XP booting direct from USB Options

[sisal]

is it possible to boot a hidden ntfs (type 17h)?

when i try i get this autochk error and a bs0d with a number i forgot while rebooting

[jaclaz]

is it possible to boot a hidden ntfs (type 17h)?

when i try i get this autochk error and a bs0d with a number i forgot while rebooting

No, you cannot boot from Hidden partitions.

But nothing prevents you from unhiding it at boot time (and possibly hide another one at the same time).
Using a first stage bootloader.
(Normally the NTLDR, which is actually a second stage bootloader, is invoked directly by the code in the MBR, you can put in the MBR code that calls another program which does whatever is supposed to do and THEN invokes NTLDR)

FREEWARE candidates to do this:
1) XOSL (nice, graphical, oldish, needs a lot of files on FAT partition or a dedicated partition)
2) GRUB/GRUB4DOS (powerful,newish, takes the first 8 sectors of HD+configuration files)
3) Partita (minimal, substitutes the MBR, only 512 bytes, no config files)

See links in my post here:
http://www.911cd.net/forums//index.php?showtopic=14617

I would try the 3rd one in your case, as it does not change anything but the MBR.


jaclaz

[edborg]

@jaclaz

No, I did not express myself well
I had already addressed my attention to the Disk Identifier (not the DOS serial) and checked with SavePart that it was the same for all partitions and that drive letters and (apparently also) the offset of first byte of first partition were correct. That's why I didn't make any correction.

I'll now check that this signature (a11ca11c) is the same in the Registry key of the non-working XP.
I cannot obviously access to it neither directly nor from the other (working) partition on the same HD, cause it makes the first unactive and hidden.

Is it safe if I boot to the working USB XP (with the non-working HD partition active), load the System hive in the USB registry and check it from there?
What if I find that the first part of the value (which is the disk identifier) is correct?

Sorry to bother you whith all these details, but I need to be sure I understand before acting casually and making things worse.

As a second step (your method #2) shall I delete MountedDevices after loading the hive System into USB registry as described above and exporting back the modified hive to the non-working partition, letting Windows rebuild them at next reboot (if any)?

Thanks for your patience
Edborg

P.S.
Unfortunately the BOOTLOG hint did not work, cause (I think) Windows rebooted so early that it didn't even have the time to write NTbtlog.txt to disk and what I find in the Windows folder is a previous ntbtlog.

Edit
I've now deleted the Mounted devices and nothing has changed in booting (neither have they been rebuilt as no boot has taken place). I've then restored the original registry, but they are cleared anyway.

[jaclaz]

Is it safe if I boot to the working USB XP (with the non-working HD partition active), load the System hive in the USB registry and check it from there?

Yes, it is, I thought you could do it directly from Savepart:
http://damien.guibouret.free.fr/en/lisezmoi.html#Chapitre_11

I cannot obviously access to it neither directly nor from the other (working) partition on the same HD, cause it makes the first unactive and hidden.

Hey, wait a minute, a standard install does NOT make ANY other partition "hidden" and/or "inactive".
Are you using a bootmanager of some kind?
Now that you mentioned it, your data:

0 0 0B-FAT32 6.0G Yes No 63 12,289,662 <- Working XP (my presumption)??
1 1 1B-FAT32 1.1G No Yes 12,289,725 2,249,100 <-Non-working XP (from your post)?
2 2 1C-FAT32x 1.9G No Yes 14,538,825 3,903,795 <- Working 98 (my presumption)??
3 3 0F-EXTEND 69G No No 18,442,620 141,629,040 <- Volume(s) with other DATA (not relevant)

indicates that you have some way to hide/unhide partitions at boot.
Can you post some details on this?
What I need is to know is:
1) Where are your set(s) of boot files NTLDR/NTDETECT.COM/BOOT.INI for XP and COMMAND.COM/MSDOS.SYS/IO.SYS for Win98
2) The contents of your BOOT.INI file(s)
3) Which bootmanager you use to hide/unhide partitions
The problem could be something gone wrong with this part of the booting, that would justify the problem with the BOOTLOG.

