Windows XP crashed - strange symptoms

[Akula2]

Dear Friends,

I did boot with WinXP SP2 CD, pressed 'R' then I get this message:

The path or file specified is not valid

C:\>

It's showing like that, what should I do next ? Typing fixmbr nothing happens...

Before making the C: as active my PC used to boot but now it's not booting

Windows Boot screen appears...keeps on scrolling and on and on...then reboot and shows the boot options:

Safe mode

....

....

....

Start Windows normally

I tried in Safe Mode but it's getting struck after BTHidMgr.sys line. Could you please tell me at what stage in the Safe Mode I should hit F8 key to select Disable automatic restart on system failure?

I got though, here is the Blue Screen error message:

A problem has been detected and windows has been shutdown to prevent damage to your computer

.............

.............

.............

Technical Information:

***STOP: 0x0000007B

Actually there was power outage while I was transfering the backup into my iPod. Is that a problem? I am extremely worried now, there is data on that PC - more than 5 GB including valuable 600MB plus Incredimail data Please guide me. Big thanks.

[-pops-]

Have a look at http://support.microsoft.com/kb/324103

It is never good news for any drive to have been powered down whilst reading or writing.

[Akula2]

Have a look at http://support.microsoft.com/kb/324103

It is never good news for any drive to have been powered down whilst reading or writing.

Thanks but that's not helpful...don't know how to proceed next :(

Please read this:

/>http://forums.windowsforum.org/index.php?showtopic=43810

[-pops-]

It was unclear that this problem was associated with your previous one - which is why I gave that reply.

In my view there comes a point where you appreciate that it is unlikely that a particular setup will work ever properly and to start again. This view may differ from yours but, I use a computer as a tool rather than an end in itself.

I have a reputation here for constantly reminding users about having a backup or image of their system(s). I assume you didn't.

[Akula2]

It was unclear that this problem was associated with your previous one - which is why I gave that reply.

In my view there comes a point where you appreciate that it is unlikely that a particular setup will work ever properly and to start again. This view may differ from yours but, I use a computer as a tool rather than an end in itself.

I have a reputation here for constantly reminding users about having a backup or image of their system(s). I assume you didn't.

Not a problem. Please share your view(s) on setups, would be glad to learn few new things...gaining knowledge is unlimited :)

Dear mod, that's not the case about Data back up. I took 6 DVD full of data from that PC but 7GB more remaining including very valuable 600MB plus of Incredimail e-mail data :( I admit it was my mistake but I pray a way out to recover my windows partition else only option is to run a tool like GetDataBackNTFS by connecting with another disk (if that tool allows corrupted disk?). Any inputs are highly appreciated and thank you.

EDIT: I left that 7GB data because it was tempting for me to try out rescuing Windows by toggling the active partition to C: drive (FC12 used to have the default BOOT flag). I blindly trusted a suggestion given by a Forum Guru and now am repenting so badly (prior to that my disk used to boot nicely no matter BOOT sector got corrupted).

[MANEMAN]

Hi there.

I blindly trusted a suggestion given by a Forum Guru and now am repenting so badly

Information given out on voluntarily run forums are suggestions and opinions and should be treated as such.

Blindly trust nothing in life even if you have paid good money for it. Such self inflicted blindness can only lead to the pathways of repenting so badly.

Recover as much data as you can. Format the disk. Re-install an operating system. Dont fiddle around too much with anything too complicated it would seem you are not to that level of understanding just yet.

"would be glad to learn few new things...gaining knowledge is unlimited" - That is good. Use the various search engines available to you on the internet.

Once you are all set up regularly do data backups with software like **Second Copy** and Disk Imaging with either ***Acronis*** or ***Macrium***

Try to learn to be self sufficient in the ways of computing through the pathways of learning.

Good luck with your computer.

Goodbye.

John.

[Seshomaru Samma]

I admit it was my mistake but I pray a way out to recover my windows partition else only option is to run a tool like GetDataBackNTFS by connecting with another disk (if that tool allows corrupted disk?). Any inputs are highly appreciated and thank you.

In your other thread I explained how you can rescue all your data .

Here

[Akula2]

Information given out on voluntarily run forums are suggestions and opinions and should be treated as such.

