Grub Error 22

[D-cat]

The best I can tell, testdisk has detected partitions that have since been resized and partially overwritten (which is why some can't show files... they start in an area that has since been overlapped). I can make a guess which ones are correct, but it is only a guess... I'm not there so I can't really be sure of this.

Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63

Partition 	Start 		End 		Size in sectors
D FAT32 LBA   	0 1  1 		33002 254 63 	530193132 [NO NAME]
D HPFS - NTFS 	0 32 33 	21939 13  42 	352448848
D HPFS - NTFS 	0 32 33 	33002 177 7 	530186240
D HPFS - NTFS 	0 32 45 	32676 254 63 	524953945
When i select the above partition and type p to list files, i get the message that I can't open file
D Linux 	21940 0   1 	23854 254 60 	30764472
D Linux 	23855 1   1 	32485 254 63 	138656952
D Linux 	28158 0   1 	36788 253 63 	138656952
can't open the above either
D Linux Swap 	32486 1   1 	33001 254 42 	8289456
D Linux 	32677 2   1 	32980 254 61 	4883632
D Linux Swap 	32981 1   1 	33001 254 41 	337280
D HPFS - NTFS 	33002 209 40 	36987 37  42 	64008192 [LENOVO]
* HPFS - NTFS 	36987 37  43 	38899 129 14 	30722048

That's six likely candidates for for partitions, and only four primary spots. That means at least three of these partitions are logical, and it's not the bootable one at the end (confusing, some BIOS still can't boot past the 1024 cylinder).

My guess on the original structure is as follows (and yes, this is in almost backwards order in the partition table):

sda1: NTFS 	0      to 21939    Primary
sda2: NTFS 	36987  to 38899    Primary Bootable
sda3: NTFS 	33002  to 36987    Primary
sda4: Ext'd    21940  to 33001
  sda5: Linux 	  21940  to 23854   (probably /)
  sda6: Linux 	  23855  to 32485   (probably mounted /home)
  sda7: Swap 	  32486  to 33001

I have ignored the detected partition between the swap locations under the suspicion that it is something that got left in swap space at around the time of whatever caused this problem.

I could be wrong though.. I'm exploring another possibility:

sda1: NTFS 	0      to 32676    Primary
sda2: NTFS 	33002  to 36987    Primary
sda3: NTFS 	36987  to 38899    Primary Bootable
sda4: Ext'd    32677  to 33001
  sda5: Linux 	  32677  to 32980
  sda6: Swap 	  32981  to 33001

Edit: I don't think this second one is the case because of your comment about not being able to read files from one of the partitions in this scheme. That would imply that maybe this was the scheme prior to a resize operation, but is no longer valid. /Edit

I think the tell tale would be what files can actually be read from whatever locations. It's hard here, since there's really no way for the program to be sure, so how can we?

If you restore the partition table as I have written, I'd suggest you at least back up (as a raw image file) the individual partitions, including the swap, so you can have something for recovery programs (like photorec) to work with, prior to attempting to boot from the hard drive. Otherwise you may suffer irreversible data loss (especially if we choose the wrong structure). 360GB is a lot of space, you're probably best off using an external hard drive if you can afford it.

[dagarshali]

Hi,
Thanks for the reply... Wat is the procedure for backing it up as an image file..?

I do have access to external drive....

Here are the contents of the different partitions...

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>


Disk /dev/sda - 320 GB / 298 GiB - CHS 38914 255 63
Partition Start End Size in sectors
D FAT32 LBA 0 1 1 33002 254 63 530193132 [NO NAME]
D HPFS - NTFS 0 32 33 21939 13 42 352448848
D HPFS - NTFS 0 32 33 33002 177 7 530186240
D HPFS - NTFS 0 32 45 32676 254 63 524953945
D Linux 21940 0 1 23854 254 60 30764472
D Linux 23855 1 1 32485 254 63 138656952
D Linux 28158 0 1 36788 253 63 138656952
D Linux Swap 32486 1 1 33001 254 42 8289456
D Linux 32677 2 1 32980 254 61 4883632
D Linux Swap 32981 1 1 33001 254 41 337280
D HPFS - NTFS 33002 209 40 36987 37 42 64008192 [LENOVO]
* HPFS - NTFS 36987 37 43 38899 129 14 30722048





Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, 271 GB / 252 GiB


-rwxr-xr-x 0 0 852030 18-Mar-1980 00:03 b
-rwxr-xr-x 0 0 2097184 31-Dec-1979 00:00
-rwxr-xr-x 0 0 4063279 2-Mar-1980 00:01 <
-rwxr-xr-x 0 0 2097184 11-Jan-1980 00:00
-rwxr-xr-x 0 0 7340064 28-Jan-1980 00:01 ./
-rwxr-xr-x 0 0 7209065 30-Jan-1980 00:01 a
-rwxr-xr-x 0 0 7929888 18-Mar-1980 00:03 d
-rwxr-xr-x 0 0 655373 16-Mar-1980 00:01
-rwxr-xr-x 0 0 3932192 31-Dec-1979 00:01 .<
-rwxr-xr-x 0 0 6750319 16-Mar-1980 00:01 m
-rwxr-xr-x 0 0 3604514 5-Mar-1980 00:03 r
-rwxr-xr-x 0 0 6553697 31-Dec-1979 00:03 6
-rwxr-xr-x 0 0 2097184 31-Dec-1979 00:00 -
-rwxr-xr-x 0 0 6619245 14-Mar-1980 00:01 .e
-rwxr-xr-x 0 0 2097186 6-Mar-1980 00:03 =
-rwxr-xr-x 0 0 2097184 14-Jan-1980 00:02 w
-rwxr-xr-x 0 0 7274594 28-Jan-1980 00:01 .p
-rwxr-xr-x 0 0 7602234 13-Mar-1980 00:03 d
-rwxr-xr-x 0 0 3080252 14-Jan-1980 00:02 e
-rwxr-xr-x 0 0 851978 30-Jan-1980 00:03 x


HPFS - NTFS 0 32 33 21939 13 42 352448848
Directory /

dr-xr-xr-x 0 0 0 25-Aug-2009 02:30 .
dr-xr-xr-x 0 0 0 25-Aug-2009 02:30 ..
dr-xr-xr-x 0 0 0 24-Jul-2009 04:43 Intel
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 $Recycle.Bin
dr-xr-xr-x 0 0 0 31-Oct-2009 18:30 BIOS
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 Boot
-r--r--r-- 0 0 333203 24-Jul-2009 03:59 bootmgr
-r--r--r-- 0 0 8192 24-Jul-2009 04:17 BOOTSECT.BAK
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 Documents and Settings
-r--r--r-- 0 0 520 15-Sep-2009 16:13 ICAutoUpdate.log.bak
-r--r--r-- 0 0 904704 24-Jul-2009 05:50 msdia80.dll
dr-xr-xr-x 0 0 0 24-Jul-2009 05:31 MSOCache
-r--r--r-- 0 0 4571443200 24-Jul-2009 04:22 pagefile.sys
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 PerfLogs
dr-xr-xr-x 0 0 0 25-Aug-2009 02:19 Program Files
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 Program Files (x86)
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 ProgramData
dr-xr-xr-x 0 0 0 5-Oct-2009 04:05 QUARANTINE
-r--r--r-- 0 0 1821 24-Jul-2009 05:03 RHDSetup.log
-r--r--r-- 0 0 266240 24-Jul-2009 05:05 RtkApoApi.dll


HPFS - NTFS 0 32 33 33002 177 7 530186240
Directory /

dr-xr-xr-x 0 0 0 25-Aug-2009 02:30 .
dr-xr-xr-x 0 0 0 25-Aug-2009 02:30 ..
dr-xr-xr-x 0 0 0 24-Jul-2009 04:43 Intel
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 $Recycle.Bin
dr-xr-xr-x 0 0 0 31-Oct-2009 18:30 BIOS
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 Boot
-r--r--r-- 0 0 333203 24-Jul-2009 03:59 bootmgr
-r--r--r-- 0 0 8192 24-Jul-2009 04:17 BOOTSECT.BAK
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 Documents and Settings
-r--r--r-- 0 0 520 15-Sep-2009 16:13 ICAutoUpdate.log.bak
-r--r--r-- 0 0 904704 24-Jul-2009 05:50 msdia80.dll
dr-xr-xr-x 0 0 0 24-Jul-2009 05:31 MSOCache
-r--r--r-- 0 0 4571443200 24-Jul-2009 04:22 pagefile.sys
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 PerfLogs
dr-xr-xr-x 0 0 0 25-Aug-2009 02:19 Program Files
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 Program Files (x86)
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 ProgramData
dr-xr-xr-x 0 0 0 5-Oct-2009 04:05 QUARANTINE
-r--r--r-- 0 0 1821 24-Jul-2009 05:03 RHDSetup.log
-r--r--r-- 0 0 266240 24-Jul-2009 05:05 RtkApoApi.dll


Linux 21940 0 1 23854 254 60 30764472
Directory /

drwxr-xr-x 0 0 4096 31-Oct-2009 20:21 .
drwxr-xr-x 0 0 4096 31-Oct-2009 20:21 ..
drwx------ 0 0 16384 31-Oct-2009 20:21 lost+found