What if I find that the first part of the value (which is the disk identifier) is correct?

It means that I misled you, and the problem is somewhere else.

As a second step (your method #2) shall I delete MountedDevices after loading the hive System into USB registry as described above and exporting back the modified hive to the non-working partition, letting Windows rebuild them at next reboot (if any)?

Yes, to be more exact, you DO NOT want to delete the HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices key
but rather
delete VALUES inside the HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices key.

A GOOD idea is however to save a copy of the files (with reference to the non-working XP install):
\system32\config\SAM
\system32\config\SECURITY
\system32\config\software
\system32\config\system
\system32\config\default
\Documents and Settings\Administrator\NTUSER.DAT
\Documents and Settings\Administrator\Application Data\MICROSOFT\Windows\UsrClass.dat
BEFORE modifying the Registry.

A further advise (for the future) is to ALWAYS, and when I say ALWAYS, I mean ALWAYS, use ERUNT:
http://www.larshederer.homepage.t-online.de/erunt/
BEFORE making ANY "important" change to your PC, and however run it periodically.

jaclaz

P.S.: I know I sound like a teacher, but, once this problem will be hopefully solved, you should really have a thought about the "proper" way to setup a multiboot system (using Logical Volumes inside Extended partitions instead of having multiple Primary ones):
http://www.msfn.org/board/index.php?showtopic=22526

[edborg]

Yes, it is, I thought you could do it directly from Savepart:
http://damien.guibouret.free.fr/en/lisezmoi.html#Chapitre_11

This I've done, and it's OK

Hey, wait a minute, a standard install does NOT make ANY other partition "hidden" and/or "inactive".
Are you using a bootmanager of some kind?

Yep, PQboot from Partition Magic, so that I have always only one primary partition active and visible; I didn't think I had to mention, sorry

Now that you mentioned it, your data:

0 0 0B-FAT32 6.0G Yes No 63 12,289,662 <- Working XP (my presumption)?? no: non-working
1 1 1B-FAT32 1.1G No Yes 12,289,725 2,249,100 <-Non-working XP (from your post)?no: fresh, working
2 2 1C-FAT32x 1.9G No Yes 14,538,825 3,903,795 <- Working 98 (my presumption)??yes
3 3 0F-EXTEND 69G No No 18,442,620 141,629,040 <- Volume(s) with other DATA (not relevant)yes

indicates that you have some way to hide/unhide partitions at boot.

My HD is organized like this: Three primary partitions (two of which always inactive and hidden) with my main XP, fresh XP used to build USB stick, and Win98 respectively. One extended partition with some volumes of DATA.
When I need (very seldom, unless for specific reasons) to boot to an OS different from my main XP, I run PQboot/Pmagic and change for the next boot the active primary partition, which I have to change back before rebooting. So I'm actually not offered a choice at boot time.

Can you post some details on this?
What I need is to know is:
1) Where are your set(s) of boot files NTLDR/NTDETECT.COM/BOOT.INI for XP and COMMAND.COM/MSDOS.SYS/IO.SYS for Win98
2) The contents of your BOOT.INI file(s)
3) Which bootmanager you use to hide/unhide partitions
The problem could be something gone wrong with this part of the booting, that would justify the problem with the BOOTLOG.

All system files are in the root folders of the respective partitions and the boot.ini is something like this for each XP install which is always partition 1 (no choice):

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

Is all this wrong? It's always worked todate (I mean till yesterday).

A further advise (for the future) is to ALWAYS, and when I say ALWAYS, I mean ALWAYS, use ERUNT:
http://www.larshederer.homepage.t-online.de/erunt/
BEFORE making ANY "important" change to your PC, and however run it periodically.

I DO IT, but I don't know how to use ERDNT for a non booting system. Is there a way? I'll be happy to learn, this would solve the problem, hopefully.

