findpart/editpart help, please! Ran fixboot from Rec Conso..

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Here's how I got where I am:

System is a few months old HP Pavilion, with a single 200Gig SATA
drive. It came from the store with 2 partitions - a "Recovery
Partition" of about 6 Gig, and another partition of about 180Gig where
WinXP Home was installed. I upgraded WinXP Home to WinXP Pro by running
an in-place upgrade. Applied Service Pack 2. Everything seemed to work
fine.

The system became infected with numerous spyware, etc, and I had to
clean it up. I used the MS Antispyware. I booted into Safe Mode and ran
the MS Antispyware scan. The following day, my wife said it wasn't
working. I wasn't able to boot, with an error - "Windows could not
start because of an error in the software. Please report this problem
as : load needed DLLs for kernel. Please contact your support person to
report this problem.".

I booted into BartPE (built with from a SP2-slipstreamed WinXP Pro disk
amd UBCD from ubcd4win.com), and wanted to see the event logs, so I
looked for them in %systemroot%\system32\config where they are
normally. They weren't there. This seemed quite odd to me. However,
most everything else looked normal - including that my personal data
files were where I expected them to be.

Booted with my original "non-slipstreamed" Windows XP Pro CD, loading
the SATA drivers by pressing F6 during startup of the CD. I tried to do
a repair, but was not allowed. The only thing I could do was format the
partition where "C:" was, because it was labeled with "(Unknown)". I
then booted into the Recovery Console using the same CD, and ran
"fixboot", hoping to fix the partition. (Duh! I didn't know about the
48-bit LBA issues then. I suspect that the 48-bit LBA issues are why it
was labeled "(Unknown)", right?)

Afterwards, the 180Gig volume appears to be only 10Meg, and FAT12
instead of ~180Gig an NTFS. The directory listing on the drive (using
BartPE again) shows a bunch of odd characters, but no files of mine.

I tried looking at it with Partition Magic 8, but that wasn't helpful.
I haven't modified the drive since the goof with "fixboot".


Here's what I've done so far using findpart. I'm not sure where to go
from here. I've tried to delete the incorrect partition table entries
(see output below), but it appears not to be working. What am I doing
wrong? What should I do? Any help sincerely appreciated!




# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # first run of findpart # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK




# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # ran this command # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

>findpart 2 843 2 * 00 843 0 1 844 89 12 842 25841 240 63 42
Editpart, version 4.2. Copyright Svend Olaf Mikkelsen, 2005.
Disk 2 Cylinder 843
Entry 2:
--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
843 2 00 0 0 0 0 0 0 0 0 0 NB
OK





# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # reran findpart after reboot # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #


>findpart 2

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK

>


# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # ran this command # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

> findpart 2 0 3 - 00 2810 0 1 2879 239 63 0 25841 240 63 42
Editpart, version 4.2. Copyright Svend Olaf Mikkelsen, 2005.
Disk 2 Cylinder 0
Entry 3:
--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 3 00 0 0 0 0 0 0 0 0 0 NB
OK

>





# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #

# # reran findpart after reboot # #

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # #


C:\DataRecovery\findntfs_fntfs165>findpart 2

Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK

What should I do now? Please help!

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

MartyEgan <martyegan@gmail.com> wrote

> Here's how I got where I am:

> System is a few months old HP Pavilion, with a single
> 200Gig SATA drive. It came from the store with 2 partitions
> - a "Recovery Partition" of about 6 Gig, and another partition
> of about 180Gig where WinXP Home was installed.

What was the story with that service pack wise ?

> I upgraded WinXP Home to WinXP Pro by running an in-place
> upgrade. Applied Service Pack 2. Everything seemed to work fine.

> The system became infected with numerous spyware, etc, and
> I had to clean it up. I used the MS Antispyware. I booted into
> Safe Mode and ran the MS Antispyware scan. The following
> day, my wife said it wasn't working. I wasn't able to boot,

Presumably you could boot after completing the antispywhere scan ?

> with an error - "Windows could not start because of
> an error in the software. Please report this problem
> as : load needed DLLs for kernel. Please contact
> your support person to report this problem.".

> I booted into BartPE (built with from a SP2-slipstreamed WinXP Pro
> disk amd UBCD from ubcd4win.com), and wanted to see the event
> logs, so I looked for them in %systemroot%\system32\config where
> they are normally. They weren't there. This seemed quite odd to me.
> However, most everything else looked normal - including that my
> personal data files were where I expected them to be.

> Booted with my original "non-slipstreamed" Windows XP
> Pro CD, loading the SATA drivers by pressing F6 during
> startup of the CD. I tried to do a repair, but was not allowed.
> The only thing I could do was format the partition where
> "C:" was, because it was labeled with "(Unknown)".

So its likely it was corrupt by then, before you had written to it.

