'NTLDR missing' booting XP with grub

galle · 01-01-2007, 02:35 PM

Hello,

I know this has been asked before, but after reading the other posts I still have some questions so please bear with me.

Some days ago I wanted to boot XP and got this error message from grub:

Code:

root (hd0,0)
         Filesystem type unknown, partition type 0x7
(....)
NTLDR is missing
Press CTRL+ALT+DEL to restart

I have no problem mounting the windows partition in linux. What puzzles me is, I don't understand how my MBR got screwed up. The only thing I can think of is I did an 'apt-get upgrade' the day before and updated over 300 packages. Perhaps grub got updated and this messed up something? But in that case shouldn't I be able to fix it without having to deal with the windows recovery and fixmbr?

The boot entries from my menu.lst are:

Code:

title		Debian GNU/Linux, kernel 2.6.18-3-amd64
root		(hd0,4)
kernel		/boot/vmlinuz-2.6.18-3-amd64 root=/dev/sda5 ro vga=795
initrd		/boot/initrd.img-2.6.18-3-amd64
savedefault

title		Debian GNU/Linux, kernel 2.6.18-3-amd64 (recovery mode)
root		(hd0,4)
kernel		/boot/vmlinuz-2.6.18-3-amd64 root=/dev/sda5 ro single
initrd		/boot/initrd.img-2.6.18-3-amd64
savedefault

title		Debian GNU/Linux, kernel 2.6.15-1-amd64-generic
root		(hd0,4)
kernel		/boot/vmlinuz-2.6.15-1-amd64-generic root=/dev/sda5 ro vga=795
initrd		/boot/initrd.img-2.6.15-1-amd64-generic
savedefault

title		Debian GNU/Linux, kernel 2.6.15-1-amd64-generic (recovery mode)
root		(hd0,4)
kernel		/boot/vmlinuz-2.6.15-1-amd64-generic root=/dev/sda5 ro single
initrd		/boot/initrd.img-2.6.15-1-amd64-generic
savedefault

title		Debian GNU/Linux, kernel 2.6.12-1-amd64-generic
root		(hd0,4)
kernel		/boot/vmlinuz-2.6.12-1-amd64-generic root=/dev/sda5 ro vga=795
initrd		/boot/initrd.img-2.6.12-1-amd64-generic
savedefault

title		Debian GNU/Linux, kernel 2.6.12-1-amd64-generic (recovery mode)
root		(hd0,4)
kernel		/boot/vmlinuz-2.6.12-1-amd64-generic root=/dev/sda5 ro single
initrd		/boot/initrd.img-2.6.12-1-amd64-generic
savedefault

### END DEBIAN AUTOMAGIC KERNELS LIST

# This is a divider, added to separate the menu items below from the Debian
# ones.
title		Other operating systems:
root


# This entry automatically added by the Debian installer for a non-linux OS
# on /dev/sda1
title		Microsoft Windows XP Professional
root		(hd0,0)
savedefault
makeactive
chainloader	+1

pixellany · 01-01-2007, 04:59 PM

If you can boot into Linux, then there is nothing wrong with the MBR.

What maybe is missing is the NTLDR code which normally sits in the boot sector (ie the first sector) of the Windows partition. To see what is there, do this:
dd if=/dev/sda1 | hexdump -C | more

Here are a few selected lines from my system:
00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |ëR.NTFS .....|
000001f0 00 00 00 00 00 00 00 00 83 a0 b3 c9 00 00 55 aa |......... ³É..Uª|
00000200 05 00 4e 00 54 00 4c 00 44 00 52 00 04 00 24 00 |..N.T.L.D.R...$.|
00000210 49 00 33 00 30 00 00 e0 00 00 00 30 00 00 00 00 |I.3.0..à...0....|

You may need to restore the Windows NTLDR, but I am not sure that is possible without also restoring the mbr, which in turn will require you to re-install GRUB.

syg00 · 01-01-2007, 06:03 PM

Quote:

Originally Posted by pixellany

What maybe is missing is the NTLDR code which normally sits in the boot sector (ie the first sector) of the Windows partition.