P.S.: I know I sound like a teacher, but, once this problem will be hopefully solved, you should really have a thought about the "proper" way to setup a multiboot system (using Logical Volumes inside Extended partitions instead of having multiple Primary ones)

I'm grateful for your sounding like a teacher and being patient to explain, I'm learning a lot.
And I appreciate your point, which may well be the best/right approach for a multiboot system.
However, I really don't need a multiboot system, but rather the possibility of occasionally booting to a different OS (usually for maintenance/debugging purposes). This way I always boot from C: and don't get drive letters mixed up.

Regards
Edborg

P.S. I'm now not sure if it's a hard disk problem (MBR/partiton list) or a registry problem. What do you think?

[jaclaz]

Re:ERUNT use

I DO IT, but I don't know how to use ERDNT for a non booting system. Is there a way? I'll be happy to learn, this would solve the problem, hopefully.

Well, actually the problem here is that your multiple installs of XP do not "see" each other, so that you cannot use one instance to "fix" the other.

And if you unhide first and second partition making the second active, it will probably cause problems with drive lettering (which CAN be solved, but it is a bit complex)

Since your first partition is FAT32, there is however a simple way out, i.e. install on that same partition a minimal Win98 dos or use a standard floppy bootdisk, then use the ERDNT capabilties:
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt
go to the "ERDNT technical information" part.
You can run ERDNT from DOS (Win98 DOS in your case due to FAT32 formatting):

CODE

ERDNT sysreg /mode:filecopy

(not really needed, as ERDNT detects if it's running under DOS or under NT)

Or you can manually copy relevant files to the RIGHT directory.

Have a look with the EDIT DOS command in the file ERDNT.INF file in the ERDNT directory where you saved your Registry, you will notice how ERUNT stores path with shortnames to keep compatibility with DOS/Win9xDOS.

jaclaz

P.S.: Yes, PQboot works quite well, it is not a bootmanager as I feared but just a pre-reboot Partition Table editor, and it is NOT the problem in this case, your Partition Table looks OK

As an afterthought, you could also try making yourself a boot floppy as depicted here:
http://www.xxcopy.com/xxcopy33.htm
so that we can also exclude you have a corrupted NTLDR/NTDETECT.COM/BOOT.INI on Hd partition.
(as said, Partition Table seems OK and the MBR code MUST be OK, otherwise you would not have been able to boot on the second instance of XP or on the Win98 one)

Also, you could try "forcing" Safe Mode by adding a /BASEVIDEO and SAFEBOOT:MINIMAL in the boot.ini.
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="XP Bootlog" /BOOTLOG
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="XP Safeboot" /SAFEBOOT:MINIMAL
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="XP Basevideo" /BASEVIDEO

[sisal]

hi jaclaz

thank you for your fast reply

i will try partita, it seems to be exaclty what i want (partly )

what i want to do is when connecting my usb harddisk to any computer, it should only mount the second partition automatically. the first partition should be hidden, only unhidden when booting this disk. and be hidden again when shutting down.
cos i'm a pc supporter, and need my usb harddisk on near every pc i support. and they should not mount my windows partition and copy their viruses to it

from beeblebrox i know when changing the partition type from 07 to 17, windows ignores it while running.
i think it should be possible to change the partition type on windows startup with a command line tool (command line options for beeblebrox?)

do you know such a program from scratch?

thanks in advance
sis

[edborg]

@jaclaz
SOLVED!!!!!
You're great! And an inexaustible source of knowledge... and ideas. Thanks a lot!
I had forgotten ERDNT's capability of working from DOS (I read the manual at time of installation, but never had the need to put it into practice).
Your hint led me to understand in detail how the program works... so i did it by hand without rebooting to DOS. From the working USB XP I copied the registry hives...and it worked! .

In exchange of your help and commitment I owe you at lest a follow-up report, so these are the details, in case you're interested:
I first restored the hive SYSTEM to no avail, then all together SAM, SECURITY and DEFAULT and it worked. I don't know exactly which one of these was the one who had caused the problem in the first place, although I suspect it being a SECURITY problem (as it is not a SYSTEM problem, and I don't know what SAM is) . I tried to avoid restoring SOFTWARE in order not to affect installed programs, and there was no need to restore ntuser.dat and UsrClass.dat.

As an afterthought, you could also try making yourself a boot floppy as depicted here:
http://www.xxcopy.com/xxcopy33.htm
so that we can also exclude you have a corrupted NTLDR/NTDETECT.COM/BOOT.INI on Hd partition.

I also created this floppy, which I didn't use in this case, but could be very useful in the future!

I'm now again up and running , but a bit scared (not knowing precisely what messed things up) at the idea of continuing my attempts to create a WinXP USB disk with a direct install, as per Martin's/Sisal's procedure.
Or might my problems have arisen exactly because I didn't follow their indication to unplug the HD and simply disabled it from BIOS?
I mention this in case my bad experience can be useful to somebody else in the forum.

Regards
Edborg

[jaclaz]

@sisal
Yes, Partita leaves the Partition table entries as they were at LAST boot.

You can ALWAYS remember to re-boot to the second dummy partition to reset the hiding or, to RE-HIDE the first partition before next boot, you can use PQboot (part of Partition Magic - COMMERCIAL) or a small batch file using the capabilities of the FREEWARE:
Findpart utilities:
http://www.partitionsupport.com/utilities.htm
(I am not sure if the standalone editpart supports NT/W2K/XP, the one inside Findpart does)
MbrWizard:
http://mbr.bigr.net/


@edborg
Well, happy it worked!
ERUNT is a real lifesaver!

Or might my problems have arisen exactly because I didn't follow their indication to unplug the HD and simply disabled it from BIOS?

I cannot say, but it is a possibility.
I have succeeded with the "original" tutorials 1 and 2 and with later v3 with just the HD disabled in BIOS, but as I have not (and will never have ) my main XP or 2K on Primary Partitions, it is possible that this makes things different.
On the whole I doubt it, it is more probable that in one or the other of the needed "fiddling" something went wrong, probably caused by the XP on the external USB HD.

It is possible that having at the same time two drives with two SAME signatures made the problem, not, as I thought, changing the signature but changing something in the "other" Registry.

It would be interesting if you could:
1) Repeat the problem
2) Load the non-working Registry as a hive in another instance of XP
3) Export the hive to a .REG file
4) Repair system
5) Load the now working Registry as a hive in another instance of XP
6) Export the hive to another .REG file
7) Use a comparison tool to find out the differences between the two

I still remain of my idea that a good practice is to always wipe or change the Disk Signature of the cloned disk, maybe it is not necessary, but "better be afraid then sorry".
As far as I know the signature is present in these keys:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet*\Enum\STORAGE\Volume
HKLM\SYSTEM\ControlSet*\Control\DeviceClasses\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
HKLM\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\5\DiskController\0\DiskPeripheral\0

Where ControlSet is:
CurrentControlSet
ControlSet001
ControlSet002
ControlSet...

jaclaz

[edborg]

@edborg
Well, happy it worked!
ERUNT is a real lifesaver!
................
I have succeeded with the "original" tutorials 1 and 2 and with later v3 with just the HD disabled in BIOS, but as I have not (and will never have ) my main XP or 2K on Primary Partitions, it is possible that this makes things different.
On the whole I doubt it, it is more probable that in one or the other of the needed "fiddling" something went wrong, probably caused by the XP on the external USB HD.

Well, in this case I'll go for the WinXP USB disk direct install, as per Martin's/Sisal's procedure, just to test also that way.
And I've just made two brand new backups MBR (with MBRFix) and Registry (with ERUNT)... just in case!
Edborg

[Former_tajbash_post]

Hi everyone

@jaclaz

i have succeeded into booting into DOS from my USB HDD, so i presume it is bootable??
i made a copy of freshly installed xp and tried the orginal tutorials numerous times....

thanks for your help


TajBash

[Former_DiGLoW_post]

I've been following this thread daily since early December, and I'll just say many thanks to everyone that has contributed thus far.

