Overwrote NTFS header with GRUB core.img

MatejBellus

New member
So I was trying to fix my non-booting Windows by installing GRUB. I marked the Windows data partition (/dev/sda4) as BIOS_GRUB in GParted and did and update-grub /dev/sda, with the idea that grub MBR code will execute Windows bootloader.

However grub took the /dev/sda4 partition and used it for it's core.img

And now by Windows NTFS partition is gone. Or is it? I read that the core.img file only has like 32KB which totally overwrote the NTFS partition header. But the data must still be there. I tried to use ntfsfix -n /dev/sda4 but unsuccessfully:

[pre]Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
The alternate bootsector is usable
The startup data can be fixed, but no change was requested
Volume is corrupt. You should run chkdsk.
No change made[/pre]

Without touching the computer I would like to get other peoples opinions on how to fix this. So is there a way to fix the NTFS header that was corrupted by core.img?

Here is my boot info https://pastebin.com/aRKMuFTY note that only /dev/sda is relevant, am currently on /dev/sdc Manjaro I moved the BIOS_GRUB flag away from /dev/sda4
 

Jared

Administrator
Staff member
MatejBellus":82pmrhsv said:
[post]12958[/post] would like to get other peoples opinions on how to fix this.

Stop trying to "fix" it. You've already caused more damage than you can fix. Priority one is getting the data back. Your first step (one you should already be wishing you did) should be to clone the HDD to another drive. You can use ddrescue to do this since you're already in Linux. Here's a tutorial for using ddrescue.

After you get a full clone I'd start by scanning with some good data recovery software such as R-Studio and recover all the files you need out to a third device.

If you're hellbent on making it bootable, you can probably just do a fresh install of Windows afterward, and then copy all the recovered data over the top of the fresh install. It may or may not work, but it's worth a shot.
 
Top