Jump to content











Photo
- - - - -

disk read error, how to restore MBR and BCD (if this is it)

crc mbr bcd windows 7

  • Please log in to reply
37 replies to this topic

#26 matrix.rebooted

matrix.rebooted

    Newbie

  • Members
  • 26 posts
  •  
    France

Posted 07 September 2020 - 12:22 PM

well,

 

Have a look with TinyHexer and Load 16 sectors of the PBR of your Drives E: and F:

 

I guess it is 0x0f from 0 but in any case it is a CRC read error

 

 

 

To try forcing the write of a single sector the best tool would be grub4dos dd command

grub4dos is on my multiboot usb, as standalone too; also have dd for windows

 

so:

WD life guard:

despite the first message, when trying to repair it then says
"unaibale to repair the drive"

bootsect:

2nd, hard drive is 7Home! no bootsect, tried from the dvd and a local copy, with /force too, but still same error message:
"could not open the volume root directory \\?\volume{...} no bootcode updated"

another side note:

I thought I succeeded my partitions scheme as I mentioned before because when booting under 7pro it was indeed the first, primary, active and C: partition (despite not the case if booting with vista or 7home, seems scheme depends on booted system). Here when booting with windows dvd, I just observed partitions were 'mounted' again differently: C: was system reserved (of 7home, drv0), D vista (drv1), E 7home(drv0), F 7pro(drv1), G hp recovery(drv1), not a big deal but what is actually on the drive?! Indeed Schrödinger must be close, partition's positions depend on the observer...



 


Edited by matrix.rebooted, 07 September 2020 - 12:36 PM.


#27 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 07 September 2020 - 01:41 PM

Definitely partition order (or more exactly drive letter assignment to volumes) depends on the OS booted (on DOS/Windows), this is perfectly normal and is not at all connected with the issue at hand.

 

In a nutshell every time a Windows NT system is booted checks Disk Signature and the volume offset against the HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices Registry key and (if the Disk Signature+Volume offset is not found) it assigns a new one (according to a set of rules) that normally remains "sticky" until tjere are changes in the disks or volume connected.

 

For the C: driveletter (that is the first driveletter assigned) and for all the other ones on a disk that is the only disk connected at the time of installing/booting this setting is very "static" a it is the boot (and in your case of the second disk also the system volume (and though it can be changed it is not ever automatically changed). 

 

So the behaviour you describe is normal and perfectly reasonable/repeateable, etc. since it is unrelated it isn't worth the (lengthy) detailed explanation of how it works.

 

The dd for windows is pretty much unuseful (as it relies in the same understructure of Tiny Hexer, HDHacker, etc. i.e. the Window HAL and disk driver). 

 

If you want to try the dd in grub4dos you need first to create an empty (filled with 00's) file, 512 bytes in size OR find a sector that is surely already all 00's to use as source.

 

Good candidates (sectors that are already all 00's) are sectors LBA 1-62 of the same disk.

I.e. boot to grub4dos, press "c" to get to command line. then:
1) make sure that you know which disk it is, i.e. run

geometry (hd0)

geometry (hd1)

2) let's say that the disk is (hd1), you should be able to recognize it by the number and size/type of partition,

3) make SURE that the chosen source sector is actually 00's, i.e.

cat --hex (hd1)1+1

cat --hex (hd1)2+1

etc. and confirm visually that it is all 00's

 

4) let's say that (hd1)1+1 is all 00's, now you have to dd it to sectors 75 and 146785914, i.e.

dd if=(hd1)1+1 of=(hd1)75+1 bs=512 count=1

dd if=(hd1)1+1 of=(hd1)146785914+1 bs=512 count=1

 

Will it work?

 

Most probably not.

 

The error is on the disk and you cannot avoid it.

 

Now, "bad" sectors may be either "bad" or "weak", while actually "bad" sectors are normally NOT recoverable, "weak" ones can in some cases be restored by overwriting them several times or "exercising" them (there are tools capable of this).

 

But this is not a case of a "normally bad" sector (and not that of a "weak" one) since even the WDC tool cannot fix/exclude it (by re-mapping it in the internal G-list).

