Member Avatar for MichaelFitz

When booting one our laptops, it boots up to C drive which turned out to be the recovery partition.
Running ERD found the windows partition.
Does anyone know how the active partition could of been changed inadvertantly?
Anyone seen this before?
System was running XP SP3.

  • 2 Contributors
  • 3 Replies
  • 272 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by MichaelFitz

Dani AI

Generated

Brief expert summary and practical checklist tied to the thread (references at the end).

The partition "active" bit is not a file but a single boot flag in the MBR partition table that firmware/bootloaders use to decide which primary partition to boot. That explains why the system can suddenly try to boot a hidden recovery slice instead of the Windows partition — the boot flag (or what the BIOS thinks is the system disk) changed. Given reported the problem happened repeatedly rather than once, a persistent process or configuration change is more likely than a one-off media/bit-flip. (en.wikipedia.org)

Fast checklist to narrow the cause

  • Confirm which partition is marked active with Disk Management or DiskPart (safer to inspect first). A minimal DiskPart session: 
diskpart
list disk
select disk 0
list partition
select partition 1
detail partition

If the wrong partition is active note the time stamps on files in the recovery partition and audit scheduled tasks/services or installed imaging/restore software that could run at boot. Also verify BIOS boot-order and remove any USB media that can change drive numbering. (learn.microsoft.com)

Recovery and prevention notes

  • If boot files got disrupted, restore the boot loader/boot files via the XP Recovery Console (fixmbr / fixboot / bootcfg) or equivalent repair tools — but avoid blindly overwriting an MBR if a third‑party boot manager is present. Back up the MBR/partition table or image the disk before making changes.
  • OEM recovery/restore utilities (Asus factory F9-style partitions) can and do set the recovery partition active during their process; audit any factory-recovery agents or restore scripts.
  • Run a SMART check and vendor surface test even if a quick diagnostic passed; intermittent drive/controller problems or bad SATA cables can produce strange boot behaviour.

Capture timestamps (when the active bit changes), check scheduled tasks/services, and examine any imaging/restore tools first — those are the most common root causes when the symptom repeats. (learn.microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for MichaelFitz

I should add that using symantect recovery 2010, managed to change the active partition so that it boots to the domain ok now. I have run malwarebytes just in case. I really just want to know how it could of happened.

Member Avatar for jak0b

Hi Michael

The difference on an active and an inactive partition on a hard drive is only a few bits on the platter.
All hdd's are expected to make such an error, on very rare occasions. I think the common number is about 1 time in 10^15 read attempts, so it might just have been a freak accident.

But I suggest that you run a full diagnostic with surface scan on that particular drive, as it might also be a bad disk.
If you happen to find any other errors in the scan, I suggest you get a replacement from the dealer, before you loose any important data. :)

Member Avatar for MichaelFitz

Hi Michael

The difference on an active and an inactive partition on a hard drive is only a few bits on the platter.
All hdd's are expected to make such an error, on very rare occasions. I think the common number is about 1 time in 10^15 read attempts, so it might just have been a freak accident.

But I suggest that you run a full diagnostic with surface scan on that particular drive, as it might also be a bad disk.
If you happen to find any other errors in the scan, I suggest you get a replacement from the dealer, before you loose any important data. :)

Thanks for the suggestions jakob

I've run full diagnostics on the HDD. No errors.

If it had happened just the once I would agree with you but as it kept happening I believe it was intentional. I have backed up all the data and am reinstalling the SOE.

Thanks for the advice

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.