1

Topic: Ok, another "Current NTFS volume size" problem

Which I am deathly afraid that I have exacerbated.

Let me detail what happened.

I resized the partition, getting ready to copy it, and once I tried to copy it, GParted gave my the "Current NTFS volume size" error.

I landed at this forum after much searching, and I tried to fix the problem myself, but I believe that I grew confused, and when I tried to edit the pbr and mbr files, I put in wrong values.

I should say here that there was originally only the NTFS partition on the drive, and it started 2048 sectors into the drive.  When I started
fdisk -u -l:

Disk /dev/sda: 250.0 GB, 250000000000 bytes
255 heads, 63 sectors/track, 30394 cylinders, total 488281250 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x69205244
 
   Device  Boot      Start         End      Blocks   Id  System
/dev/sda1  *        2048      283209885               7  HPFS/NTFS

parted /dev/sda unit s print:

Model: ATA ST3250820AS (scsi)
Disk /dev/sdb: 488281250s
Sector size (logical/physical): 512B/512B
Partition Table: loop

Number  Start  End         Size        File system  Flags
 1      2048s     283209885s  283207837s  ntfs

I ran the following commands to extract the mbr and the pbr:

dd if=/dev/sda of=sda-xcrln.mbr bs=512 count=1
dd if=/dev/sda of=sda1-xcrln.pbr bs=512 count=1 skip=2048

I then edited the pbr (because I was shrinking the partition) to read
00000020   00 00 00 00  80 00 80 00  9C 68 E1 10  00 00 00 00
I didn't record the value before I changed it

When that didn't work, I edited the mbr:
From: 00000020   00 00 00 00  80 00 80 00  F8 7F 1A 1D  00 00 00 00
To: 00000020   00 00 00 00  80 00 80 00  A2 94 1A 1D  00 00 00 00

And I got to where I am now, with one big NTFS partition that encompasses the entire drive
I undid the change to the mbr, but that didn't change anything.
The current mbr and pbr files can be found here:
MBR: http://dl.dropbox.com/u/373779/sda-xcrln.mbr
PBR: http://dl.dropbox.com/u/373779/sda-xcrln.pbr

I have dd'd the drive to an external one to work on, and I found this http://support.microsoft.com/kb/153973, which I followed until step 4. because I didn't get the ASCII text that it said I would, I got the text "ntldr is missing press ctrl+alt+del to restart"   I then went to sector 2048, and saw the change that I had made on offset 20, and then I went to 2049 and the ASCII at the top said NTLDR.

So I know where the NTLDR is, and how big the partition was or is supposed to be (283207837s).

Currently, when I run fdisk, and parted I get: (remember that I am on a copy on a different harddrive)
fdisk -u -l:

Disk /dev/sdb: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders, total 488397168 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x69205244

This doesn't look like a partition table
Probably you selected the wrong device.

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   ?   218129509  1920119918   850995205   72  Unknown
Partition 1 does not end on cylinder boundary.
/dev/sdb2   ?   729050177  1273024900   271987362   74  Unknown
Partition 2 does not end on cylinder boundary.
/dev/sdb3   ?   168653938   168653938           0   65  Novell Netware 386
Partition 3 does not end on cylinder boundary.
/dev/sdb4      2692939776  2692991410       25817+   0  Empty
Partition 4 does not end on cylinder boundary.

Partition table entries are not in disk order

parted /dev/sdb unit s print:

 Model: Maxtor OneTouch (scsi)
Disk /dev/sdb: 488397168s
Sector size (logical/physical): 512B/512B
Partition Table: loop

Number  Start  End         Size        File system  Flags
 1      0s     488397167s  488397168s  ntfs

Can anyone help me?

2

Re: Ok, another "Current NTFS volume size" problem

I have fixed this problem with a sector by sector scan for the files.

But if you know what to do to fix this problem, I would still love to hear it.

3

Re: Ok, another "Current NTFS volume size" problem

xcrln wrote:

<snip>
I then edited the pbr (because I was shrinking the partition) to read
00000020   00 00 00 00  80 00 80 00  9C 68 E1 10  00 00 00 00
I didn't record the value before I changed it
<snip>
So I know where the NTLDR is, and how big the partition was or is supposed to be (283207837s).
<snip>

You were extremely close to fixing the problem.

After reversing the byte pairs, the hexadecimal number you used is 10E1689C.  This value in decimal is 283,207,836.

Note:  The NTFS volume size is always 1 sector less than the total number of sectors in the partition table entry because the NTFS backup sector is not considered part of the NTFS volume.

Hence the number you needed for the partition is 1 sector more than the NTFS volume size, or as a number:
10E1689E hexadecimal
283,207,838 decimal
9E 68 E1 10 reversed reversed byte pairs.

4

Re: Ok, another "Current NTFS volume size" problem

Thanks gedakc.

I should have tried going the other way when I tried to restore it on my own.  I'll know fro next time!
Thanks gedakc again.

~