Recovering an NTFS Boot Sector in Symantec Storage Foundation for Windows

One evening, I received a call from a customer who ran into an issue with Storage Foundation for Windows. They ran into a SFW bug while trying to shrink volumes for a disk space recovery project. FYI, unlike UNIX, SF volumes in Windows need to be offline before shrinking the volume. Long story short, the shrink process ended up corrupting the NTFS boot record on a 1.3TB volume. Even though the vxprint output showed the volumes ENABLED and ACTIVE with the correct volume boundaries, the volume showed up RAW, not NTFS from both VEA console and DISKPART.


From the UNIX perspective, this would have been no big deal. Running a vxmksdpart would recreate the partition table. This process is not as easy with Windows. You need to locate the backup NTFS boot sector which is located at the end of the volume and copy it over the corrupted one. You then run an fsck of the file system (which can take FOR-E-VER!!), cross your fingers and pray. I emphasize that this is a LAST RESORT measure before recovering from backups. There is NO, I repeat, NO GUARANTEE that you will be free from data corruption. But, if you’re going to have to rebuild the file system and recover the data from tape/disk, you might as well give it a shot. As in my customer’s case, they were fortunate enough to recover the volume on the first try. When this issue appeared again, they ended up losing ACL’s to all files in the volume. However, recovery of the ACLs was still much faster recovering all the data!

Here’s the detailed steps on the process of recovering the NTFS boot sector. I used the vxtool from Symantec to locate the backup boot sector and to perform the recovery. This tool can be downloaded from ftp://ftp.veritas.com/pub/support/vmtools.

1) Determine the location of the backup NTFS boot sector.

a) Make a note of the harddisk number that contains the RAW volume.

b) In VEA, select the volume with the corrupt NTFS boot sector. In the right panel, select the Subdisks, tab. Highlight the affected subdisk, right-click and select “Properties”. Note the size of the volume in sectors and disk offset.

c) Jot down the Size and Disk offset.

d) Add the size in sectors to the disk offset in sectors minus 1. This is the location of the backup boot sector.

Size=409600 Disk offset=65570

Backup boot sector = 409600 + 65570 – 1 = 475169

2) From a command window, use the vxtool utility to scan the range near the end of the problem volume.

Hard disk size (sectors) = 10485760

Command: vxtool disk sectorscan harddisk<#>

From a command window:

vxtool disk sectorscan harddisk1 0 10485760

Output:

The Disk Offset number (65570) is the location of the original NTFS boot sector. The backup NTFS boot sector is the number calculated from Step 1d). Verify that this block is noted as “magic NTFS”.

3) Now, to restore the corrupted NTFS boot sector using the backup copy using the vxtool utility. The source and target disks may be different if the volume spans multiple disks.

Command:

vxtool disk copyblock sourcedisk offset targetdisk offset block

Example:

vxtool disk copyblock harddisk1 65570 harddisk1 475169 1

4) Perform a rescan from VEA and DISKPART.

The volume should show up as an NTFS volume. Cross your fingers and run a chkdsk to ensure file system data integrity.


Here are some reference articles from Symantec that addresses the data corruption issues with volume shrinks. A patch has now been provided as of 06/01/2011.


Tech Alerthttp://www.symantec.com/docs/AL1130


Tech Article http://www.symantec.com/docs/TECH160393


Patch
https://sort.symantec.com/patch/detail/5022

Recovering an NTFS Boot Sector in Symantec Storage Foundation for Windows