ntfs.sys corrupt?

[AndrewGS]

Early last week I ran a Windows update on my Compaq SR1625NX and upon restart it would not boot Windows. I tried "last good configuration", "debug mode" and "safe mode" to no avail. It always restarts while booting Windows. I tried both the built-in "recovery console" and the recovery discs I bought from HP/Compaq upon the advise of an online support person. When loading the recovery console either way the blue screen pops up and tells me there is a problem with the "ntfs.sys" file.

I pulled the hard drive and put it in an external case to get all my files, links and software off but both computers I hooked it up to immediately crashed and would only boot Windows after I unhooked the affected hard drive. I completed Western Digital's test and it looks like the hard drive is indeed fine. What I can't figure out is why it kills Windows on other systems I hook it up to. I'm using an external case via USB since I don't have another machine with an SATA port on the motherboard.

I ran offline DOS diagnostics and there is a fail for the "DMA Channels". Pardon the idiocy here, but would that affect the hard drive's ability to work on another system?

I keep tabs on updates, run anti-virus (Avira AntiVir), firewall (Sygate) and spyware (SpywareBlaster) software all the time and use WinCleaner to clean up temp. folders, the registry, etc.

Any Ideas?

[AndrewGS]

OK. So I downloaded Knoppix and ran ntfsfix on the hard drive. Now I can get to the recovery console. My concern now is will running a "standard recovery" truly maintain all my pictures, mp3s, documents, IE links, etc.? The other option is "full system recovery" that definately wipes the data away, but they claim "standard recovery" will save my "data files".

I just need some support before I hit "enter".

[AndrewGS]

Nevermind, I lost everything from the last seven years of my life.

Thanks for the help!

[Budfred]

Nevermind, I lost everything from the last seven years of my life.

Thanks for the help!

Welcome to http://www.pcguide.com/ubb/pcgubb.gif

So glad we could help... Of course, with the huge fees you pay for this service, we are all just sitting here on Sunday afternoon waiting to help you with your problem, especially since we know you are going to take risks that you don't understand without waiting for an answer... Since apparently you are a tiny bit dissatisfied with our prompt service, I will be happy to refund your fee -- no make that TRIPLE your fee to maintain good customer relations...

Of course, depending on what you did, it may still be possible to recover some of what you lost, but you would need to tell us exactly what you did and you would need to have some patience while someone who knows how to help has a chance to visit and respond... Since that seems to be too much trouble, I guess you can just stick with losing all that data...

By the way -- have you never heard of backups??

And it is sarcasm, not "sarchasm"...

[Paul Komski]

If you ran any compaq restore then it is likely that all of your data was overwritten in the process - making data recovery unlikely or incomplete. You are usually warned about this before hitting enter. You could try scanning the drive with GetDataBack for FAT or NTFS (http://www.runtime.org) as appropriate and that should let you see what is and isn't likely to be recoverable. If GDB doesnt identify any recoverable files you are into professional, expensive and not-guaranteed recovery.

BTW you should not have expected to be able to boot via a USB external drive but the drive might have allowed the files to be seen from another PC running an appropriate operating system.

AFAIK - standard recovery is dependent on you having first created a customised image backup and if that was done it should be able to go back to that image as opposed to a factory image. Of course current data and files would also have been overwritten in the very same manner as a factory re-iimaging/restore.

[AndrewGS]

Welcome to http://www.pcguide.com/ubb/pcgubb.gif

So glad we could help... Of course, with the huge fees you pay for this service, we are all just sitting here on Sunday afternoon waiting to help you with your problem, especially since we know you are going to take risks that you don't understand without waiting for an answer... Since apparently you are a tiny bit dissatisfied with our prompt service, I will be happy to refund your fee -- no make that TRIPLE your fee to maintain good customer relations...

Of course, depending on what you did, it may still be possible to recover some of what you lost, but you would need to tell us exactly what you did and you would need to have some patience while someone who knows how to help has a chance to visit and respond... Since that seems to be too much trouble, I guess you can just stick with losing all that data...

By the way -- have you never heard of backups??

I'm sorry I came off as an ass, but five hours with not a single reply combined with immeasurable frustration from dealing with this issue for some time (although not on this forum) as well as several other dire issues in my life led to haste and anger. No offense to you nor the community.

Yes, I've heard of backups, but i have only recently purchased an external hard drive and hadn't had time to backup my data yet. I also have never had an issue this major in ten years of computing, so I wasn't too worried as I've always been able to recover my data by hooking the hard drive up to another machine.

And it is sarcasm, not "sarchasm"...

Thanks professor, I'll be sure to run all my posts by you a few weeks in advance so you can correct my spelling. ;)

Anyways, here's where I'm at right now. I used Knoppix to try and run chkdsk as per some instructions I found when searching for the ntfs.sys fix. While doing this fixed the ntfs.sys issue, I still couldn't boot Windows.

I decided before running the Compaq System Recovery to try and hook the hard drive back up to another machine via an external enclosure and USB so I could try to save my files. When I hooked it up it no longer killed the machine, but the hard drive was constantly busy (light was flickering, etc.). I get a ballon warning me that the "delayed write" had failed even though I had not yet tried to copy any data. I went to move my files which were on the desktop and the "Compaq_Owner" folder showed to be empty and "Locked". I tried to open the "Windows" folder and got the same error.

