RSS 2.0Recovery from Windows XP chkdsk failure
My laptop started hanging at the Windows logo stage and successive reboots wouldn't fix the problem. Booting into the Windows recovery console and running chkdsk manually on the C: drive would hang at the 22% mark. Next I booted Trinity Rescue Kit 3.3. This Linux-based Live CD is essential to any system recovery arsenal. It can be booted from a USB stick and even a PXE network boot, if necessary. Bruce Allen's Bad block HOWTO for smartmontools is a great source of help. Its focus is Linux file system recovery but the techniques are readily adaptable to NTFS.
No obvious indications of errors were turned up using smartctl. The
next thing I did was use badblocks to run a low level read-only test;
# badblocks -v -o bad.txt /dev/sda1
This came up with a list of 113 corrupted blocks starting at 19519872,
which is roughly 22% of the way into the NTFS partition. There was a
single block at this location and the remaining 112 in a contiguous
segment starting at 19519892. I used dd and ddrescue to make a copy
of the blocks and hexdump to have a look at the contents. ddrescue is
one of the GNU utilities I've fortunately never had to use before. It
is suited to recover entire disk images and has some smarts built in
to recover problem areas.
# ddrescue -b1024 -i19519872b -o0 -s1b -t /dev/sda1 /tmp/bad2.img # ddrescue -b1024 -i19519892b -o0 -s112b -t /dev/sda1 bad3.img # hexdump -C bad3.img | less
The hexdump didn't show up anything of importance (or so I thought.) I now had the option of writing back the ddrescued image or zeroing the blocks. This forces the disk to mark the blocks as bad and reallocate. I opted for zeroing as I didn't want any future problems to be masked by the attempted recovery. This was followed by a non-destructive read-write test on the full disk ensured that I'd got all the bad blocks;
# dd of=/dev/sda1 if=/dev/zero bs=1024 seek=19519872 count=1 # dd of=/dev/sda1 if=/dev/zero bs=1024 seek=19519892 count=112 # badblocks -v -o bad-2.txt -n -s /dev/sda1
A succession of reboots and chkdsk's later got me back to the XP login screen. The side effect of zeroing the bad blocks appeared to be losing the Windows license which prevented any kind of login. This may have been prevented by writing the bad blocks with the recovered image. A re-installation of XP corrected the problem with no loss of data.
posted by James Gemmell on Sun, 30 Aug 2009 at 08:19 | permalink