Though there may be (or there are) tools/methods capable of manually modify the G-list they are complex, error prone, and definitely outside the use of a non-professional (it is simply not worth it in this case). 

 

The only sensible thing to do in this case would be to image the disk, restore the image to a brand new disk and throw the disk away.

 

BUT since you seem like having nothing to loose, there i still the possibility of slightly resizing shrinking the two volumes as to move the "bad" sectors away from the $Boot area.

BUT, BUT, due also to the "queer" positioning of other filesystem mandatory files on those two filesystems this is easier said than done, particularly it would be (relatively) easier for the first volume and (relatively) harder for the second one (because the $MFTmirr is in the way).

 

If you are game for this, I would gladly try and assist you.

 

:duff:

Wonko



#28 wimb

wimb

    Platinum Member

  • Developer
  • 3756 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 07 September 2020 - 02:11 PM

It remains strange that two partitions (drives E: and F:) of the disk (nr 1)  become RAW at the same time due to uninstall of drivers  :w00t:

 

It means most likely that it is not simply a bad sector ....

 

I think when you would format the two drives E: and F: of the disk then they can be used again .... :rolleyes:



#29 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 07 September 2020 - 02:51 PM

It remains strange that two partitions (drives E: and F:) of the disk (nr 1)  become RAW at the same time due to uninstall of drivers  :w00t:

 

It means most likely that it is not simply a bad sector ....

 

I think when you would format the two drives E: and F: of the disk then they can be used again .... :rolleyes:

No. no, NO.

 

If the WDC tool cannot "fix" it then format won't.

 

If the WDC tool did not find any error, then the format (or simply writing that sector to 00's with Tiny Hexer, etc.) would work.

 

The error is a CRC error, it is at a lower level than what can be normally accessed/changed in Windows.

 

Presumably (but not necessarily) the WDC tool has "better" way to access it than any other tool, and surely "better" than anything that goes through the HAL and driver.

 

:duff:

Wonko



#30 wimb

wimb

    Platinum Member

  • Developer
  • 3756 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 07 September 2020 - 03:04 PM

No. no, NO.

 

If the WDC tool cannot "fix" it then format won't.

 

If the WDC tool did not find any error, then the format (or simply writing that sector to 00's with Tiny Hexer, etc.) would work.

 

The error is a CRC error, it is at a lower level than what can be normally accessed/changed in Windows.

 

Presumably (but not necessarily) the WDC tool has "better" way to access it than any other tool, and surely "better" than anything that goes through the HAL and driver.

 

:duff:

Wonko

 

OK, but why would that happen on two drives (partitions) of the disk at the same time ?

 

It seems a setting somewhere that also can be undone somehow ....

 

 

@matrix.rebooted

 

[attachment=17350:gparted_overview.png]

 

In gparted I see NTFS drives .... that may be can be formatted there as well ....

 

And how exactly did you have access to files ? Show picture of FileList ....

 

 

Drive is not dead and I can access files! (Plus, HDTune find the drive is healthy)


#31 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 07 September 2020 - 04:18 PM

I already said how it is extremely improbable.

 

Yet all the evidence till now points to a bad sector (CRC code mismatching).

 

If you take your time reviewing the DMDE screenshots matrix.rebooted posted earlier you will see how apparently the filesystem is essentially sound.

 

Anyway in the meantime I devised a (clever? :unsure: ) procedure to (partially and only intended as a temporary measure) workaround the RAW issue (if it works).

 

Basically the 16 sector size of the $Boot is not carved in stone (it is only carved ;) in the $MFT and in the $Bitmap).

 

So it is possible to reduce its size :w00t: , this should work for having the volume accessible (but not necessarily, even if it work for that, to have it bootable) because, improbable as this might be, both the bad sectors are past the eighth sector of the $Boot file.

 

This is actually an attempt IMHO worth it.

 

@matrix.rebooted

Detailed (hopefully) instructions (if there is something that is unclear or if you have any doubt ASK BEFORE doing something you may regret):

 

 

Run DMDE open the Physicaldrive and the volume (first volume).

