Anyone?

umm, one thing for the win7 uefi booting method the letter is not of consequence, it uses the partition "ID" now.

the BCD junk is (usually) a small partition with the boot stuff in it, then that passes over to the partition with the os in it.

If you got an error like that, you would want to know previously what and where these partitions are, just so you know what your dealing with , when stuff changes.

sorry i dont really know enough because i despise the method.

when you get the I/O error it could mean friggen anything (like all errors) but at that time a persom might want to check the viability of the drive itself WithOut writing to it, or doing chkdisk stuff. There are certian types of problems that checkdisking can make worse :-(

A linux person would want to hop into some portable boot of some sort and do a check of the drive from "outside" and see what was up. A windows person would want to have some bootable USB or disk tool stuff with a gui :-) and do a quick check of the disk.

From some disk tool a person would want to see how the array of partitions looked. Like the rapaar one, and the recover one, and the "system" one ( the one with BCD stuff) and the OS one. (again what purpose is served for having complicated the structure so) so you need to see is the disk working, is there an intact partition table/structure.

Back at the ID of the partition. this stupid (imo) first partition has on it a few programs for doing the passing from the uefi to the boot , that first small partition is what has the "bcd" from that crap, it finds the partition with the actual OS on it, based on the ID. and an ID change on the OS partition would leave the BCD itself lost.

So go back a bit, if it claims it cannot find the BCD, then it could be things like the wrong Disk. or simple stuff like the UEFI/BIOS isnt set to boot to it . I would have started back at the UEFI, for the purpose of seeing if the disk is working (init on the motherboard will have scanned the disk and at least know it is there). You believe it is seeing that disk, that has not been proved.

Maybe it isn't. I am on windows 8.1 btw

When I try to refresh pc, it says place where Windows is installed is locked. Unlock and try again

@Psycogeek ^

Start back at the UEFI, what does it say in the Boot and disk sections?

Not sure how to do that. Or maybe I do, but I don't understand how you want me to do that

@DemCodeLines I have never heard of locked in a windows system. it isnt encrypted ? In other systems "locked" could mean it is corrupted , and until it is fixed , it will be read only?

The only legit thing I can use for info is cmd in recovery tools. I renamed e drive to c drive, but no diff

@DemCodeLines Get into your motherboard bios , and look there first (for anything) but mostly for disk stuff, and see what you can see about it?

One sec

@DemCodeLines I dont know, letters in NT systems became assigend "mapped" by the system, so in NT the letter was not hugely important, then with UEFI (only after passing over from the first partition) it is all about the ID. This was suppsed to be better :-) so indeed changing the letter in the psudo DOS thing should not change anything.

Nothing about uefi in the bios.

If your using win8 then it is likely your "bios" thing is a uefi , the new "bios"

They changed up bioses from being some simple thing on a small chip to being another piece of software , that can have issues. They did that because security started back at the hardwares software. and because they wanted cute looking shit :-)

Oh well that helps.

It's a vaio with win 7 pre-installed that I upgraded to Windows 8.1

You have a real bios :-)

You have one disk only?

What do you mean?

And it shows up in the boot area? or in the advanced they may give you some sata or other ways to see disk?

In boot, it just says boot configuration (disabled), network boot (disabled) and then boot order

@DemCodeLines I mean you can tell some things from seeing the disk info in the bioses. (but not always in manufactured computers where they dont let you see).

Is there only one "internal" disk in your laptop there?

Is the one internal disk showing up "as expected" with whatever info they provide for you there?

there is only one hard disk in the laptop, if that's what you mean

although there are two partitions plus one hidden one

Did it originally have a manufactures recovery partition? and was that left on when you upgraded?

apparently yes

@DemCodeLines In what did you observe the partitions?

diskpart

list disk

returned disk 0 and said its online

I did this in recovery console by using the windows 8 recovery tools that come with the cd

then did list vol

returned 4 volumes, 1 was the cd itself, two were the partitions I created and one was a recovery partition that some how continues to live.

and did you see if any of the data is visable?

The BCD stuff in the (lets call it) BCD partition, is patchable. It is just some software, and 5 ID pointers specifically pointing to the ID of the OS partition . So IF the error means anything, that might be a thing to try.

I can access 3 of those volumes, but not the main partition i use that had windows on it

when i try to go to e: (main volume), it gives the i/o error

@DemCodeLines And that makes more sence. Because somewhere in all that you said, it sounds more like it fails to find the OS , even though the error indicates it fails to find the BCD.

possibly

oh and when i do list vol

drive e has RAW under Fs (filesystem)

and the stupid system is possible to ask you to format it, even though it might just be a simple partition table issue or a corrupt sector.

how desperate are you to keep all the data on it? desperate enough to try and "clone" the whole disk off to an external prior to messing with it?

i can always re-install windows and get all the current files by copying them off using an ubuntu live cd

I can access the directory from an ubuntu live cd

Was there also bootloader things on the disk for linux or do you do it only portable?

I do not know As i said before I disliked the method so mine is totally different , making me a lot of help.

I have an ubuntu cd. When it gives me an option to install it or try it, I just hit try it.

So I don't really need a partition on the disk for it. It runs off the cd.

The error would tell me to patch the BCD, the "Raw" would say to fix the OS partition. patching the BCD is uneventfull, and should not change data.

The "raw" file system, i would just plop in my backup :-)

It sounds like (again i have no idea) you would want to fix the OS partition. i wouldnt even know what tool to use to do that. I just know that most of the windows tools will help you reinstall :-)

sigh reinstalling windows will mean re-installing all the programs too

way too much time needed for that

You need somone who knows what program would easily restore that partion, when it is known that the data is in the sectors, just windows doesnt know what is going on. some partition table recovery tool thing (that is specifically recommended, because there is a lot of crap out there)

Gparted, might be one. superuser.com/search?q=partition+table+recovery some other suggestions exist here.

@Boris_yo At that point, just write it off and replace with a new one...

@Psycogeek Recovery from bad sectors is a lie.

but trying to fix the partition will delete all data on it

You have lost your data - get a new drive, and toss the old one.

@Bob It is not known if the disk itself is damaged

@DemCodeLines If you do not use the correct method , then the stuff will certannly be lost. But most programs would tell you that it is about to finish things for you :-)

@Psycogeek Normally a good bet that it is. Check the SMART data.

how do you check smart data?

@DemCodeLines Continuing to use a faulty drive is just asking for trouble.

@DemCodeLines smartmontools if on *nix

blog.shadypixel.com/…

Yes it might be a good time to check re-allocated sectors, and see if the disk is dying. But i have seen software turn a partition inside out without a disk being at fault.

isn't there easybcd on ubuntu?

windows claiming the file system is "raw" not unallocated, can happen just from an obscure file system it does not understand.

@DemCodeLines easybcd is a pile of crap

hey it works

for the most basic tasks

tasks I can do just as easily with bcdedit

anything remotely advanced? nope. not happening.

@Bob lol, now you tell me. I used BCDedit, it was less thought than was required for easy in my situation.

can i edit bcd with ubuntu?

@Psycogeek I like visual bcd editor

far more control than easybcd (you can actually modify recovery, hibernate, memdiag, etc)

and easier than bcdedit, too

@DemCodeLines I don't know about other tools, but you can try running visual bcd editor through mono

it might work

then just load the store through the menu

IF you can see the files in the OS partition (myself) i would be trying to clone the partition. acronis uses some sort of linux for startup. I have no idea if it would see it properly, but for me it would only take a few minutes to check inside acronis's sofware booting from cd. I would hate having to re-install, gee that is why i have an image backup.

I guess Ill have to wipe it out and re-install

what a shame

If i was going to destroy it, i would try and recover first, even for the learning.

In ubuntu's gparted partition editor, it shows the windows drive as NTFS (compared to RAW inside Windows recovery cmd)

(i could always destroy it while recovering instead :-)

If it was XP, you could just copy paste the files , no (grumble grumble) layers of cross liking junk, reinstall then plop the files on top (when not in the system) add in a registry and it is done. good thing this new system is "better", and fixes itself so easily.

@Psycogeek if you need to perform a backup on a possibly-damaged drive, ddrescue. always.

@Bob is that for one of them forensic clones? a whole secotr by sector clone?

@Psycogeek just copying the entire contents of an XP OS partition would completely and utterly break security, even if nothing else

@Psycogeek that's what dd does. ddrescue is a variant designed to make an image from a damaged rdrive

it performs skips and retries on damaged areas, to make a best effort clone of as much as possible

@Bob security? windows had 400 holes in it, that they Found :-) the only security computers ever have is aware users.

(the plain dd would just keep trying and then quit on the first error - ddrescue would skip the error to grab as much good data as possible, and then come back to narrow down the skipped hole)

@Psycogeek defense in depth

EVERYTHING has security holes

all we can do is have layers of security

when one layer fails, as it inevitably will, another layer will hopefully catch it

saying "there's holes anyway, may as well throw away ALL (or even just one layer, when that layer is so critical) security" is pretty stupid

one lock on the door, stops the honest people from getting in, 10 locks on the door keeps the honest people from getting out :-)

@Psycogeek do you routinely invite thousands of strangers into your home?

perhaps a lock on the bedroom door in addition to the lock on the front door would help?

But that aint the way it is with computers, these layers your talking about add more software, more dlls, more things, and things is how it happens.

Back in win95 a person had Few thing, they could keep an eye on them all, control the whole thing. Now we can only suppose that a team of people can even understand it.

@Psycogeek Do you have any idea how easy it was to gain total and complete control over a Win95 machine?

Zero privilege separation.

Don't even start with shared computers.

Also, Win95 in itself was a complicated system that didn't even work properly.

Install two programs, and you're lucky if they don't clash with each other.

Install one program and you're lucky if it doesn't clobber key OS files.

Known as DLL Hell.

blogs.msdn.com/b/oldnewthing/archive/2014/04/11/10516280.aspx

I do not run a web server, so there is pretty much only one pipe to my system, i do not have users, I have never used the users system. Where is my virus? where is the people controlling my machine?

@Psycogeek Are you running Win95 and currently browing the web?

That said, I'm not sure how many people are still targeting 95 now. But 15 years ago? Ooooh boy.

the virus was the feature, the control was the feature, the features are off, so if someone did try and control my machine, how could they do so without the feature in place designed to control my machine?

Also, one anecdote of an uninfected machine (how do you know you're uninfected?) does not mean security is useless.

@Psycogeek Now that's just nonsense.

Feature in place designed to control your machine?

Hah!

@Bob I splained, you knew you were uneffected because there was 4000 files not 70,000

If you can use it, malware can use it. All we can do is try to prevent such malware from executing.

@Psycogeek It's got nothing to do with the number of files.

there were 24 processes running not 124

Many drivers are buggy as all hell.

Your computer wouldn't work at all without those drivers.

You cannot remove them.

@Bob It has to do with knowing what is going on or not.

@Psycogeek Do you understand assembly? Have you audited all drivers on your system?

@Bob I can turn them on and off at will.

A driver is effectively a part of the kernel.

It is part of the system.

Most security built into Windows is to stop malicious software from achieving that level of privileges.

@Psycogeek No you can't.

You need a display.

You need an input device.

Why did not the system Come With the ability to turn on and off things like full control of the computer? too many buttons for users? they would rather have , Regularly have viruses and malware.

Your OS needs to interact with the motherboard. With the CPU. It needs to know how to communicate over the network.

It needs to know how to allocate and access memory.

@Psycogeek It's impossible.

Your computer is not a computer without a CPU.

Why did you not come with the ability to remove your brain and continue functioning?

That's the equivalent question.

@Bob Humans come with an ability to remove thier brains?? When the one lock doesnt work the shortgun does.

Is there anyway I can see which partition the computer looks at for the OS?

You're so busy removing other components that you ignore the possibility of bugs opening up attack vectors in the core of the OS, and associated drivers required to communicate with the machine (What's a computer without a display, without networking, without input devices? Not a home machine, that's for sure.)

@Bob How do the bugs get there?

@DemCodeLines Assuming BIOS (and not UEFI), the 'active' partition is looked at for the bootloader.

The bootloader will then load the OS.

Windows' BOOTMGR stores all the OS partitions in the BCD.

@Psycogeek In the end, computers are designed by humans. And humans make mistakes.

We try to mitigate that with multiple layers of security.

Again i am not running a web server, i am not letting people run rampant in my system, effect my data, change things. you wouldnt put a Faucet in a home for water, or a gas line into a home, or power into the home without an OFF switch.

If an attacker gets through one, they should not be able to get to another.

@Psycogeek You can turn off your computer.

As a whole. As a unit.

Do you routinely strip entire rooms out of your house?

Or brick up their entrances?

It's not a good analogy anyway.

A better analogy is to a human, or an animal. Do you cut off limbs? Do you take pull out their nerves? Do you expect them to be incapable of malicious thoughts while their brain is attached and someone can speak to them?

@Bob But they did not make it easy to turn stuff off. heck 80% of the people dont need 80% of the stuff in it, yet it is on and even running. It could have come to them OFF then it could be turned on if they ever did need it.

@Psycogeek You can turn off your whole computer.

You cannot turn off individual parts. Tell me when you figure out how to turn off your heart, your brain. Your lungs. It's the same idea.

@Bob good idea.

@Psycogeek Go install the minimal version of Debian.

Oh, wait, look at all those kernel modules.

Better disable them.

Oh, wait, now I can't install it because it can't access the HDD.

Let's enable that.

Wait, now it's complaining it can't access the network.

Let's enable that too.

@Bob Humans are vulnerable in every aspect of thier lives, they could DIE (not just get a bug) at any single moment that any other person desired that they die. Do you see me looking under my car for a bomb? Did i put bars on all my windows (yet:-) do i still drive an item that kills more people than anything?

My keyboard doesn't work! Let's add USB drivers. And HID drivers.

Wait, I have no display! I can't see what I'm doing! Better enable those graphics drivers too.

And all of those, and more, are necessary. And can, will contain bugs.

@Bob Buttons, on off buttons, i got them they are easy, you got a keyboard, is it a big problem pusing its buttons or something?

@Psycogeek What are you on about?

You computer doesn't even know a keyboard is connected until you install the appropriate drivers.

Heck, without ACPI drivers, your shutdown button wouldn't work.

Buttons do nothing without the software recognising them.

@Bob Oh sure, my keyboard is being attacked by hackers , how would that happen, ohh because somone put in a feature to control it that way.

@Psycogeek The drivers, which are necessary to even use those devices, could have bugs. Then those bugs could be exploited.

I did not, at any point, mention a physical attacker.

@Bob Ooooh and i needed 20 layers of software to power off my computer, cause its a features.

As long as a software layer exists, yes, it can be attacked. But as soon as you remove that layer, it can't do anything. You can't use it either.

@Psycogeek Oh, for fuck's sake. I give up.

Go back to your DOS 1.0

I'm sure it's very secure.

@Bob It is a whole lot easier to exploit the heck out of stuff when it is programmed with a language that a 4 year old can use , and connects to the web first before it operates, Features, added like that non-stop.

HAMMERTIME!

@Psycogeek You're just spouting nonsense now.

HAMMERTIME!

@Bob Your holding yout own.

@Psycogeek Gee, thanks.

There are no bad people here in my home, the people who are attacking stuff , are brought in from outside, down a little wire. these systems have added hundreds of more ways to have stuff comes into your computer down that wire (or wirless).

Why should 100% full control remote operation of your computer be left running by default?

@Psycogeek It isn't.

You're assuming someone malicious has left holes intentionally.

Whether that's true or not, pure unintentional bugs can and will be exploited.

If you don't want network-based attacks, simple solution. Unplug the NIC.

But then you wouldn't be able to post here, would you?

Why should the running of a WEB program direct on your computer , be even concidered.

I... what?

Your web browser. To show you these pretty colours.

It needs to take input from an external source.

It needs to render images. Render colours. Render text.

Even the very first web browser.

Even the text-based ones.

Just the act of rendering text. Heck, just the act of taking this input.

A bug could be there. Could be exploited.

That is all that's necessary.

A buffer overflow, and someone could break in. Except, now the OS protects against that (btw, Win95 didn't protect against that).

But what if the OS protection (ASLR) has a bug itself? That could be further exploited.

@Bob What is the #1 and #2 ways that people are gettin gthier computers controlled (zombied) or having thier information stolen? A) a exploit in the spell checker B) exploits in manufactures drivers C) And exploit in un-encrypted data to the LCD screens D) none of the above.

Each layer, many of which are completely invisible to the user, adds another barrier to an attacker.

@Psycogeek Heartbleed has shown that the browser layer can and will be exploited.

It happens.

Anyway I can boot from one of those recovery partitions?

It didn't get any worse because of ASLR. They got into the web client/server layer. But not the OS itself, thankfully.

@DemCodeLines Which recovery partitions?

The one that still somehow exists

@DemCodeLines Normally, there's an option at startup.

Like, press esc for more options, or press F-something for recovery.

it doesn't come up. goes straight to saying error with boot configuration data and that it doesn't contain a valid os

Ah. Probably through the Windows bootloader, then.

Give Visual BCD editor a try. I've actually done something similar before: superuser.com/questions/421467/…

don't know how to get visual bcd editor on ubuntu though

@DemCodeLines It's a .NET program. You can probably run it with mono.

Or, you can try the startup repair from any Windows 7/8 installation DVD.

startup repair doesn't work

it says "Startup Repair couldn't repair your PC"

@DemCodeLines Run from the DVD?

Yes, running it from Win 8 DVD

@Bob heartbleed is back at the 400holes, it has existed for years. but when it is public everybody goes Ooooh and Ahhh. when 400 holes existed what is the responce there "someone is fixing it for me" yea right they are.

And when I do "Refresh PC", it says "The drive where Windows is installed is locked. Unlock the drive and try again"

@DemCodeLines Try launching the command prompt (Shift+F11) and running bootrec /rebuildbcd.

@Psycogeek And? That doesn't take anything away from the argument that layers of security help.

says 0 windows installations found

There will always be bugs, as long as humans are involved.

The idea is to minimise the impact of any one of those bugs.

/scanOS and /rebuildBCD give 0 windows installations found

When you remove layers of security, sure, you remove bugs in those layers. But you also give any attackers a clean path through where those barriers were.

@DemCodeLines Try bcdedit on the BCD.

@Bob Layers of crap are not security, one effective layer is. 20 sieves just makes for 20times more holes.

@Psycogeek Go ahead and believe that.

how do you do that?

Each sieve catches what one above might have missed.

They don't allow a bypass straight through, if layering is performed properly.

@Bob sure then i suppse your running 20 anti-virus programs too :-)

There's a difference between more holes sequentially and in parallel.

@Psycogeek There's also a difference between removing security designed to work together and adding security that clashes.

You're making far too many assumptions and avoiding the point.

@Bob Dude you run a server, you got everyone and thier mother in on and around your computer, you gonna have 1000 live connections, and you cant "turn it off" . you certannly need to have layers. I just need a wire cutter :-)

@DemCodeLines bcdedit /store <filename>

what's filename?

@Psycogeek Nothing to do with running a server. Sure, a server allows more unknowns to connect to your machine. But you also connect to many unknown servers.

Network connections are a two way street.

You connect to Google. What if they're the attackers?

You couldnt selectivly firewall the whole universe , and still have anyone showing up at your server.

What if they have been compromised and their servers are performing an attack on any browsers that connect to them?

It's not just servers that are vulnerable.

Clients are just as vulnerable.

@DemCodeLines The BCD file.

You run the server by the same remote that should have an off switch, and most certannly would not want it turned off. (they would charge you $5 each time to switch it for you.)

@Psycogeek Wrong again.

IPMI and other out-of-band management.

Yes

It displays a huge list

One's titled Windows Boot Manager

Another one's Windows Boot Loader

@DemCodeLines Seeing as you can't exactly copy and paste it - maximise the window, take a photo, and paste it in here.

@Bob Wrong? lets see how quickly can you remotely destroy everything on it? now i will give you my IP and all my passwords, and see how quick you can do the same here.

@Psycogeek Destruction is so 90s.

Now? The goal is to stay hidden, and steal data.

If you're infected, you won't even know it.

@Bob I always said a good hacker is the one you dont see. Funny how when you look at the (reality) that exists on peoples computers they have 30 things you can see, and they would not even know they had been compromised if the computer had not failed, or acted funny.

There

now?

@DemCodeLines You need a better camera :P

@DemCodeLines It actually looks fine.

What was the error message again?

do note that before messing stuff up, I created a bcdbackup by using tutorials. I just restored it and then did the bcd /store things

^^^^^^

@Bob Thats just it, thanks to all the holes and the from the web run program on your computer, and lack of off switch, they are all infected. Oh gee, and that would be after the "layers of security" but still without the user awareness.

so it may look ok now

Ill restart and see what happens now

o.O

@DemCodeLines What are you trying to do?

I missed the beginning of the conversation.