cgsecurity.org

Posted: **22 Nov 2013, 07:10**

I have 4 operating systems installed on my notebook's 500G SATA HDD. Recently I upgraded to a new 1TB WD Blue SATA HDD and cloned my old hard drive using Acronis TrueImage and everything worked out well. My partitions and disk structure were intact, but with more free space. I have Win XP, Win 7, Win 8 and Ubuntu on my notebook of which Win XP only works when I switch HDD mode from AHCI to IDE because I couldn't find appropriate SATA drivers for it during installation.

Anyway, so I was logged into Windows 7 and I had my 2TB WD external HDD connected to the notebook and uTorrent was running when there was a power outage. My notebook's battery is as good as dead so before Windows could hibernate, the computer turned off. Since then, I've been encountering an error code of 0x0000225 ("Windows failed to start. A recent hardware or software change might be the cause") and neither Win 7 or Win 8 would boot. Win XP would boot if I switched HDD over to IDE and tried again. I read on a forum somewhere that others have experienced the same problem when they've left a large external USB HDD connected to the computer while shutting down.

So I connected my 2TB WD HDD to the notebook during boot, but that didn't work, so I started Win XP, installed TestDisk, followed the instructions in the Step By Step guide and probably did something wrong because then Win XP wouldn't boot either and I got the dreaded "NTLDR is missing" error. Probably because I made the Win XP partition primary bootable.

Thankfully, I had downloaded GParted Live CD and made a bootable USB drive out of it. I booted from the USB drive and ran testdisk again, did quick as well as deep search for lost partitions and after a few trial and errors, set the SYSTEM RESERVED partition to primary bootable and I finally managed to get Win 8 booting again. I also recovered 4 other partitions, one of which had Win 8 installed.

But now I don't see my Win 7 partition or the Win XP partition. I don't care much about booting into XP but if I could boot into Win 7 again, that'd be really nice.

Here is the latest testdisk backup of my partition table which is currently being used:

Code: Select all

#1385092443 Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
 1 : start= 24578048, size=   210247, Id=07, *
 2 : start=171583461, size=1751075739, Id=0F, E
 5 : start=171583488, size=449794647, Id=07, L
 6 : start=659449791, size=209714904, Id=05, X
 6 : start=659449856, size=209714839, Id=07, L
 7 : start=1009924020, size=424905390, Id=05, X
 7 : start=1009924096, size=424905314, Id=07, L
 8 : start=1859733414, size= 62925786, Id=05, X
 8 : start=1859733504, size= 62925696, Id=07, L

And the current partition structure with CHS entries from running TestDisk:

Code: Select all

Current partition structure:
 1 * HPFS - NTFS           1529 232 48  1542 254 63     210247 [SYSTEM RESERVED]
 2 E extended LBA         10680 147  1 119679 254 63 1751075739
Warning: number of heads/cylinder mismatches 16 (NTFS) != 255 (HD)
 5 L HPFS - NTFS          10680 147 28 38678 254 63  449794647 [Miscellaneous]
   X extended             41048 217  1 54102 254 63  209714904
 6 L HPFS - NTFS          41048 218  3 54102 254 63  209714839 [RootWin8]
   X extended             62864 220  1 89313 254 63  424905390
 7 L HPFS - NTFS          62864 221 14 89313 254 63  424905314 [Music and Other Stuff]
   X extended             115763  13  1 119679 254 63   62925786
 8 L HPFS - NTFS          115763  14 28 119679 254 63   62925696 [Stuff]

I've also attached the logs (as a ZIP file) from running testdisk from the GParted Live CD which includes Deeper Search logs. Please take a look at them and let me know what I can do to get my notebook booting into Win 7 again. Thank you.