Click on the left pane on $Metadata

On the right pane, right click on $Boot and select "Open $MFT File"
In the lower pane you will see (for File #7)
#0
#2
#3
#x <- this may be 1 or any other number starting from 4


Click on the [+] sign to open
#0
No changes

#2
select the line "allocated"
Press CTRL+E (this will change to Edit mode) the cursor will appear
Press delete 4 times to delete the current 8192
Type 4096
Use the down arrow to get to the line below
Repeat changing 8192 to 4096

#3
No changes

#x $DATA

Start vcn: 0 <- leave as is
end vcn: 1 change to 0

Change as before:
allocated: 8192 -> 4096
size: 8192 -> 4096
initializ.: 8192 -> 4096

then, below, after 0 run 11h change:
len: 2 ->1


In the Menu:
Drive-> Apply Changes (or press CTRL+W)
Confirm writing directly to disk.

Press again CTRL+E to exit Edit mode.

Exit DMDE.

Reboot.

Run chkdsk on the (right) volume, hopefully it should be not RAW anymore.
The chkdsk should say something about errors in the Bitmap and about needing to be run again with the /F parameter.
Do so (chkdsk <driveletter:> /F).
Then run again chkdsk <driveletter:> without parameters.

 

 

:duff:

Wonko



#32 wimb

wimb

    Platinum Member

  • Developer
  • 3756 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 07 September 2020 - 04:57 PM

The last two bytes of each sector  of MBR and first sector of PBR is the Signature ID and should be 55 AA with hex value 0xAA55 

but in case of LBA 75 the sector Signature ID indicates invalid sector

 

EDIT: wrong conclusion removed

somehow gparted does not have a problem with this invalid sector.

I should try to format in gparted and then return to Windows to see what has happened

 

[attachment=17351:dmde_lba_75.PNG]



#33 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 07 September 2020 - 05:10 PM

The last two bytes each of sector should be 55 AA value 0xAA55  but in case of LBA 75 the sector Signature ID is wrong

 

somehow gparted does not have a problem with this invalid sector.

I should try to format in gparted and then return to Windows to see what has happened

 

attachicon.gifdmde_lba_75.PNG

No, no, NO. NO!

 

Check any other NTFS $Boot.

ONLY the first sector has the Magic Bytes.

From 2nd to 5th sector the last two bytes are "normal" code.

From 6th to 16th sector the last two bytes are 00's.

From 7th to 16th sector the WHOLE sector is 00's.

 

What DMDE (cleverly) does is that SINCE THERE IS A CRC ERROR, it marks (virtually) the sector that cannot be read as BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD BAD ...

 

the 2044 represents the space and the D of the above (reversed).

 

It doesn't really exist, it is virtual, because the sector CANNOT BE READ.

 

The  BAD BAD BAD or 0x20444142 (reversed) is all over the sector in that image (which is the template for the bootsector - first sector of the $Boot - ONLY).

0x20 Space
0x41 A

0x42 B

0x44 D

 

:duff:

Wonko



#34 wimb

wimb

    Platinum Member

  • Developer
  • 3756 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 07 September 2020 - 05:19 PM

OK, Thanks for explaining .... :blush:

 

Boot Signature ID is only for MBR and first sector of PBR



#35 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 07 September 2020 - 05:43 PM

OK, Thanks for explaining .... :blush:

 

Boot Signature ID is only for MBR and first sector of PBR

You won't get away with just this correction:

 

 

The last two bytes of each sector  of MBR and first sector of PBR is the Signature ID and should be 55 AA with hex value 0xAA55 

 

This:

but in case of LBA 75 the sector Signature ID indicates invalid sector

 

somehow gparted does not have a problem with this invalid sector.

I should try to format in gparted and then return to Windows to see what has happened

 

remains wrong.

 

gparted (nor any other tool) will likely have any problem if the last two bytes of the 9th or 12th sector (or any sector past the 5th) of the $Boot is not 55AA (or not 0000, or any other value or not any other value) simply because these area is NOT used at all, but it must be readable (and writable in case of attempting to format).

 

The issue here is that accessing that sector provokes a CRC error, so the values in that sector are not "invalid" they simply do not exist or - as you prefer - they are undefined/undetermined, you cannot replicate the issue on a working a hard disk/readable sector.

