Troubleshoot TC header Windows header Troubles

Alexdr

Level 1
Thread author
May 15, 2017
9
I'm crossposting from Wilders to hit a broader spectrum of people. One thing I did forget to state there is that, when I get to the recovery tools part in the story below, I tried sfc /scannow, it finds something but can't fix it until next boot. Thus, I reboot, but it's the BSOD junk so it never gets a chance to really fix it. Similarly, I try doing CHKDSK, but you can't CHKDSK a RAW drive (as detailed below).

I just wanted to post this thread in hopes someone would have some guidance. Last week, my laptop of a few years had its battery die. I.e., I woke up, went to the laptop and found it to be off. It wouldn't turn on except when I took out the battery and kept it plugged in with the AC adapter.
Later that day, I shutdown the computer--at this point I'm just speculating--and then, I think, I pulled out the power cable too soon (I was packing up the laptop) such that it had an unexpected shut off (especially since no battery) while doing Windows shutdown processes.
As a result, when I turned my laptop back on (with AC adapter connected), I went through the TrueCrypt screen to put in my password and then got stuck in a BSOD loop. It's the one that occurs after starting Windows and says "UNMOUNTABLE_BOOT_VOLUME". At this point, I though, OK, use recovery tools.
I proceeded to tap F8 after typing in my TC password and got to the recovery screen. I ran the recovery screens "try to fix things" command, rebooted, didn't fix it. I then, from the CMD in the recovery module, ran diskpart to see what was up. I found my drive was now labeled as RAW (not NTFS). At this point, I felt that I probably ruined something in the boot sector. I proceeded to run bootrec /fixboot. I rebooted, that didn't fix anything (surprisingly it still worked if I remembered correctly, i.e. it was the BSOD that killed me). I then went back into recovery tools, ran bootrec /fixboot and then bootrec /fixmbr and then rebooted. This is where things went bad. I would turn on the computer and wouldn't even get the TC password prompt.
My default thought was that, in fixing the MBR I overwrote something related to the TC header or the Windows header. I proceeded to get my TC Rescue disk. Instead of trying to regain the TC or System header from the TC rescue disk, I immediately ran "Decrypt everything". It was going pretty quick (supposedly only one day to decrypt), however, upon awaking the next day, I found it stopped asking "Read error: 16 bad drive 0: sector 12652XXXXXXX" skip all bad blocks? (y/n). I first typed "N", after all, I thought "even if they're bad blocks, just try and decrypt them, I don't want to miss anything". However, this stopped the decryption process. I pressed to decrypt the whole thing again and, luckly, it seemed to continue from where I left off asking me the (y/n) question again. This time, I pressed y. At this point the decrypt speed went from 10.XX MB/s to 2.27 MB/s (I hope this doesn't mean it's throwing away everything because it thinks everything is a bad sector). Now the waiting time will be for another 40 hours.
After it finishes decrypting, I plan to run windows repair using a physical disk and run bootrec /fixboot andbootrec /fixmbr again. If this doesn't fix it, I heard about testdisk and will see if that can be used.
If worst comes to worst, I'll image my thing with Acronis, move it onto a 3 TB harddrive and wait until I'm more capable of messing with it.
Note, my laptop is itself a 1TB drive. I believe there are only two partitions, the recovery and the main (i.e. the main partition is also the boot partition). I will also note that, after saying (Y) to the skip bad sectors (it could've happened before but I was asleep), after a few hours it hung on a certain Remaining number of MB. It hung for a long while (I want to say an hour). It did continue after that (the speed went up from 2.27 MB/s to 2.29 MB/s) and has continued to run. I don't know what it means to hang for a long time on a certain number of MB remaining.
Thank you for any guidance you can provide me. I've tried to do some degree of research.

Note also, it's been a pretty crazy week, all my computers have something dying. You'd think they were rigged to fail after a set amount of time.
 

Alexdr

Level 1
Thread author
May 15, 2017
9
Update: Decryption has finished. Supposedly, i.e. "supposedly", it worked because now when I used a Windows repair disk and run chkdsk it recognizes the file system as NTFS. I.e., on the data section of the harddrive, or at least where ever the identifier for the NTFS is would have to have been decoded correctly for it to recognize NTFS, hence, the decryption must have worked.
Obviously the booting issue persists.
A strange thing now is that, in Windows Repair tools loaded off of a disc, CHKDSK hangs after stating "The type of the file system is NTFS", Diskpart hangs after telling the copyright and "On Computer: XXXX-XXXXX", i.e. it doesn't actually get into the program Diskpart where the prompt changes from x:\sources> to diskpart>. Similarly, running the standard "Startup Repair" command given in repair mode hangs on "Searching for problems", and bootrec /FixBoot and /FixMBR both state "Element not found". I will also state that the operating system detected by the repair disc is "Uknown" and running bootrec /scanOs either hangs or is taking way too long for what I feel is right.
My present thoughts are to make a clean install of Windows. I, however, want to make sure that I don't lose any data. Re-installing some programs is fine, but actual files must be kept.
If anyone knows anything regarding the present situation, i.e. the issues described in this post, thank you.
 
Upvote 0

Alexdr

Level 1
Thread author
May 15, 2017
9
Is editing a post restricted to a certain amount of time after which the post is originally posted? If so, sorry for bumping. All I wanted to add is that in using UBCD, memtest x86 found no errors after 3 passes (just did it because why not). Also, in running testdisk which loads me into the PartedMagic OS environment, it seems that all 3 partitions are "intact". I.e. the bios one, the recovery one, and then the one with all of my data. I can even access all of my data from here. Therefore, the big question remains, despite the recovery partition seemingly being fine, despite my filesystem seemingly being fine, despite the bios section seemingly being fine (actually, I don't know how the bios partition should look, but, there is no garbled data), why does it give me the "No bootable media" screen on start-up? (I think I can access the system's personal recovery partition, I've yet to try. Maybe it'll yield different results than running the disc's recovery module, however, if anything, one would thing the ones from the disc, which certainly aren't corrupted, would yield "at least as good as" results as those in the recovery partition).
It'll be nice if I can figure this all out on my own, then, maybe, my thread could serve as some use to people in the future who deal with this issue. Afterall, I would hate for this to turn out like that (one of the few true) XKCD comic where the last post in the thread on an issue was in 2004 with no resolution.
As an addendum:
To those who are using Veracrypt, maybe I'm misinformed, however, I thought Veracrypt was backwards compatible with TrueCrypt volumes. However, in attempting to use the latest VeraCrypt to mount an encrypted drive/volume using a SATA-to-USB (trying every combination of settings), yielded error 7763. However, in using the last 7.1a TrueCrypt software it worked immediately with simple auto-mount no-pre-boot-authentication (since it was a drive with a system partition, I assumed to do this).
 
Last edited:
Upvote 0

Alexdr

Level 1
Thread author
May 15, 2017
9
Well, I decided to run ddrescue from parted magic and back up most everything. 31 MB of possibly bad (I ran it so that it only tried once), with 1.1 MB of actually known bad sectors. It's been backed up to my 3TB hard drive. I then proceeded to use DDRUtility in order to deduce which files were bad. What was striking was that only the following were bad:
-am image for a game file in Program Files (x86)
-a temp .wav file from CamStudio
-Some image files (the primary ones affected)
-A couple videos
-A PDF
-A data file from a game
-A weird one: data from the Journal
-And one which says Inode none File none. Based off of what the log file says, this is fine, this means those bad sectors had no data allocated to them.
What is surprising now is, why TestDisk found no bootable partition etc., when the bad sectors seem to be restricted to my files (except for the Journal one). Since I didn't retry on reading from the disc, I think it counted the entire 31 MB as bad, thus there are 66727 bad sectors (529 not allocated) listed in the log file. When I look at DDRViewer it doesn't look like much, but I guess I'll need a new hard drive soon.
I could probably get it to run if I ran chkdsk /R, however I'm confused as to whether or not it destroys my data.
Just to clarify, these are the only files with a "striking look" that have bad sectors, i.e. the only ones which aren't my personal files or in unallocated locations:
##########################################################
########## Files in group StartSector=1265289721 EndSector=1265289726 ##########
Inode 87652 File /$Extend/$UsnJrnl/$DATA($J)
##########################################################
########## Files in group StartSector=1265289730 EndSector=1265289734 ##########
Inode 87652 File /$Extend/$UsnJrnl/$DATA($J)

Also, since the rescue log yields:
# pos size status
0x00000000 0x2C228EE000 +
It follows that the boot sector shouldn't have been affected by any bad sector corruption. Thus, I can't for the life of me guess why, at the very beginning, the laptop didn't just turn on like usual (before I started messing with it. Well, I guess before I started messing with it recovery tools appeared, but why did the BSOD occur still?, i.e. the UNMOUNTABLE_BOOT_VOLUME).
 
Upvote 0

Alexdr

Level 1
Thread author
May 15, 2017
9
Fixed.
It seemed the hanging in the recovery tools was just lag. Smashing F8 to load safe mode from the recovery disk did part of the trick. After that I used diskpart to re-activate my boot partition. I ran chkdsk as well (no /f) and it did find the 8KB of bad sectors. I then just had to spam the "Repair" button a few times (and wait) and eventually it found the recovery partition and restored my Windows 7 Home Premium. Now to use my activation key to get my proper OS back.
Note, I did also, after reactivating my partition, run again bootrec /fixBoot, /fixMBR, bootsect /nt60 all /mbr. I also then tried to do bootsec /fixbcd, but that failed due to I/O permissions. At that point is when I spammed the fix.
Since the repair tool spent its time repairing the disk, it probably did the chkdsk /R for me. Note, at this point (after the bootrecs but before the spamming, I had rebooted and had at least gotten to the point where it just said: No boot manager).
 
Upvote 0

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top