Deleted partition with MBR in! Thinkpad T410 won't boot

tobzzz
tobzzz used Ask the Experts™
on
Hi Experts,

Following a virus infecting a hidden partition (4th, 1.33mb partition) on my Lenovo Thinkpad T410 I followed someone elses successful process of deleting the seemingly unused partition (in virtual disk management under windows it said 100% free space). It seems that partition contained the MBR master boot record, so after removal the laptop no longer boots at all!! Aghhh. There is a Windows7_OS (C:) partition unchanged and intact, also a Lenovo (D:) partition unchanged and intact and one other partition that was called SYSTEM something, also OK but no drive letter assigned.

Is there:

1). A way to rebuild/restore the MBR so it can work again?
2). A way to boot into it some other way temporarily so I can continue working until a solution is found? Some kind of boot disc that does the same thing as the intel boot device that it should be using?

The machine boots from boot CDs (I tried with Windows7 install DVD, but all i can do is reinstall, there's no repair feature. I don't have recovery discs, just the recovery partition, which I cannot get to without the MBR).

- Windows install screenshot attached so you can see drives are in tact.
- Boot screenshot 1 and 2 so you can see what's currently happening.

Please only confident answers not guess work, it's an urgent problem that needs confident, accurate answers - thanks so much experts!

/ Tobzzz
win-install-view.JPG
boot-shot-1.JPG
boot-shot-2.JPG
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Bartender_1Microsoft Network Administrator

Commented:
Please see here about recovering a boot sector in Windows 7:

http://support.microsoft.com/kb/927392

Hope this helps!

:o)

Bartender_1

Author

Commented:
Unfortunately i cannot get into recovery console to do that! Theres no repair option on my install disc and I don't know of another way.

Note to all: the screenshot i posted of Win7 wasn't of Win7 - in error it was the shot of just before I STUPIDLY deleted the 4th partition!
Bartender_1Microsoft Network Administrator

Commented:
Can you use your installation disk to create a recovery disk following these instructions?:

http://forums.techarena.in/guides-tutorials/1114725.htm

Bartender_1
Acronis in Gartner 2019 MQ for datacenter backup

It is an honor to be featured in Gartner 2019 Magic Quadrant for Datacenter Backup and Recovery Solutions. Gartner’s MQ sets a high standard and earning a place on their grid is a great affirmation that Acronis is delivering on our mission to protect all data, apps, and systems.

Top Expert 2013

Commented:
for windows 7 repair  see here how to do it :  http://www.sevenforums.com/tutorials/681-startup-repair.html
noxchoIT Product Manager
Top Expert 2009

Commented:
Actually you did not delete MBR and you could not delete it as it is located in sector 0 of HDD. To delete MBR you need to fix this sector with zeros.
What you did is delete partition that seemingly contained your BootMGR and Boot folder.
In Parted Magic CD that you are using on first screen shot - are you able to browse these partitions? If yes then check this System partition and see if you have there BootMGR file and Boot folder.
As soon as you provide the answer to this question I will help you to repair your system properly.

Author

Commented:
Hi Noxcho

I am using Ophcrack boot CD, I used it in the screen shot to delete the highlighted partition. I don't really know how the software works (hence making such a huge error!). Do I need a Parted Magic CD or can I try to browse these partitions using Ophcrack? When you say browse system partition, do you mean the partition labelled SYSTEM_DRV? What would a BootMGR file look like typically, would it be labelled as such?

Many thanks!

Author

Commented:
Ah OK, yes I found a way to browse and found those files/folders. See photo attached.

I'm starting to feel better already - thanks! What now?
ophcrack-boot.JPG
noxchoIT Product Manager
Top Expert 2009

Commented:
Ok, you need now Boot Corrector tools from Paragon Rescue Kit 11 Free CD: http://www.paragon-software.com/home/rk-express/download.html
Download it and execute - it will let you burn CD or USB.
Then boot from this media - select on the first screen - at the bottom find Find OS on local HDD. Does it find anything? If yes then try to boot from found OS. Does it boot?
If yes we go to next step:
Boot again from Rescue Kit - Normal Mode - Boot Corrector - Change Partition Parameters.
On the next screen if you click on partition which is SYSTEM_DRV, does the key active/inactive change to Set Inactive? This will let us check if this System_Drv partition is active. It must be active for successful boot.
If is active then one step back and select Find Windows Installations to correct. There Correct Partition Boot Record. Correct it.
Then again to the start screen of Boot Corrector - Correct Boot Parameters - Correct BCD on selected drive - apply.
Try to boot into Windows after that. Does it boot?

