Re: HDD down-Data Recovery Question

On Fri, 12 Aug 2005 18:07:01 -0700, "MidwestTech"

>When you try to start or restart your Windows XP-based computer, you may
>receive one of the following error messages:
>Windows XP could not start because the following file is missing or corrupt:
>\WINDOWS\SYSTEM32\CONFIG\SYSTEM

That means the more important chunk of the registry's gone.

>-started with recovery console and ran a chkdsk /r

Bad idea. ChkDsk is lethal in a data crisis, as it will irreversibly
"fix" whatever if finds "wrong" without asking you for permission
first. It's fundamentally incompatible with data safety.

By "fix", it will resolve conflicting file structure information in
favor of one or other alternative. No conflict, no problem, right?
Nope; no conflict, no *detectable* problem - you've just thrown the
needles back in the haystack, by destroying the cues that highlighted
that file as possibly damaged. You've also destroyed the information
you might have used to repair the damage, if ChkDsk guessed wrong.

>CHKDSK found and fixed one or more errors on the volume

Details? Or was ChkDsk too useless to privide any, beyond a glib
"ChkDsk found errors, but fixed them all!"?

>Attempted to recover system registry by following details in q307545

If a file system or hard drive is at risk, Windows is no loger fit for
use. Windows can't boot without writing to the hard drive, and runs
services that gratuitously write to every hard drive volume it sees
(AutoChk, System Restore, .PF management, thumbnails, indexing, file
access date stamps...). So you are taking a chance even when you drop
an at-risk HD into another PC to salvage data from it.

>-each time a boot was attempted it just shut itself off-including in safe
>mode-no messages

That you saw the turn-off to Safe Mode, means you get as far as
loading and running C:\NTLDR. The reason the PC restarts instead of
stopping with an error, may be because the duhfault "Automatica;lly
restart on system errors" setting is in effect. Kill that at birth.

>-will need to take it to office to get it slaved over to another HDD to
>offload the data

See above.

>-hooked up HDD to another computer and attempted to explore the
>drive-Windows detected the drive as unformatted-RAW partition-

That's interesting, as it implies an invalid partition table or
partition boot record, which would have precluded getting as far as
C:\NTLDR when you tried to boot it as a "live" HD.

Unless the new host PC was older than XP SP1, and the hard drive is
over 137G? In any event, get that HD out of that host PC **fast**.

>-booted into recovery mode again and attempted to browse files using dir
>command-Message-An error occured during directory enumeration
>-attempted a chkdsk /r -Message -The volume appears to contain one or more
>unrecoverable problems. Message o' death!
>-same thing at 50% each time

Step one: Turn off the flamethrower (ChkDsk). If you want to destroy
the HD, just crush it with a hammer; much faster than ChkDsk.

>This is my client's main business computer and of course the files are not
>backed up since my last visit. Wish they would listen. Anyone know of any
>utility or further t-shooting that I can attempt? I'm not hopeful and have
>already advised my client of the bad news (felt like being a doctor and
>telling them their family member died).

If it's FATxx, it's comparitively easy:
- DOS mode boot
- use Norton Disk Edit or similar if file system needs repair
- else use LCopy from Odi's LFN Tools to copy off data with LFNs
- else forego LFNs and copy via DOS mode
(or you can use approaches that follow, or access via Linux boot)

If it's NTFS, it's a gloomier picture; either...
- DOS mode boot
- if file system barfed, give up
- forego LFNs, using ReadNTFS to copy subtrees one at a time
....or...
- Bart PE CDR mode boot
- if file system barfed, try a few "automagical" repair tools
- if those fail, give up; there's no manual repair tools for NTFS
- else if OK, copy off data using A43, Cmd.exe, etc.
....or...
- boot the XP CD, choose Recovery Console
- if the Set commands work, use them to facilitate copy off HD
- else give up, as unless you'd facilitated Set earlier, you're dead
- copy files one at a time, by name, because that's all RC can do
....or if you feel like taking a chance...
- drop HD into an XP system
- press Esc if AutoChk tries to "fix" the HD
- immediately in XP, kill SR for the dropped-in HD
- try copying stuff off the HD now
- accept some collateral damage as inevitable with this approach
- accept secondary damage to host XP if lock-ups force bad exits

See http://cquirke.mvps.org/whatmos.htm


>------------ ----- ---- --- -- - - - -
The most accurate diagnostic instrument
in medicine is the Retrospectoscope
>------------ ----- ---- --- -- - - - -
.

Relevant Pages

  • Re: PLEASE HELP: 2 ERROR MESSAGES
    ... recognise CHKDSK/F or CHKDSK /F), then I type in FIXBOOT and it asks: ... It seems as though it would not boot from the CD ... Which windows installation would you like to log onto (To cancel, ... into recovery console. ...
    (microsoft.public.windowsxp.general)
  • Re: Please Help!! Boot Failure!!
    ... Is it safe to write to the HD? ... Evacuate data from HD, test HD, test file system, exclude malware ... Windows on the host PC until you know it is safe to do so - while the ... Make whatever non-HD boot disk you like; ...
    (microsoft.public.windowsxp.general)
  • Re: Did not "activate" my XP...???
    ... something that triggered Windows Product Activation ... Is it safe to write to the HD? ... Evacuate data from HD, test HD, test file system, exclude malware ... Make whatever non-HD boot disk you like; ...
    (microsoft.public.windowsxp.general)
  • Re: PLEASE HELP: 2 ERROR MESSAGES
    ... It seems as though it would not boot from the CD unless ... It booted from the CD and a menu came up where I selected recovery console. ... Which windows installation would you like to log onto (To cancel, ... except that I was prompted to perform a chkdsk on the ...
    (microsoft.public.windowsxp.general)
  • Re: CHKDSK: How often?
    ... If Windows *thinks* it needs to run ChkDsk ... ... file system for that volume, and is cleared when the volume is closed. ... that the previous session interrupted disk writes in progress. ...
    (microsoft.public.windowsxp.perform_maintain)