2 Win7 partitions no longer bootable after Upgrade of one

[sigi]

My system is as follows:

HD-0:

6 MiB Free Space in front
Windows 7 (my main working partition)
Linux Mint
EMBRM at the end


HD-1:

8 MiB Free Space in front
Extended
Windows 7 (newly installed for upgrading to Win10


I use BIBM for partioning. My BIOS is conventional, no UEFI.

When trying to upgrade my HD-1 Win7, the PC booted (as expected) no longer into the BIBM boot menu but directly into the Win7 to be upgraded.

The upgrade process has stalled (for hours) at 99 % installation progress.

At this time I wanted to know what the partitions would look like. So I first made a Backup from my EMBRM using TBWinRE, then rebooted from my BIBM-CD and accessed BIBM. A warning popped up telling me that there were overlapping partitions. I opened Work with Partitions and saw that there was now a 100 MiB partition in front of my Win 7 working partition.

Both partition names had the same letter „E“ (if I remember correctly) attached to them obviously illustrating the overlap.

I was not aware of the EFI thing because I thougt myself safe in a pure BIOS environment. So I unsuspectingly deleted the 100 MiB partition without checking any option. I thought I could easily undelete it if the need arose.

Now, as a consequence, I cannot boot either of the two Win7 partitions:

If I try to resize my HD-0 Win7 partition I get the information „Abort: The file system is unsupported or unformatted.“ When selecting its properties I get „Bootable: No - The location of this Partition will prevent some Operating Systems from booting from it.“ Trying to boot it anyway brings up the following message: „The partition is not bootable! If you are in the process of installing an OS then insert an installation media and press ctrl-alt-del to initiate a reboot otherwise click OK to return to BooIt BM."

Resizing of the HD-1 Win7 could be possible (I did not pursue it beyond selecting the function). Properties info reads „Bootable: NTFS“. Trying to boot it anyway brings up the following message: „This partition does not contain an operating system. If you are about to install a new OS then insert the installation diskette into drive A: - Press any key to run the BIOS bootstrap loader...“

What can I do now to recover both partitions and render them bootable by BIBM? I have no backups apart from the EMBRM (created with TBWinRE). As concerns further Terabyte tools to handle the situation: I own IFW, IFL and TBOSDTS.

[TeraByte Support]

The answer is to restore your backup, but since you didn't create one, first
if the 100m was formatted, then you're not going to get much back without
using a data recovery tool. If it was only created but not formatted,
delete the two new partitions (ensure you don't use any clear or wipe
options), use "undelete". (if it was formatted you're only going to get
back the 100m partition, otherwise the entire partition will be back). On
the HD1 copy, that should be the same, ensure the swap option is used
(should contain bootmgr and some other files in the root - unless you were
booting to it through a partition on hd0).

"sigi" wrote in message news:11880@public.bootitbm...

My system is as follows:

HD-0:

6 MiB Free Space in front
Windows 7 (my main working partition)
Linux Mint
EMBRM at the end


HD-1:

8 MiB Free Space in front
Extended
Windows 7 (newly installed for upgrading to Win10


I use BIBM for partioning. My BIOS is conventional, no UEFI.

When trying to upgrade my HD-1 Win7, the PC booted (as expected) no longer
into the BIBM boot menu but directly into the Win7 to be upgraded.

The upgrade process has stalled (for hours) at 99 % installation progress.

At this time I wanted to know what the partitions would look like. So I
first made a Backup from my EMBRM using TBWinRE, then rebooted from my
BIBM-CD and accessed BIBM. A warning popped up telling me that there were
overlapping partitions. I opened Work with Partitions and saw that there was
now a 100 MiB partition in front of my Win 7 working partition.

Both partition names had the same letter ?E" (if I remember correctly)
attached to them obviously illustrating the overlap.

I was not aware of the EFI thing because I thougt myself safe in a pure
BIOS environment. So I unsuspectingly deleted the 100 MiB partition without
checking any option. I thought I could easily undelete it if the need arose.

Now, as a consequence, I cannot boot either of the two Win7 partitions:

If I try to resize my HD-0 Win7 partition I get the information ?Abort: The
file system is unsupported or unformatted." When selecting its properties I
get ?Bootable: No - The location of this Partition will prevent some
Operating Systems from booting from it." Trying to boot it anyway brings up
the following message: ?The partition is not bootable! If you are in the
process of installing an OS then insert an installation media and press
ctrl-alt-del to initiate a reboot otherwise click OK to return to BooIt BM."

Resizing of the HD-1 Win7 could be possible (I did not pursue it beyond
selecting the function). Properties info reads ?Bootable: NTFS". Trying to
boot it anyway brings up the following message: ?This partition does not
contain an operating system. If you are about to install a new OS then
insert the installation diskette into drive A: - Press any key to run the
BIOS bootstrap loader..."