I just finished my second attempt at this project but I can't test it here at work because this computer won't boot from USB... I will post my hardware and hopeful success info after getting home and testing.

But I'm still confused about the EWF filter for pendrives. As long as I'm using FAT or FAT32, and don't want HORM, do I need it or not? I'd like to use it once I get a larger pendrive, but for now, if it's not needed, I'd prefer skipping this extra step... Am I safe in doing so?

[edborg]

I've been following this thread daily since early December, and I'll just say many thanks to everyone that has contributed thus far.

I just finished my second attempt at this project but I can't test it here at work because this computer won't boot from USB... I will post my hardware and hopeful success info after getting home and testing.

But I'm still confused about the EWF filter for pendrives. As long as I'm using FAT or FAT32, and don't want HORM, do I need it or not? I'd like to use it once I get a larger pendrive, but for now, if it's not needed, I'd prefer skipping this extra step... Am I safe in doing so?

Somebody more expert could certainly expand on this, but to summarize what I've learned on this thread:
A USB pendrive (flash, not USB disk) does need the filter (EWF) to preserve its lyfe span, not only if it's formatted NTFS, but also for FAT/FAT32 (although somewhat less).

By the way, adding the filter is an easy step, provided you find the files (two small files from a very large download; you'll find explanations in the thread) and follow SFiorito's tutorial.

Edborg

[bilou_gateux]

Customizing Windows XP Embedded thin clients

Windows XP Pro and XP Embedded are constantly reading from and writing to a disk. This translates into many flash erase cycles, of which CompactFlash and mini-IDE flash memory devices have a limited number. Without sophisticated wear-leveling technology, CompactFlash and mini-IDE flash cards will wear out much faster than in normal consumer-electronic style use.

To protect the life of the flash, thin client manufacturers implement XP Embedded's Enhanced Write Filter (EWF) to prevent writes (erase cycles) to the flash drive.

[Former_DiGLoW_post]

I think that answers my question! On my first attempt at this project, I tried installing EWF before even testing, and screwed everything up. After testing my new "Dietmar" drive, I will just go ahead and try installing EWF again. Thanks.

[radrusky]

Dietmar, are you still planning on providing a tutorial specifically for XPE?

[Dietmar]

Hi Rad,

XPE is that, with which I first succeed to boot from USB.
And: This makes XP like Win98: You can do all, that you want with it...
So it is a clear thing for me:
I write a Tutorial for XPE.

Nice to hear from you
Dietmar

[sisal]

Hi jaclaz

thank you very much for your links.

i't works like a charm
on boot partita sets 07, and from hklm\software\ms\run mbrwiz sets it to 17 again

but the drive order changes from pc to pc, and my usb disk isn't always the first. so i wrote a little perl script which reads the drive signature of each drive found and /save='d to select the right one

i'm lucky now

[jaclaz]

Happy it works for you.

but the drive order changes from pc to pc, and my usb disk isn't always the first. so i wrote a little perl script which reads the drive signature of each drive found and /save='d to select the right one

Could you better elaborate on this?

Also, seeing that you are one of the "I like to experiment" type of person, I could give you a further hint:
GUJIN
http://gujin.sourceforge.net/
it's like the "new kid on the block" bootmanager, and has some really interesting features, which might interest you.

jaclaz

[sisal]

Could you better elaborate on this?

i don't understand this phrase. and what i got from google translator makes no sense to me

but if you wantet to know what this script does:
it parses the output from mbrwiz /list
creates a named pipe (mbrwiz)
for each drive found from /list it does a mbrwiz /disk=$i /save=\\.\pipe\mbrwiz
then $sig=substr($mbr, hex('1b8'), 4)
and compares this to my hardcoded sig ref, and if found, mbrwiz /disk=$matched /hide=0

thanks for the gujin link. it sounds very interesting, but rather for my laptop, as i'm using linux and windows together