0xc0000001 at boot - Windows 10

Question

Level 2

227 points

0xc0000001 at boot - Windows 10

I was under the mistaken impression that the system image backup and restore function that comes with Windows would be a good way to backup my partition. Turns out it doesn't play all that nice with at least some dual boot situations. Anyway, I got the restore to go, and straightened up the inconstancies with the partition tables. I have Windows 10 installed.

When I tried to start Windows, it went into an automatic repair loop. I found out how to disable that via bcdedit, but now I get a Blue Screen with a 0xc0000001 at boot.

chkdsk /r c: found some problems, but otherwise didn't help. Tried bootrec, that did nothing. sfc /scannow says something about a pending repair and refuses to run.

I'm not really sure where to proceed from here. The last thing I want to do is reinstall from scratch, since that defeats my purpose of making the system image. First thing I want to do is get sfc /scannow to run, then maybe I can look at replacing corrupted system files, or whatever might be the problem. I saw something about an offline scan for sfc, would that be what I'm looking for?

MacBook Pro (Retina, Mid 2012), OS X El Capitan (10.11.1)

Posted on Nov 3, 2015 3:48 PM

Reply

Answer 1

Loner T

Level 9

59,536 points

Nov 3, 2015 5:45 PM in response to Sam Wilkins

Did you rebuild the BCD using bootrec.exe?

Reply

Answer 2

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 5:49 PM in response to Loner T

Tried bootrec, that did nothing.

That includes /rebuildbcd, as well as /fixmbr and /fixboot. Though I think /rebuildbcd said it didn't find any Windows installations.

Reply

Answer 3

Loner T

Level 9

59,536 points

Nov 3, 2015 6:36 PM in response to Sam Wilkins

Can you mount the EFI disk (usually disk0s1) and see if you have a Microsoft directory in that partition?

Reply

Answer 4

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 6:33 PM in response to Loner T

I don't have a Microsoft directory.

Reply

Answer 5

Loner T

Level 9

59,536 points

Nov 3, 2015 6:39 PM in response to Sam Wilkins

Is this an upgrade from W7/W8+ to W10 or a clean installation? Does a Startup Repair using the Windows Installer work?

Reply

Answer 6

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 7:01 PM in response to Loner T

It was an upgrade from 8.1. I've tried Startup Repair from a flash drive with the Windows installer around 5 times. No luck.

By the way, this thread was quite helpful in getting my partition tables straightened out:Bootcamp unrecognized after restoring Windows from system image I couldn't install gdisk because El Capitan, but gpt ran after I nuked the MBR. I took careful notes. Doesn't look like resizing the OS X partition showed up in that thread. Had to do that to make room after the restore decided to place Windows somewhere over top my OS X Recovery partition.

I've heard you can still install stuff in /usr/local, so I'm guessing gdisk tries to install itself in /usr. I'd far rather it go in /usr/local, since I'd like to keep stuff I install separate from Apple stuff. I don't suppose there's any way to get the installer changed to do that?

Reply

Answer 7

Loner T

Level 9

59,536 points

Nov 3, 2015 7:24 PM in response to Sam Wilkins

On El Capitan, with SIP (System Integrity Protection) enabled, you will not be able to install GPT Fdisk. If you boot in Local Recovery (not internet Recovery) and type csrutil disable in Utilities -> Terminal, it disables SIP. Once disabled install GPT Fdisk normally, and run GPT commands as necessary. You can re-enable SIP by using csrutil enable in Local Recovery.

We never got the Restore from Windows backup to work in the thread you reference. A slightly larger partition causes a discrepancy between GPT and MBR, and would cause future problems.

Once option would be to install a new Windows on a larger partition, and then restore the older smaller image. Boot Camp was an attempt at that, but OP was very sporadic in responses. You can try this method. Since you have a good backup, this is probably the most reasonable method. A secondary method is to restore the Image to a blank PC and then 'migrate' it to Mac, but I have never had the time to test it fully.

The primary issue with an Image/File History restore is the assumption that Windows makes that it is the only OS on the entire physical disk. This is part of the reason I prefer Winclone over Windows Image backup on Macs, but regular backups on PC work correctly for a Restore.

Reply

Answer 8

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 7:41 PM in response to Loner T

Anyway, I'm pretty sure I managed to fill in the missing parts of that thread. Like my Windows HD is on my desktop right now, and Disk Utility says there's nothing wrong with the drive. And I have a working recovery partition. I spent a lot of time in Internet Recovery during that time.

Unfortunately, I thought I could use the stuff that came with Windows to image my partition.

I can give you the output from fdisk and gpt if you want to see it, otherwise I'd like to proceed from the fact that Startup Repair off the installer doesn't fix anything. Maybe getting sfc /scannow to work.

Reply

Answer 9

Loner T

Level 9

59,536 points

Nov 3, 2015 7:54 PM in response to Sam Wilkins

It would be good to have the GPT and Fdisk output for the record. Is SFC /scannow not working?

Reply

Answer 10

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 7:56 PM in response to Loner T

Tycho:~ sam$ sudo gpt -rvvv show /dev/disk0

Password:

gpt show: /dev/disk0: mediasize=500277790720; sectorsize=512; blocks=977105060

gpt show: /dev/disk0: Suspicious MBR at sector 0

gpt show: /dev/disk0: MBR part: type=175, start=409640, size=585938864

gpt show: /dev/disk0: MBR part: type=171, start=586348504, size=1269536

gpt show: /dev/disk0: MBR part: type=7, start=587618304, size=389486592

gpt show: /dev/disk0: Pri GPT at sector 1

gpt show: /dev/disk0: GPT partition: type=C12A7328-F81F-11D2-BA4B-00A0C93EC93B, start=40, size=409600

gpt show: /dev/disk0: GPT partition: type=48465300-0000-11AA-AA11-00306543ECAC, start=409640, size=585938864

gpt show: /dev/disk0: GPT partition: type=426F6F74-0000-11AA-AA11-00306543ECAC, start=586348504, size=1269536

gpt show: /dev/disk0: GPT partition: type=EBD0A0A2-B9E5-4433-87C0-68B6B72699C7, start=587618304, size=389486592

gpt show: /dev/disk0: Sec GPT at sector 977105059

start size index contents

0 1 MBR

1 1 Pri GPT header

2 32 Pri GPT table

34 6

40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B

409640 585938864 2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC

586348504 1269536 3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC

587618040 264

587618304 389486592 4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7

977104896 131

977105027 32 Sec GPT table

977105059 1 Sec GPT header

Tycho:~ sam$ sudo fdisk /dev/disk0

Disk: /dev/disk0 geometry: 60821/255/63 [977105060 sectors]

Signature: 0xAA55

Starting Ending

#: id cyl hd sec - cyl hd sec [ start - size]

------------------------------------------------------------------------

1: EE 1023 254 63 - 1023 254 63 [ 1 - 409639] <Unknown ID>

2: AF 1023 254 63 - 1023 254 63 [ 409640 - 585938864] HFS+

3: AB 1023 254 63 - 1023 254 63 [ 586348504 - 1269536] Darwin Boot

*4: 07 1023 254 63 - 1023 254 63 [ 587618304 - 389486592] HPFS/QNX/AUX

Reply

Answer 11

Loner T

Level 9

59,536 points

Nov 3, 2015 8:01 PM in response to Sam Wilkins

Can you also post the output of

sudo dd if=/dev/rdisk0s4 count=1 2>/dev/null | hexdump -C

Reply

Answer 12

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 8:05 PM in response to Loner T

