Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unable to boot into anything resembling windows


  • This topic is locked This topic is locked
71 replies to this topic

#1 Nick10213

Nick10213

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 25 July 2013 - 06:44 PM

I've recently had assistance with virus/spyware removal here, although the name of the issue was never given, only solutions (which I am grateful for, but I don't have the name of the virus(es) that were fixed).  Anyway, the same machine exhibited the same symptoms as before (periods of total unresponsiveness), though this time for only a day.  I tried running recovery console with no success; it wouldn't load.  The only boot CD I have is a windows defender boot cd, and when I load it, I get the following:

 

 

Windows Defender Offline cannot be started

Error: Unable to detect a Windows system drive.  This could be due to missing drivers, an encrypted drive, or a corrupted Windows installation.

Error Code: 0x8004cc01

 

 

The virus/spyware that caused the previous issue also caused some white text on the bottom right corner of the desktop saying something about "This build of Windows 7 is not genuine" (or something similar, along with version information).

The help I received previously was great, but the issue is back.  I have Norton, and was instructed to disable it, but turning it back on was never mentioned or addressed even though I asked the person helping me about 3 times.  Any help offered would be incredible.

Thank you,

Nick

(If I should post this as a continuation of the thread where I was previously being assisted, please let me know and I'll continue it there)



BC AdBot (Login to Remove)

 


#2 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 27 July 2013 - 09:57 PM

"Windows" no longer recognizes that I have a hard drive attached (it's in quotes because I can't get into windows, but I have a copy of the recovery environment on cd; when I open notepad from command line, my flash drive is now c:\, and there is no hard drive listed).  When run the Ubuntu live CD, it lists my hard drive as 250 GB Volume.  It displays the folders, but any attempt to click them freezes Ubuntu.  I'm leaving the computer alone entirely until instructed to do something else before I ruin it.


Edited by Nick10213, 27 July 2013 - 09:58 PM.


#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,662 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:28 PM

Posted 30 July 2013 - 06:45 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/502250 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 30 July 2013 - 07:27 PM

In regards to step 2.1 listed above:

     First: I do believe this was initially caused by a virus, but if this would be better suited to another forum, I would be happy to move this post there.  I'm running on a Dell Latitude E600 series (I don't have the exact number) with Windows 7, 32 bit.  My current problem is that my computer doesn't recognize my hard drive or windows outside of Ubuntu.  I'm fairly certain even BIOS does not recognize it (I've run the dell BIOS diagnostic and it claims there is no hard drive).  However, when I run various checks and scans in Ubuntu, it can see the drive, but the problem there is that I can't access the drive; I can receive information about it through scans, I think it even recognizes that windows is on it, but if I open a window and click on a folder in the drive (listed as 250 GB volume instead of by a letter) it freezes.  The only windows boot-related cd I had at the time (a windows defender cd) could not recognize that windows was on the computer.  I recently downloaded an iso of a windows recovery environment (not something I usually do, but I'm desperate), and it also cannot recognize a windows installation.  So far, the only access I have into that hard drive is through Ubuntu, an OS I am very minimally acquainted with.

 

     Steps I have taken to resolve the issue:

 

The original issue produced an unbootable computer, along with some error messages when I tried to run my Windows Defender disk, which I have typed out above in the original post.  With no success there, I went to Ubuntu to find some programs that would allow me to boot into windows.  I found one called "Boot Repair" that seemed like it would resolve the issue, but didn't.  After that, the computer didn't recognize the hard drive at all, except for in Ubuntu as "250 GB volume" rather than by a letter association. "Boot Repair" produced a log; I'll post it at the end of this.  The log is from the second time I ran it.  I have also contacted the manufacturer (Dell) to attempt to get some recovery media.  They are mailing me "OS Installation disks and hard drive;"  I'm a little concerned with taking that solution.  They want me to replace the hard drive, which will cause data loss on my end.  Also, the response claims "if Dell determines the fault is due to customer-induced damage, which is not covered by your limited warranty, we will inform you for the cost that you might incur."  This is not ideal either, as the damage probably is my fault, and I'm not exactly sure how much they want from me (something I plan to find out very quickly).  I've ran some scans with Ubuntu (fschk) which is like chkdsk for windows (so I've been told).  If the results of that are of interest to anyone, I can post them.  Basically, they're bad.

 

 

Step 2.2

    I don't believe I can get dds to run because I can't get windows to work.  If it will run in Ubuntu or if there is an equivalent log I can run in that OS, I would be happy to.

Step 2.3

    No, I don't have the installation disks, but as I stated above, they are in the mail and should be here by 8/1, along with a replacement hard drive.

Having said all that, here is the only log I've produced (which may or may not have information you need).  If there is any other information I can give you that would be helpful, please let me know.

"Boot-Repair" log:
http://paste.ubuntu.com/5926492/

 

 

My drive is labeled sdb in the log.  Sda is a small flash drive.



#5 whoabuddy

whoabuddy

    Bleepin' Verbose


  • Malware Response Instructor
  • 2,053 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cottonwood, AZ
  • Local time:05:28 PM

Posted 31 July 2013 - 08:08 AM

Hello Nick10213,

:welcome: to Bleeping Computer!

My name is whoabuddy and I will be assisting you today. Before we get started, please keep the following in mind while I am helping you to make things go easier and faster for both of us.


Please do not run any tools unless instructed to do so.

We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.

Please do not attach logs or use code boxes, just copy and paste the text.

Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.

Please read every post completely before doing anything.

Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process. Also watch for items italicized or in green[/i], these entries are notes to help explain the process or common occurrences.

Please provide feedback about your experience as we go.

A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of headaches as we go along. For more information about backing up your system, please review the links in the first item of the Malware Removal Preparation Guide.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Please respond and acknowledge that you have read my introduction and I will begin reviewing your logs so we can get started!

Best Regards,
whoabuddy
Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!"
If I am helping you and have not responded within 48 hours, please send me a PM.
Vi Veri Universum Vivus Vici (VVVVV)
Excellent Security Advice
Proud member of UNITE

#6 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 31 July 2013 - 03:00 PM

I've read the above, acknowledge, and understand the "terms and conditions."  I have posted the only log I'm able to produce on my own, which is probably not as useful as you'd like it to be.  If there is another log I can run from Ubuntu, I'd be happy to run it and post it.  If not, I am unable to access my hard drive, let alone windows, so producing a windows based log is not possible at the moment.



#7 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 31 July 2013 - 04:16 PM

Some more information:  Dell warranty delivery came; I now have a blank hard drive preloaded with windows 7, as well as some recovery media.  The problem is they sent me a 64 bit install disk and I'm almost positive I'm running 32 bit windows.  The computer can't tell I have windows installed though, so I can't even tell at this point on my own, but I'm sure there is some way to check.  Either way, those tools are now available.  I only have 10 days though before I have to send either the new or old hard drive back.



#8 whoabuddy

whoabuddy

    Bleepin' Verbose


  • Malware Response Instructor
  • 2,053 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cottonwood, AZ
  • Local time:05:28 PM

Posted 01 August 2013 - 09:32 AM

Hi Nick,

I've read the above, acknowledge, and understand the "terms and conditions." I have posted the only log I'm able to produce on my own, which is probably not as useful as you'd like it to be. If there is another log I can run from Ubuntu, I'd be happy to run it and post it. If not, I am unable to access my hard drive, let alone windows, so producing a windows based log is not possible at the moment.

Thank you, I understand that first post is a bit generic, but you are doing fine so far.

I reviewed your old topic and I see it was quite the journey, and we will work to address all of your issues one by one.

First: I do believe this was initially caused by a virus, but if this would be better suited to another forum, I would be happy to move this post there. I'm running on a Dell Latitude E600 series (I don't have the exact number) with Windows 7, 32 bit.

We will check for viruses before we are finished, but we need to start with checking the health of your disks followed by making Windows bootable again before we get that far.

My current problem is that my computer doesn't recognize my hard drive or windows outside of Ubuntu. I'm fairly certain even BIOS does not recognize it (I've run the dell BIOS diagnostic and it claims there is no hard drive). However, when I run various checks and scans in Ubuntu, it can see the drive, but the problem there is that I can't access the drive; I can receive information about it through scans, I think it even recognizes that windows is on it, but if I open a window and click on a folder in the drive (listed as 250 GB volume instead of by a letter) it freezes.

If you can see the drive on the Ubuntu Live CD than that is a good sign, and it means the drive should show in your BIOS as well. As far as the diagnostic routine, I am not sure what steps it takes so it is hard to say why it would or would not show the drive. The freezing can mean a few things, but in this case and based on your boot-repair log I believe your MBR is corrupted/incorrect and your partitions need to be repaired as well. No need to panic though, there are a few things we can do to repair it if it's healthy, and additional options if not, so please wait for any instructions before continuing.

The only windows boot-related cd I had at the time (a windows defender cd) could not recognize that windows was on the computer. I recently downloaded an iso of a windows recovery environment (not something I usually do, but I'm desperate), and it also cannot recognize a windows installation. So far, the only access I have into that hard drive is through Ubuntu, an OS I am very minimally acquainted with.

Understood, Linux is definitely a little different, it took some time but I finally use it on my personal/work machine and I'm never looking back! :busy: Where did you download the Recovery Console ISO from? Do you have additional blank CDs or USB drives that we can load tools on?

With no success there, I went to Ubuntu to find some programs that would allow me to boot into windows. I found one called "Boot Repair" that seemed like it would resolve the issue, but didn't. After that, the computer didn't recognize the hard drive at all, except for in Ubuntu as "250 GB volume" rather than by a letter association.

Before you ran the "Boot Repair" program where were you able to see the drive with a letter association? Also, before running the program, what would happen if you let the computer boot normally? Did you receive any message at all? I understand Windows Defender Offline and the Recovery Console ISO were unable to find a Windows installation - but did the machine still attempt to boot at all?

"Boot Repair" produced a log; I'll post it at the end of this. The log is from the second time I ran it.

I reviewed the log and I believe I have pinpointed the errors, we will address them as we go along.

I have also contacted the manufacturer (Dell) to attempt to get some recovery media. They are mailing me "OS Installation disks and hard drive;" I'm a little concerned with taking that solution. They want me to replace the hard drive, which will cause data loss on my end.

There are a few ways to replace a hard drive, and depending on its health sometimes you can clone it (make an exact copy) over to a new hard drive. There are a few factors involved but if the drive needs to be replaced I will be happy to provide you with the instructions. The OS installation disks will be a good resource to have as well.

Also, the response claims "if Dell determines the fault is due to customer-induced damage, which is not covered by your limited warranty, we will inform you for the cost that you might incur." This is not ideal either, as the damage probably is my fault, and I'm not exactly sure how much they want from me (something I plan to find out very quickly). I've ran some scans with Ubuntu (fschk) which is like chkdsk for windows (so I've been told). If the results of that are of interest to anyone, I can post them. Basically, they're bad.

That's standard Dell boilerplate and I believe related more to physical damage (especially spills), but it does raise an interesting point, automated tools do not always fix the problem and in some cases make things worse! In the future I would advise asking for help before performing more advanced fixes like these, better safe than sorry!

Some more information: Dell warranty delivery came; I now have a blank hard drive preloaded with windows 7, as well as some recovery media. The problem is they sent me a 64 bit install disk and I'm almost positive I'm running 32 bit windows. The computer can't tell I have windows installed though, so I can't even tell at this point on my own, but I'm sure there is some way to check. Either way, those tools are now available. I only have 10 days though before I have to send either the new or old hard drive back.

Thank you for letting me know the tools arrived, and although the recovery media is 64-bit we still may be able to use it for our needs. For now please answer my questions above, I have summarized them below.

In your next post I need the following:
  • Where did you download the Recovery Console ISO from?
  • Do you have additional blank CDs or USB drives that we can load tools on?
  • Before you ran the "Boot Repair" program where were you able to see the drive with a letter association?
  • Before running the program, what would happen if you let the computer boot normally? Did you receive any message at all?
  • Is there anything else you would like to add at this time?
Best Regards,
whoabuddy
Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!"
If I am helping you and have not responded within 48 hours, please send me a PM.
Vi Veri Universum Vivus Vici (VVVVV)
Excellent Security Advice
Proud member of UNITE

#9 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 01 August 2013 - 06:35 PM

  • The recovery iso was downloaded from http://probz.net, more specifically, from here: http://probz.net/uploads/repairdiscs/RepairDiscWindows7-32-bit.iso (I couldn't find one anywhere that I deemed "reputable," and I figured the computer was already pretty beat up...under ordinary circumstances I would not have done that.)  I don't believe that this did anything positive or negative; it couldn't find any windows installations to repair.  I got into a command line with it and tried to run chkdsk, and while I don't remember the specific error, it wouldn't run at all.  I think it gave the same thing about not detecting a windows installation.
  • Yes, I have a flash drive with all of the programs that I ran from the previous issue as well as an AVG boot-up utility/virus cleaner (AdwCleaner, ComboFix [which I have read and understand the many warnings about not running unless instructed], FRST, JRT, RogueKiller, SecurityCheck, RootkitBuster, and the AVG boot/virus scanner) as well as blank CDs
  • Before I ran boot repair, I can't recall seeing the drive by letter association, but I assumed that it would show up like that.  If that's not the norm for Ubuntu then it probably didn't and I'm just assuming that it should be.  The last place probably would have been in windows before the loss of access.
  • Before boot repair, I'm not exactly sure what I came to when booting.  I'm pretty sure it would attempt to boot.  At some point I had my Windows startup repair from the OS on the hard drive run overnight with no progress or success.  It was stuck on attempting repairs and would not give me the opportunity to cancel, so I felt it necessary to restart (after about 8 hours, I didn't think anything was happening).  Again, I don't know exactly what happened exactly when because everything sort of came suddenly.  I know at some point I would just get black screens with a blinking underscore and no means to interact with anything.  I believe that was before boot repair and probably prompted the windows defender/Ubuntu attempts on my part.
  • You are right, BIOS is detecting the drive, but it must be some Dell diagnostic that isn't detecting it then.

Edited by Nick10213, 01 August 2013 - 08:26 PM.


#10 whoabuddy

whoabuddy

    Bleepin' Verbose


  • Malware Response Instructor
  • 2,053 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cottonwood, AZ
  • Local time:05:28 PM

Posted 02 August 2013 - 01:15 PM

Hi Nick,

Thank you for the additional information, I am working on our next steps and will reply when they are ready!

Best Regards,
whoabuddy
Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!"
If I am helping you and have not responded within 48 hours, please send me a PM.
Vi Veri Universum Vivus Vici (VVVVV)
Excellent Security Advice
Proud member of UNITE

#11 whoabuddy

whoabuddy

    Bleepin' Verbose


  • Malware Response Instructor
  • 2,053 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cottonwood, AZ
  • Local time:05:28 PM

Posted 02 August 2013 - 01:47 PM

Hi Nick,

The recovery iso was downloaded from http://probz.net, more specifically, from here: http://probz.net/uploads/repairdiscs/RepairDiscWindows7-32-bit.iso (I couldn't find one anywhere that I deemed
"reputable," and I figured the computer was already pretty beat up...under ordinary circumstances I would not have done that.) I don't believe that this did anything positive or negative; it couldn't find any windows installations to repair. I got into a command line with it and tried to run chkdsk, and while I don't remember the specific error, it wouldn't run at all. I think it gave the same thing about not detecting a windows installation.

I understand your desperation, and the difficulty with downloading from a non-genuine source comes from the potential for infection, but this particular site appears to be out for a good cause. Either way I am hoping we will be able to boot into the recovery console on the hard drive after making a few changes, and if not we can use the Dell recovery media with that ISO as a last resort. Windows is currently unable to "see" the disk because of a formatting issue, sort of comparable to asking you to read a language you have never seen before and understand it.

Yes, I have a flash drive with all of the programs that I ran from the previous issue as well as an AVG boot-up utility/virus cleaner (AdwCleaner, ComboFix [which I have read and understand the many warnings about not running unless instructed], FRST, JRT, RogueKiller, SecurityCheck, RootkitBuster, and the AVG boot/virus scanner) as well as blank CDs

Excellent, the tools I am going to recommend are typically burned from an ISO file to CD, and if you have any questions during the process please let me know.

Before I ran boot repair, I can't recall seeing the drive by letter association, but I assumed that it would show up like that. If that's not the norm for Ubuntu then it probably didn't and I'm just assuming that it should be. The last place probably would have been in windows before the loss of access.

Got it, thank you.

Before boot repair, I'm not exactly sure what I came to when booting. I'm pretty sure it would attempt to boot. At some point I had my Windows startup repair from the OS on the hard drive run overnight with no progress or success. It was stuck on attempting repairs and would not give me the opportunity to cancel, so I felt it necessary to restart (after about 8 hours, I didn't think anything was happening). Again, I don't know exactly what happened exactly when because everything sort of came suddenly. I know at some point I would just get black screens with a blinking underscore and no means to interact with anything. I believe that was before boot repair and probably prompted the windows defender/Ubuntu attempts on my part.

Understood, I have experienced that with startup repair, unfortunately it has not automatically fixed many issues at all for me.

You are right, BIOS is detecting the drive, but it must be some Dell diagnostic that isn't detecting it then.

That is interesting that the diagnostic doesn't pick up the drive, but let's test it ourselves just to be sure it is not starting to fail.

We need to check the health of your hard drive:

Note: you will need a blank CD and a USB drive to perform the following
  • Please download the .ISO for Parted Magic and save it to your Desktop
    note: the download will start automatically
  • Burn the .ISO file to a CD
    note: if you need software/instructions please let me know
  • Insert the Parted Magic CD into the computer and reboot the computer
  • When the menu appears, select Default Settings (Runs from RAM) and press Enter on the keyboard
  • Allow the system to load, you will see lines of text and eventually a desktop environment
    note: at this point the CD will be ejected and Parted Magic is running from your RAM. You can remove the CD at this time
  • On the desktop, double-click on Disk Health, the current drives will be listed by model number
  • Single-click on each drive and use the info after Drive information: to locate your Windows disk, note the drive name (/dev/sd?)
    note: we will need this information in the second part of the fix
  • Double-click on your Windows disk to view the details, then click the Perform Tests tab
  • For Test type: choose Short Self-test then click Execute
    note: this procedure runs a built-in test routine on the drive, and usually takes no more than a few minutes. please do not interrupt this test.
If the test gives you an error, please copy it down and post it here. If the test completed 100% without error, then please complete the following as well, you will need the /dev/sd? drive information from above!

