Unable to restore Windows boot sector using dd

[Chanchao]

On Fri, 2006-12-08 at 11:40 +0530, Shriramana Sharma wrote:

Heh, I fiddled around with something like this just last Sunday after an
over-eager user removed a lot more from a windows drive than the virus
she was trying to remove. :)

Anyway, some comments:

> When the partition contents are merely removed by rm -Rf * and the
> boot sector is untouched, then trying to boot to that partition via
> GRUB gives "NTLDR missing" which is the Windows bootloader's error
> message. 

No it's not.  NTLDR is a hidden system file on disk.  Is it possible
that when you create the tar file, you don't include system and/or
hidden files?  

Make sure that the files NTLDR, NTDETECT.COM and BOOT.INI are included
in the tar file, and are successfully put back.

> But when the partition is formatted using mkdosfs or something else (I
> tried BootIt NG) then just restoring the first 512 bytes of the
> partition using dd and the backup does not give me back the NTLDR
> missing error. Instead, I get a GRUB commandline when I tried to boot
> to the Win XP GRUB item.

Boot issues in Windows are most easily fixed using the Windows Recovery
Console.  The option to start this you get when booting from a Windows
Installation CD.  Then you get to a blue screen where one of the options
is to press 'R' to start the recovery console.  Note that it can also be
installed on disk, so then it is available from the Windows boot menu.
(See a Microsoft.com article on how to do that) 

Anyway, in the recovery console you have a limited set of commands that
you can run, two of which are 

 FIXMBR

and

 FIXBOOT

Those will restore a windows boot record, enabling you to boot into
windows.  Note that you won't get grub then. :-)  So this works best if
Windows is on a separate drive and you use the BIOS to select the drive
to boot from. 

Finally I also recall that grub/Ubuntu is a bit weird with SATA (sda)
drives and deciding from which drive to boot from / install grub on.
Not sure if that has been corrected, but it was most definitely weird
pre-dapper.

> Furthermore when Kubuntu boots and tries to mount the partition as it
> is listed in fstab, it throws out the following error:
> 
> [17179621.500000] FAT: Filesystem panic (dev sda1)
> [17179621.500000]     fat_get_cluster: invalid cluster chain (i_pos 0)
> [17179621.500000]     File system has been set read-only

Are you sure the original filesystem was FAT32?  Because if you make a
tar file from NTFS and then use Ubuntu to create a vfat / FAT32
filesystem, then I bet Windows will hit the fan violently. :-)

So, I'm sorry there's no clear solutions in here, but I have this way of
blabbering just enough around the topic to give smart people new ideas
to move forward. :)

Cheers,
Chanchao