WD800BB-00JHC0: Corrupt Firmware?

[HaQue]

It isnt going to take long to reach the "20 hours" of your time playing around with this

Does it work like that?

No. With windows, it is not as simple as a file being in the right folder. Windows keeps track of changes, file versions, security settings, permissions etc etc. What you are suggesting, IMHO, would result in a computer that would be extremely troublesome.

Windows drivers and installed software in most cases needs to be installed, not simply copied. .dlls need to registered, reg keys need to be valid.

If you cant resurect the partition with fzabkar's advice, then a full re-install would be the best option for a stable system. We still don't know if the filesystem has sustained other damage as we are focusing on what is obvious to see at the moment.

[fzabkar]

If you are going to be working on live data, IMHO it would be safest to edit the bad sectors manually. That gives you the best undo strategy because you can see exactly what you have done.

To this end I would edit the partition table in sector 0 as follows:

Code:

Offset(h)  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

0000001B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 01
0000001C0  01 00 07 FE FF FF 3F 00 00 00 C1 A5 50 09 00 00
0000001D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

I would then copy the backup boot sector (156280319) to sector 63. Feel free to do this any way that you prefer, but I am in the habit (since my Norton Utilities days) of explicitly specifying the source and destination sectors. I feel safer this way.

Instead of using FIXBOOT to reconstruct the NTLDR (assuming it was responsible for the damage), I would carve out the relevant sectors from a similar Windows XP installation. Alternatively, you could try to extract the relevant code from your own FIXBOOT executable in XP's Recovery Console.

Before attacking the NTLDR code, I would dump sectors 64 and onwards, looking for the first clean sector, ie one where there is an uncorrupted sequence of zero bytes rather than 0x0020 pairs. It would be safe to assume that any code before this point may have been rewritten by FIXBOOT and would therefore be corrupt.

As for your questions regarding the structure of the boot sectors, I recommend the following resource:
http://thestarman.pcministry.com/asm/mbr/index.html

BTW, you only need to repair the NTLDR if you wish to boot from this drive.