What can I do now to recover both partitions and render them bootable by
BIBM? I have no backups apart from the EMBRM (created with TBWinRE). As
concerns further Terabyte tools to handle the situation: I own IFW, IFL and
TBOSDTS.

[sigi]

I think I should give more detail about what I have done. The Attachments show my MBR details. If needed I can provide partinfo as well.

I did not take notes of what I have done in BIBM after the Win10 upgrade process took over. I was in kind of emotional state of emergency. I just realized that there was a new 100 MiB partition in front of and partly overlapping my Win7 Working Partition. Without examining the contents of my two HDDs in depth I think there was no furher partition added.

In my emotional state and relying on the recoverability of partitions deleted without ticking checkmarks I deleted that 100 MiB partion and got 6 MiB in front instead.

So, what can I do to get my Win7 Working Partition back? The Win7/Win10 is obviously not so much of a problem.

[sigi]

Hello,
I need my Working Partition urgently back and I am asking myself why there has been no reaction on my second post.
I hesitate to proceed on my own on the basis of what I take from the first (Terabyte) answer because I will absolutely avoid anything that could deteriorate the chances of restoring my data. So I have a few questions on that first answer:


TeraByte Support wrote:
>.....
>.....
> if the 100m was formatted, then you're not going to get much back without
> using a data recovery tool. If it was only created but not formatted,
> delete the two new partitions (ensure you don't use any clear or wipe
> options), use "undelete".


I have mentioned already that to the best of my recollection, there has been added one additional partition only right at the beginning of HD-0. Its size was 100 MiB. Before that happened and again after I had deleted that additional partition, there was a 6 MiB Free Space at the beginning of HD-0 and right in front of my Win7 Working Partition. Perhaps this is sufficient information for you to tell whether the overlap had been formatted. I, for my part, just don't know and I fail to see any helpful clue in the screenshots attached to my previous post.

Would it be without risk under these conditions to try to delete/undelete (without any options checkmarked) the HD-0 Win7 partition? Or would it be safer to have (TB)WinRE try to recover the lost Win7 partition?

What data recovery tool did you think of in case the 100 MiB had been formatted?

[TeraByte Support]

those are the choices, you can try deleting and then undelete, if not,
you'll have to use a tool design for data recovery to try and get files out
from the areas the new partition overwrite. If you wanted to, you could
note the last lba of your current large partition before deleting it (if
it's overlapped with the 100, you may be able to just delete the 100).


Anyway, save the 1 sector at the last lba. If the undelete doesn't work or
partition is only 100m then restore that backed up one sector to the
location of where the partition should start. Then undelete that, you may
get something back, but part will be gone (the part overwritten).



"sigi" wrote in message news:11893@public.bootitbm...

Hello,
I need my Working Partition urgently back and I am asking myself why there
has been no reaction on my second post.
I hesitate to proceed on my own on the basis of what I take from the first
(Terabyte) answer because I will absolutely avoid anything that could
deteriorate the chances of restoring my data. So I have a few questions on
that first answer:


TeraByte Support wrote:
>.....
>.....
> if the 100m was formatted, then you're not going to get much back without
> using a data recovery tool. If it was only created but not formatted,
> delete the two new partitions (ensure you don't use any clear or wipe
> options), use "undelete".


I have mentioned already that to the best of my recollection, there has been
added one additional partition only right at the beginning of HD-0. Its size
was 100 MiB. Before that happened and again after I had deleted that
additional partition, there was a 6 MiB Free Space at the beginning of HD-0
and right in front of my Win7 Working Partition. Perhaps this is sufficient
information for you to tell whether the overlap had been formatted. I, for
my part, just don't know and I fail to see any helpful clue in the
screenshots attached to my previous post.

Would it be without risk under these conditions to try to delete/undelete
(without any options checkmarked) the HD-0 Win7 partition? Or would it be
safer to have (TB)WinRE try to recover the lost Win7 partition?

What data recovery tool did you think of in case the 100 MiB had been
formatted?

[sigi]

Sorry for repeating my main question because I feel it has not been answered so that I could confidentially go ahead:

sigi wrote:
> .....
> .....
> Would it be without risk under these conditions to try to delete/undelete (without
> any options checkmarked) the HD-0 Win7 partition?

Your answer on the one hand let it appear optional whether to note and save the sector at the last lba of my "current large partition" (I think you mean my /dev/sda3 with 70,31 GiB ? - cf. my Attachment "My lost W7 Working Partition.jpg" in an earlier post), on the other hand it seems to indicate that if the undelete fails I would only get something back if I had taken the precautions mentioned wrt to the sector at the last lba:


TeraByte Support wrote:
> .....
> .....
> If you wanted to, you could note the last lba of your current large
> partition before deleting it .....
> .....
> .....
> Anyway, save the 1 sector at the last lba. If the undelete doesn't work or
> partition is only 100m then restore that backed up one sector to the
> location of where the partition should start. Then undelete that, you may
> get something back, .....


