Solved

LOST C Partition - LIVE server

Posted on 2012-03-11
10
773 Views
Last Modified: 2012-03-17
Hi,
we have a new Hyper-V Virtual Machine running SBS 2011 and discovered serious issues with the OS partition file system.  A chkdsk in read mode shows this:
The first NTFS boot sector is unreadable and corrupt. Reading second NTFS boot sector instead.
Scan finds several index errors.
When restarting the VM to run chkdsk in Fix mode the OS partition is empty. There is nothing to boot from. We restored a previous snapshot so the VM is running for now.
Is there a way to recover from this? Can the OS partition be repaired? This is a live server and currently in use.
 
Any help would be appreciated.

Thank you.

Host OS - Server 2008 R2
0
Comment
Question by:comtechnate
  • 5
  • 4
10 Comments
 
LVL 12

Expert Comment

by:Navdeep
Comment Utility
Hi,

Do you have any events related to the error in app/sys logs?

You can try to run low level repair.
Although the article is for win7 however it can be applied to server 2008

http://support.microsoft.com/kb/927392
http://www.petri.co.il/windows-recovery-environment.htm

Regards,
Navdeep [v-2nas]
0
 
LVL 46

Accepted Solution

by:
noxcho earned 400 total points
Comment Utility
You can copy a second boot sector to the start of partition. This should fix it.
0
 

Author Comment

by:comtechnate
Comment Utility
Thank you for the replies.

noxcho, how can I copy a second boot sector to the start of the partition? Is there a tool I can use when in Windows?
Once I restart the VM the Recovery Environment won't recognize a filesystem on the OS partition, so it won't let me switch to it to run any commands.
0
 
LVL 46

Expert Comment

by:noxcho
Comment Utility
A trial version of Paragon Drive Backup 10 (server in your case) www.drive-backup.com
Install it on machine - do not restart - start it - right click on system partition - View Edit Sectors. There you can save the last sector and restore it over the sector one.
NTFS always keeps the backup of the first boot sector at the end of partition.
0
 

Author Comment

by:comtechnate
Comment Utility
I have restarted the server, of course it won't boot now. Disk Management shows the OS Partition as RAW. Drive Backup shows it as Not Formatted - see screenshot (Local disk F:).

Screenshot.pdf

Yet while it says Not Formatted, i can see the file and folder structure and browse some folders.
Any way to recover from this?
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 46

Expert Comment

by:noxcho
Comment Utility
Did you copy the sector?
Please revert to snapshot and run CHKDSK C: in read only mode.
Then copy and paste the chkdsk output here.
We need to find out the cause of this exactly before we try fixing it.
Also in Drive Backup 10 root directory you can find STUBACT.log file. Upload it here as well.
0
 

Author Comment

by:comtechnate
Comment Utility
Here is the chkdsk output in read mode and the stubact log file:
chkdsk.pdf
stubact.log

Yes I tried to copy the last sector over the first, but that did not resolve the issue. Had to revert to the snapshot.
Here is the first, last sector plus a disk view.
First-Sector.pdf
Last-Sector.pdf
Disk-View.pdf

As you can see in the disk view the C volume shows as not formatted.

Any advice?



Thank you for your continued assistance
0
 
LVL 46

Expert Comment

by:noxcho
Comment Utility
First sector is crapped for sure. I am interesting now if you did it copy the right way. How did you replace the first sector? Would be nice if I could have a look on this process remotely.
0
 

Author Comment

by:comtechnate
Comment Utility
noxcho,
thank you for your help - when trying again I was able to copy the good boot sector ove the corrupted one, run chkdsk to fix file system errors.
Partition looking good again!
0
 
LVL 46

Expert Comment

by:noxcho
Comment Utility
Glad I could help. Thanks for feedback.
Noxcho
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now