Booting out the "Operating System Not Found"

It was a sort of novelty to see an "Operating System Not Found" message as the BIOS booted up. As the message stayed on, and the message sunk in, the feeling of novelty gave way to the dawn of a sombre realization. It was Friday the 14th, not quite the 13th but close. And something was wrong.

No sight of the familiar GRUB boot menu. No sight of the Win2K and Linux configs I could choose without lifting a finger. Just a dark screen with the ominous message on the far left corner.

The last shutdown was a "hibernate" from W2K, and I had seen the "Hibernating..." screen before closing the lid.

Well, GRUB is gone. But I had a GRUB boot floppy. Pulled out that old boot floppy and booted the beast with it. Grub came up with its prompt, and I typed:

grub> root noverify (hd0,0)
grub> chainloader +1

because I just wanted to boot from what was the 'C:' drive. I had thought (or rather hoped!) that perhaps just GRUB was gone.

Alas, at the 'chainloader' command, grub complained:

Partition Table Invalid or Corrupt

Bye-bye, partition table !

Poor GRUB... now who could handle such a thing ? Thought of another bootable floppy I had handy in the diskette box -- PAUD (PArted and Utilities Disk).

Located the PAUD diskette, and booted up with PAUD. While coming up, it said:

hda: Unknown partition table

(strangely, this sounded gentler than GRUB's frank and frontal assessment of the situation).

PAUD had given up too !

Just to be sure, selected "hda" for /dev/hda, which is the first IDE drive. Typed this to the shell:

parted /dev/hda

and parted said:

Unrecognized disk label

In other words: sector 0 of the disk is cooked, for sure.

The Rescue

Fortunately, I had equipped myself to enable a rescue. The last time I had installed GRUB on the MBR, more than a year ago, I had taken care to save the first 64 sectors of the disk. Located the snapshot, moved the 'image' file to a USB thumb drive, and got ready for the rescue operation.

Now the PAUD floppy, being too small, did not have the likes of 'dd', 'od' and 'diff' that I would need to effect the rescue.

Booted up an old Knoppix bootable Live CD that I had lying around. At the boot: prompt, selected the option for text, i.e., just give me the root shell I need.

Mounted the thumb drive (it appeared as SCSI device /dev/sda1) :

mkdir /tmp/thumb
mount /dev/sda1 /tmp/thumb

Took a snapshot of the first 64 sectors as of now and saved it to the thumb drive, thus:

dd if=/dev/hda of=/tmp/thumb/bad-sect0to64.bin bs=512 count=64

Compared this 32K binary file against the previously saved "healthy" snapshot (using "od -x -Ax" to generate the hex dumps first, and then using "diff" on the hex dumps).

The partition table should have been there towards the end of the first sector (a sector is 512 bytes, or 0x200 in hex). Here was no partition table, no 0xAA55 signature, but a sea of random stuff that came from who knows where and it seemed to go on and on.

Saved the random stuff "just in case", and replaced the first 64 sectors from what I had saved earlier:
(note: the command below is dangerous. Use at your own risk. Something like this has the power to render your system unbootable, and make your data as good as lost).

dd if=/tmp/thumb/healthy-snapshot-sect0-to-64.bin
of=/dev/hda bs=512 count=64

Ok. The disk has the partition table now. And the rest of the junk in the first 64 sectors has been booted out too.... so will this boot ?

Asked 'parted' to show us back the partitions now, and yes, they were there.

So, can we mount one of the partions now, and check it out ?

(Not yet! The kernel does not know the new partition data. A reboot fixes that easily...)

Rebooted with Knoppix again, checked the partitions, found all to be OK.

Removed the Knoppix CD and rebooted...got back my old GRUB menu ! Verified that Win 2K Boots up.

Did a disckcheck, and found a bad cluster in C:\hiberfil.sys, the Hibernation file. Now...could this have caused Win2K to write junk into the MBR ???

I will never know that for sure, but I suspect this might have had something to do with it.

Thanks to Linux and Free Software, I had recovered my Windows 2000 environment back in less than an hour, and not lost a byte of data.

Another case of Linux saving the life of windows ! :)