1) So, is it imperative for maximal data recovery to first back up the sector at the last lba before deleting/undeleting my /dev/sda3 ?
2) As to that sector, is it sector 147458047 (cf. Attachment)?
3) How should I go about saving that sector and how about restoring it to the correct position? Is there a KB article to it?


For the sake of unambiguity you will find attached an excerpt of my partinfo (cannot include it as code because for me BBCode is OFF and i cannot change this).

[TeraByte Support]

if the overlapped partition still exists, the last sector has a copy of the
boot sector of the original, if the new 100 went over it and corrupted it,
you can try putting it back, it may get most data back, but may not, some
stuff will be bad for sure, probably won't boot unless the same boot code
was installed.

So 1 - save start/end lba of partitions you think are good (they way it was)
2 - you could try delete then undelete.
3 - if it undeletes the 100 m partition, then if that 100m started at the
same as the old windows, you can try doing the backup of the end of the
partition sector and put it at the start, then undelete again. If the 100m
is not same start, you can delete with clear sector (but that will then be
gone), and try undelete again.
4 - if not back, you'd need a tool that does data recovery (looks for file
system and file information on the raw disk without regard to partition).



"sigi" wrote in message news:11909@public.bootitbm...

Sorry for repeating my main question because I feel it has not been answered
so that I could confidentially go ahead:

sigi wrote:
> .....
> .....

[sigi]

TeraByte Support wrote:
> if the overlapped partition still exists, the last sector has a copy of the
> boot sector of the original, if the new 100 went over it and corrupted it,
> you can try putting it back, it may get most data back, but may not, some
> stuff will be bad for sure, probably won't boot unless the same boot code
> was installed.
>
> So 1 - save start/end lba of partitions you think are good (they way it
> was)
> 2 - you could try delete then undelete.
> 3 - if it undeletes the 100 m partition, then if that 100m started at the
> same as the old windows, you can try doing the backup of the end of the
> partition sector and put it at the start, then undelete again. If the 100m
> is not same start, you can delete with clear sector (but that will then be
> gone), and try undelete again.
> 4 - if not back, you'd need a tool that does data recovery (looks for file
> system and file information on the raw disk without regard to partition).



Thank you for this detailed (and for most forum members perhaps exhaustive) explanation. I learnt some important facts but am still missing some for a clear view. What would be quite clear for the initiated leaves me as a newbie in English language and partition management with a couple of questions.

What puzzles me is that you still use if's. I thought the screenhots and the partinfo I had attached to my last posting have made it clear that the "overlapped partition" (I assume you mean /dev/sda3 i.e. Win7 on HD-0) still existed but has an unknown file system.

My below questions refer to your last posting quoted above in toto. Quotations therefrom are preceded by ">".


Question 1)
----------------

> if the new 100 went over it and corrupted it

What is "it" here? It cannot be the the last sector because that is some 70 GiB later than the end of the 100 MiB (deleted by me in a hasty action).


Question 2)
----------------

> you can try putting it back

Again what is "it" here?


Question 3)
----------------

> So 1 - save start/end lba of partitions you think are good (they way it was)

That is start/end lba of partiitions Num 1 through 9 in the below partiition table? All of the eight, and excluding Num 0 because it is not good?

[TeraByte Support(PP)]

sigi wrote:
> What puzzles me is that you still use if's. I thought the screenhots and the partinfo
> I had attached to my last posting have made it clear that the "overlapped
> partition" (I assume you mean /dev/sda3 i.e. Win7 on HD-0) still existed but has
> an unknown file system.

By "still exists" I think what was meant was that the partition was still in an intact state underneath the overlap. In that case, recovering the partition would be fairly easy. I seriously doubt the Windows partition is still intact, though.

> Question 1)
> ----------------
>
> > if the new 100 went over it and corrupted it
>
> What is "it" here? It cannot be the the last sector because that is some 70
> GiB later than the end of the 100 MiB (deleted by me in a hasty action).

"It" is the boot sector of the original Windows 7 partition (the one that got overwritten). When the new Windows boot partition was created it overwrote the beginning of the existing Windows 7 partition. Any data that got overwritten is lost. Using the backup of the boot sector (located in the last sector of the existing Windows 7 partition) may allow you to recover the partition and partially recover the data (anything overwritten is lost, anything corrupted is most likely lost, etc.).

> Question 2)
> ----------------
>
> > you can try putting it back
>
> Again what is "it" here?

"It" is the copy of the boot sector (from the last sector of the partition). The process would be to copy the backup copy of the boot sector to the first sector (original location) of the partition.