Author

Commented:
So far so good! I had to go out to find somewhere to burn the CD, thinkpad wouldnt boot from USB for whatever reason, I checked all bios and boot order putting USB first.

Anyway, made CD, brought it back and i'm up to here:
"Boot again from Rescue Kit - Normal Mode"

I just booted from OS and got into Windows. I'm VERY happy to see all my files and set up as previously!
noxchoIT Product Manager
Top Expert 2009

Commented:
So if you use Find OS on HDD - it allows you booting from that. Correct?

Author

Commented:
Yes, I'm in Windows now, backing up databases and outlook befoore I move to your next step :)
noxchoIT Product Manager
Top Expert 2009

Commented:
:) Ok. Let me know if you have questions.

Author

Commented:
Hi - many thanks. I attach a screen shot of next step, whichever drive I hightlight all the options undernearth seem to be greyed-out/disabled? What does this mean, what is the next step? Thank again...
rescue-kit-partitions.JPG

Author

Commented:
Could I go into Windows virtual disk manager to see if SYSTEM_DRV drive is active if this way doesn't show it? Thanks
noxchoIT Product Manager
Top Expert 2009

Commented:
Interesting. On my machine it is active and I can change the active flag.
In Windows Disk Management it will show in any case that system_drv is active because Paragon CD forced it to use this CD.
Let's see if we can use trial version of Backup & Recovery 12 Home from Paragon www.drive-backup.com
Download it - install and start it. Change to Full Scale mode and there tools - Recovery media builder. Create the CD and boot machine from it. Select Normal mode - and follow my previous instructions.

Author

Commented:
I can only see trial/demo of version 11 here:
http://www.paragon-software.com/home/brh/
Will that work? Perhaps Ophcrack I was using previously would tell me if the drive is active?

Thanks

Author

Commented:
By the way, for whatever reason, when I was in Windows and in My Computer, I saw the SYSTEM_DRV was showing as a drive, which is never previously did, it was just hidden away.

Author

Commented:
Would the 'Undelete Partition' option in Rescue Kit 11 not be worth using? I know I would probably have the virus back but presumably I'd have the boot back too?
noxchoIT Product Manager
Top Expert 2009

Commented:
Yes, B&R11 Home trial will work. You can always undelete this partition but was it your aim originally?
Make the CD from B&R11 and go to it.

Author

Commented:
OK success with B&R11... screen shot attached, buttons no longer greyed over. I'm not 100% sure what I should do now, do you want me to click 'Set active' with SYSTEM_DRV highlighted? Please advise.

Re undeleting the partition, i'm very happy the virus has gone (why I removed it) and don't want it back, so I'm sticking with this as you advise. I'm at your command! ;-)

Thanks so much once again.
boot-corrector.JPG
IT Product Manager
Top Expert 2009
Commented:
Yes, set it active. Then try do the following:
Normal Mode - Boot Corrector - Change Partition Parameters.
On the next screen if you click on partition which is SYSTEM_DRV, does the key active/inactive change to Set Inactive? This will let us check if this System_Drv partition is active. It must be active for successful boot.
If is active then one step back and select Find Windows Installations to correct. There Correct Partition Boot Record. Correct it.
Then again to the start screen of Boot Corrector - Correct Boot Parameters - Correct BCD on selected drive - apply.
Try to boot into Windows after that. Does it boot?

Author

Commented:
It worked perfectly, I followed your steps and restarted, it booted into Windows immediately.

I can't tell you how grateful I am, It's such a relief to go back to exactly where I was with my work - thank you so much.

Is there anything else I need do now, to clean up files or anything or that sort?
noxchoIT Product Manager
Top Expert 2009

Commented:
No need to do anything else. But I would start using backup software and taking backups. So if you get virus next time - simply restore from backup and virus is gone.

Author

Commented:
Will do. I assume I can use B&R11 to take a carbon copy of my C:\ to an external drive. I'll look into it or other ways if not. All work is kept externally and cautiously backed up already, just my O/S and software that isn't.

Many thanks once again.

Author

Commented:
Oh, I just noticed that in Windows and My Computer, I can see SYSTEM_DRV as a mounted drive, (F: drive). Should this be hidden?
noxchoIT Product Manager
Top Expert 2009

Commented:
Nope. Leave it as is. It does not harm your machine or way you work with it.
When you take backup you need to take backup of F: and C: both. You remember that your F: drive has boot data on it? =)

Author

Commented:
Good point :-)

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial