73 replies to this topic

[Anon10]

Hello, 

About a week ago my desktop went black and it said my windows wasn't genuine but I had put in the key I got on the windows sticker when I first set up my computer. I googled how to remove the message and downloaded a program called windows loader which said it would fix this problem. I ran it and my computer rebooted but didn't work since. It was a black screen with white writing and said different windows options but none of them worked and took me to a thing which said "grub>".

After googling for ages I found this thread:
http://reboot.pro/to...its-dead/page-2
but the steps wouldn't help me as I have more than one drive and don't know which is which.

I have a desktop that my boyfriend built from parts I bought so it isn't branded and I have 64-bit windows 7.

I have an SSD which is where I installed windows, a 2TB hard drive and a 500GB hard drive which have my files but I think the 2TB one has been split into two partitions. I don't think I have added partitions to the SSD and the 500GB hard drive had a tiny truecrypt drive.

When I type find into the grub command line thing it shows this:

 

grub>find

(hd0,0)

(hd0,1)

(hd0,2)

(hd0,3)

(hd1,0)

(hd1,1)

(hd2,0)

 

I then typed this to try to work out which drive is which but I still don't know:

 

grub>geometry (hd0)

Drive 0x80(LBA): C/H/S=1023/255/63, Sector Count/Size=16434495/512

Partition num: 0, Filesystem type unknown, partition type 0x4A

Partition num: 1, Filesystem type unknown, partition type 0x73

Partition num: 2, Filesystem type unknown, partition type 0x2B

Partition num: 3, Filesystem type unknown, partition type 0x61

 

grub>geometry (hd1)

Drive 0x81(LBA): C/H/S=1023/255/63, Sector Count/Size=16434495/512

Partition num: 0, Filesystem type is ntfs, partition type 0x07

Partition num: 1, Filesystem type unknown, partition type 0x07

 

grub>geometry (hd2)

Drive 0x82(LBA): C/H/S=1023/255/63, Sector Count/Size=16440560/512

Partition num: 0, Filesystem type is ntfs, partition type 0x07

 

If you need any more information I am willing to give it as I really need this computer fixed. It's the only one I have with everything I own and as I'm a student I can't afford another one or a recovery service. Please please help me

[steve6375]

You can use the ls command to list files - e.g.

ls (hd2,0)/
ls (hd1,1)/
ls (hd1,0)/

If you can find bootmgr then you might be able to boot to Windows using

root (hd2,0)
chainloader /bootmgr

(where hd2,0 is the partition that contains \bootmgr)

 

or if there is only one Windows installation try

find --set-root bootmgr
chainloader /bootmgr

[Anon10]

I have already tried both of the last two commands but neither find a file  

For the ls stuff:

(hd0,0): Error 17 Cannot mount selected partition

(hd0,1): Error 17 Cannot mount selected partition

(hd0,2): Error 17 Cannot mount selected partition

(hd0,3): Error 17 Cannot mount selected partition

(hd1,0): (Folder names of one of my hard drives or hard drive partition as these folders are backed up on both hard drives)

(hd1,1): Error 17 Cannot mount selected partition

(hd2,0): Config.Msi Programs System\ Volume\ Information SYSTEM~1 Virtual\ HDDs VIRTUA~1 (2TB partition folders)

 

From this I think my SSD with my OS is on hd0 but I don't know why there are 4 partitions. I haven't used it for anything but installing windows on (twice).

[steve6375]

can you try

cat --hex --skip=0x1be (hd0)1+1

Can you report back the first 16 bytes (the first line)

and the last two bytes  (may be AA and 55)

[TheHive]

 

I have an SSD which is where I installed windows, a 2TB hard drive and a 500GB hard

 

Try taking out the spare drive(s) (a 2TB hard drive and a 500GB hard). Try working on the SSD boot drive by itself.

I would suggest making a Back up of the SSD boot drive that has all the important files and using a Pe with back up sofware.

 

What version of Windows do you have? 64-bit windows 7

if 64-bit windows 7 came on dvd you can try a repair option or try a reinstall upgrade option.

Repair Install to Fix Windows 7 Without Reformatting by Britec

[Anon10]

can you try

cat --hex --skip=0x1be (hd0)1+1

Can you report back the first 16 bytes (the first line)

and the last two bytes  (may be AA and 55)

000001BE: 0B C0 0F 85 16 00 66 0F B7 0E 00 02 66 B8 02 02 ; ......f.....f...

The last line just has E8 and E4

 

Try taking out the spare drive(s) (a 2TB hard drive and a 500GB hard). Try working on the SSD boot drive by itself.

I would suggest making a Back up of the SSD boot drive that has all the important files and using a Pe with back up sofware.

 

What version of Windows do you have? 64-bit windows 7

if 64-bit windows 7 came on dvd you can try a repair option or try a reinstall upgrade option.

Repair Install to Fix Windows 7 Without Reformatting by Britec

 I will try removing my other two drives. Can I make a backup without another computer? I am using my phone right now. I also don't have a windows disk, I tried looking and I either never had one or have lost it.

[steve6375]

The drive data seems to indicate that the partition table of the Windows drive is totally corrupt.  :-(

If you have important data then you need to do an image backup of the whole SSD drive.

Otherwise, just reformat it and re-install Windows 7 (you will lose all your files).

You could try making a bootable USB drive containing TestDisk and boot from it and try to fix the hard disk (unplug all the others first).

http://www.cgsecurit...TestDisk_Livecd for a variety of sources.

 

If you are not very experienced with low-level disk work on computers, I would suggest you get help from a friend or go to a computer shop, if the Windows disk contents are important.

[TheHive]

 I will try removing my other two drives. Can I make a backup without another computer? I am using my phone right now. I also don't have a windows disk, I tried looking and I either never had one or have lost it.

 

 

You would need a computer to create a bootable Dvd or cd, or usb thumdrive. To try the repair you would need the Windows 7 Dvd

 

I'm a student I can't afford another one or a recovery service

 

 

Since youre a student. I would recommend going to the schools "IT" or a class that relates to PC and see if someone can help. Most tech guys will try to help. But be carefull since you do have impotant data on the drive. Ask who they would recommend to help in such a case as yours.

[Anon10]

There were some important files temporarily on the SSD so I don;t have a back up of those. Do you recommend any programs to make an image of my SSD? I don't want any more dodgey programs like the one that did this. And I have no experience at all with low-level disk stuff. If I make an image of my SSD, can I then reinstall it and try to access the files from the image?

[Anon10]

Since youre a student. I would recommend going to the schools "IT" or a class that relates to PC and see if someone can help. Most tech guys will try to help. But be carefull since you do have impotant data on the drive. Ask who they would recommend to help in such a case as yours.

Unfortunately I don't know anyone who knows about this and IT is useless at my school. I went to them to see if they would help with my ipod not responding well and they opened it up and completely crushed the circuit board with pliers. Also the Computing teacher is pretty useless. 

[TheHive]

Since i dont have ssd drive i cant personally which backup method is best. But you can try the free Todo Backup Free 7.5

 

Top Features

• Efficient system backup & recovery. No need to reinstall OS or applications to get everything back.
• Back up data, system, hard disk, partition or individual files to a safe destination for disaster recovery.
• Disk clone, disk upgrade and SSD migration solution.
• Quickly restore what you need, recover granular files, folders, volumes, or all from a single image.
• Comprehensive full backup, Incremental backup, differential backup.

 

http://www.todo-back...up-software.htmhttp://www.youtube.com/watch?v=1Nustx8hWjQYoure going to need a Pc.

Ask the students not the teacher for help. Might have better luck.

 

 

Create Backup Image with Macrium Reflect by Britec

[steve6375]

The Ultimate Boot CD has clonezilla and TestDisk.

http://www.ultimatebootcd.com/

You could boot from the UBCD (from a CD or a USB drive) and run Clonezilla and backup to one of the other drives in your system (full raw image whole disk backup = Device to Image).

http://clonezilla.or...=/00_Clonezilla

Once that is done, you can run TestDisk and try to fix hd0.

Don't blame me if it goes wrong though!

[Anon10]

In the time I've been gone, I've borrowed a laptop and downloaded linux onto a usb stick. I read that only linux would be safe for a corrupt partition table. I am my computer off my usb stick with only the ssd plugged in and I can see most of my files there. There is also a boot folder in there so maybe I could fix the windows stuff from inside linux? perhaps you two don't know much about linux though. I really appreciate your help and I would be so lost without it. I would not have got this far and would probably be very upset. Thank you both!

[Wonko the Sane]

As a matter of fact it is possible that only the partition table in the MBR is corrupted and that the volume/filesystem is fine.

If the SSD was originally partitioned under XP (or earlier) try issuing in grub4dos the command:

cat --hex (hd0)63+1

If the SSD was originally partitioned under Vista or later, try issuing in grub4dos the command:

cat --hex (hd0)128+1

and the command

cat --hex (hd0)2048+1

(or try all three commands, their execution will not affect anything).

 

Explanation: Disk Management by default sets "sectors before" first (and only in your case) partition to 63 under XP and 128 or 2048 (depending on size of the whole device) under Vista and later.

 

If any of the two displays a screen in which first line begins with EB 52 90 4E 54 46 53 20  (on the left side) and where you can see distinctly "NTFS" on the right side, chances are that the *whatever* corruption that happened did not affect the bootsector of the volume.

 

If this is the case, notwithstanding the NEED to make a full image (as Steve6375 suggested) it will be easy to recover (or recreate manually) the partition table entry.

DO NOT attempt using TESTDISK (or any other "partition recovery tool") on your own, post about the results of the above commands and wait for a set of instructions on how to use TESTDISK or manually create the partition entry.