That freaked me out so I decided to just put it back into the original machine and run the "Standard Recovery" which is supposed to just repair Windows and leave the data unaffected. Well, I get to the recovery screen and there is no longer an option for "Standard Recovery", only the destructive recovery. In haste and rage I decided to go ahead, I was sick of dealing with the problems. The recovery window showed thye progress, but it only took about eight minutes and never said anything about formatting the hard drive, only "Restoring Windows XP". After the "recovery" I searched for any of my files and none were there.

I'm not too "computer savvy" beyond very basic issues, but after reading the Wiki definition of partitions could it be that my files are on another partition on the drive?

I guess it's time for me to read up on data recovery.

[Paul Komski]

could it be that my files are on another partition on the drive?
I doubt it. I expect there are two partitions - one for windows and one for the compaq restore files.

The less you access the disk by booting to it the better - though most of the damage will already have been done by the destructive restore.

You can display the information about any partitions by booting to Knoppix (http://www.iol.ie/~krakowangus/knoppiximaging.htm)and using fdisk -l -u or by running gparted. You could also clone the whole drive to your external drive if it is big enough with either Knoppix or BiNG (in my sig) and BiNG would also let you view partition information and copy partitions one by one to the USB drive. Once you have cloned your current drive you can boot to your current hard drive and attempt recovery from the external without writing any more information to it. GetDataBack is your best hope - though I would be fairly pessimistic that you will get that much data back.

[Budfred]

Thanks professor, I'll be sure to run all my posts by you a few weeks in advance so you can correct my spelling.Your "apology" lacks sincerity when accompanied by more sarcasm...

I hope you are able to recover your files and I hope you realize people are helping you because they are helpful people, not because they are paid or owe you anything... Please exhibit some patience and respect... We have all struggled with computers that did not want to cooperate, that is how most of us learned what we know... We also have learned not to take out our frustration with those computers on the people we are asking for help... Many of the problems we have gotten help with or given help for have taken a lot more than 5 hours to get a first response... We all have lives other than volunteering here...

Now, back to your regularly scheduled disaster recovery...

[Paul Komski]

The biggest problem with both sarcasm and users of sarcasm is that it may be perceived as sarcasm by some and literally by others. I have heard an obstetrician say, in a normal voice, that women who didn't experience the pain of childbirth, because of an epidural, "didn't really have a baby". Was that an attempt at humour or the words of a misogynist. Only the speaker would know.

[AndrewGS]

I doubt it. I expect there are two partitions - one for windows and one for the compaq restore files.

The less you access the disk by booting to it the better - though most of the damage will already have been done by the destructive restore.

You can display the information about any partitions by booting to Knoppix (http://www.iol.ie/~krakowangus/knoppiximaging.htm)and using fdisk -l -u or by running gparted. You could also clone the whole drive to your external drive if it is big enough with either Knoppix or BiNG (in my sig) and BiNG would also let you view partition information and copy partitions one by one to the USB drive. Once you have cloned your current drive you can boot to your current hard drive and attempt recovery from the external without writing any more information to it. GetDataBack is your best hope - though I would be fairly pessimistic that you will get that much data back.

Thanks very much. I'm looking at either buying 'GetDataBack' or 'Active@ UNDELETE' either by using a Windows boot image and restoring to my eSATA drive or by pulling the hard drive and using it as a slave in another machine.

[Paul Komski]

Try GDB and see what it will see. That will cost you nothing and you can also save the scans so that you can re-open at the same point later to save time the next time you run the application. You can recover the files one by one for free by opening them in another application and using that application to save the files. If you cant find an application to open the files use a disk editor such as TinyHexer or WinHex. There are GDB plug-ins to enable the utilities to run from a BartPE should you ever want to 'go that road'.

[AndrewGS]

Try GDB and see what it will see. That will cost you nothing and you can also save the scans so that you can re-open at the same point later to save time the next time you run the application. You can recover the files one by one for free by opening them in another application and using that application to save the files. If you cant find an application to open the files use a disk editor such as TinyHexer or WinHex. There are GDB plug-ins to enable the utilities to run from a BartPE should you ever want to 'go that road'.

Here's how sweet life is right now. I have my hard drive and spend 20 minutes removing my friend's machine from his complicated desk. I open it up and see the 2 SATA ports on the motherboard, so I mount the hard drive and plug it in, however, there is no power plug for my SATA drive to plug into.

After I contemplate suicide for a few minutes I think "ok, I'll just get my eSATA cable and external hard drive case to provide power." Well, I do, and when I switch on the external SATA hard drive (hard drive I want to recover from) it makes some normal-sounding clunking noises but does so for an abnormal amount of time. Not only that but the hard drive isn't detected by the BIOS. So now I don't know if my hard drive decided to kill itself and have to put it back into the original machine to run the Western Digital test again.

So after screwing around with hardware for 45 minutes I get to put everything back to run a test to see if I might be able to possibly recover some data. This also means I'm just going to buy Active@ UNDELETE PRO to get the Vista image and boot from there because I don't have a copy of XP on CD to build a BartPE image to boot and run GetDataBack. I guess I just have to hope there is something to recover after spending the $50.

[Paul Komski]

I just have to hope there is something to recover after spending the $50.If you've spent the money you've spent the money but it should have been possible to scan your system for free to see if it was worth spending it.