Remove accidental part. to restore unbootable windows drive?

[drbobbert]

Hi all,

I recently used my desktop to make a bootable USB to install a linux distro on a dead laptop. I was in a rush and EXTREMELY careless, blindly trying things without knowing what I was doing -- predictably, I messed up my desktop's SSD and HDD.

After creating the USB, I turned off my desktop. When I turned it on a few hours later, it wouldn't boot. (It went straight to a black screen with an error saying something like "Error loading \vmlinuz-linux: Not found.") So I realized that during my several attempts to put the ISO on the USB, I must have accidentally targeted my desktop's hard drive(s) instead of the USB. Not a nice feeling...

The desktop has two drives -- a 120gb SSD and a 1TB HDD. I plugged both into a laptop with a SATA-USB connector, but neither drive showed up in windows explorer. So I downloaded "Raise Data Recovery for NTFS" and tried that; screenshots SSD_1 and HDD_1 show what initially appeared. The labels on the FAT partitions say "ARCHISO_EFI", which must be what I added. (Arch Linux)

After using Raise Data Recovery's ability to "find lost disc partitions" on the SSD, a bunch of partitions showed up: see SSD_2. There were several NTFS partitions, including one that had my whole file system (SSD_3) and one that looks like it might be the original boot drive (SSD_4).

I didn't let the "find partition" process finish for the HDD, because it was going to take a while, but the first one that popped up had all of my data on it: see HDD_2.

So, I'm thrilled that I was able to recover and backup my data, but now I'm wondering if there's a easy way to get rid of the new partitions I added (I'm guessing all the "FAT" ones?) leaving the drives as they were before I messed with them. I'd love to be able to get the desktop back up and running without having to re-install Windows and lose all my installed programs. Does anyone have any ideas?

Thanks to those who made it through this long first post of mine! Much appreciated.

Attachments

[warnerr]

Congratulations on getting your data back. Booting on windows OS disk and selecting 'repair' option should repair damaged boot areas. (NOT install)

[fzabkar]

ISTM that a 32MB FAT partition has been written to the beginning of each drive. The phantom partitions in the "find lost partition" dialogue box appear to be boot sector templates that are embedded in various system files. The additional ARCHISO_EFI partitions would probably be located within the image file that you attempted to write to your USB stick.

The first partition of each drive begins at sector 2048, ie 1MB from the start of the user area. It is unclear whether this sector has been overwritten by the FAT volume. It could be that Raise has used the backup boot sector at the end of NTFS partition to locate the missing partition, in which case a simple fix might not be possible.

I would start by examining sectors 0 and 2048 on each drive with a disc editor, eg DMDE (freeware). If sector 2048 is untouched, then a complete restoration of your original file systems should only require a few mouse clicks.

BTW, I wouldn't use Microsoft tools in this case.

[drbobbert]

Thank you both for your replies!

fzabkar, is there anything in particular I should be looking for when I examine those sectors? I've attached some screenshots of what I'm seeing in DMDE.

And warnerr, I totally forgot to mention that that's the first thing I tried -- it stuck on "Attempting to repair..." (or something like that). I left it on overnight, but eventually stopped it.

Attachments

[fzabkar]

Sector 2048 should have been viewed in either Mode -> Hexadecimal or Mode -> NTFS Boot Record. You would then have seen the NTFS signature.

Your partition table contains two entries. These need to be deleted.

Highlight the "Primary - Unknown EF" partition and select Remove the Partition.

Try to do the same with the "ISOHybrid Data 4GB E" entry. It has an ID of 00, so I don't know whether DMDE will delete it. If not, then we can remove it manually by writing zeros to the corresponding locations in sector 0.

Now highlight the "System Reserved NTFS 367MB BF" entry and select Insert the Partition (Undelete).

Then insert the "$Noname 03 NTFS 120GB BF" partition.

Write the changes (you may need to select Edit -> Edit Mode) and eject the drive. Now reconnect it and allow the OS to mount it. Hopefully this is all that we need to do.

[fzabkar]

If you need to replace the MBR code in sector 0, then type ...

Code:

bootrec /fixmbr

http://support.microsoft.com/kb/927392

If you wish to boot from this drive, then you will also need to make the boot partition active.

[drbobbert]

Highlight the "Primary - Unknown EF" partition and select Remove the Partition.

Try to do the same with the "ISOHybrid Data 4GB E" entry. It has an ID of 00, so I don't know whether DMDE will delete it. If not, then we can remove it manually by writing zeros to the corresponding locations in sector 0.

Now highlight the "System Reserved NTFS 367MB BF" entry and select Insert the Partition (Undelete).

Then insert the "$Noname 03 NTFS 120GB BF" partition.