 

Wonko

[Anon10]

I am copying everything from my SSD into a folder on one of my hard drives. Would this not be enough or do I need to make an image too? Would my partitions on my other hard drives or permissions mess up if I reinstalled windows from fresh on my SSD? I would like to fix it without that but now I have the files I could reinstall if that is easier. Also I tried downloading TestDisk on linux (the only thing I can use on here atm) but don't know how to even run it from what downloaded. I tried doing commands in terminal but they didn't seem to work.

[tinybit]

can you try

cat --hex --skip=0x1be (hd0)1+1

Can you report back the first 16 bytes (the first line)
and the last two bytes  (may be AA and 55)

Why to use (hd0)1+1 ? Should it be (hd0)0+1 ?

[TheHive]

I am copying everything from my SSD into a folder on one of my hard drives. Would this not be enough or do I need to make an image too? Would my partitions on my other hard drives or permissions mess up if I reinstalled windows from fresh on my SSD? I would like to fix it without that but now I have the files I could reinstall if that is easier. Also I tried downloading TestDisk on linux (the only thing I can use on here atm) but don't know how to even run it from what downloaded. I tried doing commands in terminal but they didn't seem to work.

That should work.

[steve6375]

Why to use (hd0)1+1 ? Should it be (hd0)0+1 ?

When grub4dos is installed it makes a backup in LBA 1 - I was hoping the original partition table might be there.

[Wonko the Sane]

That should work.

It (what?) should work to have a lousy (not useful) copy of *something* (that we have NO idea about what it is) and will do nothing helping for the repair of the system.

 

@Anon10

Post the result of the three grub4dos commands you were suggested to run in post #14.

DO NOT ATTEMPT using TESTDISK (as you were already told) until we understand if it may be useful.

 

If you want to repair the SSD structure, IF needed, making a "dd-like" or "forensic sound" image of it will be needed (and NOT *anything else*) 

 

Wonko

[Anon10]

Wonko - The commands just produced a screen full of FFs. I'm guessing that's a bad sign?
 

I'm still in the process of working out how to make a proper image of my SSD. I am mainly trying to work out how to use one of the programs I've downloaded

[Wonko the Sane]

Wonko - The commands just produced a screen full of FFs. I'm guessing that's a bad sign?
 

I'm still in the process of working out how to make a proper image of my SSD. I am mainly trying to work out how to use one of the programs I've downloaded

It depends.

The issue here is that there is a "set of addresses" in the MBR's partition table (first absolute sector of the device) and seemingly you have those "botched", as well as the backup of it that may have been created on second sector (LBA 1) that you already inspected running the command Steve6375 suggested.

 

So the attempt was to check in a few "known" or "common" locations there was the actual beginning of the partition.

 

Can you confirm that the SSD had only one (primary) partition formatted as NTFS?

 

Try doing another attempt, try on the grub4dos prompt:

cat --hex --locate=NTFS (hd0)0+20000

the command will attempt locating the string "NTFS" (which is normally in the first sector of a NTFS formatted volume) inside the first 20000 sectors.

It will take some time to run and should (hopefully) return one (or more) LBA addresses.

 

If for any reason there was more than one volume on the SSD and the first volume was not NTFS it will return anyway nothing, as the 20000 sectors scan will cover only around 10 Mb at the beginning of the device.

 

Also, when you get to the grub> prmpt you should see at top of the screen the exact version of grub4dos that has been installed by that stupid "loader", please post this information as some older version of grub4dos may simply miss some commands.

 

As it was suggested before, you may want to try removing all devices exception made for the SSD, in order to be definitely sure that the SSD is (hd0).

 

Finally, you should provide info on the EXACT size/model of your SSD. (even if the bootsector has been overwritten, there is a backup bootsector for NTFS volumes at the very end of the volume and it may be possible to find that one)

 

Wonko

[Anon10]

I have already removed my hard drives to check that the SSD is hd0. I had always thought that the SSD was not partitioned but the find command shows it as having 4 partitions (I think). I have a 250GB Samsung 840 EVO SSD. I'll go try that command now and report back.

[Anon10]

It only took a few seconds to run and just returned "3 6F". Oh and I didn't see a grub4dos version at all at the top.

Edited by Anon10, 10 November 2014 - 06:46 PM.

[Wonko the Sane]

It only took a few seconds to run and just returned "3 6F". Oh and I didn't see a grub4dos version at all at the top.

 

You mean a "3" and a space after it and then "6F"?

This means that the string NTFS is found at absolute offset 3 AND on absolute offset 111 (in bytes) which should mean that *somehow* your SSD is now a "superfloppy", which is "strange", i.e. the first absolute sector of the disk is similar to this one:

http://thestarman.pc...m/mbr/W7VBR.htm

 

Can you try again issuing the following command:

cat --hex (hd0)+1

and check if you can see the "first line begins with EB 52 90 4E 54 46 53 20 (on the left side) and where you can see distinctly "NTFS" on the right side"

 

If it does, try:

root (hd0)
ls

and report?

 

I still need the answer to the question about EXACT model/size of the SSD.

 

Wonko

[Anon10]

The model and size I told you is as much as I know. I'll try the other command now.