I'm still trying to save/restore a disk on a Windows Server 2003 system.
Now, I have a problem after the restore step : my system doesn't boot.
So, I get a dump of the MBR after restoring with ODIN, and I compare it with a dump of the original MBR with an hexa editor.
It seems that the bytes from 0x000 to 0x1B7 are not restored (the boot code area, in fact). All theses bytes are set to a null (0) value.
I look at the .mbr file created by ODIN : the boot code area is present in the .mbr file, after a 48 bytes header.
Since this area is existing in the .mbr file and not on my disk after the restoring process, I guess the problem is in the restore step and not in the backup step...
Any ideas ?
Thanks a lot.
Christian
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
a) maybe you have activated a kind of "virus protection" in your bios setup - this usually protects mbr from being written by application programs, but brings up a warning box in TEXTMODE - so you don't see it in windows.
b) you could easily write a new MBR or bootrecord from the recovery console that you can boot with a Windows CD (or install to boot with windows). The command to restore MBR there is "fixmbr", the command to write the bootrecord is "fixboot"
you get details on the parameters with "help" there.
Anyway it seems very strange that just a few bytes are not written by ODIN...
Are you sure that you saved AND restored the whole harddisk and not just a partition?
Since the MBR ist NOT part of a single partition, it would not be restored with such a partition, but just when you are restoring the whole harddisk.
hth
Cyberbrain
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I have done an other test today and confirm my problem :
- Step 1 : in BIOS setup : verifying the the Virus Protection is Disabled => Ok
- Step 2 : Under Windows Server 2003, creating a backup with ODIN of C: (Entire Disk, checked; Save used block with snapshot; Compression : GZip; Split file : 1488Mb) on a USB Disk Drive => 100%, Ok
- Setp 3 : verifying the created image => Verify result Ok
- Step 4 : Booting on a Linux Live CD, erasing MBR and partition table of the disk with the folowing command : dd if=/dev/zero of=/dev/sda bs=512 count=1000
- Step 5 : Booting on a Bart PE CD with ODIN
- Step 6 : Restoring the backup : file .mbr selected, destination = Entire Disk => 100%, Ok
- Step 7 : verifying the created image => after 100%, got an error message : "Exception of type Internal Exception thrown, cause : Internal thread synchronization timeout". Then "Verify result OK" !
- Step 8 : Booting on the hard disk drive => unable to boot, just got a blinking underscore
- Step 9 : Booting again on the Bart PE CD with the testdisk utility (from www.cgsecurity.org)
- Step 10 : Restore the MBR with the testdisk utility
- Step 11 : Booting on the hard disk drive again => Ok, the system boots on Windows Server 2003
I checked again the .mbr file created by ODIN : it contains the boot code.
It seems that something in the restore process prevents the writing of a part of the MBR.
I can exclude a antivirus in the bios because :
1. it is disable in the bios setup
2. I tried another software (partition saving form http://damien.guibouret.free.fr\) and this one runs perfectly without any changes
Maybe something in the Bart PE Environment ?
Anyone has the same problem ?
Christian
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
with this detailed descriptions of the steps I should be able now to reproduce this problem. I will take a look into this.
BTW Step 3 and 7 do the same. Verifying the image does nothing more than reading through all the data of the image file and compare this to a checksum in the header. I need to look at this error messege however.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
The new version you provided is running fine : I was able to restore the entire disk and boot on it.
I also checked the boot sector, and all the bytes previously null are correctly written. Good work !
However, a last point a bit confusing : if you run the verifying process after restoring entire disk, you can see the gauge growing up to 100%, and then the program is still working. Only the speed counter is decreasing slowly. After a (long) while, you get the message I described in a previous post : "Exception of type Internal Exception thrown, cause : Internal thread synchronization timeout". After a clic on the dialog box, you get the message showing the the verify if Ok.
Is that due to the (de)compression process ? (i.e the program reads data while the gauge progress, and unzip it after 100%) ?
thanks,
Christian
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I looked at this issue as well, but was not able to reproduce it so far. I do not get an exception. What file name is dsiplayed in the text box: the .mbr file or the .img file? Does your disk contain more than one partition? Dou you use a multicore CPU? The progress indicators monitors only one thread, so there might be a little asynchronicy between the progress bar and the confirmation box. However it should not take longer than a second. Somethings goes wrong with the thread snychronization in your case, but I don't know what....
... really time to add log file support...
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
After generating a new Bart PE boot CD with the last version of ODIN (0.2.2.204), I retry the test related in my previous post : verifying the image after the restore step (the save/restore is still Ok).
I still get the "problem" : the verifying process runs up to 100% (in 8 min 33 sec, for 18.343GB), and then, the program continues to do something until 25 min 12 sec. During this step, only "time elapsed" and "speed" counters change (time is increasing, obviously, and the speed counter is decreasing).
After that, the message "Exception of type Internal Exception thrown, cause : Internal thread synchronization timeout" appears. I click OK, the message "Verify result Ok" appears, and I can access to the user interface of ODIN again.
I have the DISQUEC.mbr file In the "Store/Load Image File(s) at/from" area.
However, I get the message "Can not open file ....\DISQUEC-Partition1.im..." in the area above.
The disk I save/restore contains only one NTFS bootable partition (MBR style), and few Mbs not allocated at the end of the disk.
The environment :
IBM XSeries System x3650 MT 7979
CPU Intel Xeon E5405 @ 2.00GHz (QuadCore)
12 Gb RAM
OS : Microsoft Windows Server 2003 R2 Enterprise Edition Service Pack 2 (with PAE)
Disk Subsys : Controller IBM ServeRAID 8k/8k-I
Raid Array 1 : two physical Hard drives => one logical disk of 69878Mb => subdivided in one NTFS partiton (C:) 68238 Mb and few Mbs not allocated
Raid array 2 : three physical hard drives => one logical disk of 279780 Mb => not concerned by the save/restore operation (tested OK with ODIN, but the verify step).
If these informations can help you...
Christian
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Thanks for your effort and your detailed information! This means that the thread calculating the checksum does not get the event that it can terminate. So it waits until it gets a timeout. The success message indicates however that it has received all data and could calculate the checksum (otherwise it would fail). Need to review the code again, I wish I could reproduce this problem. BartPE also uses only one core so it can't be a multithreading issue. BTW you do not have to create a new BartPE CD each time. You can just place ODIN somewhere in the file system on your disk and start from there. It must not be on the CD itself. I found another little issue that the file name in the text box changes each time after a restore. This should not happen either.
Jens
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Hi Jens,
I'm still trying to save/restore a disk on a Windows Server 2003 system.
Now, I have a problem after the restore step : my system doesn't boot.
So, I get a dump of the MBR after restoring with ODIN, and I compare it with a dump of the original MBR with an hexa editor.
It seems that the bytes from 0x000 to 0x1B7 are not restored (the boot code area, in fact). All theses bytes are set to a null (0) value.
I look at the .mbr file created by ODIN : the boot code area is present in the .mbr file, after a 48 bytes header.
Since this area is existing in the .mbr file and not on my disk after the restoring process, I guess the problem is in the restore step and not in the backup step...
Any ideas ?
Thanks a lot.
Christian
Hi Christian!
Two possible solutions come to my mind:
a) maybe you have activated a kind of "virus protection" in your bios setup - this usually protects mbr from being written by application programs, but brings up a warning box in TEXTMODE - so you don't see it in windows.
b) you could easily write a new MBR or bootrecord from the recovery console that you can boot with a Windows CD (or install to boot with windows). The command to restore MBR there is "fixmbr", the command to write the bootrecord is "fixboot"
you get details on the parameters with "help" there.
Anyway it seems very strange that just a few bytes are not written by ODIN...
Are you sure that you saved AND restored the whole harddisk and not just a partition?
Since the MBR ist NOT part of a single partition, it would not be restored with such a partition, but just when you are restoring the whole harddisk.
hth
Cyberbrain
Hi !
I have done an other test today and confirm my problem :
- Step 1 : in BIOS setup : verifying the the Virus Protection is Disabled => Ok
- Step 2 : Under Windows Server 2003, creating a backup with ODIN of C: (Entire Disk, checked; Save used block with snapshot; Compression : GZip; Split file : 1488Mb) on a USB Disk Drive => 100%, Ok
- Setp 3 : verifying the created image => Verify result Ok
- Step 4 : Booting on a Linux Live CD, erasing MBR and partition table of the disk with the folowing command : dd if=/dev/zero of=/dev/sda bs=512 count=1000
- Step 5 : Booting on a Bart PE CD with ODIN
- Step 6 : Restoring the backup : file .mbr selected, destination = Entire Disk => 100%, Ok
- Step 7 : verifying the created image => after 100%, got an error message : "Exception of type Internal Exception thrown, cause : Internal thread synchronization timeout". Then "Verify result OK" !
