Grub Disappeared, how to recover

[dehawkinz]

I was running a multi-boot system - Windows XP, Mint 12, Mint 14, UberStudent and was using Windows when the processor died a horrible death in operation. It was totally dead, no sign of life so I purchased a cheap replacement system, swapped the old hard drive from my old system into the new system. and booted it up. Instead of the familiar Grub bootloader, I was thrown straight into Windows which promptly gave the infamous blue screen of death complaining about fatal drive errors.

I booted the system from the Mint 12 live cd, and followed the instructions from [url=http://opensource-sidh.blogspot.ca/2011/06/recover-grub-live-ubuntu-cd-pendrive.html]here[/url] to try and recover the missing grub bootloader.

I was surprised to see that it no longer lists any of the Linux partitions, just the (corrupted) NTFS partition

I get as far as step 3 in the instructions and get this

sudo fdisk -l

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x1c531c52

Device Boot Start End Blocks Id System
/dev/sda1 * 63 78108029 39053983+ 7 HPFS/NTFS/exFAT

If I run Testdisk on the initial scan it sees just the single partition

Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 4861 254 63 78107967

If I do a quick search it shows the missing partitions

Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Partition Start End Size in sectors
D HPFS - NTFS 0 1 1 4861 254 63 78107967
D HPFS - NTFS 4862 0 1 10673 30 44 93355649 [New Volume]
D Linux 10673 46 62 16484 51 15 93353984
D Linux 16484 83 48 27376 36 52 174977024
D Linux 27376 36 53 38522 235 49 179073024
D Linux Swap 38523 13 19 38913 69 52 6268912

I am assuming that if I was to make one of the Linux partitions the primary bootable, it would recover the missing grub bootloader, but I have 2 questions
1. How do I change the primary bootable partition without terminally killing the drive? I know I can use the arrow keys to change the partition characteristics, but since it is not showing the first partition as bootable on this screen, I am not sure if I make a different partition primary bootable this will create a disk error of 2 primary bootable partitions
2. How do I / Can I repair the windows partition to make it boot to windows (I do not have a windows cd as it came preinstalled - the price of buying 2nd hand)

Thanks

Richard

[kurotsugi]

that's a long step. I usually run this two command to reinstall my grub

Code: Select all

sudo mount /dev/sdXY /mnt
sudo grub-install --root-directory=/mnt/ /dev/sdX

the X and Y stands for our partition. in my case, I have my linux root partition on sda7 so I'll need to run

Code: Select all

sudo mount /dev/sda7 /mnt
sudo grub-install --root-directory=/mnt/ /dev/sda

this trick usually install and detect all OS installed in my drive without any hassle. regarding the windows xp stuff, you can try with boot into safemode before try anything. if you could boot into safemode it means your windows is still fine.

[uberstudent]

Boot in to UberStudent using the live disc and then go to Applications > System > System and run Boot Repair. It can repair most issues with a click or two. It's there so that, in case a snafu occurs such as you described, users don't have to go through all the sort of rigmarole above.

[mintybits]

I am assuming that if I was to make one of the Linux partitions the primary bootable, it would recover the missing grub bootloader,

No. It doesn't work like that for linux. The boot flag is not used by Grub at all.
Grub is normally in two places: in tens of sectors at the disk start and in the /boot/grub directory in your linux root filesystem.

1. How do I change the primary bootable partition without terminally killing the drive? I know I can use the arrow keys to change the partition characteristics, but since it is not showing the first partition as bootable on this screen, I am not sure if I make a different partition primary bootable this will create a disk error of 2 primary bootable partitions

Not relevant.

2. How do I / Can I repair the windows partition to make it boot to windows (I do not have a windows cd as it came preinstalled - the price of buying 2nd hand)

Well, according to Test Disk your filesystems occupy the disk space like this:

Code: Select all

SECTORS					
start           end             size           size GB   gap before    description
63               78108029        78107965        37.2       62           NTFS
78108030        171463678        93355647        44.5        0           NTFS
171464704       264818687        93353982        44.5     1025           linux
264820736       439797759       174977022        83.4     2048           linux
439797760       618870783       179073022        85.4        0           linux
618872832       625141743         6268910         3.0     2048           linux swap

But your fdisk command shows only the first of these in the partition table (PT) in the first sector (MBR) at the disk start. The PT has been corrupted.
Can you post the PT contents? (you may need to install hexdump first: sudo apt-get install hexdump)

Code: Select all

dd if=/dev/sda bs=1 count=66 skip=446 status=noxfer | hexdump -C

[dehawkinz]

@kurotsugi - thanks, that worked, I was able to restore my Linux installations. I think the Windows partition got corrupted as it will not load, and I get a filesystem error when I try to read the files from Linux. I guess I will have to live without my Windows games

[mintybits]

@kurotsugi - thanks, that worked, I was able to restore my Linux installations. I think the Windows partition got corrupted as it will not load, and I get a filesystem error when I try to read the files from Linux. I guess I will have to live without my Windows games

Good, but make sure your partition table is fixed or you'll have serious problems.
Check the ouput of sudo fdisk -lu again.

[dehawkinz]

Hmmmmmm

I think there is an error in the PT still

It crashed again this afternoon, and I did a rebuild as before using the example from kurotsugi

all my linux distributions are there and seem to be working (I tried Mint 14 and Uberstudent), but the windows is not working, it looks like the rebuild has dumped the Windows OS partition, and the Linux Swap partition is missing


testdisk
Disk /dev/sda - 320 GB / 298 GiB - CHS 38913 255 63
Current partition structure:
Partition Start End Size in sectors

1 * HPFS - NTFS 4862 0 1 10673 30 44 93355649 [New Volume]
2 P Linux 10673 46 62 16484 51 15 93353984
3 P Linux 16484 83 48 27376 36 52 174977024
4 P Linux 27376 36 53 38522 235 49 179073024

fdisk
Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sda1 * 78108030 171463678 46677824+ 7 HPFS/NTFS/exFAT
/dev/sda2 171464704 264818687 46676992 83 Linux
/dev/sda3 264820736 439797759 87488512 83 Linux
/dev/sda4 439797760 618870783 89536512 83 Linux

hexdump
00000000 80 fe ff ff 07 fe ff ff 7e d5 a7 04 81 7e 90 05 |........~....~..|
00000010 00 fe ff ff 83 fe ff ff 00 58 38 0a 00 78 90 05 |.........X8..x..|
00000020 00 fe ff ff 83 fe ff ff 00 d8 c8 0f 00 f0 6d 0a |..............m.|
00000030 00 fe ff ff 83 fe ff ff 00 c8 36 1a 00 70 ac 0a |..........6..p..|
66+0 records in
66+0 records out
00000040 55 aa |U.|
00000042

[mintybits]

What has happened is that TestDisk did not reconstruct the original extended partition and this means it had to drop 2 partitions, because without using an extended partition (a special partition that can "contain" lots of partitions) an MBR-formatted disk can only have 4 partitions.

Your first, Windows partition is still there. It is just a matter of putting an entry for it in the PT. But to do this you either need to delete a partition or create an extended partition, or use a second disk to clone some of it to and reconstruct the PT.

Can you eliminate one linux partition by copying its contents into one of the others? Then it is easy to manually add the original Windows partition to the PT.

Do you have another disk you can use? Then it is easy to clone the linux partitions to it (or the Windows) and manually reconstruct the PT.

Best if you would post the output of

Code: Select all

df -h

So we can see how full your linux partitions are.

Meanwhile...DO NOT make any more changes to your partitions.

[dehawkinz]

argghhhhh

That does make sense actually

yes, I have a USB external drive I use for backups and data storage, its got over 200GB space free

filesystem output
Filesystem Size Used Avail Use% Mounted on
/dev/sda2 44G 7.3G 35G 18% /
udev 1.8G 12K 1.8G 1% /dev
tmpfs 705M 784K 704M 1% /run
none 5.0M 0 5.0M 0% /run/lock
none 1.8G 14M 1.8G 1% /run/shm
/dev/sdb1 466G 202G 265G 44% /media/SimpleDrive

[mintybits]

You show neither sda3 nor sda4 as mounted so I assume they are data storage and not part of your normal filesystem.
So I suggest making a couple of linux partitions on your USB drive and copying the contents of sda3 and sda4 to them. The quickest way is to use rsync.

BACK UP anything critical as this could go horribly wrong!

First mount the source partition and then the destination on your USB, eg:

Code: Select all

sudo mkdir /tmp/sda3
sudo mkdir /tmp/usb2
sudo mount /dev/sda3 /tmp/sda3
sudo mount /dev/sdb2 /tmp/usb2
sudo rsync -vaxHAX /tmp/sda3 /tmp/usb2

Repeat for sda4

Now use GParted to delete sda3 and sda4

Now fix the partition table to include the original Windows partition
Copy the PT contents into a file

Code: Select all

sudo sfdisk -d /dev/sda > pt

Then edit this file with gedit to add in the original partition at slot 3, eg:

Code: Select all

# partition table of /dev/sda
unit: sectors

/dev/sda1 : start= 78108030, size= 93355647, Id= 7
/dev/sda2 : start= 171464704, size= 93353982, Id= 83
/dev/sda3 : start=       63, size= 78107965, Id= 7, bootable
/dev/sda4 : start=        0, size=        0, Id= 0

Be very careful not to change the existing entries.

Then write this new PT back to the disk:

Code: Select all

sudo sh -c "cat pt | sfdisk --force /dev/sda"

Then run fsdisk -lu to check the PT change looks correct.
Then run sudo update-grub and check that Windows is listed in /dev/sda3

If all ok, reboot and select Windows and cross your fingers.

[dehawkinz]

sda2 is my uberstudent partition
sda3 is my Mint14 partition
sda4 is my Mint12 partition

does this change anything?

I am in Mint14 today, if I mount all the partitions I get this

Filesystem Size Used Avail Use% Mounted on
/dev/sda3 83G 19G 60G 24% /
udev 1.8G 12K 1.8G 1% /dev
tmpfs 706M 936K 705M 1% /run
none 5.0M 0 5.0M 0% /run/lock
none 1.8G 692K 1.8G 1% /run/shm
none 100M 12K 100M 1% /run/user
/dev/sdb1 466G 202G 265G 44% /media/richard/SimpleDrive
/dev/sda2 44G 7.3G 35G 18% /media/richard/c320cafd-2bae-4e3e-ab35-93e01a389edb
/dev/sda4 85G 22G 59G 28% /media/richard/fcbebfd1-d55c-4285-ba56-7959edc00c7d
/dev/sda1 45G 8.5G 37G 20% /media/richard/New Volume

[felonius]

EasyBCD.

http://neosmart.net/EasyBCD/

For a walkthrough,

http://www.linuxbsdos.com/2012/03/10/re ... ith-linux/

I just used this yesterday.

I've got a new gamer box and wanted to try a new linux (Mint of course lol) along with my win7 x64. What I didnt want was my windows mbr to be toasted by Grub.

Until i can get a new drive, i'm playing with a 16gig thumb drive. I was curious if I could disable the "real" drives in the bios and not effect them. Well, the new boxs arent that different from the old. I boogered up my mbr with grub when i installed to the thumb drive.

What to do.

I "startpaged" it and found the above walkthrough and the link to the free limited use software. Worked like a freakin charm!

This is my first post. I really hope this made a difference. im still a big newbie at linux.

[felonius]

BTW,

I failed to mention you need to run this via windows.

[dehawkinz]

BTW,

I failed to mention you need to run this via windows.

doesn't help me when Windows is one of my missing partitions

in the end I kind of put it on the back burner as I just swap in a working windows drive when I need windows and use Linux the rest of the time

[felonius]

Dang it. I was hoping one of my first posts would be a winner.

Good luck either way though.

Too bad windows doesnt have a live cd thing. Maybe you could back door it somehow.