> Question 3)
> ----------------
>
> > So 1 - save start/end lba of partitions you think are good (they way it was)
>
> That is start/end lba of partiitions Num 1 through 9 in the below partiition table?
> All of the eight, and excluding Num 0 because it is not good?

You would make a copy of the last sector of the existing Windows 7 partition (sector 147458047). TBOSDT can be used to copy the sector (this can be done when booted to BIBM or TBWinRE).

When it comes to recovering corrupted partitions there are many ways to go at it -- some might work, some might not or even make things worse. Below is what I would try. Perhaps it will provide you some insight.

What I would do first is create an entire disk image backup of everything (include unused sectors). This will be a large backup and take time, but you would have a complete copy of the disk that could be restored for additional data restoration attempts, if needed. At the very least, I'd create a backup of the entire Windows 7 partition (including unused sectors) and normal backups of the other partitions. In any case, be aware the Windows partition, even if recovered to the point it's browseable and you can copy files off, will very likely not be usable for Windows. For example, you may be able to copy off your data files, but Windows may not boot or function (you'd need to reinstall).

Deleting and undeleting partitions can be done to see if the partition can be recovered that way. Note that making these types of attempts can write to the disk and may make further recovery attempts more difficult. In your case, it sounds like you just deleted the new 100MB Windows boot partition and didn't clear its boot sector as part of the delete. Then the original pre-existing Windows 7 partition remained on the disk as it originally was (same size, same starting location) -- only it's now corrupted and won't boot due to part of it having been overwritten.

[Note: You may wish to save the starting and ending sectors for the corrupted Windows 7 partition before deleting it (see next step, items 1-4, below).]
Using BIBM, if you delete the existing corrupted Windows 7 partition (do not use the option to clear the boot sector) and then undelete, does it find the new 100MB Windows boot partition? Or does it find the pre-existing Windows 7 partition? If it finds the 100MB partition again, then you would need to delete it and select the option to clear the boot sector. Then try to undelete again. Does it find the pre-existing Windows 7 partition? If so, can you access it (browse it, etc.)? From what you've described, I would assume not and you'd likely end up with the disk just as it is now (or without the Windows 7 partition).

The next step would be to try restoring the backup copy of the partition's boot sector. To do this, make a copy of the last sector of the partition and then copy that to the first sector.

1) Run TBOSDT (this can be from BIBM or TBWinRE).
2) Determine the Disk # to use. This is probably 0. You can run the command "list hd 0" to get a list of partitions on disk 0, "list hd 1" for disk 1, etc. Use the disk number in the following commands (0 is used below). Note that the Windows 7 partition won't show up in the list if it has been deleted.
3) Save a copy of the backup boot sector, run: copy sectors 0 147458047 1 bootsect.bin
(A copy of the sector will be saved to the bootsect.bin file in the current directory.)
4) Save a copy of the current "bad" boot sector, run: copy sectors 0 16065 1 badbsect.bin
(This assumes that LBA 16065 is the original starting sector for the partition.)
5) To copy the saved backup boot sector to the original boot sector location, run: copy sectors 0 16065 1 bootsect.bin /w
6) At this point, if the Windows 7 partition doesn't exist, use BIBM to undelete the space and see if it shows up. Otherwise, reboot. Then check if the partition is accessible.

If it doesn't help, you'll need to try some data recovery programs on the disk. As previously stated, they would need to look for file system and file information on the raw disk without regard to a partition.

-------

Note: The Windows 10 installer/updater will very likely make partitioning changes as part of the process. These changes may be expected (such as creating a boot partition if one's not found) or unexpected -- and almost always unwanted in multi-boot setups. In my experience, it's best not to count on anything partition related when Windows is installing/updating (I've seen quite a few different results from the same operation). I would create a backup image first if a drive must be connected and disconnect or disable drives not necessary for the install/update operation so Windows never sees them. If using EMBR partitions make sure the partition table is loaded in such a way that Windows won't be able to overwrite anything or create a partition (e.g. all partitions loaded, partition table full).

[sigi]

Thank you Paul, for the detailed and enlightening answer. This is the kind of explanation, guidance and detail that matches my modest level of knowledge.

Here is what I will do next:

I will first create a full backup of HD-0 using TBWinRE („Copy a hard drive to another hard drive“). I think that should include any „unused sectors“, which you mentioned twice. If it doesn't how would I include them? Any of the Settings responsible for this?

Thereafter I will save the last sector of the pre-existing Win7 partition according to your listed steps 1 through 4. This raises two questions for me:

- Where do I run TBOSDT? In TBWinRE: Do I use „TeraByte OSD Tool? In BIBM: just press „P“?
- What is the location of the „current directory“ you mentioned in step 3? What would be the command to read it?

Then I would like to delete/undelete the partition. Or should I perform steps 5 and 6 prior to delete/undelete?