I was able to do all of this except for removing the "ISOHybrid Data 4GB E" partition (as you suspected, it wouldn't give me the option.) What exactly should I be replacing with zeros in sector 0?

Thanks again for your help so far, really appreciate it.

[fzabkar]

I was able to do all of this except for removing the "ISOHybrid Data 4GB E" partition (as you suspected, it wouldn't give me the option.) What exactly should I be replacing with zeros in sector 0?

Could you upload a screenshot of sector 0 in hexadecimal mode?

BTW, can you now see the drive's file system in My Computer?

[drbobbert]

I've attached a screenshot of Sector 0 in hexadecimal mode, as well as a screenshot of the partition list after the changes. Just let me know if you need any other info! Also, it's not showing up in windows explorer yet.

Attachments

[fzabkar]

Change this ...

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000001C0  13 2C 07 21 E0 FF 00 F8 0A 00 00 48 EE 0D 00 FE
000001D0  FF FF 00 FE FF FF F4 00 00 00 00 F8 00 00 00 00

... to this:

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000001C0  13 2C 07 21 E0 FF 00 F8 0A 00 00 48 EE 0D 00 00
000001D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[drbobbert]

Made the change -- screenshot attached. (Notice that those lines were actually 000001D0 and 000001E0, rather than 000001C0 and 000001D0 -- is that alright?)

Still not showing up in windows explorer, but I can try connecting to my desktop tonight to see if it boots. Also, do I need to do anything with Sector 244? That's what's listed for ARCHISO_EFI on the partitions page. Thanks!

Attachments

[fzabkar]

All we have done is to edit sector 0. I don't believe that we need to touch anything else. That's assuming that Microsoft hasn't "repaired" anything.

AISI, the original Windows 7 MBR code has been reinstated, and the two original partitions are also present.

Does the drive appear in Disk Management, and are the partitions correctly identified?

In DMDE, if you double-click the larger partition, do you see your files and folders?

BTW, sorry about the typo.

[drbobbert]

Does the drive appear in Disk Management, and are the partitions correctly identified?

Yep! It looks like they are identified the same way that they are in DMDE. (Screenshot attached.) I see that neither has a drive letter assigned -- does that factor into them not showing up in windows explorer?

In DMDE, if you double-click the larger partition, do you see your files and folders?

I do, although they aren't right at the "top"...the file system is inside a folder called "Root." Screenshot 1 shows what I see after double clicking, and pictures 2 and 3 show the contents of Root and Metadata.

Also, you've been extremely helpful and generous with your time -- feel free to gracefully bow out if you're getting sick of the back and forth =)

Attachments

[fzabkar]

If you r-click the 111GB partition in Disk Management, are you given the option to assign a drive letter?

[drbobbert]

It does -- I just assigned a letter ("E" for now) and it's now showing up in windows explorer.

Should I try plugging it into the desktop to see if it will boot?

[fzabkar]

I just have one niggling concern.

The USB image is that of a GPT partitioned drive. Typically there will be 3 GPT related sectors at the beginning (0,1, and 2), plus there will be copies of sectors 1 and 2 at the end of the drive. If these copies exist, then they will have overwritten your data partition at the 4GB mark.

To test whether this is the case, I would use DMDE to search for the text string, "EFI PART". The first occurrence will be in sector 1 (primary GPT header). You should find the next occurrence, if it exists, within 5 minutes or so. Abort the search if it takes longer than this.

A more direct way would be to examine sector # 7808607 (= 0x77265F). This is the location of the secondary GPT header as identified in sector #1.

In DMDE, select Editor -> Goto Offset and choose sector 7808607 (decimal). If this sector is a copy of what you see in sector #1, then this means that the partition has been corrupted. In this case I would page-up and page-down around this sector, just to get an idea of the extent of the damage.

Whether or not the data partition is corrupted, you should still be able to boot your drive.

[drbobbert]

I just tried searching for "EFI PART" -- the next two occurrences after sector 1 were in sectors 49,006 and 10,427,275. (Screenshots attached...for the third occurrence I also included a couple pictures of the surrounding information.) I stopped searching at that point.

I also took a look at sector 7808607 and it does not appear to be a copy of sector 1 -- it sounds like that is a good thing? (Screenshot attached)

Attachments

[fzabkar]

I haven't seen you particular file system before, but FWIW ISTM that everything is OK.

Good luck.

[drbobbert]

Got it working -- thanks for all the help! Much appreciated.

I did run into one last error after plugging the drive into the desktop and turning it on, but was able to get it sorted by clearing the "hidden" attribute for the disk's volumes using the command line. After that everything was fine.

Thanks again!