LinuxQuestions.org - corrupted NTFS partition. could it be GRUB?

- Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)

- - corrupted NTFS partition. could it be GRUB? (https://www.linuxquestions.org/questions/linux-general-1/corrupted-ntfs-partition-could-it-be-grub-427808/)

corrupted NTFS partition. could it be GRUB?

I have a problem mounting my windows ntfs partition (/dev/hda1, c:).

I just installed Fedore Core 5, wiping out FC4 installation, as I planned.
Before that my motherboard crashed, so I put in a new one.
My FC5 is on a sata disk (/dev/sda1).

The partition just won't mount in FC5, nor on a 3.9 or 4.0 Knoppix. GRUB chainloader also displays blank screen when trying to boot from that partition, then returing to boot menu. Windows recovery console doesn't recognise the partition too.

As i do "mount -t ntfs /dev/hda1 /mnt/win_c/", with "dmesg|tail" i get:

Code:

NTFS-fs warning (device hda1): is_boot_sector_ntfs(): Invalid boot sector checksum.

NTFS-fs error (device hda1): read_ntfs_boot_sector(): Primary boot sector is invalid.

NTFS-fs error (device hda1): read_ntfs_boot_sector(): Mount option errors=recover not used. Aborting without trying to recover.

NTFS-fs error (device hda1): ntfs_fill_super(): Not an NTFS volume.

The files are there, I used some system tools, and I also see them in "hexedit /dev/hda1", apparently just the first few KB of hda1 or hda are corrupted.

Could have GRUB "setup (hdx,x)" done any damage? How to fix the partition?

NTFS access problem after motherboard crash & FC5 install

What sounds very suspicious to me is the crash .. which you say happened before the install after which U replaced motherboard .

I doubt that GRUB overwrote the partition table but AFAIK Linux still has some problems on SATA disks ... so cant rule that out .

Cant help lot but recommend testdisk to recover any partitions ... (never exec DOS fdisk/mbr for than once !!! - it ate my table :D) ... .

If you forcibly do a Grub "setup (hdx,x)" with the Windows NTFS partition you then ask Grub to install itself into the first 512 byte of that partition. In so doing you could have destroyed part of the Windows boot loader rendering its boot sector imcompatible with the partition content (A Linux's boot loader at the front with NTFS data following).

Such partition cannot be mounted because the boot sector (also called the superblock) is regarded as corrupted since the information from the area occupied by Grub does not match the partition interior and no OS would know what to do.

I am not entirely sure if it works but if you boot up the Windows installation CD and drop into the recovery console the "fixboot" command is supposed to fix this problem.

fixboot has a very poor record if grub has overlaid the boot sector record. Try it though. Perhaps try also try the following from a Knoppix terminal, and post the output (info only, won't solve anything);

Code:

dd if=/dev/hda1 bs=512 count=1 | hd

It worked.

I repaired my partition with:

Code:

# dd if=/dev/hda5 of=/dev/hda1 bs=512 count=1

And that was all. First I made backups, of course:

Code:

# dd if=/dev/hda1 of=/root/backupA1.pbr bs=512 count=1

The problem arose from my "setup (hd0,0)" instead of "setup (hd0)", overwriting
first 512 bytes of ntfs boot partition (MBR was ok, GRUB on it). Windows's fixboot did not work, because it wanted to repair some G: instead of C: partition.

Thank you very much to all. I now also know about testdisk. Now I have a working windows partition
and it boots (btw. i've had to reboot 5 times just to get the new motherboard drivers to install :).

And for anyone looking at this thread with similar problem...
The corrupted hda1 sector looked (before repair):

Code:

# dd if=/dev/hda1 bs=512 count=1

�NTFS  ??�

          NG.ʀ�|1؎м @|<t�y}��tTAUZRrIUuCA|�t7fL|�fD|�f�pf1    DfD

                                                                  Brps

���|�f�fD1��@�ffD|f1��T

f1��T

    D

�L    ;}<T

ъl

  Zt

    p�۸r*ÎH|`��a&B|}�}�}�}��GRUB GeomHard DiskRead Error<u�DR is compressed

Press Ctrl+Alt+Del to restart



# dd if=/dev/hda1 bs=512 count=1 | hexdump

0000000 48eb 4e90 4654 2053 2020 0020 0802 0000

0000010 0000 0000 f800 0000 003f 00ff 003f 0000

0000020 0000 0000 0080 0080 edeb 04e1 0000 0000

0000030 0000 000c 0000 0000 1ede 004e 0000 0203

0000040 0082 8000 2e47 0058 0800 80fa 80ca 53ea

0000050 007c 3100 8ec0 8ed8 bcd0 2000 a0fb 7c40

0000060 ff3c 0274 c288 be52 7d79 34e8 f601 80c2

0000070 5474 41b4 aabb cd55 5a13 7252 8149 55fb

0000080 75aa a043 7c41 c084 0575 e183 7401 6637

0000090 4c8b be10 7c05 44c6 01ff 8b66 441e c77c

00000a0 1004 c700 0244 0001 8966 085c 44c7 0006

00000b0 6670 c031 4489 6604 4489 b40c cd42 7213

00000c0 bb05 7000 7deb 08b4 13cd 0a73 c2f6 0f80

00000d0 f084 e900 008d 05be c67c ff44 6600 c031

00000e0 f088 6640 4489 3104 88d2 c1ca 02e2 e888

00000f0 f488 8940 0844 c031 d088 e8c0 6602 0489

0000100 a166 7c44 3166 66d2 34f7 5488 660a d231

0000110 f766 0474 5488 890b 0c44 443b 7d08 8a3c

0000120 0d54 e2c0 8a06 0a4c c1fe d108 6c8a 5a0c

0000130 748a bb0b 7000 c38e db31 01b8 cd02 7213

0000140 8c2a 8ec3 4806 607c b91e 0100 db8e f631

0000150 ff31 f3fc 1fa5 ff61 4226 be7c 7d7f 40e8

0000160 eb00 be0e 7d84 38e8 eb00 be06 7d8e 30e8

0000170 be00 7d93 2ae8 eb00 47fe 5552 2042 4700

0000180 6f65 006d 6148 6472 4420 7369 006b 6552

0000190 6461 2000 7245 6f72 0072 01bb b400 cd0e

00001a0 ac10 003c f475 00c3 0000 0000 0000 0000

00001b0 0000 0000 0000 0000 5244 6920 2073 6f63

00001c0 706d 6572 7373 6465 0d00 500a 6572 7373

00001d0 4320 7274 2b6c 6c41 2b74 6544 206c 6f74

00001e0 7220 7365 6174 7472 0a0d 0000 0000 0000

00001f0 0000 0000 0000 0000 a083 c9b3 0000 aa55

0000200

alesz,

Good reply.

I didn't realise you have a duplicate of the XP boot sector in hda5 for transferring to hda1.

As a matter of interest hda5, for being the 5th partition, is a logical partition. Did you install XP in a logical partition?

saikee,

I have main Windows XP installation on hda1, but keep my document files on hda5, by soft linking to them (linux's ln=windows's junction.exe, third party download). Both are ntfs partitions, hda5 being on a logical hda2 partition:

Code:

  Device Boot      Start        End      Blocks  Id  System

/dev/hda1  *          1        5099    40957686    7  HPFS/NTFS

/dev/hda2            5100        9732    37214572+  f  W95 Ext'd (LBA)

/dev/hda5            5100        9732    37214541    7  HPFS/NTFS

As hda5 is a ntfs partition, by copying the 512B header from it I was able to mount the hda1 partition under Linux.

Unfortunately (for me to completely answer your question) after doing that I was not sure wether hda1 will boot right away, so I repaired the hda1 partition with the suggested testdisk, as it was so easy to install testdisk under my FC5. After dd+testdisk, windows was able to boot normally.
But I am not sure if dd repaired the boot problem totally or if the testdisk helped anyhow.

At this time (after being rebooted to windows and back to linux), my hda1 and hda5 headers differ only in first few bytes:

beggining of hda1:

Code:

0000000 52eb 4e90 4654 2053 2020 0020 0802 0000

0000010 0000 0000 f800 0000 003f 00ff 003f 0000

0000020 0000 0000 0080 0080 edeb 04e1 0000 0000

0000030 0000 000c 0000 0000 1ede 004e 0000 0000

beggining of hda5:

Code:

0000000 52eb 4e90 4654 2053 2020 0020 0802 0000

0000010 0000 0000 f800 0000 003f 00ff 003f 0000

0000020 0000 0000 0080 0080 b299 046f 0000 0000

0000030 0000 000c 0000 0000 fb29 0046 0000 0000

Comparing hexdumps of both headers (stored in utility files a1d and a5d):

Code:

diff a1d a5d

3,4c3,4

< 0000020 0000 0000 0080 0080 edeb 04e1 0000 0000

< 0000030 0000 000c 0000 0000 1ede 004e 0000 0000

---

> 0000020 0000 0000 0080 0080 b299 046f 0000 0000

> 0000030 0000 000c 0000 0000 fb29 0046 0000 0000

When looking to this difference, I could conclude two things:
- wheter the Windows boot or new driver install changed those 8 bytes or
- testdisk changed the hda1 header before the Windows boot (now I belive it's this option).

So probbably it was like that: dd made my partition mountable, testdisk made it bootable.

Whoa ... I'm surprised that worked.
I'd have been tempted to run a fixboot after the copy back to hda1. Still, it's bootable, and that was the desired result.