Not stricly true. The boot sector contains code to locate ntldr - and in fact it is this code that issues the message the OP is seeing.
Getting a message like that might mean you are chain-loading to the wrong partition - usually something like a vendor (recovery) partition.
Check if this is the case.

galle · 01-02-2007, 04:58 AM

Thanks for the replies guys!

syg00: The XP partition is on sda1 and grub is looking for it on hda(0,0). That's correct isn't it?

pixellany: The hexdump from sda1 reads:

Code:

00000000  eb 52 90 4e 54 46 53 20  20 20 20 00 02 08 00 00  |.R.NTFS    .....|
00000010  00 00 00 00 00 f8 00 00  3f 00 ff 00 3f 00 00 00  |........?...?...|
00000020  00 00 00 00 80 00 80 00  26 79 1a 06 00 00 00 00  |........&y......|
       .
       .
       .
00000170  b4 01 8b f0 ac 3c 00 74  09 b4 0e bb 07 00 cd 10  |.....<.t........|
00000180  eb f2 c3 0d 0a 41 20 64  69 73 6b 20 72 65 61 64  |.....A disk read|
00000190  20 65 72 72 6f 72 20 6f  63 63 75 72 72 65 64 00  | error occurred.|
000001a0  0d 0a 4e 54 4c 44 52 20  69 73 20 6d 69 73 73 69  |..NTLDR is missi|
000001b0  6e 67 00 0d 0a 4e 54 4c  44 52 20 69 73 20 63 6f  |ng...NTLDR is co|
000001c0  6d 70 72 65 73 73 65 64  00 0d 0a 50 72 65 73 73  |mpressed...Press|
000001d0  20 43 74 72 6c 2b 41 6c  74 2b 44 65 6c 20 74 6f  | Ctrl+Alt+Del to|
000001e0  20 72 65 73 74 61 72 74  0d 0a 00 00 00 00 00 00  | restart........|
000001f0  00 00 00 00 00 00 00 00  83 a0 b3 c9 00 00 55 aa  |..............U.|
00000200  05 00 4e 00 54 00 4c 00  44 00 52 00 04 00 24 00  |..N.T.L.D.R...$.|
00000210  49 00 33 00 30 00 00 e0  00 00 00 30 00 00 00 00  |I.3.0......0....|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000250  00 00 00 00 00 00 eb 12  90 90 00 00 00 00 00 00  |................|
00000260  00 00 00 00 00 00 00 00  00 00 8c c8 8e d8 c1 e0  |................|

Difficult to say if it is correct or not, but at least it is almost identical to your lines. Could that star in the middle indicate some problem?

pixellany · 01-02-2007, 07:39 AM

Quote:

Originally Posted by syg00

Not stricly true. The boot sector contains code to locate ntldr - and in fact it is this code that issues the message the OP is seeing.

I think you are right---there is code in sector 1, and NTLDR seems to start in sector 2.

Galle;
The * means that hexdump found all zeros. If you send me the complete dump of the first 10 sectors, I can compare to mine.
dd if=/dev/sda1 of=sda1_dump bs=512 count=10

Sending you an address by e-mail (you can't do attachments thru LQ mail)

pixellany · 01-02-2007, 11:43 AM

OK---Galle's boot sector code does not match mine. I also now question some of my earlier assumptions about how things work. Some references talk about the boot sector and how it finds ntldr. Well, ntldr is a file in the Windows filesystem. So now I am no longer sure about how much of the stuff in the first few sectors of the partition is relevant.

In any case, I would next try fixmbr and Other Windows command to restore the boot sector. (Make a GRUB boot floppy first, so you can get into Linux.)

galle · 01-02-2007, 12:47 PM

Yes, I guess I'll have to resort to the windows rescue disc. It's just a bit annoying to not know how this happened in the first place.

Thank you for your suggestions. It was very appreciated.

syg00 · 01-02-2007, 04:00 PM

Only time I've heard something like this is if grub was installed (erroniously) to the XP partition (rather than the MBR) and "fixboot" run.
Grub overwrites too many sectors for "fixboot" to recovery properly - sometimes 'fixboot" works, sometimes not.
I haven't tested for this specifically, so can't say; another on my list of things to do.

galle · 01-05-2007, 08:42 AM

Sorry for the late conclusion. Well it seems ntldr is a file which somehow had gotten corrupted (not very comforting for the integrity of my system...). After replacing that file and a ntdetect.com everything worked like normal.

ealvinoq · 12-08-2009, 02:54 PM

Quote:

Originally Posted by pixellany

I think you are right---there is code in sector 1, and NTLDR seems to start in sector 2.