Posted: **22 Nov 2013, 09:47**

Your System Reserved partition is actually your boot partition to start into Windows.
It's depend on, which OS created this partition?
In testdisk you can set it to bootable.
Looks like that you already did that?
Please note, only one partition can be bootable.
If you still experience some problems, you can use your appropriate Windows-CD and start-options to repair start.
You can use a boot manager like EasyBCD to boot all the other OSes.
But it's only possible if your partitions are healthy and don't appear as RAW.
Laptops are often delivered with recovery partitions.
Emergency recovery programs can modify the mbr also, so that you're able to boot into recovery and diagnosis options, provided by the manufacturer.
But if you're already modified your MBR through multiple OSes, might be possible that those settings are already overridden and don't work anymore.
Some more info are appreciated!
Are you able to watch your data using your LiveCD on your win7 partition?
EsyBCD might be able to solve your problem.
Since Vista up to Win8 partition not Intel standard anymore and alligned not on cylinder boundary but megabyte boundary.
For example winXP doesn't support it.
Info;
http://support.microsoft.com/kb/931854/en-us
Currently, I don't find any win7 partition in your partition table.
Might be possible that you have to register all partitions included your win7-partition into your partition table using testdisk again.
But I'm not sure about your current partition table.
Would it be possible to copy and paste the content of your current situation from TestDisk / Analyse into your next post?
As long, you don't need to change or modify your partition table.

Fiona
But only if no file system nor boot sector is damaged.

Posted: **22 Nov 2013, 13:34**

Fiona wrote:Might be possible that you have to register all partitions included your win7-partition into your partition table using testdisk again.

Sure. I just finished running a Deeper Scan using testdisk on Win 8 right now. Here are the results:

Code: Select all

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
>  HPFS - NTFS              0  32 33  1529 232 47   24576000 [PQSERVICE]
   HPFS - NTFS              0  32 40  1529 232 47   24575993
   HPFS - NTFS           1529 232 47  3059 177 54   24575993
   HPFS - NTFS           1529 232 48  1542 168 34     204800 [SYSTEM RESERVED]
   HPFS - NTFS           1529 232 55  1542 168 34     204793
   HPFS - NTFS           1530  64 21  1542 254 63     204793
   HPFS - NTFS           1542 168 27  1555 104  6     204793
   HPFS - NTFS           1542 168 34  1555 104 13     204793
   HPFS - NTFS           1542 168 42 10680 147 27  146800633
   HPFS - NTFS          10680 147 28 38678 245 31  449794048 [Miscellaneous]
   HPFS - NTFS          10680 157  4 38678 254 63  449794041
   HPFS - NTFS          20176 216  9 33230 226 20  209713152 [RootWin7]
   HPFS - NTFS          20176 216 16 33230 226 20  209713145
   HPFS - NTFS          20176 216 16 41048 185 33  335306745
   HPFS - NTFS          41048 218  3 54102 228 14  209713152 [RootWin8]
   HPFS - NTFS          41048 218 10 54102 228 14  209713145
   HPFS - NTFS          41048 218 10 62864 188 44  350472185
   HPFS - NTFS          41048 244 59 54102 254 63  209713145
   HPFS - NTFS          62864 221 14 89313 212 51  424902656 [Music and Other St
   HPFS - NTFS          62864 221 21 89313 212 51  424902649
   HPFS - NTFS          62865   8 33 89313 254 63  424902649
   HPFS - NTFS          87764 171 31 115763  14 27  449794041
   HPFS - NTFS          89313 245 21 115762 236 58  424902656 [Movies and TV Sho
   HPFS - NTFS          89313 245 28 115762 236 58  424902649
   Linux                100907  14 36 102404  52 48   24051712
   Linux                100914 115  2 102411 153 14   24051712
   HPFS - NTFS          115763  14 28 119679  45 46   62912512 [Stuff]
   HPFS - NTFS          115763  14 35 119679  45 46   62912505
   HPFS - NTFS          115763 223 52 119679 254 63   62912505
Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
     Enter: to continue

My Win XP partition is called RootWinXP but I can't see it in the results. Could you help me set the correct attributes to each partition? I should again make SYSTEM RESERVED the primary bootable partition, right? Also, I am able to see files in all the labelled partitions using the 'p' key. But the ones without labels always say "Can't open filesystem. Filesystem seems damaged".

Fiona wrote: You can use a boot manager like EasyBCD to boot all the other OSes.
But it's only possible if your partitions are healthy and don't appear as RAW.

Unfortunately,

Fiona wrote: Are you able to watch your data using your LiveCD on your win7 partition?

I can't use the GParted Live CD to access the Win 7 partition because it shows up as unallocated. But using testdisk, I can access all my partitions using the 'p' key (except Win XP, probably because my HDD was scanned in AHCI mode?)

Fiona wrote: As long, you don't need to change or modify your partition table.