 

:duff:

Wonko



#36 wimb

wimb

    Platinum Member

  • Developer
  • 3756 posts
  • Interests:Boot and Install from USB
  •  
    Netherlands

Posted 07 September 2020 - 06:08 PM

OK  :)  Wrong Conclusion is removed.



#37 matrix.rebooted

matrix.rebooted

    Newbie

  • Members
  • 26 posts
  •  
    France

Posted 07 September 2020 - 07:40 PM

Sorry I had to go

 

I see I have a lot to read!! when the cat's away.. :lol:

 

I was at post #27, top of the page, about blank sector:

booted g4d, hd0 is usb pendrive, disk was hd1 (for more safety I unplugged working drive)
first command (geometry) returns error: hang! use geometry --lba1sector (129) in the preset menu
so I typed
    geometry (hd1) --lba1sector (129)
and then screen had frozen...

maybe if I cant use a blank sector I can make one with this command:
    dd if=/dev/zero of=blank bs=512 count=1

BUT, the geometry command I typed was perhaps not the good one because now 2nd drive (current 7home) refuses to boot if faulty drive is plugged in... maybe the command I typed changed something in its geometry... I'm going to see if I still can see it using gparted and read all your messages!

edit:

well I think it died, pendrive doesn't boot anymore if hard drive is plugged in and with hard drive alone even bios hangs when trying to detect devices... :ph34r:

 

@wimb

I 'was accessing' :( the files using file manager in linux parted magic bootable iso or ubuntu boot repair disk both on the multiboot pendrive. At first gparted didn't gave access to E: and F: but says something like use ntfs-3g to mount drive. Just had to mount the devices /dev/sdb1 or sdb2 via mount or ntfs-3g, then they appeared in gparted and also file managers were able to explore files too (open,copy,delete, all was working); I get back few files I was missing doing so.

 

@wonko the sane

too bad I had already used wrong dd command at the time of your post #31

 

Then, since I cant access the drive anymore I think it's over unless you have other magician tricks under the hat B)

 

In any case thank you both for your time and all the clear explanations, at least it was interesting and I learned things :)

 

I think now I have to find how to fix the nvstor32 bug before second drive follow the same destiny... while apparently the event seems to not appear anymore since bad hard drive is unplugged.. crossing fingers


Edited by matrix.rebooted, 07 September 2020 - 08:38 PM.


#38 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 08 September 2020 - 08:31 AM

Well if the drive died, it is dead, though as you surely well know ;)

https://fr.wikipedia...iki/Lapalissade

 

« Un quart d'heure avant sa mort, il était encore en vie »

 

Rest assured however that it is not your fault, the geometry command only reads some data and of course geometry is embedded in factory in the controller/eprom/disk and cannot be changed by any software.

 

Allow me to also doubt that the issues originated from a "bad" driver (or from any other non-specific software).

 

There are of course quite a few magician's tricks around, the point is that they are exactly that, mostly illusions.

 

It may even be possible :unsure: to revive that disk temporarily, the point is that even if it starts again (by magic), it doesn't pass the WDC test, already has at least two irrecoverable sectors so to make it work again (with no guarantee whatsoever about its durability) it would need "low-level" work, which almost surely would make anyway existing data unrecoverable (and you already got it).

 

You have to understand that modern (like manufactured in the last 20 years or so) hard disks are "black boxes" that you cannot really access from the outside if not through at least two layers of intermediate translations, and even if you can get access they have hundreds of settings that are totally undocumented and only very partially reverse/engineered understood, usually by good guys that in their simplicity sell for anything between 3,000 and 15,000 US$ apiece specialized hardware and software (making as sure as possible to not reveal how they actually work), though there are some rare leaked info here and there that sometime can be used by "end users".

 

So, the pro's that work in the field charge crazy amounts of money for their work (and use of these tools), here since you already got your data, get a new hard disk (I would guess that you may spend anything between 40 and 80 Euro for a suitable replacement disk) and call it a day.

 

BTW, it is not of course necessarily true, but if you had spent the first day that 40-80 Euro amount and imaged/cloned the original disk, maybe you would have had already a perfectly functional new disk with all the previous content and working/booting, this is the only mistake you made that you can  be (only a little) sorry about.  

 

You played the game (fairly enough), sometimes you win, sometimes you lose ...

 

:duff:

Wonko






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users