Windows Server Troubleshooting - Boot Records

Click here to start saving with ING DIRECT!

Home | Up | Methodology | Architecture | Tools | Memory | Processor | Registry | Network | Active Directory | Contents

Get the Book

Major Topics
Methodology
Architecture
Tools
Memory
Processor
Registry
File System
Network
Active Directory
Contents
Other Topics
Maintenance
Defragment
Boot Records
WFP
Junction Point
Counters
Dynamic Disk
MFT Metadata
More Detail

eXpert Genealogy

Memory from Crucial.com


2003-2006 Team Approach Limited
All rights reserved


Master Boot Record

At startup, the system BIOS on Intel computers looks for a MBR Master Boot Record at Cylinder 0, Head 0, Sector 1 on the hard disk. The MBR contains standard boot code along with a partition table that defines up to four partitions and identifies one as active. The active partition must contain an OS boot record.

Boot code - Loads the OS boot record from the active partition
Partition Table
Partition 1 start end active
Partition 2 start end  
Partition 3 start end  
Partition 4 start end  
Boot sector signature: 55 AA

The MBR is created during the installation or with FDISK.

Windows Boot Record

The first sector of the active partition is a OS boot sector. This is created when the partition is formatted. Formatting a diskette with Windows will put this OS boot sector on the diskette.  The BPB BIOS Parameter Block identifies the file system and its characteristics so that files on the root folder can be identified. The boot code finds NTLDR in the root folder of the active partition and runs it.

OS boot code
BIOS parameter block
Boot sector signature: 55 AA
 
 

FIXMBR, FIXBOOT, and DISKSAVE

 Both the MBR and the OS boot record are critical to your system startup. A virus can potentially corrupt a boot record. If either boot record becomes corrupted, startup the Recovery Console and run FIXMBR to fix the MBR and FIXBOOT to fix the OS boot record. Either may fail if the boot sector signature is incorrect. FIXMBR cannot correct a corrupted partition table.

To recovery from partition table corruption, you must use the DISKSAVE utility from the NT Resource Kit. The Resource Kit contains a procedure to make a DOS diskette that includes DISKSAVE. A backup of your complete MBR including the partition table can be stored on the diskette. DISKSAVE can then restore this at a later time if the MBR gets corrupted.

Avoid Using the DOS Command Fdisk /mbr

  • Not supported on dynamic disks or GPT disks.
  • If the signature word has been corrupted, the partition table entries are overwritten with zeros. Access to all partitions and logical volumes is lost.

NTLDR - NT Loader

Once NTLDR runs, it does the following

  • Reads BOOT.INI and displays boot options
    • If original OS is chosen, BOOTSECT.DOS is loaded and run
  • Starts NTDETECT.COM to do the hardware detection
  • Offers choice of harware profiles, if more than one
  • Loads NTOSKRNL.EXE which does the following
    • Initializes drivers
    • Starts WINLOGON.EXE
    • Starts services

 

BOOT.INI

The Windows setup program WINNT automatically updates the records in the BOOT.INI file.The BOOT.INI file is an text file and its syntax must be understood if you intend to modify it with a program like Notepad.  If necessary, use MSConfig to modify BOOT.INI.

Keyboard Exercise

Although your boot records may not be corrupted, you can run the FIXBOOT and FIXMBR commands from the Recovery Console.