10 replies to this topic

[pedrole15]

When booting, (PC of a friend ), I see the logo Windows XP and then reboot
Try to retaure last good configuration from menu (F8) same
Compaq Presario AMD 64 Athlon - Windows XP Home - Disk 160 Go SATA - 2 partitions
Screen shot with LiveXP




What can I do ?

[was_jaclaz]

Most probably you are experiencing a BSOD and the (default - thanks MS guys ) setting in Registry is to reboot immediately.

You need a Registry editor to change the setting:
http://www.pctools.c...try/detail/229/
autoreboot to 0

Then we should be able to see the BSOD and the actual error.

Additionally, edit BOOT.INI and add an entry with /bootlog:
http://technet.micro...s/bb963892.aspx

/BOOTLOG
Causes Windows to write a log of the boot to the file %SystemRoot%\Ntbtlog.txt.

and post the Ntbtlog.txt as attachment.

BUT apart the above, your C:\ drive appears to be "RAW", which usually means a corrupted filesystem.

Try running CHKDSK C: (with NO parameters) from the LiveXP (if available or from the XP install CD Recovery Console) and report


jaclaz

[pedrole15]

I can't edit anythings because i can't access to disk c:
with chkdsk i got this:

[Brito]

Don't forget to backup the contents of the C:\ drive before any attempt to fix.

You can likely use driveImageXML to backup the whole C: partition even if not being recognized.

If this operation is not possible then you can use the NTFS reader and copy the contents of the C:\ partition to a backup folder in a external USB drive.

[was_jaclaz]

GOOD.

Now run first:

CHKDSK C: /F

@Nuno
CHKDSK without parameter is working, this means that a CHKDSK /F will most probably solve the problem.
CHKDSK, with /F parameter does NOT worsen a situation on a NTFS drive.
CHKDSK with the /R parameter, may.


jaclaz

[Brito]

I can't edit anythings because i can't access to disk c:
with chkdsk i got this:
...

Sounds like the work from a nasty piece of virus.

If you do a

chkdsk c: /f

Should be enough to fix the file system but do make a backup before applying any changes on the partition.

Chkdsk might as well completely wipe out the whole file structure without giving any change to recover afterwards.



----

Oops.. double post, sorry Jaclaz - You have more experience than I with these matters so I'll let you proceed.

Edited by Nuno Brito, 22 June 2008 - 01:58 PM.

[was_jaclaz]

@Nuno
CHKDSK without parameter is working, this means that a CHKDSK /F will most probably solve the problem.
CHKDSK, with /F parameter does NOT worsen a situation on a NTFS drive.
CHKDSK with the /R parameter, may.

jaclaz

[pedrole15]

Ok with CHKDSK C: /F
I haven't make backup ,but all seem correct
After chkdsk , i can read immediatly the disk from liveXP
Boot is ok now

Thanks

[Brito]

..
CHKDSK, with /F parameter does NOT worsen a situation on a NTFS drive.
CHKDSK with the /R parameter, may.
...

Interesting.

Good to know this from an expert, was personally in doubt about this matter so whenever not sure - backup is my answer to avoid a possible mess later.

..
After chkdsk , i can read immediatly the disk from liveXP
Boot is ok now
..

Excellent news!

[was_jaclaz]

Thanks

Happy everything is allright now.

Interesting.

Good to know this from an expert, was personally in doubt about this matter so whenever not sure - backup is my answer to avoid a possible mess later.

Yep, but you see, the idea is to backup regularly and BEFORE a drive gets corrupted.

Once it is corrupted, we are entering in the realm of Data Recovery, where the "right" thing to do is theoretically that of IMAGING the RAW drive, TWICE, then recover data from second copy, leaving first one ALONE.
Once you are satisfied with result, image back the "fixed" image and test it in real system, if anything is not working or is not repairable easily, make another copy from first copy and try using another method.

When there are all in all trifling filesystem problems like in this case, as seen by CHKDSK, CHKDSK /F will solve them in 99% of cases.

Making anyway an IMAGE of the RAW drive is however a very sound advice.

I sincerely doubt that the problem was caused by a Virus or Malware, it seems more likely due to a incorrect shutdown (choose one):
- switching the PC off by unplugging it (while drive is working) or resetting it
- sudden power surge or blackout
- failing power supply
- cables/connectors not seated properly/not making good enough contact
- motherboard controller defective
- hard disk dying/defective
- driver conflict

NOW that the data is accessible, is the right time to make a complete image/backup of the data, before visually checking the hardware and run some tests on it, AS WELL AS a complete and thorough Virus/Malware scan.

It may well be an intermittent problem that might never repeat, but you never know.


jaclaz

[billonious]

As far as I know, it is a typical MFT corruption problem, cross-linked indexes of files.