in Tools - FTW) and browse for X: drive. There find the Paragon directory and Program folder. In this folder the file should be created.
Top Expert 2013

Author

Commented:
i found the paragon directory; but not the file
FYI i run DB9 server edition from cd
i start it, click on disk editor to view sectors, then use FTW to scroll to the directory
or did i miss a step ?
noxchoIT Product Manager
Top Expert 2009

Commented:
Hmm I think the problem is that you use version 9. I am using version 10. Get a copy of latest version it is still free for you.
Top Expert 2013

Author

Commented:
ok -i'll download server version 11
or do you want me to use another?
noxchoIT Product Manager
Top Expert 2009
Commented:
I prefer HDM11Server. Use it.
Top Expert 2013

Author

Commented:
ok -i'll download the trial
noxchoIT Product Manager
Top Expert 2009

Commented:
Hmm trial has no WinPE. You can get easily full version as well. All EE experts can get it as far as I know.
Top Expert 2013

Author

Commented:
>>  All EE experts can get it as far as I know.  <<  that's how i got it; good you remember me of it; will do so
Top Expert 2013

Author

Commented:
ok - i downloaded the hdm 11 server and installed it
but when i select the file transfer wizard, it locks up ...
note that it is on a clean disk, with a fresh W7 install + only Office and drivers
i tried the hdmserver recovery cd - but it has not the same functionality
Top Expert 2013

Author

Commented:
ok - it is running now, and i made the recovery cd - also working
HDM 11 running from disk C: now, i looked in c:\program files\paragon\Hard Disk Manager 11 Server but did not see fdisk.txt
noxchoIT Product Manager
Top Expert 2009

Commented:
Hi nobus, did you look into C: while booting from CD or while working from installed copy?
Also to create the WinPE you do not need to install anything. WinPE as far as I got it came always in self burning ISO file packed into burning shell with .exe extension. Did you download all files sent to you by Paragon?
Once you boot to WinPE CD for HDM11 - select Full Mode there where you see the disk layout - there press on Tools - FTW - search in X: directory. X: is the RAM device to which WinPE loads usually.
Top Expert 2013

Author

Commented:
i made the standalone CD from the installed one - it seems ok now
the downloaded cd was a rescue cd (while it DID say HDM11 Server rescue cd...)
but up to now - i simply can't find fdisk.txt somewhere  -starnge
noxchoIT Product Manager
Top Expert 2009

Commented:
Yes, because it is generated in WinPE IMHO. I checked it and yes, it is generated only in WinPE environment. Linux/DOS which you have does not create this log.
Top Expert 2013

Author

Commented:
what do you suggest me to do then ?
noxchoIT Product Manager
Top Expert 2009

Commented:
Download WinPE - boot from it - select full scale mode - thus to run the engine of the tool one time and let the log create. Then use the FTW to extract it.
Top Expert 2013

Author

Commented:
which winpe file?  there are lots, and the hdm11 winpe was not what i needed
noxchoIT Product Manager
Top Expert 2009

Commented:
Wait. What files did you get with HDM11 download email? How many links were there in the mail? I have two links.
Top Expert 2013

Author

Commented:
ok i have :
Component Paragon Hard Disk Manager 11 Server - Windows Installation Package
Component Paragon Hard Disk Manager 11 Server - WinPE based Recovery CD Image
 so you mean the second one, yes -  i'll download and try that then (maybe i was sidetracked, and downloaded  a wrong one)
Top Expert 2013

Author

Commented:
and that is the file :  Paragon-201-SEE_WinPERCD_10.0.17.13908_000.exe
Top Expert 2013

Author

Commented:
..which i was using the last time
noxchoIT Product Manager
Top Expert 2009
Commented:
Yes, I meant this one: Component Paragon Hard Disk Manager 11 Server - WinPE based Recovery CD Image
Look attached video example. I changed the extension from .exe to .png.
Download the file and change the extension back. Double click and look the video.
winpe.png
Top Expert 2013

Author

Commented:
tx for the video noxcho - that helps
here the file (at last) :-))
fdisk.txt
Top Expert 2013

Author

Commented:
here the other file you need  attached -renamed to txt
fsdump-110930-0840-0-0x3f.txt
noxchoIT Product Manager
Top Expert 2009

Commented:
 nobus, I am unable to download it. Interrupts after 3.4MB finished. Can you use some file sharing service or FTP for it?
Top Expert 2013

Author

Commented:
maybe it got corrupt -i'll post it again
fsdump-110930-0840-0-0x3f.txt
Top Expert 2013

Author

Commented:
i will close out this question - tx to Jt92677 and noxcho
JT posted first to use the disk sectors and compare them - noxcho supported me further so i could start

and for everyone : no i did not analyse it yet (not too much time) but now i know where to start at least

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial