Need to restore my windows xp mbr

Try looking for help here if you are having problems with the Ultimate Boot CD.

Moderators: Icecube, StopSpazzing

Locked
Message
Author
m_debator
Posts: 2
Joined: Mon Jun 16, 2008 4:19 am

Need to restore my windows xp mbr

#1 Post by m_debator » Mon Jun 16, 2008 5:05 am

This has been very very frustrating. It all started from a very nasty virus. I then installed pclinuxos to try to get rid of the virus...somehow I corrupted the mbr. What can I do to restore my mbr? Are there any particular steps that I need to follow?


When I try running the salvation hdd scan and repair program it can't find a hard drive. I've also tried super grub to no avail


here is my yahoo messenger account if anyone can help...very desperate

anst0ni0 (yahoo)

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

#2 Post by Icecube » Mon Jun 16, 2008 1:26 pm

Testdisk can do it.
MBRtool and MBRWork maybe.

Boot in the recovery console of your windows 2000/XP installation and type "fixmbr". Maybe a "fixboot" can help to.
FIXBOOT
fixboot drive name:
Use this command to write the new Windows boot sector code on the system partition. In the command syntax, drive name is the drive letter where the boot sector will be written. This command fixes damage in the Windows boot sector. This command overrides the default setting, which writes to the system boot partition. The fixboot command is supported only on x86-based computers.

FIXMBR
fixmbr device name
Use this command to repair the MBR of the boot partition. In the command syntax, device name is an optional device name that specifies the device that requires a new MBR. Use this command if a virus has damaged the MBR and Windows cannot start.

Warning This command can damage your partition tables if a virus is present or if a hardware problem exists. If you use this command, you may create inaccessible partitions. We recommend that you run antivirus software before you use this command.

You can obtain the device name from the output of the map command. If you do not specify a device name, the MBR of the boot device is repaired, for example:
fixmbr \device\harddisk2
If the fixmbr command detects an invalid or non-standard partition table signature, fixmbr command prompts you for permission before rewriting the MBR. The fixmbr command is supported only on x86-based computers.
More information about the recovery console, see http://support.microsoft.com/kb/314058.

m_debator
Posts: 2
Joined: Mon Jun 16, 2008 4:19 am

here goes

#3 Post by m_debator » Mon Jun 16, 2008 2:59 pm

EDIT - After using the mbr function and it not working I rebooted back into ultcd and ran testdisk again...this time around it shows "No Partition is Bootable

Now the partition table looks like this


Partition Start End Size in sectors
* linux 0 1 1 1018 254 63 16370172
E Extended LBA 1019 0 14592 254 63 218066310
L Linux Swap 1019 1 1 1527 254 63 8177022
L Linux 1528 1528 1 1 14592 254 63 209889162 - EDIT

What should I do?

I'll try testdisk again. When I did it last time I got a 1234f. I googled this and learned that I need to press one of the keys (1234f) to try to get the machine to load a partition in there. Now while I am in there I selected anaylze and I got "partition sector doesn't have the endmark 0xaa55" (Maybe this is from installing pclinuxos, I did this so that I could originally run testdisk to fix the mbr). When I proceed I see:


Partition Start End Size in sectors
* linux 0 1 1 1018 254 63 16370172
L Linux Swap 1019 1 1 1527 254 63 8177022
L Linux 1528 1528 1 1 14592 254 63 209889162


Just to fancy my curiosity I clicked t to change the partition type and I see a whole bunch of different partition types. Should I change the partition type? To maybe fat32 or ntfs?

Now without changing anything I have selected the mbr to load a new mbr and I get this prompt: 1234f and nothing else. This is a little weird, before when I would press the 2 key, it would at least do something. When I press the 2 key it just repeats the 1234f prompt.

Thanks

anst0ni0 (yahoo)
Icecube wrote:Testdisk can do it.
MBRtool and MBRWork maybe.

Boot in the recovery console of your windows 2000/XP installation and type "fixmbr". Maybe a "fixboot" can help to.
FIXBOOT
fixboot drive name:
Use this command to write the new Windows boot sector code on the system partition. In the command syntax, drive name is the drive letter where the boot sector will be written. This command fixes damage in the Windows boot sector. This command overrides the default setting, which writes to the system boot partition. The fixboot command is supported only on x86-based computers.

FIXMBR
fixmbr device name
Use this command to repair the MBR of the boot partition. In the command syntax, device name is an optional device name that specifies the device that requires a new MBR. Use this command if a virus has damaged the MBR and Windows cannot start.

Warning This command can damage your partition tables if a virus is present or if a hardware problem exists. If you use this command, you may create inaccessible partitions. We recommend that you run antivirus software before you use this command.

You can obtain the device name from the output of the map command. If you do not specify a device name, the MBR of the boot device is repaired, for example:
fixmbr \device\harddisk2
If the fixmbr command detects an invalid or non-standard partition table signature, fixmbr command prompts you for permission before rewriting the MBR. The fixmbr command is supported only on x86-based computers.
More information about the recovery console, see http://support.microsoft.com/kb/314058.

Icecube
Posts: 1278
Joined: Fri Jan 11, 2008 2:52 pm
Contact:

Re: here goes

#4 Post by Icecube » Tue Jun 17, 2008 12:44 pm

I think that you have installed pclinuxos on your hard drive (no windows files available).

Look at http://www.cgsecurity.org/wiki/TestDisk (Documentation ==> using testdisk). Read everything carefully and try it.

If you want to recover your files that were on the windows partition which is gone, I suggest that you use photorec http://www.cgsecurity.org/wiki/PhotoRec (also included in ubcd ==> first start testdisk and go to quit, then type photorec at the command prompt). But you need an external hard disk to save the recovered files. Never save them on the partition from which you are recovering, because it will overwrite the file that are not recovered yet. I don't know if freedos will see the external hard drive. But you can boot the pclinuxos cd and install testdisk and photorec from there and use it from there. Pclinuxos will recognize your drive.

Locked