This is what I got

00000000 eb 52 90 4e 54 46 53 20 20 20 20 00 02 08 00 00 |.R.NTFS .....|

00000010 00 00 00 00 00 f8 00 00 3f 00 ff 00 00 58 06 23 |........?....X.#|

00000020 00 00 00 00 80 00 80 00 ff 17 37 17 00 00 00 00 |..........7.....|

00000030 00 00 0c 00 00 00 00 00 02 00 00 00 00 00 00 00 |................|

00000040 f6 00 00 00 01 00 00 00 7b c0 21 4e e7 21 4e 16 |........{.!N.!N.|

00000050 00 00 00 00 fa 33 c0 8e d0 bc 00 7c fb 68 c0 07 |.....3.....|.h..|

00000060 1f 1e 68 66 00 cb 88 16 0e 00 66 81 3e 03 00 4e |..hf......f.>..N|

00000070 54 46 53 75 15 b4 41 bb aa 55 cd 13 72 0c 81 fb |TFSu..A..U..r...|

00000080 55 aa 75 06 f7 c1 01 00 75 03 e9 dd 00 1e 83 ec |U.u.....u.......|

00000090 18 68 1a 00 b4 48 8a 16 0e 00 8b f4 16 1f cd 13 |.h...H..........|

000000a0 9f 83 c4 18 9e 58 1f 72 e1 3b 06 0b 00 75 db a3 |.....X.r.;...u..|

000000b0 0f 00 c1 2e 0f 00 04 1e 5a 33 db b9 00 20 2b c8 |........Z3... +.|

000000c0 66 ff 06 11 00 03 16 0f 00 8e c2 ff 06 16 00 e8 |f...............|

000000d0 4b 00 2b c8 77 ef b8 00 bb cd 1a 66 23 c0 75 2d |K.+.w......f#.u-|

000000e0 66 81 fb 54 43 50 41 75 24 81 f9 02 01 72 1e 16 |f..TCPAu$....r..|

000000f0 68 07 bb 16 68 52 11 16 68 09 00 66 53 66 53 66 |h...hR..h..fSfSf|

00000100 55 16 16 16 68 b8 01 66 61 0e 07 cd 1a 33 c0 bf |U...h..fa....3..|

00000110 0a 13 b9 f6 0c fc f3 aa e9 fe 01 90 90 66 60 1e |.............f`.|

00000120 06 66 a1 11 00 66 03 06 1c 00 1e 66 68 00 00 00 |.f...f.....fh...|

00000130 00 66 50 06 53 68 01 00 68 10 00 b4 42 8a 16 0e |.fP.Sh..h...B...|

00000140 00 16 1f 8b f4 cd 13 66 59 5b 5a 66 59 66 59 1f |.......fY[ZfYfY.|

00000150 0f 82 16 00 66 ff 06 11 00 03 16 0f 00 8e c2 ff |....f...........|

00000160 0e 16 00 75 bc 07 1f 66 61 c3 a1 f6 01 e8 09 00 |...u...fa.......|

00000170 a1 fa 01 e8 03 00 f4 eb fd 8b f0 ac 3c 00 74 09 |............<.t.|

00000180 b4 0e bb 07 00 cd 10 eb f2 c3 0d 0a 41 20 64 69 |............A di|

00000190 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 6f 63 |sk read error oc|

000001a0 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d 47 52 |curred...BOOTMGR|

000001b0 20 69 73 20 63 6f 6d 70 72 65 73 73 65 64 00 0d | is compressed..|

000001c0 0a 50 72 65 73 73 20 43 74 72 6c 2b 41 6c 74 2b |.Press Ctrl+Alt+|

000001d0 44 65 6c 20 74 6f 20 72 65 73 74 61 72 74 0d 0a |Del to restart..|

000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

000001f0 00 00 00 00 00 00 8a 01 a7 01 bf 01 00 00 55 aa |..............U.|

00000200

Reply

Answer 13

Loner T

Level 9

59,536 points

Nov 3, 2015 8:19 PM in response to Sam Wilkins

The header looks clean. Can you test the following steps?

1. Assuming you have a W10 USB installer (if not use BCA Options 1 and 2 and build a USB2 flash installer), connect it.

2. If the System Preferences -> Startup Disk shows Bootcamp (not the USB), select it, and click on Restart.

3. Check if you get a Repair option. If you do, try a Repair.

Reply

Answer 14

Sam Wilkins Author

Level 2

227 points

Nov 3, 2015 9:50 PM in response to Loner T

Wait, I'm connecting the USB, and booting from the internal SSD? Actually, BCA Options 1 and 2 were the cause of a major headache in even getting to the repair options when I first needed to restore my system image. It was causing the installer to go straight to installing Windows without giving me any repair options. I ended up looking at the difference between the USB drive with and without option 2, and there was an AutoUnattend.xml file when you use both option 1 and 2. I had to delete that file to access the repair options. I'd imagine just option 1 would suffice here as well.

Which specific kind of repair do you mean? Like I said, I've attempted to run startup repair off my installer USB several times, without it being able to repair anything.

Reply

Answer 15

Loner T

Level 9

59,536 points

Nov 4, 2015 4:23 AM in response to Sam Wilkins

In a PC with BIOS, there is a boot order specified, which can be modified using a BIOS UI. Macs with CSM-BIOS do not have a UI, but the order is built based on detected devices. If the USB is connected, it will boot from it, but the underlying environment should point to the on-disk Bootcamp partition, and should let you Repair.

Here is an example - http://imgur.com/a/1DaOE#0 . This is from a 2013 15-in rMBP.

Reply