Blindly trust nothing in life even if you have paid good money for it. Such self inflicted blindness can only lead to the pathways of repenting so badly.

Try to learn to be self sufficient in the ways of computing through the pathways of learning.

Good luck with your computer.

John.

Thanks for responding. I think am being misunderstood for what I've written about following a suggestion. I never meant in a -ve way. I have to solve this problem myself, can't afford to format and re-install (that's a child's play). Anyway, I shall post once I solve this problem.

Dr. Sunil Naidu

[MANEMAN]

Information given out on voluntarily run forums are suggestions and opinions and should be treated as such.

Blindly trust nothing in life even if you have paid good money for it. Such self inflicted blindness can only lead to the pathways of repenting so badly.

Try to learn to be self sufficient in the ways of computing through the pathways of learning.

Good luck with your computer.

John.

Thanks for responding. I think am being misunderstood for what I've written about following a suggestion. I never meant in a -ve way. I have to solve this problem myself, can't afford to format and re-install (that's a child's play). Anyway, I shall post once I solve this problem.

Dr. Sunil Naidu

can't afford to format and re-install

You can format and re-install without incurring any additional cost Dr.Sunil.

(that's a child's play)

"Never approach a computer with the words "I'll just do this quickly..." (Author Unknown)

I shall post once I solve this problem.

We will then look forward to that point in time and wish you success Doctor.

[Akula2]

We will then look forward to that point in time and wish you success Doctor.

Thank you.

GOOD NEWS: Data is intact. Results:

1) PCLinuxOS 2009.1 (May Mag. CD).1 Live CD: Shows ALL partitions and data intact. I even mounted and check my data, most of the folders. There is k3b on that live CD too but don't know where it will burn the data?? ( I mean on Live CD programs we open by CD (and loaded in RAM), so never tested if it burns a DVD or not (after removing Live CD from optical disk tray).

I tried to do fdisk -l but it says Unable to seek /dev/sda. So Partition table corrupt?

2) KDE4.3 Live CD - openSUSE11.1 base (Sep Mag. CD): Shows ALL partitions exactly the same way in PCLinuxOS way but I can't mount them (with a click) and I don't have its root password (not given anywhere or don't remember). But it's a positive result, am sure not we could mount NTFS from this CD too if we know root password - fdisk -l also ruled out.

3) ubuntu Karmic 9.10 (Dec Mag. CD: Once again I booted this Live CD, Palimpsest Disk utility shows the partitions clearly even with corresponding Windows Labels (WinXP_SP2 for C: drive etc).

IMPORTANT: It is clearly showing H: drive as Unallocated space and / of FC12 as Uallocated space. All other partitions are intact. GOOD NEWS: open all partitions from the File browser since sudo support is there by default). I am very happy (relieved).

I tried to do sudo fdisk -l (root access enabled by default) but it says Unable to seek /dev/sda. Same like PCQLinuxOS. This confirm partition table corrupt?

But, by which OS (culprit)? Who must be the culprit? Let's discuss on this detail. Hope more Gurus join in this discuss, don't know why such a thin participation!

I know the incredimail path. It would be in the All Users

It's in Documents and Settings>sunil>Local Settings>Application Data>IM folder.

I right clicked from ubuntu on IM folder: Clearly shows the volume name (WinXP_SP2) with size is 660.9MB and 2,479 items

Lastly, now point is, how to pull that data I need to explore

So, NO more UBCD testing etc things or need to remove the hard drive. These confirmations with my Eyes is more than enough.

[MANEMAN]

Congratulations Dr Sunil !!

No sooner had I signed out from the forum, and you had fixed the problem.

The point of time came well before expectations.

Salutations to you. John.

[Akula2]

Congratulations Dr Sunil !!

No sooner had I signed out from the forum, and you had fixed the problem.

The point of time came well before expectations.

Salutations to you. John.

Thank you so much John.

