My freebsd partition changed by Windows chkdsk (Leslie Jensen)

[Manish Jain]

On 02-Nov-12 19:19, Leslie Jensen wrote:
>
>
> Manish Jain skrev 2012-11-02 14:39:
>>> That I trusted the chkdsk program to do what I told it to do was in
>>> retrospect a bit naive ;-) I do have a backup although it's not as
>>> recent as I would have liked.
>>>
>>> Can you think of any way to perhaps recover the data from the freebsd
>>> partition?
>>
>> I trust that you by now have discovered that your trust was never 
>> breached
>> by Microsoft (for once). Microsoft firmly believes that Windows is 
>> the only
>> OS that should reside on a PC's disk. Therefore running chkdsk with 
>> force
>> was only an invitation to Microsoft to run amok.
>>
>> BTW, the reason I replied to this message was not to provide you with a
>> solution but with a trivial yet good bit of precaution I use on my own
>> dual-boot PC, wherein ad4s1 is NTFS/Windows and ad4s2 is my FreeBSD 
>> slice.
>> Right after installation of FreeBSD, I ran :
>>
>> dd if=/dev/ad4 of=ad4.512 bs=512 count=1
>> dd if=/dev/ad4s2 of=ad4s2.512 bs=512 count=1
>> dd if=/dev/ad4s2a of=ad4s2a.512 bs=512 count=1
>>
>> No matter how Windows screws up the MBR or FreeBSD's slice, 
>> recovering from
>> the situation is simple enough.
>>
>> Regards
>>
>> Manish Jain
>> bourne.identity at hotmail.com
>>
>>
>> _______________________________________________
>> freebsd-questions at freebsd.org mailing list
>> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>> To unsubscribe, send any mail to
>> "freebsd-questions-unsubscribe at freebsd.org"
>
>
> Thank you for your comment.
> I must admit that I do not fully understand what it is you do.
> Will you explain the details, Please?
> Thanks
> /Leslie
>
>

Hello Leslie,

Sorry if my comment sounded a bit cryptic.

The first 512 bytes of any hard-disk reside outside of any slice and
contain the master boot record. If you installed Windows first and
FreeBSD second and opted for the FreeBSD (a.k.a. Easy) Boot Manager,
the disk's first 512 bytes will contain 446 bytes of Boot Manager
code (which the BIOS executes to give you the F1/F2/F3/F4 choices),
64 bytes containing the disk's slice layout (maximum 4 slices) and
2 bytes for a BIOS checksum.

It is very easy to lose the MBR. If, instead of chkdsk, you were to
run the fixmbr command, Windows will put its own code into the 446
bytes. That code is capable of only one thing - booting drive C:

When you ran chkdsk /f, Windows changed the slice-type of your
FreeBSD slice from FFS (ID=165) to NTFS (ID=7) in the MBR. Only
Microsoft knows why chkdsk is permitted to do that.

Once that happens, you would REALLY like to fix the MBR. One way to
do it is to to run the reverse of the first command :

dd if=ad4.512 of=/dev/ad4 bs=512 count=1

This assumes 1) you can boot into FreeBSD or Linux or have a GParted
bootable CD, and 2) you saved your original MBR as ad4.512 and have
access to it, possibly on a USB pendrive that you can mount.

Just as the disk's first 512 bytes reside outside of any slice,
every slice's first 512 bytes reside outside any partition in that
slice and consequently outside the filesystems in that slice. This
sector contains the boot code (a.k.a. boot record) needed to boot
the OS on that slice. Windows will generally be nice enough to first
read the boot.ini file, which gives us the option of booting FreeBSD
from Windows' boot.ini :

dd if=/dev/ad4s2 of=ad4s2.512 bs=512 count=1

Copy out ad4s2.512 to drive C:, and put this in your boot.ini :

c:\ad4s2.412="Boot FreeBSD instead"

Of course, you have to substitute your correct numbers in the
ad<N>s{N} notation. For me, <N> is 4 and {N} is 2.

The ad4s2a.512 file contains the first sector in your FreeBSD /
partition and is meaningful to the loader more than to us mortals.

If everything else fails, you might like to give the following a
try :

1) Boot from your FreeBSD CD/DVD, enter the slice editor and
change the type of your FreeBSD slice back to 165. Do not press Q.
Press W instead. Conform with Yes to the warning, and then press
Ctrl+Alt+Del to abort the installation.

2) Boot from your FreeBSD CD/DVD again, and run boot0cfg -B in an
emergency shell.

<My legal disclaimer comes here, but do let me know if you get lucky>

I hope my message sounds less cryptic now. I personally don't have
anything against running chkdsk or fixmbr, AS LONG AS I have backed
up the important sectors.

Regards

Manish Jain
bourne.identity at hotmail.com