> I then booted into the Recovery Console using the
> same CD, and ran "fixboot", hoping to fix the partition.
> (Duh! I didn't know about the 48-bit LBA issues then.
> I suspect that the 48-bit LBA issues are why it was
> labeled "(Unknown)", right?)

Not likely, as long as you havent written to the drive without
48-bit LBA support, it shouldnt have produced that.

> Afterwards, the 180Gig volume appears to be only 10Meg, and FAT12
> instead of ~180Gig an NTFS. The directory listing on the drive (using
> BartPE again) shows a bunch of odd characters, but no files of mine.

> I tried looking at it with Partition Magic 8, but that wasn't helpful.
> I haven't modified the drive since the goof with "fixboot".

> Here's what I've done so far using findpart. I'm not sure where to
> go from here. I've tried to delete the incorrect partition table entries
> (see output below), but it appears not to be working. What am I
> doing wrong? What should I do? Any help sincerely appreciated!

I'd run the hard drive manufacturer's diagnostic
on the drive to see if the drive is just dying.

Check the SMART data with Everest too.

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On 21 Aug 2005 13:46:08 -0700, "MartyEgan" <martyegan@gmail.com>
wrote:

>C:\DataRecovery\findntfs_fntfs165>findpart 2
>
>Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
>Copyright Svend Olaf Mikkelsen, 1999-2005.
>
>OS: Windows 5.1.2600 Service Pack 2
>
>Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779
>
>--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
> 0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
> No jump 0 1 1
> 842+- 01 1 20739 10 843 0 1 844 89 12 B OK
> 0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
> 0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK
>
>------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
> 0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
> 2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188
>
>Partitions according to partition tables on second harddisk:
>
>--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
> 0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
> 0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK
>
>What should I do now? Please help!

I only read the quoted text, since I cannot fully concentrate right
now.

It seems as the fixboot program wrote a 10 MB FAT12 partition at the
location of the 184548 MB NTFS partition.

It may be possible to mostly repair the partition by copying the
backup boot sector to the boot sector, but I cannot suggest that.

It may be possible to copy the files from the 184548 MB NTFS partition
using this command:

findpart findntfs 2 843 0 1 backupboot 377954640 copy

This command should be run in an empty subdirectory in a partition
with room for the files.

--
Svend Olaf

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Sorry, I left out that I already salvaged files by using findntfs.

Now I'm just hoping to fix the partition so I can repair Windows and
not have to reinstall. Part of it is the challenge, part expediency.

So, given that my current findpart output is below. What commands do I
run to correct the partition table? The entries in the third section
of output are the correct partitions. Thanks again.

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
842+- 01 1 20739 10 843 0 1 844 89 12 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On 22 Aug 2005 17:01:02 -0700, "MartyEgan" <martyegan@gmail.com>
wrote:

>Sorry, I left out that I already salvaged files by using findntfs.
>
>Now I'm just hoping to fix the partition so I can repair Windows and
>not have to reinstall. Part of it is the challenge, part expediency.
>
>So, given that my current findpart output is below. What commands do I
>run to correct the partition table? The entries in the third section
>of output are the correct partitions. Thanks again.
>
>--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
> 0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
> No jump 0 1 1
> 842+- 01 1 20739 10 843 0 1 844 89 12 B OK
> 0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
> 0 - 07 12746160377954640184548 843 0 1 25839 239 63 BU OK
>
>------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
> 0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
> 2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188
>
>Partitions according to partition tables on second harddisk:
>
>--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
> 0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
> 0 2*07 12746160377954640184548 843 0 1 25839*239 63 NB OK

The partition table is correct.

If only the boot sector (first 512 bytes) of the 184548 MB NTFS
partition is damaged, the partition can be repaired by copying the
backup boot sector at CHS 25839/239/63 to the boot sector at CHS
843/0/1.

I assume the disk is still disk number 2 to Findpart.

To retrieve the current wrong boot sector:

findpart getsect 2 843 0 1 1 wrong.bin noheader

Then verify that the wrong.bin file contains the string "FAT12" using:

edit /64 /r wrong.bin

To retrieve the backup boot sector:

findpart getsect 2 25839 239 63 1 good.bin noheader

Then verify that the good.bin file contains the string "NTFS".


Now, if you do *not* use the force parameter, you cannot do it wrong.

set findpart=edit
findpart putsect 2 843 0 1 good.bin 25841 00000000 checkfile wrong.bin


This Findpart command will only write 1 sector (512 bytes) to a disk
with 25841 cylinders, where the current content of CHS 843/0/1 matches
the file wrong.bin.

Note that from the Findpart findings, we do not know if the partition
is internally OK, except for the boot sector.

Findpart did not report a FAT at the partition, but I cannot be
certain that more than the wrong boot sector was not written to the
partition.
--
Svend Olaf

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

Thanks! I can see that partition again!

