Filling Disk Divots
A friend called in despair when her old Sony Vaio laptop wouldn't boot Windows ME. A neighbor had diagnosed the problem as a dead hard drive, but she was looking for a second opinion. She's retired and uses the thing just for e-mail, so dropping a few hundred bucks on a repair—or worse, a new system—wasn't in the cards. Reinstalling Windows and all the programs wasn't an option, either, for all the usual reasons.
I found that the laptop started to boot, spat out a few useless messages, then jammed solid. The erratically varying symptoms seemed to show that Norton Internet Security was badly damaged. At least the drive wasn't quite as dead as the neighbor had led us to believe.
I treat alien Windows boxes with the same cheerful nonchalance as I might handle random lumps of high-level radioactive waste and, in particular, I don't just plug them into my LAN to see what happens. As it turns out, Linux provides the best way to safely and securely repair Windows problems.
The object of the game was to save the contents of the drive so I could perform repairs without making things worse. Most disabled PCs have older, relatively small, drives and this laptop was no exception: It had a 12-GB drive sliced into four (!) separate partitions.
I backed up the partitions with partimage to ensure that, if all else failed, I could restore the drive to its original configuration. However, partimage stores image files in a format that's suited for backups, not repair work, so I needed another trick.
The dd utility (an abbreviation for either "data dump" or "disk destroyer," depending on whether you've ever swapped its if= and of= operands) makes an exact byte-for-byte copy of its input source at its output. Listing Two(a) shows how I backed up the master and partition boot records and first partition of the Vaio's drive.
<b>(a)</b> net-setup eth0 # define IP address and suchlike /etc/init.d/nfs start # nfs starts up portmapper, lockd, etc mount 192.168.1.2:/bulkdata /mnt/temp1 # mount the NFS share mkdir "/mnt/temp1/Backups/Sony Vaio" # set up a directory to hold images cd "/mnt/temp1/Backups/Sony Vaio" # save some typing dd bs=512 count=1 if=/dev/hda of=drive.mbr # save drive's master boot record dd bs=512 count=1 if=/dev/hda1 of=hda1.mbr # save partition 1 boot record dd if=/dev/hda1 of=hda1.bin # save wrecked Windows partition <b>(b)</b> mount -o loop "/mnt/bulkdata/Backups/Sony Vaio/hda1.bin" /mnt/loop fsck -vV /dev/loop0 # fsck uses underlying loopback pseudo-device ll /mnt/loop # the mounted filesystem looks like any other
A failing drive will return errors at bad sectors and fill those parts of the image file with invalid data. Restoring a damaged image to a new drive won't magically recreate the original bytes, so the best I could do was remove the damaged files.
After creating the backup images, I returned to my desktop system and mounted them using the Linux loopback pseudodevice to see what was broken. Listing Two(b) shows how that works for the first partition.
Loopback lets you manipulate the partition image with the same tools that work on an actual disk partition. Filesystem utilities such as fsck use the underlying pseudodevice, typically /dev/loop0 for the first file you mount this way. File-handling utilities, browsers, and suchlike refer to the mount point, which is /mnt/loop in Listing Two(b).
I managed to repair the filesystem errors by deleting the affected files, emptying the various directories that contain autostarting programs, and generally trimming the underbrush. The ClamAV virus scanner (www .clamav.net/) reported no hits, a pleasant surprise on a Windows box. All this fiddling ran much faster on the image than directly on the laptop, too.
Booting SRCd on the laptop again, I ran fsck on the drive to mark the bad sectors, deleted everything except the boot files required to start WinME, then used cp -au to copy everything from the repaired partition image back to the drive. You may not be able to use dd to restore an image file to a repaired partition, because it must maintain sector-by-sector alignment during the copy to keep the filesystem structures intact. Modern desktop drives can transparently remap failed sectors below the level of the filesystem, but that trick was beyond this drive's capabilities.
There's no good way to edit the Windows Registry using Linux, so I eventually had to boot WinME in Safe Mode on the laptop, uninstall several programs, then blowtorch a few recalcitrant programs with regedit. After several iterations of this, the laptop finally booted cleanly and ran well. My friend said that she didn't use the missing programs.
I transferred the compressed partition images to DVDs so I can restore the system with somewhat less effort when that drive finally fails completely. Regular backups would be nice, but it's out of my hands.
Speaking of images, the command dd if=/dev/cdrom of=image.iso makes an image backup of a CD. You can then burn the image to a CD-R to make a duplicate or mount it using loopback to read its contents, subject to the usual copyright and EULA issues.
After you're up to speed with PC restoration, try your hand at some embedded systems work.
