Unable to Boot Windows 10

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
rdkapp
Posts: 2
Joined: 15 May 2020, 04:16

Unable to Boot Windows 10

#1 Post by rdkapp »

I'm new here and to TestDisk, and I'm hoping it can save my drive. First some background:

The subject drive was the Windows 10 SSD boot drive in a dual boot system (Win 10 and XP). I've rarely used XP in the past couple of years, but found I needed to restore some backups made with the XP backup program. Due to the time involved, I had to do it in 2 sessions. In the 1st session, everything went smoothly, but the 2nd session, in hindsight, was a huge fail. At the beginning of the dual boot into XP, it told me it needed to run CHKDSK on one of my drives (N:). I didn't really know what drive that was until it was too late. It was the Windows 10 Boot Drive! So, CHKDSK ran and the files were scrolling so fast on the screen, I couldn't tell what it was doing. After booting into XP, I was able to restore the files I needed, but ever since, I have been unable to boot into Windows 10, and in fact, I can no longer boot into XP. The computer continuously loops on startup. When I tried to boot into Safe Mode, I received the error that Winload.exe was either missing or corrupted. Since this happened, I've only been able boot with the Windows 10 recovery console or with a rescue boot disc which contains TestDisk.

The Windows recovery console (Startup Repair and command prompt bootrec /rebuildbcd) was unsuccessful. Thus, I turned to TestDisk and have attached the drive to another computer that is able to boot to Windows 10. I'm unsure of what to do after analyzing the drive. Hopefully, someone can help me. Here's the logfile.
Thu May 14 22:50:32 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Windows 8 (9200)
Compiler: GCC 6.4, Cygwin 2009.0
ext2fs lib: 1.43.1, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=500107862016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=499430457344
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=524288000
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=248999776768
Hard disk list
Disk /dev/sda - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512 - WDC WDS500G2B0A-00SM50, S/N:172843420611, FW:X61130WD
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 850 EVO 250GB, S/N:S2R5NB0J107529F, FW:EMT02B6Q

Partition table type (auto): Intel
Disk /dev/sdb - 250 GB / 232 GiB - Samsung SSD 850 EVO 250GB
Partition table type: Intel

Analyse Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
Geometry from i386 MBR: head=255 sector=63
BAD_RS LBA=2048 18446744073709551615
NTFS at 0/32/33
Info: size boot_sector 1023993, partition 1024000
NTFS at 63/221/31
heads/cylinder 240 (NTFS) != 255 (HD)
check_part_i386 3 type 27: no test
Current partition structure:
1 * HPFS - NTFS 0 32 33 63 221 30 1024000

Warning: Bad starting sector (CHS and LBA don't match)
Warning: number of heads/cylinder mismatches 240 (NTFS) != 255 (HD)
2 P HPFS - NTFS 63 221 31 30336 93 38 486327689
3 P Windows RE(store) 30336 103 40 30401 42 41 1040384

search_part()
Disk /dev/sdb - 250 GB / 232 GiB - CHS 30401 255 63
NTFS at 0/1/1
heads/cylinder 16 (NTFS) != 255 (HD)
filesystem size 122880177
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 7680011
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 7648 239 63 122880177
NTFS, blocksize=4096, 62 GB / 58 GiB
NTFS at 30336/103/40
filesystem size 1040384
sectors_per_cluster 8
mft_lcn 43349
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 30336 103 40 30401 42 41 1040384
NTFS, blocksize=4096, 532 MB / 508 MiB
file_pread(5,2,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(5,1,buffer,488398847(30401/107/42)) lseek err Invalid argument
file_pread(5,2,buffer,488398848(30401/107/43)) lseek err Invalid argument
file_pread(5,8,buffer,488397184(30401/81/17)) lseek err Invalid argument
file_pread(5,1,buffer,488397184(30401/81/17)) lseek err Invalid argument
file_pread(5,8,buffer,488397312(30401/83/19)) lseek err Invalid argument
file_pread(5,8,buffer,488397440(30401/85/21)) lseek err Invalid argument
file_pread(5,8,buffer,488397568(30401/87/23)) lseek err Invalid argument
file_pread(5,8,buffer,488397696(30401/89/25)) lseek err Invalid argument
file_pread(5,8,buffer,488397824(30401/91/27)) lseek err Invalid argument
file_pread(5,8,buffer,488397952(30401/93/29)) lseek err Invalid argument
file_pread(5,8,buffer,488398080(30401/95/31)) lseek err Invalid argument
file_pread(5,8,buffer,488398208(30401/97/33)) lseek err Invalid argument
file_pread(5,8,buffer,488398336(30401/99/35)) lseek err Invalid argument
file_pread(5,8,buffer,488398464(30401/101/37)) lseek err Invalid argument
file_pread(5,8,buffer,488398592(30401/103/39)) lseek err Invalid argument
file_pread(5,8,buffer,488398720(30401/105/41)) lseek err Invalid argument
file_pread(5,6,buffer,488398850(30401/107/45)) lseek err Invalid argument
file_pread(5,2,buffer,488398848(30401/107/43)) lseek err Invalid argument
file_pread(5,8,buffer,488398856(30401/107/51)) lseek err Invalid argument
file_pread(5,3,buffer,488398864(30401/107/59)) lseek err Invalid argument
file_pread(5,3,buffer,488398911(30401/108/43)) lseek err Invalid argument
file_pread(5,8,buffer,488398927(30401/108/59)) lseek err Invalid argument
file_pread(5,11,buffer,488398974(30401/109/43)) lseek err Invalid argument
file_pread(5,2,buffer,488400896(30401/140/12)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=1
Warning: the current number of heads per cylinder is 255 but the correct value may be 240.

Results
* HPFS - NTFS 0 1 1 7648 254 63 122881122
NTFS, blocksize=4096, 62 GB / 58 GiB
P HPFS - NTFS 30336 103 40 30401 42 41 1040384
NTFS, blocksize=4096, 532 MB / 508 MiB
I'd like to note that the log reflects "OS: Windows 8 (9200)"; however, this drive never had Windows 8 on it. In fact, I've never owned Windows 8.

My guess is that CHKDSK messed up the Master Boot Record of the Windows 10 drive. I'd really like to recover and repair the MBR, but I just don't know what the next step should be. If someone would be so kind as to provide me detailed instructions on the next steps, I would greatly appreciate it.

rdkapp
Posts: 2
Joined: 15 May 2020, 04:16

Re: Unable to Boot Windows 10

#2 Post by rdkapp »

I forgot to mention in my original post that the Windows folder on the subject drive is gone, or has been renamed. Some of the folders/files in the root directory that were modified around the time that CHKDSK ran are:

Windows (file - 0 KB)
Recovery (folder)
found.000 (folder)
Config.Msi (folder)
PerfLogs (folder)

There are also a couple of folders dated back to Jan 14, 2020 (may be the last major update to Windows?) with the following names:
$WINDOWS.~BT (folder)
$Windows.~WS (folder)

Finally, in the Recovery partition, there is a Boot folder modified around the time that CHKDSK ran.

Hope these help.

Locked