Recently, a friend's XP computer started to refuse booting, both in regular and Safe Boot modes: the windows logo appears, then the progress bar hangs, a BSOD is shown for a few milliseconds, reporting that an unmountable boot volume, and the computer reboots.
The drive has two partitions, a system one and a data one, both formatted as NTFS.
I've rescued the data, but I'm interested in learning about what I might have done wrong, or what I could do to make the computer boot again (except formatting the drive, of course)
Here is a summary of all the steps I took since the drive the problems started, about two days ago. Can you suggest other solutions that I could try?
First, I booted from a Ubuntu live CD to backup the data. I tried to ntfsclone --rescue the system partition (it reported bad sectors), but it didn't work: ntfsclone reported extra clusters in $bitmap. So I mounted the system partition read-only and could recover all the files without problems. ntfsclone worked perfectly on the data partition. ntfsresize -i reported that the disk had bad sectors, and suggested to use chkdsk.
Second, I booted XP's recovery console, and ran chkdsk. That took about an hour to complete. After that, the system booted correctly until the "please wait..." screen, and the computer restarted. All subsequent attempts to boot Windows resulted in the aforementioned BSOD.
Third, I tried to re-run chkdsk, but it reported that the drive had "unrecoverable problems". Running fixmbr and fixboot didn't help.
Fourth, I ran TestDisk from my Ubuntu LiveCD, and rewrote the MBR, the MFT, and the partition table. Which didn't do anything. I also tried ntfsfix, to no avail.
Fifth, I ran badblocks in read-only mode. It reported a number of bad sectors on the drive. So I ran a non-destructive read-write test (-n) to force the drive to remap the bad sectors. badblocks returned one bad sector this time. I retried chkdsk; that didn't work. However, ntfsclone now accepts to clone my system partition.
Sixth, I ran SMART tests on the drive (using smartctl) to check if it was a hardware failure. The short tests passed, and the overall health assessment passed too (-H). The long tests are currently running. I've also downloaded and burnt a liveCD containing Hitachi hard drive tests, which I plan to run once the long tests are over.
I think that's pretty much everything I did. Could you suggest ideas that I could try to make Windows boot again? I'm out of ideas. I know that reinstalling Windows would be the easiest way, but I find it fun to try to diagnose the roots of the problem, and possibly fix it by hand instead of just wiping the drive and starting over.
Thanks for your help (hope you like the challenge!)
Answer
ChkDsk probably ditched all recoverable data when it 'fixed' any bad sectors it may have found, so I wouldn't expect the remaining file system to boot ever again (due to now-missing data). I would recommend using SpinRite in the future which, unlike ChkDsk, would try to recover the data in the bad sectors before marking them as bad.
Also, perhaps you could have tried Hitachi's Drive Fitness Test HDD Diagnostics, to ensure the drive doesn't have an physical problems, before trying to beat the file system back into place.
For now I'd say test the drive throughly (with Hitachi's diags), and if it comes out good format it, reinstall and restore from the backups.
No comments:
Post a Comment