Windows 7 boot troubleshooting
Jump to navigation
Jump to search
To tidy up. Info collecting when trying to P2V (Physical-2-Virtual) a native (physical) Windows 7 partition to a virtual disk image for VirtualBox.
win7_P2V_links.txt
Error 0x0000007B INACCESSIBLE_BOOT_DEVICE
http://triplescomputers.com/blog/casestudies/stop-error-0x0000007b-0xfffff880009a98e8-0xffffffffc000000d-0x0000000000000000-0x0000000000000000/
--> script to completely rebuild the BCD store using bcdedit.exe
http://support.microsoft.com/kb/927391
msg "The Windows Boot Configuration Data file is missing required information"
- The Windows Boot Manager (Bootmgr) entry is not present in the Boot Configuration Data (BCD) store.
- The Boot\BCD file on the active partition is damaged or missing.
--> script to rebuild using bootrec.exe
Bcdedit /export C:\BCD_Backup
ren c:\boot\bcd bcd.old
Bootrec /rebuildbcd
(+also all bootec /fixmbr; bootrec /fixboot)
--> script to rebuild using bcdedit.exe (if previous one fails)
http://social.technet.microsoft.com/Forums/en-US/windowsbackup/thread/b4d45d9d-4c90-4ab0-ae38-f1257ce9c608/
--> About Bare Metal Restore (=P2V)
--> About no injecting driver during Bare Metal Restore (BMR) recovery (DWORD DoNOtINjectDrivers)
--> About modifying drivers intelide / Pcide
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
VMWare VM:
aliide 3
amdide 3
atapi 0
cmdide 3
iastorv 3
intelide 0
msahci 3
pciide 3
viaide 3
LSI_SAS 0
Dell PE2970 physical machine with RAID card:
aliide 3
amdide 3
atapi 0
cmdide 3
iastorv 3
intelide 3
msahci 0
pciide 3
viaide 3
LSI_SAS 3
Dell PET100 physical machine on native SATA adapter:
aliide 3
amdide 3
atapi 0
cmdide 3
iastorv 3
intelide 3
msahci 0
pciide 0
viaide 3
LSI_SAS 3
Win 7 64x custom built physical machine on native SATA adapter:
aliide 3
amdide 3
atapi 0
cmdide 3
iastorv 3
intelide 3
msahci 0
pciide 0
viaide 3
LSI_SAS 3
(+idem for LSI_SAS2)
(P2V for Windows is called BMR apparently)
http://reboot.pro/topic/14130-bsod-7b-finally-fixed-for-me-maybe-for-you-too/
--> ***EXCELLENT*** analysis on the boot process in windows. A MUST READ!!!
P2V using VMware vCenter Converter
http://www.sysprobs.com/physical-virtual-machine-vmware-vcenter-converter
--> guide
NTFS on linux
http://www.tuxera.com/community/ntfs-3g-advanced/
--> ntfs-3g advanced guide
http://jp-andre.pagesperso-orange.fr/advanced-ntfs-3g.html
http://jp-andre.pagesperso-orange.fr/permissions.html
--> detailed information
http://jp-andre.pagesperso-orange.fr/advanced-ntfs-3g.html
--> tools.zip, that contains ntfscp.sh, a script that copy directory and keep permissions
To copy, while copy permission use ntfscp.sh
Note that I don't need that to copy registry from one disk to another
(Simpler is to boot in Win7, and copy using Windows Explorer)
http://b.andre.pagesperso-orange.fr/extend-attr.html
--> More info on NTFS extended attributes (stored as ntfs stream, containing special permission
--> these attributes are copied by ntfscp.sh (and also ntfscp itself I think)
--> However I can't make cp, tar or rsync copy these xattr
http://tuxera.com/forum/viewtopic.php?f=2&t=29567
--> Copying Between NTFSes With Preserving Permissions
Linux HW misc
sudo lshw -class disk # view all disks
sudo parted -l # view all partitions
ls /sys/block/sd*/ # view all partitions
Windows Registry
http://support.microsoft.com/kb/100010
--> What are Control Sets? What is CurrentControlSet?