- Step 8 : Booting on the hard disk drive => unable to boot, just got a blinking underscore
- Step 9 : Booting again on the Bart PE CD with the testdisk utility (from www.cgsecurity.org)
- Step 10 : Restore the MBR with the testdisk utility
- Step 11 : Booting on the hard disk drive again => Ok, the system boots on Windows Server 2003
I checked again the .mbr file created by ODIN : it contains the boot code.
It seems that something in the restore process prevents the writing of a part of the MBR.
I can exclude a antivirus in the bios because :
1. it is disable in the bios setup
2. I tried another software (partition saving form http://damien.guibouret.free.fr\) and this one runs perfectly without any changes
Maybe something in the Bart PE Environment ?
Anyone has the same problem ?
Christian
Thanks Christian,
with this detailed descriptions of the steps I should be able now to reproduce this problem. I will take a look into this.
BTW Step 3 and 7 do the same. Verifying the image does nothing more than reading through all the data of the image file and compare this to a checksum in the header. I need to look at this error messege however.
Hi Christian,
I was able to reproduce this problem and hopefully could fix this. I provided a new version in the download section. Try it if you want:
http://sourceforge.net/project/downloading.php?group_id=208679&filename=ODIN-0.22.zip&a=39239859
My unit tests checked only the partition information but not the boot code...
Let me know if it worked.
Jens
Hi Jens,
The new version you provided is running fine : I was able to restore the entire disk and boot on it.
I also checked the boot sector, and all the bytes previously null are correctly written. Good work !
However, a last point a bit confusing : if you run the verifying process after restoring entire disk, you can see the gauge growing up to 100%, and then the program is still working. Only the speed counter is decreasing slowly. After a (long) while, you get the message I described in a previous post : "Exception of type Internal Exception thrown, cause : Internal thread synchronization timeout". After a clic on the dialog box, you get the message showing the the verify if Ok.
Is that due to the (de)compression process ? (i.e the program reads data while the gauge progress, and unzip it after 100%) ?
thanks,
Christian
I looked at this issue as well, but was not able to reproduce it so far. I do not get an exception. What file name is dsiplayed in the text box: the .mbr file or the .img file? Does your disk contain more than one partition? Dou you use a multicore CPU? The progress indicators monitors only one thread, so there might be a little asynchronicy between the progress bar and the confirmation box. However it should not take longer than a second. Somethings goes wrong with the thread snychronization in your case, but I don't know what....
... really time to add log file support...
Hi !
After generating a new Bart PE boot CD with the last version of ODIN (0.2.2.204), I retry the test related in my previous post : verifying the image after the restore step (the save/restore is still Ok).
I still get the "problem" : the verifying process runs up to 100% (in 8 min 33 sec, for 18.343GB), and then, the program continues to do something until 25 min 12 sec. During this step, only "time elapsed" and "speed" counters change (time is increasing, obviously, and the speed counter is decreasing).
After that, the message "Exception of type Internal Exception thrown, cause : Internal thread synchronization timeout" appears. I click OK, the message "Verify result Ok" appears, and I can access to the user interface of ODIN again.
I have the DISQUEC.mbr file In the "Store/Load Image File(s) at/from" area.
However, I get the message "Can not open file ....\DISQUEC-Partition1.im..." in the area above.
The disk I save/restore contains only one NTFS bootable partition (MBR style), and few Mbs not allocated at the end of the disk.
The environment :
IBM XSeries System x3650 MT 7979
CPU Intel Xeon E5405 @ 2.00GHz (QuadCore)
12 Gb RAM
OS : Microsoft Windows Server 2003 R2 Enterprise Edition Service Pack 2 (with PAE)
Disk Subsys : Controller IBM ServeRAID 8k/8k-I
Raid Array 1 : two physical Hard drives => one logical disk of 69878Mb => subdivided in one NTFS partiton (C:) 68238 Mb and few Mbs not allocated
Raid array 2 : three physical hard drives => one logical disk of 279780 Mb => not concerned by the save/restore operation (tested OK with ODIN, but the verify step).
If these informations can help you...
Christian
Thanks for your effort and your detailed information! This means that the thread calculating the checksum does not get the event that it can terminate. So it waits until it gets a timeout. The success message indicates however that it has received all data and could calculate the checksum (otherwise it would fail). Need to review the code again, I wish I could reproduce this problem. BartPE also uses only one core so it can't be a multithreading issue. BTW you do not have to create a new BartPE CD each time. You can just place ODIN somewhere in the file system on your disk and start from there. It must not be on the CD itself. I found another little issue that the file name in the text box changes each time after a restore. This should not happen either.
Jens