Boot Sector problem

[M4LMiniMe]

I had a virus destroy my ntfs boot sector of the hard drive and it swithched it to fat32. is there a way to restore the ntfs boot sector so i can get back to windows xp. thanks minime

 

[Smilin]

If it switched your drive to fat32, it likely destroyed your MBR and partition table off of sector 0. Your ntfs boot sector is typically located at sector 63. There is a backup copy of the boot sector located at the very last sector of the partition as well. You can use that.

You are going to need to rebuild your partition table by hand and walk the disk to find out where your partitions should begin and end. The guys at Microsoft enterprise tech support can do this for you if you're not comfortable doing it yourself.

Of course this also assumes that sector 0 is the only place you have damage

Is this a Basic or Dynamic disk?
What is the exact error message you get at boot?

 

[M4LMiniMe]

Sorry i took so long to relpy to many things went worng in my main pc. It say Invalid system disk
Replace the disk, and press any key

 

[Smilin]

Have you by chance run an fdisk /mbr during your troubleshooting?

 

[Sianath]

If you can plug the disk into a good machine, run the MPS Reports utility (search for mpsreports on the http://support.microsoft.com website) after booting with that disk connected. PM me the sector inspector output along with which physical disk our bad disk is (you can check by running diskmgmt.msc from the run line) and I'll take a look if you like.

If the MBR is indeed mangled, sector inspector won't be able to walk the disk and find the boot sector, so that tool won't verify if that is any good. If that's the case, you'll have to use something like DiskProbe to gather the information for what is at Sector 63.

 

[M4LMiniMe]

yeah i ran it and it the next thing it said is C:/
after typeing fdisk /mbr that is what i got.

 

[M4LMiniMe]

these are the files i got
boot_ini
config_auto
Drivers
Drivers
EventApplication
Event system
gotfix
iebrndlog
iefiles
iefiles
iepolicyreg
ipsec
misc
msinfo32
nertinfo
printdrivers
printkey
process
process
progress
pstat
recovery
schedlgu
schedule
security.evt
setupact
svcpack
sysinfo
system32
system32
system.evt
termserv
tracing

 

[Nuker43]

interesting...

 

[M4LMiniMe]

Where can i get this DiskProbe.

 

[Smilin]

Originally posted by: M4LMiniMe
yeah i ran it and it the next thing it said is C:/
after typeing fdisk /mbr that is what i got.

Ok, you can't really do that (fdsik /mbr) on an an XP machine. You have overwritten your NT/2k/XP boot code with dos/Windows 9x boot code. That's why you are getting an "invalid system disk" error.

Since you are at the point of needing a new MBR and already an inch away from needing diskprobe to sort this out you may need to run FIXMBR to get your MBR back in order. Follow Sianaths suggestions to get an MPS report before you start. If the end of sector marker for sector 0 is gone, a FIXMBR will destroy your partition table. The MPS reports will contain enough information to fix it.

 

[M4LMiniMe]

can i boot from a shadow mbr

 

[Sianath]

Not sure I follow.

On a side note, to bypass the MBR, you can format a floppy disk and copy ntldr, ntdetect.com, and boot.ini to the disk. Make sure the boot.ini is edited to reflect the proper boot partition. This isn't a permanent solution obviously, but it does bypass the MBR.

 

[imported_Onizuka]

You can also reload the WinXP mbr by booting from cdrom with the WinXP cd inside. After that, just pick the rescue option and follow through until you get to the command prompt and type fixmbr. That should load back the WinXP mbr.

 

[Sianath]

Smilin pointed that out. The downside is that if the end-marker for the MBR (in hex, a 55 aa) is missing, the fixmbr command will overwrite partition definition information.

Hence the request for the MPS Reports data (or at least the sector inspector output).

 

[M4LMiniMe]

thank you for all your help... i was able to repair the boot sector using the xp cd. i had to type boot fix and the program rewtires the hard drive sector.