Dead win10 box - drive 'raw' format

[stam]

After an unattended update, i found my win 10 box dead - it tries to run a diagnostic endlessly on boot. After about an hour i'm given the opportunity to run a DOS shell and but can't get far...

in DiskPart > List vol, I seem to have now developed an extra partition at c: labelled 'windows rese', 100 Mb in size. My original 2 Tb volume is listed as e: (NTFS format) and DiskPart reports this as a normal/healthy partition.

however running CHKDSK (with all the options) fails as it reports the partition to be RAW format, not NTFS as 

Found some advice online and tried BOOTREC but that all fails as it can't find a windows volume and sfc/scannow fails as well (having set the volume to e: and the win directory to e:/windows).

I've not doubt there are bad sectors causing this but sadly haven't backed up the drive (i'll learn one day...) and was hoping to back up the stuff before getting a new drive.

very very grateful for any suggestions?

[jaclaz]

What you report is a bit confused (and a number of needed informations are lacking).

If - even after some (seemingly A LOT in your case) time - you can boot to *something*, it means that the *something* is actually there.

A volume label should be able to be at the most 11 characters, "windows rese" is 12  most probably it is a part of "Windows Reserved". 

Can you post some actual screenshot of the output of:

diskpart list vol

Which machine is it?

Are you booting UEFI or BIOS (or UEFI/CSM)?

It is "normal" in the case of both a BIOS "default" install and of a UEFI (in UEFI mandatory) that there is another smallish partition holding the boot files (MS calls this "system") besides the large one that contains your "system" (which MS calls "boot").

Normally on BIOS this small partition is NTFS, while on UEFI it is (obligatory) FAT32, and it has NOT a drive letter assigned (in both cases).

In UEFI (according to MS) amd Windows 10 there should be a 100 Mb partition and also an unused additional "MSR" partition:
https://msdn.microsoft.com/en-us/windows/hardware/commercialize/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions

of 16 Mb.

If - for whatever reasons - your drive letter assignment was damaged/deleted/etc., it is possible that the OS mistakenly assigned the C: drive letter to that volume/partition and thus "shifted" other letter assignments.

Since a number of paths are (again "normally") hardcoded to the drive letter C:, if this drive letter assignment has changed the OS won't boot properly (if at all).

Do you have in that machine a CD/DVD drive (and can you burn a CD/DVD in case of need) or do you have handy a USB stick that you can use (again if needed)?

jaclaz

 

[stam]

thanks for the response - apologies if my post didn't make sense, very little of this problem makes sense to me...

attached is a screenshot of the DISKPART>list vol which probably explains it better than i can.

vol 2 (e:) corresponds to my hard drive.

CHKDSK e: /f/r/x fails as it sees this as a RAW format, even though (as per screenshot) it's listed as NTFS...

BOOTREC /RebuildBcd fails instantly as well as it can't find a volume with a Windows installation

sfc /scannow /OFFBOOTDIR=e:\ /OFFWINDIR=e:\Windows (also fails instantly - "Windows Resource Protection could not perform the requested operation.")

This is pretty much the ceiling of my current knowledge so any advice appreciated...

I've downloaded Win 10 from MS and am burning DVD as we speak  - however i'm not confident that this will take me further in saving rather important data on the drive...

[jaclaz]

Ok, now it makes much more sense, "System Rese" is 11 characters (short for "System Reserved").

That 100 Mb partition (which is NTFS, which should mean BIOS - or UEFI/CSM boot) probably contains the boot files.

What happens if you issue:

CD /D %systemroot%

(I mean which drive letter gets the prompt to?)

and what happens with:

CD /D %Windir%

(they should logically bring you to either C:\Windows or E:\Windows  )

What can you see if you issue

DIR C:

and

DIR E:

jaclaz

 

[stam]

Both of the CD commands just take me to X: \Windows>

DIR C: gives me the message: "Volume in drive C is System Reserved", followed by the volume serial number

DIR E: lists the top level of my Hard Drive (including E:\Windows, E:\Users, E:\Program Files etc)

however, listing subdirectories (e.g. DIR E:\Users) failed with a 'File Not Found' error...

Bizarre situation as CHKDSK insists this is a RAW drive, but i can DIR it and DISKPART tells me it's formatted as NTFS .

Edited November 8, 2016 by stam

[stam]

Another error: I finally was able to launch from Win 10 install disk after choosing to re-install Win 10 (keep my own files).

However, it won't allow me to install as it says there are zero bytes free and the drive is not bootable (in spite the opposite being reported in PARTDISK> Attrib vol)

[Tripredacus]

17 hours ago, stam said:

DIR C: gives me the message: "Volume in drive C is System Reserved", followed by the volume serial number

Use DIR /a:h or DIR /a:s instead.