Galle;
The * means that hexdump found all zeros. If you send me the complete dump of the first 10 sectors, I can compare to mine.
dd if=/dev/sda1 of=sda1_dump bs=512 count=10

Sending you an address by e-mail (you can't do attachments thru LQ mail)

hello, i hope you could help me give any advice
i left you my sdc2_dump (partition winxp 32 bits) file.

See you

Simon Bridge · 12-23-2009, 04:43 PM

Quote:

Originally Posted by syg00

Only time I've heard something like this is if grub was installed (erroniously) to the XP partition (rather than the MBR) and "fixboot" run.

I am starting to see this sort of thing when the user has more than one version of windows installed and has set up windows dual boot in one of the installs. I suspect that this process removes ntldr from the extra installs - so they all share a stage 2 bootloader - instead of chainloading like we do. This makes sense because we often have multiple gnu/linux boots share a single grub.

It is unfamiliar because, historically, windows has been multi-boot hostile. Now it is just multi-OS hostile

I have particularly associated this with installs that include Windows 2000.

If a windows boot would normally provide a menu of choices of window OSs, then it is often easier to just point a grub "windows" entry at that loader and use that to boot windows installs.

More in line with your observation - I also see this with mixed pata/sata setups ... grub seems to get confused and write to the wrong drive or the wrong place. Even with grub2, which is much better at this, I have had to disconnect one of the drives to get grub in the correct place.

Erik_FL · 12-23-2009, 05:52 PM

Another thing to watch out for is if you change the boot order in your BIOS so that a different hard disk appears first, the BIOS drive IDs assigned to disks may change. Usually the drive that the BIOS tries to boot first is assigned drive ID 80 (hex). If you install any kind of boot loader and then change the order that the BIOS tries to boot hard disks, the installed boot loader may no longer work.

For example, with two hard disks containing Windows and Linux on each disk, you might have this.

With the Linux disk first in the BIOS boot order:

80 (hd0) - Linux
81 (hd1) - Windows

With the Windows disk first in the BIOS boot order:

80 (hd0) - Windows
81 (hd1) - Linux

If you have three disks then the ID assigned to even a non-boot disk may change when the drive IDs are shuffled.

To avoid those kinds of problems decide what order you want the hard disks to be booted by the BIOS and then make sure that the same hard disk is always first. If you change the hard disk boot order you may have to reinstall GRUB or change how it chains to the Windows partition boot sector.

Windows always writes the boot code into the first 16 NTFS partition sectors even if you aren't formatting the first partition on the first hard disk. You can also create a floppy disk containing the three files (NTLDR, NTDETECT.COM, BOOT.INI). As long as you format the floppy using Windows, it will put boot code in the floppy's first sector. You can use the floppy to boot Windows even when the boot code or NTLDR is not on the hard disk. You DO still need all the required files in the "WINDOWS" folder on the hard disk in order to boot with the floppy.

Windows Vista and Windows 7 use "bootmgr" and that can't be loaded from a floppy. Windows 7 tries to create a 200MB hidden boot partition containing "bootmgr" at the beginning of the hard disk. The Windows boot sector is still in (hd0,0) in that case but Windows is in (hd0,1) and Linux is in (hd0,2) if you create a Linux partition on the first hard disk.

When Windows formats an NTFS partition it assumes that the drive ID of the boot drive is 80 (hex). When NTLDR or "bootmgr" is not on drive 80 (hex) then you have to patch the drive ID in the boot sector (on the hard disk or in the file used to chain). For example, if you change your disk boot order in the BIOS so that the Windows hard disk is second (81 hex) then even if Linux chains to the correct boot sector (hd1,0) that boot sector will have the wrong drive ID to load NTLDR or "bootmgr" since it will have ID 80 (hex). Although you can use NTLDR or "bootmgr" on some hard disk other than the first one, you need a patched boot sector to start NTLDR or "bootmgr". It's better to create files with copies of boot sectors, and then patch the files rather than patching the actual boot sectors. GRUB can chain to a file as easily as a boot sector. You can also rearrange drive IDs in GRUB so that the drive ID is correct when it chains to the Windows boot sector.