Linux 23855 1 1 32485 254 63 138656952
Directory /

drwxr-xr-x 0 0 4096 22-Oct-2009 22:23 .
drwxr-xr-x 0 0 4096 22-Oct-2009 22:23 ..
drwx------ 0 0 16384 24-Aug-2009 11:47 lost+found
drwxr-xr-x 0 0 4096 20-Apr-2009 14:07 var
drwxr-xr-x 0 0 12288 31-Oct-2009 20:23 etc
drwxr-xr-x 0 0 4096 31-Oct-2009 20:21 media
lrwxrwxrwx 0 0 11 24-Aug-2009 11:47 cdrom
drwxr-xr-x 0 0 4096 26-Oct-2009 18:50 bin
drwxr-xr-x 0 0 4096 30-Oct-2009 01:10 boot
drwxr-xr-x 0 0 4096 20-Apr-2009 14:06 dev
drwxr-xr-x 0 0 4096 24-Aug-2009 11:54 home
drwxr-xr-x 0 0 12288 30-Oct-2009 01:09 lib
drwxr-xr-x 0 0 4096 13-Apr-2009 09:33 mnt
drwxr-xr-x 0 0 4096 22-Sep-2009 18:18 opt
drwxr-xr-x 0 0 4096 13-Apr-2009 09:33 proc
drwx------ 0 0 4096 26-Oct-2009 18:52 root
drwxr-xr-x 0 0 4096 30-Oct-2009 01:09 sbin
drwxr-xr-x 0 0 4096 6-Mar-2009 16:21 selinux
drwxr-xr-x 0 0 4096 15-Oct-2009 01:10 srv
drwxr-xr-x 0 0 4096 31-Mar-2009 09:02 sys

Linux 32677 2 1 32980 254 61 4883632
Directory /

drwxr-xr-x 0 0 4096 24-Aug-2009 16:02 .
drwxr-xr-x 0 0 4096 24-Aug-2009 16:02 ..
drwx------ 0 0 16384 24-Aug-2009 15:54 lost+found
drwxr-xr-x 0 0 4096 20-Apr-2009 14:07 var
drwxr-xr-x 0 0 4096 24-Aug-2009 16:24 etc
drwxr-xr-x 0 0 4096 24-Aug-2009 16:21 media
lrwxrwxrwx 0 0 11 24-Aug-2009 15:54 cdrom
drwxr-xr-x 0 0 4096 24-Aug-2009 16:03 bin
drwxr-xr-x 0 0 4096 24-Aug-2009 16:02 boot
drwxr-xr-x 0 0 4096 20-Apr-2009 14:06 dev
drwxr-xr-x 0 0 4096 24-Aug-2009 16:01 home
drwxr-xr-x 0 0 4096 24-Aug-2009 16:03 lib
drwxr-xr-x 0 0 4096 13-Apr-2009 09:33 mnt
drwxr-xr-x 0 0 4096 20-Apr-2009 13:59 opt
drwxr-xr-x 0 0 4096 13-Apr-2009 09:33 proc
drwx------ 0 0 4096 24-Aug-2009 16:06 root
drwxr-xr-x 0 0 4096 24-Aug-2009 16:03 sbin
drwxr-xr-x 0 0 4096 6-Mar-2009 16:21 selinux
drwxr-xr-x 0 0 4096 20-Apr-2009 13:59 srv
drwxr-xr-x 0 0 4096 31-Mar-2009 09:02 sys

HPFS - NTFS 33002 209 40 36987 37 42 64008192 [LENOVO]
Directory /

dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 .
dr-xr-xr-x 0 0 0 24-Jul-2009 03:59 ..
dr-xr-xr-x 0 0 0 24-Jul-2009 04:30 $RECYCLE.BIN
dr-xr-xr-x 0 0 0 24-Jul-2009 04:34 drivers
dr-xr-xr-x 0 0 0 24-Jul-2009 05:52 Lenovo
dr-xr-xr-x 0 0 0 24-Jul-2009 04:25 System Volume Information