[jaclaz]

Summing it up:

1) you are currently running from X:\Windows which plainly means that you are running some form of PE, which could be located on the D: drive (the one labeled Wininstall, removable, FAT32 and 119 Gb in size)

2) you are 99% running in BIOS mode (or UEFI/CSM) this is important to understand as the re-install may be automatically be somehow triggered to the "other" mode.

3) the result of DIR C: is expected and "right",  trying DIR C: /a:h /S or DIR C: /a:s /S should allow you to see the \boot\ folder and the files within it.

4) the result of DIR E: is instead "bad news", together with the fact that you can only "see" directory names but cannot access them and with the CHKDSK result. BTW since windows 8 a number of other command options were added to it, running CHKDSK /F /R /X has anyway always been "wrong" (/R implies /F, /X implies as well /F and forcing the dismount of the volume is never a good idea), just for the record (and for next time) the "right" way to run CHKDSK is to run it once, twice or thrice:

#1 run CHKDSK without parameters
#2 depending on output of #1 and only if needed, run CHKDSK /F
#3 depending on output of #2 ad only if needed, run CHKDSK /R

Whenever possible never run CHKDSK on the actual volume containing the OS from the OS itself, boot from a PE and run it from there, the boot time scan (which is forced when you try to chkdsk the system volume from itself is much slower).

5) There is something "serious" on that hard disk or volume, it could be something "fixable" or it could be something that has made your data gone poof

The "right" procedure is the following right now (details may be slightly different if the PC is a desktop or a laptop):
1) stop fiddling with the disk
2) connect it (through a USB bridge or directly through an unused SATA or eSATA port) to another working computer[1]
3) connect to this other working computer another (new or however surely good) disk with the same or larger capacity
4) clone or image the disk through dd or however making a forensic sound clone or image
5) examine the filesystem of the volume on the clone or image with a suitable program (I personally recommend/use DMDE, but there are others)
6) depending on results of #5 above, either salvage the data (as much as you can) or attempt fixing the filesystem

I know that it looks daunting, but it is all in all simpler to do than what it seems in the description, BUT you will need at the very least another (new or surely working) disk same size or bigger and additionally enough space to save the data (or yet another disk same size or bigger).

In any case, you NEED to definitely confirm if it is booting via BIOS or UEFI (or UEFI/CSM), possiby post also the EXACT make/model of the PC (or of the motherboard).

jaclaz

[1] or get another disk installed on that computer and install to it a new copy of the OS
 

[stam]

Thanks both,

Pardon my ignorance on most the technical details - Not sure about the boot mode - i just hit F8 and it launches a diagnostic program which concludes it can't repair the disk and launch DOS shell from the advanced screen there. Not sure if that's BIOS or UEFI or something else.

I suspect you're right - the disk is probably dead. It also seems unlikely i'll be able to quickly salvage files from the disk and will have get a new disk etc.

I'll follow your advice about cloning the drive and using DMDE but unlikely to report back quickly as I have limited time to dedicate to this...

Thanks for the advice, will post update if any further changes...

S.

[jaclaz]

NO need to be pardoned, it's OK  not everyone can know everything, just provide the make/model of the PC (or of the motherboard), as said 99% it is booting via BIOS services, the machine may be either "pure" BIOS or UEFI and using the BIOS services of the CSM (Compatibility Support Module) in it, the first is "standard" and "easy", the second, depending on the actual UEFI and CSM implementation may be a bit trickier when it comes to re-installing, but now this has become a secondary problem.

The disk in itself is not necessarily "dead", as it boots and via F8 accesses the recovery/emergency partition/PE, what has happened is that the filesystem of that particular volume is corrupted.

This may be due to a bad sectors (which depending on the number of them could be a huge issue) or a simple corruption of just one or a few bytes (that may be solvable in no time), the issue here is that there is no way to know in advance and that you have on that volume some valuable data, so the priority needs to be shifted to first thing attempt to salvage the data (or as much data as it is possible).

jaclaz
 

[NoelC]

Perhaps a pertinent question that could help guide further efforts:

Decide what is more important to you:

• Recovering the data from the disk that's no longer booting.
• Getting a new, fresh Windows setup with all of your prior data gone (or recoverable from other sources).

Most advice assumes there's data there that you don't want lost, so it's actually alarming to hear of your trying to install the operating system again.  At this point out of attempted haste you may already have caused the loss of that data.  But maybe that's acceptable to you.

I'd suggest following very carefully what Jaclaz is advising, without "trying things" on your own - and maybe even consider buying a whole new disk so that you don't chance further data loss (and also to start to distance yourself from whatever problem led to your loss of bootability in the first place).

-Noel