About ControlSet001 = usually default, and COntrolSet002, usually last known good
About key Select, with values Current, Default, Failed, LastKnownGood
http://msdn.microsoft.com/en-us/library/windows/hardware/ff546173(v=vs.85).aspx
--> About CurrentControlSet\Enum
PnP manager creates a subkey for each device
http://diddy.boot-land.net/firadisk/files/mounteddevices.htm
--> About SYSTEM\MountedDevices
should be deleted when booting on different devices (Windows will reconstruct it).
Otherwise disk will be assigned a different letter (it is safe to delete values '\??\Volumne{guid}')
http://technet.microsoft.com/en-us/library/cc957340.aspx
--> Detailed description of SYSTEM registry, HKEY_LOCAL_MACHINE... (for Windows 2000)
http://msdn.microsoft.com/en-us/library/windows/hardware/ff546165(v=vs.85).aspx
--> Info on SYSTEM/CurrentCOntrolSet/Control
Class --> info about the device setup class (setup class like class installer, upper-filter drivers, lower-filter drivers)
CoDeviceInstallers --> class-specific co-installers
DeviceClasses --> subkey for each device interface class
--> + info on Services/, on Enum/, on Hardware Profiles
http://msdn.microsoft.com/en-us/library/windows/hardware/ff558808(v=vs.85).aspx
The following keys are link to Pnp:
Control/Class
Control/DeviceClasses
Enum
Hardware Profiles
P2V - manual
http://www.justsoftwaresolutions.co.uk/general/importing-windows-into-virtualbox.html
About taking SYSTEM hive from a clean windows install in VM, and importing it in the P2V machine.
About patching the SYSKEY (--> SYSTEM, SECURITY, SAM protected by checksum)
http://www.beginningtoseethelight.org/ntsecurity/index.htm
--> very detailed info on windows security, on Security Accounts Manager (SAM file), data structure, relationships, etc.
VirtualBox documentation
http://www.virtualbox.org/manual/ch05.html
--> About virtual storage
- SATA: better than IDE, but only available since Vista w/o additional drivers
standard interface for SATA control = AHCI (Advanced Host Controller Interface)
- SAS = Serial Attached SCSI.
VM emulates it as a LSI Logic SAS control (require Windows Vista or higher, or additional drivers in XP)
Windows Boot issue
https://forums.virtualbox.org/viewtopic.php?f=7&t=24209&p=107595
--> About "A disk read error occured\nPress Ctrl-Alt-Del to restart"
Error comes from the Volume Boot Record, info on disk geometry is wrong (trying to read a bad sector, or a
sector number that does not exist on the drive). So message is printed by BIOS, from call in the MBR code
See detailed explanation at http://www.xtralogic.com/support.shtml#faq_vhdu_disk_read_error
Fix is to us TESTDISK to fix the volume boot record (see http://www.xtralogic.com/testdisk_rebuild_bootsector.shtml)
http://en.wikipedia.org/wiki/Volume_boot_record
--> Info on VBR
http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1006556
--> VMWare KB. List of all boot issues (and error messages), and how to fix them. But usually requires
using repair disk (no real explanations of what to do)
--> However lots of info, + links to other pages
http://support.microsoft.com/kb/308041
--> Advanced troubleshooting for general startup problems in Windows XP
Several steps, things to try, etc
Not much technical things, but some pointers
http://support.microsoft.com/kb/314477
--> Error message: "Windows could not start because of a computer disk hardware configuration problem"
about message
Windows could not start because of a computer disk hardware configuration problem.
Could not read from the selected boot disk. Check boot path and disk hardware.
Please check the Windows documentation about hardware disk configuration and your hardware reference manuals for additional information.
Due to wrong Boot.ini file (wrong partition selected in Boot.ini (partition does not exist))
http://www.sevenforums.com/tutorials/219533-troubleshooting-windows-7-failure-boot.html
--> yet another comprehensive list on boot issues, but w/o explanation. Only using 3rd party tools
Admin password recovery
http://social.microsoft.com/Forums/en-US/studentrockstar/thread/bd195503-06ab-47a7-b941-f5fe2c2215bb
Using loophole during Windows reinstall (install files, then press Shift-F10 after 1st reboot)
Copy with rsync, keeping permissions:
https://mebsd.com/cli-commands/rsync-over-ssh-keeping-file-ownerships-and-permissions.html
--> Copy using rsync, keeping permissions
Fix sudoers: add
ssh-user ALL = NOPASSWD: /usr/local/rsync
then
rsync -a --rsync-path="sudo rsync" /usr/local/www ssh-user@backup-server.tld:/usr/backup_dir/
Remove Bit-Locker Encryption
http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/74783472-3776-4b9e-a8f4-7ab777bd99d9/
--> About removing BDEDrive after BL was disabled for C:
bcdboot c:\windows /s c:
Then set c: as active
Question: What difference between this bcdboot command, and command bootrec above to repair a bad BCD?
Anyway I used that and it works
http://technet.microsoft.com/en-us/library/cc731894.aspx#BKMK_WINUI
--> About disk management on Windows 7
Namely how to shrink partition from command-line (using DISKPART), or from gui
Must remove restore points, cache file, hibernat.sys file, etc
Still the best is to use ntfsresize (that's what I did and it worked flawless')
http://technet.microsoft.com/en-us/library/cc732774.aspx
--> Overview on BitLocker
http://technet.microsoft.com/en-us/library/ee424315(v=ws.10).aspx
--> How to turn off bitlocker
o Click Start, click Control Panel, click System and Security, and then click BitLocker Drive Encryption.
o Find the drive on which you want BitLocker Drive Encryption turned off, and click Turn Off BitLocker.
o A message is displayed, informing you that the drive will be decrypted and that decryption may take some time. Click Decrypt the drive to continue and turn off BitLocker on the drive.
That's what I did, work very well
http://www.howtogeek.com/howto/3187/disable-system-restore-in-windows-7/
--> Disable windows restore
Go to control panel, --> System --> System protection --> Configure... --> Turn off system protection
(one can also reduce space used by system restore)
Best to do before shrink a drive:
- remove / disable windows restore
- remove cache file
- remove hibernat file
- empty recycle bin
- boot in linux, check that System Volume Information is indeed empty
Virtualbox IO APIC
https://forums.virtualbox.org/viewtopic.php?f=9&t=21480
--> how to disable IO APIC after installing windows 7. But I read somewhere that IO APIC is mandatory for 64-bit.
Virtualbox P2V
--> use immutable mode while trying P2V, so that we can always revert (works for RAW image too)
http://www.rajatarya.com/website/taming-windows-virtualbox-vm
--> About RAW mode. Suggest to use custom mbr as in my notes, etc. + repair of windows
In the comments, script to create grub rescue iso:
#create a grub CD image
sudo install xorriso
grub-mkrescue ?modules=?linux ext2 fat fshelp ls boot pc ntfs? ?output=/home/myusernam/virtualbox/grub2.iso iso/
Also, another script to boot virtualbox as a separate user, who will have write access to disk device (because very bad idea to give world write access to /dev/sd*)
Very complex script, not sure it is useful (won't solve my audio problem it seems')
Virtualbox P2V - boot issue
If can't access safe mode (with list of drivers being loaded), then it is not a driver issue, but instead a MBR / VBR / Boot.ini issue (still might result into 0x7B error or various error messages)
If we see safe mode list, and get 0x7B before login screen, then that's clearly a driver issue / registry setting issue.