I still have two issues with what I see in my findpart output.

In the first section of the output, what are these two entries? It
looks to me like the first line shows a partition of ~500Meg at the end
of the disk. I can't see any such partition, and the computer didn't
have one when I brought it home from the store. The second line "No
jump", I don't understand. What does that mean?

<snip from findpart output, full output below>
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B
No jump 0 1 1
</snip>



Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2005.

OS: Windows 5.1.2600 Service Pack 2

Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
No jump 0 1 1
0 - 07 12746160377954640184548 843 0 1 25839 239 63 B OK
0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK

------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188

Partitions according to partition tables on second harddisk:

--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
0 2*07 12746160377954640184548 843 0 1 25839*239 63 OK OK

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

On 23 Aug 2005 16:38:04 -0700, "MartyEgan" <martyegan@gmail.com>
wrote:

>Thanks! I can see that partition again!
>
>I still have two issues with what I see in my findpart output.
>
>In the first section of the output, what are these two entries? It
>looks to me like the first line shows a partition of ~500Meg at the end
>of the disk. I can't see any such partition, and the computer didn't
>have one when I brought it home from the store. The second line "No
>jump", I don't understand. What does that mean?
>
><snip from findpart output, full output below>
> 0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B
> No jump 0 1 1
></snip>
>
>
>
>Findpart, version 4.67 - for Windows 95/98/ME/NT/2000/XP.
>Copyright Svend Olaf Mikkelsen, 1999-2005.
>
>OS: Windows 5.1.2600 Service Pack 2
>
>Disk: 2 Cylinders: 25841 Heads: 240 Sectors: 63 MB: 190779
>
>--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
> 0 - 0B 63 12746096 6223 0 1 1 842 239 62 B OK
> No jump 0 1 1
> 0 - 07 12746160377954640184548 843 0 1 25839 239 63 B OK
> 0 - 0C 42487200 1058400 516 2810 0 1 2879 239 63 B OK
>
>------FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YY-MM-DD DataMB
> 0 1 33 12424 4 2 12424 0 0 0 04-10-21 5497
> 2810 0 33 1032 4 2 1032 0 0 0 03-02-06 188
>
>Partitions according to partition tables on second harddisk:
>
>--PCyl N ID -----Rel -----Num ---MB --Start CHS- ---End CHS-- BS CHS
> 0 1 0B 63 12746097 6223 0 1 1 842 239 63 NB OK
> 0 2*07 12746160377954640184548 843 0 1 25839*239 63 OK OK

The "No jump" indicates that the first two bytes of the boot sector is
not a jump instruction. Some operating systems then will not access
the partition, even if the data in the boot sector are OK.

There is a FAT32 partition, which may contain 188 MB of data, inside
the NTFS partition. Since the partition is not in the partition
tables, it is not a problem unless data in the FAT32 partition are
lost. Do not ask me why the partition is there, but it is.

Assuming the content of the 516 MB partition was not overwritten, you
can make a listing for your own use like this:

findpart chsdir 2 2810 0 1 files files-a.txt

If files were to be copied from the 516 MB partition, nothing of
course should be written to the NTFS partition.

The NB in the BS field is a result of the partition being one sector
smaller than according to the partition table. That is as it should
be.
--
Svend Olaf

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

I just want to say thanks for the help I received. You folks are
awesome!

Svend - I hope you make lots of money in your day job, or are
independently wealthy, because you give a LOT of free help to a LOT of
people on a VERY important subject.

Joep - I commend you and the company you work for. Instead of just
pitching your products when someone posts a request for help to Usenet,
you offer assistance in the right spirit. If I meet anyone who needs a
commercial product to do what your products do, I'll recommend you most
strongly.

Thanks to everyone else who helps in this forum!

Marty Egan

 

[Guest]

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

"MartyEgan" <martyegan@gmail.com> wrote in message news:1125516903.289224.214810@g43g2000cwa.googlegroups.com...
> I just want to say thanks for the help I received. You folks are
> awesome!
>
> Svend - I hope you make lots of money in your day job, or are
> independently wealthy, because you give a LOT of free help to a LOT of
> people on a VERY important subject.
>
> Joep - I commend you and the company you work for.

> Instead of just pitching your products when someone posts a request
> for help to Usenet,

Yup, it's almost a week ago that he last did that (pitch his products).
Meanwhile he has at least offered a whopping 0 times to help.

When he finally did, 6 days later, he greeted the OP with "You don't
have a clue what you're doing, do you?" which was obviously quite helpful.

>
> you offer assistance in the right spirit. If I meet anyone who needs a
> commercial product to do what your products do, I'll recommend you
> most strongly.
>
> Thanks to everyone else who helps in this forum!
>
> Marty Egan
>