I finished the Deeper Search partition scan but I haven't made any changes to the partition table yet. I'll wait for your advice on how to proceed next after you've gone through my logs.

I'm also attaching the current complete TestDisk log while at this stage with this post if you think that might help.
Thank you for the quick assistance.

Posted: **22 Nov 2013, 14:06**

I also downloaded and ran Easy BCD and here's what it says:

Code: Select all

There are a total of 4 entries listed in the bootloader.

Default: Windows 7
Timeout: 30 seconds
EasyBCD Boot Device: C:\

Entry #1
Name: Earlier Version of Windows
BCD ID: {ntldr}
Device: \Device\HarddiskVolume1
Bootloader Path: \ntldr

Entry #2
Name: Windows 8
BCD ID: {current}
Drive: C:\
Bootloader Path: \Windows\system32\winload.exe

Entry #3
Name: Windows 7
BCD ID: {default}
Device: unknown
Bootloader Path: \Windows\system32\winload.exe

Entry #4
Name: Ubuntu
BCD ID: {04e5904e-05ff-11e2-a3bd-9cf748453e70}
Device: unknown
Bootloader Path: \ubuntu\winboot\wubildr.mbr

Posted: **23 Nov 2013, 11:32**

Please, don't change anything to your currtent partition table using easyBCD, as long as all partitions are found and registered into your partition table.
Might be possible to repair the boot sector of your win7 partition also!
But TestDisk didn't list any win7-partition?
Did you run Deeper Search?
TestDisk / Deeper Search looks additional for any backup of a boot sector and might find more partitions.

Fiona

Posted: **23 Nov 2013, 15:01**

Yes, I did do a Deeper Search. And I posted the results of the scan in the post before the Easy BCD post.
You can click this link to see that post: Deeper Scan results

Here's the Windows 7 partition that testdisk found during Deeper Scan:

Code: Select all

HPFS - NTFS          20176 216  9 33230 226 20  209713152 [RootWin7]

Posted: **25 Nov 2013, 09:22**

Your Miscellaneous overlap your Win7-Partition.

HPFS - NTFS 10680 147 28 38678 245 31 449794048 [Miscellaneous]
HPFS - NTFS 20176 216 9 33230 226 20 209713152 [RootWin7]

Suggestion would be to backup your Miscellaneous partition and set it in testdisk to D for deleted.
It makes it possibble to recover your win7 partition and afterwards you can create on that empty/unallocated space another Miscellaneous-partition and copy data back.
This would be a safe solution.
Otherwise you can decrease the size of your Miscellaneous-partition using the disk management console using win8 but in this case you'll be working on an area containing/overlapping your win 7 data and it's not recommended.

Please let me know, whaht do you want to do?

Fiona

Posted: **25 Nov 2013, 09:26**

I'll run testdisk again, do a Deeper Search and mark Miscellaneous for deletion after I back up data from it. Could you tell me what I should set all the other partitions to, including RootWin7?

Should I mark RootWin7 as "L" for Logical or "P" for primary?

Thank you.

Posted: **25 Nov 2013, 10:04**

There are not too many possiblities.
Intel MBR only allows 4 primary or 3 primary and 1 extended partition as a container for logical partitions.
You can create as much logical partitions as you have drive letters available.
Now it's starting to have a try to get your partitions into right sequential order.
The first 2 primary partitions would be PQservice, SYSTEM RESERVED (mus be set to * active and bootable) and don't use any third primary partition, because it might be reserved for the empty/unallocated space of your Miscellaneous-partition.
Otherwise you'd be not able to create another primary nor extended partition (you can only have one extended partition and must be in one piece).
So your OSes and all succeeding partitions must be logical, which means that your System Reserved partitions should boot your logical OS-partitions.
It's the only possibilty to have a try to get your System to work?
Everything else would mean to reinstall Win7.
If you'd like to do that, please let me know.
Might be possible that you must use your Windows CD and repair your start within your repair options.

Posted: **25 Nov 2013, 10:22**

Thank you for your help, Fiona. I'll run TestDisk now and set Miscellaneous to Deleted and set the appropriate attributes to the other partitions and report back what happens.

cgsecurity.org

Recovering parition table of HDD with 4 OSes installed

Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed

Re: Recovering parition table of HDD with 4 OSes installed