* HPFS - NTFS 36987 37 43 38899 129 14 30722048
Directory /

dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 .
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 ..
dr-xr-xr-x 0 0 0 24-Jul-2009 04:30 $RECYCLE.BIN
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 boot
-r--r--r-- 0 0 438840 24-Jul-2009 03:58 bootmgr
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 EFI
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 Factory
-r--r--r-- 0 0 104896002 24-Jul-2009 09:10 factory.000
-r--r--r-- 0 0 104859568 24-Jul-2009 09:10 factory.001
-r--r--r-- 0 0 1301504 24-Jul-2009 03:58 msxml6.dll
-r--r--r-- 0 0 86728 24-Jul-2009 03:58 msxml6r.dll
-r--r--r-- 0 0 3166 24-Jul-2009 03:58 okopr.bat
-r--r--r-- 0 0 3001 24-Jul-2009 03:58 okoprnew.bat
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 OneKey Recovery
-r--r--r-- 0 0 16 24-Jul-2009 03:59 PSN.TXT
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 Servicing
-r--r--r-- 0 0 201 24-Jul-2009 03:58 Setup.cmd
dr-xr-xr-x 0 0 0 24-Jul-2009 03:58 sources
dr-xr-xr-x 0 0 0 24-Jul-2009 04:25 System Volume Information
-r--r--r-- 0 0 3116 24-Jul-2009 03:58 wimfltr.inf

[D-cat]

Thank you for that, I've made some adjustments to what I think is the correct partition table based on what you showed me.

sda1: (07)NTFS   	0      to 21939    168GB Primary Bootable [Windows]
sda2: (17)NTFS-H 	36987  to 38899     14GB Primary [Recovery] (has the factory drive image)
sda3: (07)NTFS   	33002  to 36987     30GB Primary [Lenovo] (windows drivers disk)
sda4: (05)Ext'd        21940  to 33001     84GB
  sda5: (83)Linux 	  21940  to 23854     14GB Logical (I don't know where this was mounted, clean slate)
  sda6: (83)Linux 	  23855  to 32485     66GB Logical (/)
  sda7: (82)Swap 	  32486  to 33001      4GB Logical

Like I said, I haven't used testdisk, but I'm thinking that you can use the T option to change the types to the numbers I listed (the NTFS-H is hidden NTFS.. only booted when you want to restore the computer to factory condition) and the L/R arrows to undelete the specific partitions underlined a couple posts above.
Note: You might have to Add the extended partition.

Since sda2-3 are not separated on cylinder boundaries, I'd suggest you do as much of the recovery from testdisk as you can. Using other tools (like fdisk) at this stage would probably result in making those windows partitions unreadable.

Once you have the partition table redefined, doing a raw image backup can be done with various tools. I prefer cat in this situation (it doesn't get more raw than that). It would work something like:

cat /dev/sda1 > /media/backup/partition1.img

and so forth (skipping 4, since that's a container) until the partitions are all backed up as raw images. This way, if the internal hard drive totally goes kafluey on boot and you have to start from scratch, you can sic a recovery tool on the image files and restore to the local hard drive.

[dagarshali]

Hi,
I finally did what you suggested but for one thing.. the extended partition wasn't an option at all.. all i could select was * , P, L, D not E..

So, i ignored jsut that and when i booted , i got grub error 17 instead of the 22 that I had gotten in the past..

also when i booted LIVE cd and

these are the outputs for

sudo fdisk -l

ubuntu@ubuntu:~$ sudo fdisk -l

Disk /dev/sda: 320.0 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x8e0eee9e

Device Boot Start End Blocks Id System
/dev/sda1 * 1 21940 176224424 7 HPFS/NTFS
/dev/sda2 21941 33002 88855515 f W95 Ext'd (LBA)
/dev/sda3 33003 36988 32004096 7 HPFS/NTFS
/dev/sda4 36988 38900 15361024 7 HPFS/NTFS
/dev/sda5 23856 32486 69328476 83 Linux
/dev/sda6 32487 33002 4144728 82 Linux swap / Solaris

sudo grub

grub> find /boot/grub/menu.lst
(hd0,4)

Now what do i do..

Regards,
Vishwa

[Lostfarmer]

need to clarify just when you get error 17. During grub loading or do you get grub menu and error after selecting OS to boot ?

If it is after OS selection post the menu.lst.

After this is fixed and you try to boot into XP, do not let it do auto check disk. If you made a wrong guess at partitions and check disk runs it will convert files to 'found.0xx' and you will be bad off.

[D-cat]

I believe the windows partitions are all correct, it appears you have chosen not to restore the empty 14 GB (21941-23856) partition at this time. This is okay for now, but you should keep it in mind; you may want to recover that space for use somehow in the near future.

The grub issue can probably be repaired automatically with Supergrub. It comes with the Parted Magic CD, just select SuperGrub at the boot menu.

AFA the windows scandisk (or chkdsk), it will have to be done anyway, but don't let it at boot; set it up to do the scan interactively (do not automatically fix errors) to avoid the problem LostFarmer's talking about. You might also consider running a disk utility from a Windows BartPE boot CD (e.g. Ultimate Boot CD for Windows).