We need to export and review your MBR:
  • Insert a USB drive we can use to save the logs
  • Double-click on File Manager, click on your USB drive on the left
  • Once you are able to access the drive and see the files, click File, Root Terminal, a black screen will appear
  • Note: the order of the following command is very important, so please be sure to double-check your drive identification in Disk Health if needed.
    Type the following command into the terminal where /dev/sd? is replaced with the correct value for your drive (i.e. /dev/sdb), then press enter:
    dd if=/dev/sd? of=mbr.bin bs=512 count=1
  • Check that the file mbr.bin was created on the USB drive in File Manager, otherwise check the command's syntax
  • Close the terminal, on the left-hand side right-click on your USB drive, then click Unmount
  • Remove the USB drive and insert it into your working computer
  • Upload the mbr.bin file to your next post
    note: when posting, click More Reply Options and you should see the area for an attachment
In your next post I need the following:
  • result of the drive self-test
  • mbr.bin from your Windows drive
  • is there anything else you would like to add at this time?
Best Regards,
whoabuddy
Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!"
If I am helping you and have not responded within 48 hours, please send me a PM.
Vi Veri Universum Vivus Vici (VVVVV)
Excellent Security Advice
Proud member of UNITE

#12 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 02 August 2013 - 03:15 PM

Results say "Completed with read failure," so I didn't continue with the steps following "If the test completed 100% without error."



#13 whoabuddy

whoabuddy

    Bleepin' Verbose


  • Malware Response Instructor
  • 2,053 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cottonwood, AZ
  • Local time:05:28 PM

Posted 03 August 2013 - 03:18 PM

Hi Nick,

Results say "Completed with read failure," so I didn't continue with the steps following "If the test completed 100% without error."

Good news and bad news here, your hard drive is beginning to fail, but based on the symptoms you are describing there are a few methods of recovery we should still be able to use. The important part is catching these kind of failures early before the disk stops reading all together, and at this point we have to decide the easiest way to start the recovery.

Let's start with some questions:
  • I know you said you had a flash drive, but do you have an external USB drive larger than 250gb?
  • I tried to research the model "Dell Latitude E600" but I am not finding any information from Dell, and every search keeps referring me to a Dell Latitude D600. Would you please confirm the make and model for me?
  • In Parted Magic and in the Disk Health program, are there any colored lines like the following on the Attributes tab?
    info_failing.png
  • Would you rather try to recover your computer in its current state, including programs/files? Or start new with a fresh install of Windows, re-install your programs as needed, and copy your files from the old drive?
    note: the first option sounds ideal in most cases, but will take a considerable amount more work and time than just recovering files from your failing drive.
  • Does the 10-day return from Dell count just for weekdays? Or weekends too? You may want to contact Dell and see if you can get an extension if we get close to that date.
Also, I feel I owe you a quick explanation as to why you are having difficulty accessing your disk, but we do not want to address this issue yet because we want to do as little with the failing disk as possible until recovery. It looks like the Ubuntu boot-repair utility overwrote your Windows 7 MBR with a SysLinux MBR, so even though your partitions and data are still there, Windows is unable to read the disk because it does not know how. When accessing the disk from Linux (Ubuntu/Parted Magic/etc), Linux is able to see your Windows partitions through the SysLinux MBR, but unable to open them because they are damaged and in need of a CHKDSK repair. In my experience using fsck doesn't get the job done.

Once you respond to the questions above I will start working on our next set of instructions.

Best Regards,
whoabuddy

edit: please ignore that MBR bit, selected a little too far down the text file :) sorry!

Edited by whoabuddy, 03 August 2013 - 03:19 PM.

Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!"
If I am helping you and have not responded within 48 hours, please send me a PM.
Vi Veri Universum Vivus Vici (VVVVV)
Excellent Security Advice
Proud member of UNITE

#14 Nick10213

Nick10213
  • Topic Starter

  • Members
  • 90 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Northeast USA
  • Local time:09:28 PM

Posted 03 August 2013 - 09:24 PM

  • I don't have anything quite that large, but since all these issues have been happeing I have been planning on figuring out a real backup solution that involves a large drive like that.  I've been considering either a standalone large external drive (500 GB) or a USB enclosure with a duplicate drive that I can back up to and swap out if necessary.
  • I was a little mistaken...6000 series, not 600.  On the initial boot screen, I've got Latitude E6420.
  • 732oh2.png
  • I'd like to get as close as possible to a working version of the original drive.
  • I'm going to send Dell an e-mail asking for an extension for the reason of attempting to back up my files before I send them one of the drives back.


