Unable to restore Windows boot sector using dd

[Thomas Kaiser]

Chanchao wrote:
> On Fri, 2006-12-08 at 11:40 +0530, Shriramana Sharma wrote:
> 
> Heh, I fiddled around with something like this just last Sunday after an
> over-eager user removed a lot more from a windows drive than the virus
> she was trying to remove. :)
> 
> Anyway, some comments:
> 
>> When the partition contents are merely removed by rm -Rf * and the
>> boot sector is untouched, then trying to boot to that partition via
>> GRUB gives "NTLDR missing" which is the Windows bootloader's error
>> message. 
> 
> No it's not.  NTLDR is a hidden system file on disk.  Is it possible
> that when you create the tar file, you don't include system and/or
> hidden files?  
> 
> Make sure that the files NTLDR, NTDETECT.COM and BOOT.INI are included
> in the tar file, and are successfully put back.
> 
>> But when the partition is formatted using mkdosfs or something else (I
>> tried BootIt NG) then just restoring the first 512 bytes of the
>> partition using dd and the backup does not give me back the NTLDR
>> missing error. Instead, I get a GRUB commandline when I tried to boot
>> to the Win XP GRUB item.
> 
> Boot issues in Windows are most easily fixed using the Windows Recovery
> Console.  The option to start this you get when booting from a Windows
> Installation CD.  Then you get to a blue screen where one of the options
> is to press 'R' to start the recovery console.  Note that it can also be
> installed on disk, so then it is available from the Windows boot menu.
> (See a Microsoft.com article on how to do that) 
> 
> Anyway, in the recovery console you have a limited set of commands that
> you can run, two of which are 
> 
>  FIXMBR
> 
> and
> 
>  FIXBOOT
> 
> Those will restore a windows boot record, enabling you to boot into
> windows.  Note that you won't get grub then. :-)  So this works best if
> Windows is on a separate drive and you use the BIOS to select the drive
> to boot from. 
> 
> Finally I also recall that grub/Ubuntu is a bit weird with SATA (sda)
> drives and deciding from which drive to boot from / install grub on.
> Not sure if that has been corrected, but it was most definitely weird
> pre-dapper.
> 
>> Furthermore when Kubuntu boots and tries to mount the partition as it
>> is listed in fstab, it throws out the following error:
>>
>> [17179621.500000] FAT: Filesystem panic (dev sda1)
>> [17179621.500000]     fat_get_cluster: invalid cluster chain (i_pos 0)
>> [17179621.500000]     File system has been set read-only
> 
> Are you sure the original filesystem was FAT32?  Because if you make a
> tar file from NTFS and then use Ubuntu to create a vfat / FAT32
> filesystem, then I bet Windows will hit the fan violently. :-)
> 
> So, I'm sorry there's no clear solutions in here, but I have this way of
> blabbering just enough around the topic to give smart people new ideas
> to move forward. :)
> 
> Cheers,
> Chanchao
> 
> 

Hi

I did the same some days ago. Tar.gz the whole windows partition and put 
it on a new partition. This worked without problems. But the new 
Partition was made in Windoz.

Be careful with the first 512 Bytes of the partition. There are some 
more infos not only the boot code! The boot code is around 440 Bytes and 
the rest are informations about the partition itself. I don't remember 
everything, but google knows :-)

fixboot should correctly repair the partition boot sector.

Regards, Thomas


-- 
http://www.kaiser-linux.li