Am I paranoid? Ext3FS has NTFS bootsector

From: Marc Brevoort (mrjb_at_dnd.utwente.nl)
Date: 02/17/04 

Date: 17 Feb 2004 02:01:00 -0800

This morning when I wanted to get to work, I booted my linux box but
starting up something seemed to go wrong.

Got an error message Ext3-FS: Journal inode deleted.

Mounting my work/data disk gives me the error

mount: wrong fs type, bad option, bad superblock on /dev/hda1,
       or too many mounted file systems

The system otherwise boots OK, by the looks of it. Some details:

Fdisk /dev/hda shows me:

Device Boot Start End Blocks Id System
/dev/hda1 * 1 637 5116671 83 Linux
/dev/hda2 638 1511 7020405 83 Linux
/dev/hda3 1512 1582 570307+ 82 Linux swap

My root partition is /dev/hda2.

A hexdump of /dev/hda1 shows me what looks like a NTFS boot sector.
Is this usual on a linux file system that previously contained NTFS?

000: eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 | .R.NTFS
.....
010: 00 00 00 00 00 f8 00 00 3f 00 ff 00 3f 00 00 00 |
........?...?...
020: 00 00 00 00 80 00 80 00 fd 25 9c 00 00 00 00 00 |
.........%......
030: 04 00 00 00 00 00 00 00 5f c2 09 00 00 00 00 00 |
........_.......
[snip]
170: b4 01 8b f0 ac 3c 00 74 09 b4 0e bb 07 00 cd 10 |
.....<.t........
180: eb f2 c3 0d 0a 41 20 64 69 73 6b 20 72 65 61 64 | .....A disk
read
190: 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 00 | error
occurred.
1a0: 0d 0a 4e 54 4c 44 52 20 69 73 20 6d 69 73 73 69 | ..NTLDR is
missi
1b0: 6e 67 00 0d 0a 4e 54 4c 44 52 20 69 73 20 63 6f | ng...NTLDR is
co
1c0: 6d 70 72 65 73 73 65 64 00 0d 0a 50 72 65 73 73 |
mpressed...Press
1d0: 20 43 74 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f | Ctrl+Alt+Del
to
1e0: 20 72 65 73 74 61 72 74 0d 0a 00 00 00 00 00 00 |
restart........
1f0: 00 00 00 00 00 00 00 00 83 a0 b3 c9 00 00 55 aa |
..............U.

(The partition once had Windows 2000 installed, but shouldnt the boot
sector be wiped out by formatting the disk with ext3fs? I know someone
has been in the office after I left but I don't want to start pointing
fingers unless I'm sure someone is to blame)

I do have backups, but it is quite an effort to restore everything the
way it was. What are my chances of getting hda1 back to work again?
Was my machine sabotaged? It is normally switched off when I leave
home.

Regards,

Marc Brevoort

Relevant Pages

  • Re: RH 9.0 doesnt install: blank screen! (RH 8.0 & 7.2 do though)
    ... Tried 'linux text noprobe skipddc noapic apm=off noht'. ... I wanted to try on and so I chose 7 boot options: ... linux text noprobe skipddc lowres apm=off noapic nousb ...
    (linux.redhat.install)
  • Re: installation problems
    ... RH 9 had trashed my Linux partition and rendered my PC unbootable. ... >you can create the floppy from and can be created on a differnet ... >on the CD as the floppy boot image. ... and since flash drives seem to be listed in /proc as scsi devices, ...
    (comp.os.linux.misc)
  • RE: Linux hacked
    ... Subject: Linux hacked ... After you boot up into the OS running from CD, ... >> First let me say I'm a security novice. ... >> been unsuccessful in getting root back. ...
    (Security-Basics)
  • Re: New to linux..looking for program I can boot and run off CD
    ... >>and he was using a windows os but booted and run Linux programs off a CD. ... >having to do a dual boot thing on my current machine. ... > That would be Knoppix or one of it's derivatives. ...
    (alt.linux)
  • Re: Of mice and men
    ... They're two of the many Linux distributions. ... > provided it has its own partition. ... separate boot partition, but that's the easiest approach - unless ...
    (comp.lang.cobol)