#15 whoabuddy

whoabuddy

    Bleepin' Verbose


  • Malware Response Instructor
  • 2,053 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cottonwood, AZ
  • Local time:05:28 PM

Posted 04 August 2013 - 11:32 AM

Hi Nick,

I don't have anything quite that large, but since all these issues have been happeing I have been planning on figuring out a real backup solution that involves a large drive like that. I've been considering either a standalone large external drive (500 GB) or a USB enclosure with a duplicate drive that I can back up to and swap out if necessary.

What size drives do you have available? Any of the external USB drives you see are actually internal hard drives in an enclosure, either 2.5" (laptop-sized) or 3.5" (desktop-sized), and your needs really depend on what kind of backup you intend to make. There are two primary types of backups you can do, a file backup and a system image, which are common features to most backup software.

File Backup - This is a routine, usually run daily, that copies all of your Documents/Pictures/etc to a second location. A file backup does not include programs, and ideally the location is not on the same hard drive in case of disk failure.

System Image - This will create a file that is an exact copy of your drive, including documents, programs, settings, etc. When restored to a hard drive, Windows, the programs, and the files will appear exactly the same as when the image was created. Note: this means any changes to your programs over time or changes to your documents will require the creations of a new system image.

In a business environment you will typically set up a machine with the programs and settings you want, create a system image of it to put away in case of failure, then set up a daily file backup as well. If there are any significant changes to the programs and settings, a new system image is created and the old one is discarded. This way, if the system's hard drive fails, you can purchase a new hard drive, apply the system image for your programs and settings, then restore your files from the file backup.

A system image will take up the same space as the hard drive itself (~250gb) so it is something to consider when choosing an external drive, personally I use http://newegg.com or http://shopping.google.com and I frequently see drives from 500gb to 1tb (1000gb) for less than $100 :)

I was a little mistaken...6000 series, not 600. On the initial boot screen, I've got Latitude E6420.

Perfect, thank you! I wanted to reference the service manual to see what options we have. From the image you provided we can see the drive is still in the early stages of failure, so it should be recoverable using the programs we have available.

I'd like to get as close as possible to a working version of the original drive.

Understood, I will explain the procedure I have in mind below.

I'm going to send Dell an e-mail asking for an extension for the reason of attempting to back up my files before I send them one of the drives back.

Excellent, once we get the process started we will have a better idea on how long it will take.

So in order to fix your failing hard drive we are going to create a system image as described above, however we are going to use a special tool that will help repair the bad sectors on the drive as well. You will need a drive with at least 250gb free space for this process, and all of the current data on the new drive will be overwritten. The process will go as follows:
  • run the image tool to copy from the old hard drive to an image file, skip bad sectors (copy all of the good data)
  • run the image tool again from the old hard drive to the same image file, split/trim bad sectors (break down the bad data to get as much as possible)
  • run the image tool to copy from the image file to the new hard drive (makes the new drive a "clone" of the original)
  • review/replace the MBR on the new drive with the default Windows 7 MBR (the SysLinux MBR will be transferred as well - it's an exact clone)
  • boot to Windows CD from Dell, run CHKDSK /B twice (re-evaluates bad sectors since drive does not have any now)
  • restart computer, test operation, everything should be restored to normal!
Best Regards,
whoabuddy
Meditate. Elevate. Appreciate. | "Life is a journey, love is the destination, happiness is the path!"
If I am helping you and have not responded within 48 hours, please send me a PM.
Vi Veri Universum Vivus Vici (VVVVV)
Excellent Security Advice
Proud member of UNITE




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users