Replacing SYSTEM hive with another one from working VM should give access to login screen
If go to login screen, but reboot
Possible corrupted SYSTEM / SECURITY / SAM. Pick consistency set, and see if that boots
etc.
http://r3dux.org/2010/01/how-to-switch-a-virtualbox-windows-guest-hard-drive-from-ide-to-sata-mode/
--> About switching from IDE to SATA
On Windows 7, easiest is to add SATA controller, boot, have windows install the driver for it (on XP, require intel matrix driver), then uninstall it, reboot, etc
http://communities.vmware.com/message/2030146
--> Famous comment about setting driver at boot in registry service key
Basically, load remote HIVE SYSTEM, then edit as follows (0 means loaded at boot, required for windows to see the drive)
Aliide = 3
Amdide =3
Atapi = 0
Cmdide = 3
iaStorV = 3
intelide = 0
msahci = 3
pciide = 3
viaide = 3
LSI_SAS = 0
(some say also for LSI_SAS2)
In my case, this was not enough (had the extra setting in PnP + wrong Class/, wrong enum/ etc). Also I only use SATA, so I don't need LSI_SAS, etc
http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=1005208
--> Injecting SCSI controller device drivers into Windows when it fails to boot after converting it with VMware Converter (1005208)
Idem, about setting LSI_SAS to 0 (+ check that C:\Windows\System32\Drivers contains lsi_sas.sys)
http://blogs.technet.com/b/markrussinovich/archive/2011/11/08/3463572.aspx
--> About disk ID, disk signature collision, solve it by forcing online, how to use DISKPART to restore the old disk ID reference in BCD hive, etc. A must read
if disk ID not found, error 0x0000000e
Note that DISKPART can be used to put disk online using the CLI
Other links:
http://support.microsoft.com/kb/314082
http://support.microsoft.com/kb/922976
http://www.justandrew.net/2009/10/stop-0x0000007b-on-p2vd-windows-7.html
http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31980
https://docs.google.com/document/d/1UFmoqJsQPO7p98Bv743xNsIF6BsdZruiJFkd3cqlb7A/edit?pli=1
http://www.registryonwindows.com/registry-security-2.php
http://technet.microsoft.com/en-us/library/bb457006.aspx
http://technet.microsoft.com/en-us/library/cc770856.aspx
http://www.gohacking.com/how-windows-product-activation-works/
WIndows 7 tips
psexec -i -d -s c:\windows\regedit.exe
--> very handy to see keys that otherwise are not shown in regedit (and also to ease access to some keys - I only need to change ownership once)
Linus tips
# To copy dd over ssh, simply pipe through ssh of course!!!
dd if=/dev/sda7 | ssh backupserver dd of=/backup/sda7.img
# Note that using scp does not work
# Alternative is to use regular 'cat /dev/sda' or 'cat > /dev/sda'
# To debug permission issues, find PID of faulty program (e.g. courier), then
strace -fp <pid>
# ... and then trigger action that cause the permission issue, and see the log above
# Simple shred (too pass over sdb - can also shred a file, but some limitation, see man page)
sudo shred -n2 -v /dev/sdb
# Other: wipe, or D-BAN (http://www.dban.org/)
# Network tools (from http://www.howtogeek.com/108511/how-to-work-with-the-network-from-the-linux-terminal-11-commands-you-need-to-know/)
curl & wget
ping
tracepath (similar to traceroute but does not require root privilege)
mtr (ping and tracepath together, identify at which hop packets are lost)
host (DNS lookups and reverse lookups)
whois
ifplugstatus
ifconfig
ifdown (same as ifconfig down) -- NOT ALLOWED WITH NETWORK-MANAGER
ifup (same as ifconfig up) -- NOT ALLOWED WITH NETWORK-MANAGER
sudo dhclient -r # release dhcp lease
sudo dhclient # get new lease
netstat
netstat -s # view detailed stat on each interface
1080i vs 1080p
http://www.howtogeek.com/132486/what-is-the-difference-between-1080p-and-1080i/