We help IT Professionals succeed at work.

LOST C Partition - LIVE server

Hi,
we have a new Hyper-V Virtual Machine running SBS 2011 and discovered serious issues with the OS partition file system.  A chkdsk in read mode shows this:
The first NTFS boot sector is unreadable and corrupt. Reading second NTFS boot sector instead.
Scan finds several index errors.
When restarting the VM to run chkdsk in Fix mode the OS partition is empty. There is nothing to boot from. We restored a previous snapshot so the VM is running for now.
Is there a way to recover from this? Can the OS partition be repaired? This is a live server and currently in use.
 
Any help would be appreciated.

Thank you.

Host OS - Server 2008 R2
Comment
Watch Question

CERTIFIED EXPERT

Commented:
Hi,

Do you have any events related to the error in app/sys logs?

You can try to run low level repair.
Although the article is for win7 however it can be applied to server 2008

http://support.microsoft.com/kb/927392
http://www.petri.co.il/windows-recovery-environment.htm

Regards,
Navdeep [v-2nas]
IT Product Manager
CERTIFIED EXPERT
Top Expert 2009
Commented:
You can copy a second boot sector to the start of partition. This should fix it.

Author

Commented:
Thank you for the replies.

noxcho, how can I copy a second boot sector to the start of the partition? Is there a tool I can use when in Windows?
Once I restart the VM the Recovery Environment won't recognize a filesystem on the OS partition, so it won't let me switch to it to run any commands.
noxchoIT Product Manager
CERTIFIED EXPERT
Top Expert 2009

Commented:
A trial version of Paragon Drive Backup 10 (server in your case) www.drive-backup.com
Install it on machine - do not restart - start it - right click on system partition - View Edit Sectors. There you can save the last sector and restore it over the sector one.
NTFS always keeps the backup of the first boot sector at the end of partition.

Author

Commented:
I have restarted the server, of course it won't boot now. Disk Management shows the OS Partition as RAW. Drive Backup shows it as Not Formatted - see screenshot (Local disk F:).

Screenshot.pdf

Yet while it says Not Formatted, i can see the file and folder structure and browse some folders.
Any way to recover from this?
noxchoIT Product Manager
CERTIFIED EXPERT
Top Expert 2009

Commented:
Did you copy the sector?
Please revert to snapshot and run CHKDSK C: in read only mode.
Then copy and paste the chkdsk output here.
We need to find out the cause of this exactly before we try fixing it.
Also in Drive Backup 10 root directory you can find STUBACT.log file. Upload it here as well.

Author

Commented:
Here is the chkdsk output in read mode and the stubact log file:
chkdsk.pdf
stubact.log

Yes I tried to copy the last sector over the first, but that did not resolve the issue. Had to revert to the snapshot.
Here is the first, last sector plus a disk view.
First-Sector.pdf
Last-Sector.pdf
Disk-View.pdf

As you can see in the disk view the C volume shows as not formatted.

Any advice?



Thank you for your continued assistance
noxchoIT Product Manager
CERTIFIED EXPERT
Top Expert 2009

Commented:
First sector is crapped for sure. I am interesting now if you did it copy the right way. How did you replace the first sector? Would be nice if I could have a look on this process remotely.

Author

Commented:
noxcho,
thank you for your help - when trying again I was able to copy the good boot sector ove the corrupted one, run chkdsk to fix file system errors.
Partition looking good again!
noxchoIT Product Manager
CERTIFIED EXPERT
Top Expert 2009

Commented:
Glad I could help. Thanks for feedback.
Noxcho

Explore More ContentExplore courses, solutions, and other research materials related to this topic.