Last night I booted with Parted Magic and mounted the USB flash drive and copied my Windows account Desktop and My Documents data successfully:

mount /dev/sda /mnt/usb/

root@PartedMagic:~# df

Filesystem 1K-blocks Used Available Use% Mounted on

tmpfs 253904 108428 145476 43% /

/dev/loop0 53248 53248 0 100% /lib/unionfs/usr

unionfs 253904 108428 145476 43% /usr

/dev/loop1 6144 6144 0 100% /lib/unionfs/firmware

unionfs 253904 108428 145476 43% /lib/firmware

/dev/loop2 8192 8192 0 100% /lib/unionfs/modules

unionfs 253904 108428 145476 43% /lib/modules

/dev/sda 508796 137920 370876 27% /mnt/usb

/dev/hda5 16779860 6784980 9994880 40% /media/Data <== XP data folders on

/dev/hda1 15727600 14716136 1011464 94% /media/WinXP_SP2 <== XP data folders

Did anyone tried Simple Burn program in the Parted Magic?

Here is the most important catch lol. Here is the boot.ini copied from my C: drive. I opened with Leafpad editor on the Parted Magic:

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Looks like a problem in this boot.ini. isn't it?

[Seshomaru Samma]

your boot.ini looks fine

you said :

"Windows Boot screen appears...keeps on scrolling and on and on...then reboot and shows the boot options:"

what do you mean by "windows boot screen"

since you mentioned ubuntu - best burn data with ubuntu , much easier than partedmagic

instructions here

[Akula2]

your boot.ini looks fine

you said :

"Windows Boot screen appears...keeps on scrolling and on and on...then reboot and shows the boot options:"

what do you mean by "windows boot screen"

It was the Windows Boot theme, black image with Windows logo and scroll bar running...

That happened only *after* I changed the default boot flat to Windows, i.e., C; drive. Earlier I booted couple of times (didn't tamper the disk by DEL etc) into the affected drive with the help Hiren Boot CD.

since you mentioned ubuntu - best burn data with ubuntu , much easier than partedmagic

instructions here

Yes, Karmic made my confidence grow stronger by giving a positive partition output by Palimpsest disk utility. I have been encouraged to correct the boot partition (to recover the entire windows, to pull up and running again!) area using TestDisk on the Parted Magic. Now I've taken almost 8GB of back up, nothing else left to do (worry) with that PC. Data is safely taken by using 4GB Kingston Pen drive (avoided using Simple Burn program to burn DVDs on Parted Magic itself because I faced READ-ONLY problem):

mount /dev/sda1 /mnt/usb/

TestDisk Analysis update:

Disk /dev/hda - 80 GB / 74 GiB - CHS 9730 255 63

Partition Start End Size in sectors

* HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]

P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [software]

L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]

L Linux Swap 5352 1 1 5416 254 63 1044162

L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]

D HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]

D HPFS - NTFS 6200 1 1 8549 254 63 37752687 [Pharma]

D Linux 7506 1 1 8549 254 63 16771797

P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos]

It is very evident from the above that strange things have happened *without* any deliberate mistake from my end. What might have done such a bad thing? :(

Now, what would be your suggestion to do next with TestDisk?

Should I post any other detail from TestDisk please let me know. Awaiting for a response...thank you.

[MANEMAN]

Now, what would be your suggestion to do next with TestDisk?

I could answer that. :) :) .....................

................. But I will let Seshomaru Samma carry on as he has started you off again, and has such a pleasant disposition. B)

John.

[Akula2]

I could answer that. :) :) .....................

John.

Most welcome, please go ahead :)

Thank you.

[Akula2]

I could answer that. :) :) .....................

John.

Most welcome, please go ahead :)

Thank you.

One last thorough examination I've done. Tomorrow is the self-set D-Day to recover the partitions so that the PC could be up and running as usual...

***When I ran Analyse***

Disk /dev/hda - 80 GB / 74 GiB - CHS 9729 255 63

Current partition structure:

Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]

2 P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [software]

3 E extended LBA 3263 0 1 8549 254 63 84935655

5 L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]

X extended 5352 0 1 5416 254 63 1044225

6 L Linux Swap 5352 1 1 5416 254 63 1044162

X extended 5417 0 1 6199 254 63 12578895

7 L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]

X extended 6200 0 1 7505 254 63 20980890

8 L HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]

X extended 31653 238 32 57542 205 56 415904731

Must be in extended partition

3 E extended LBA 3263 0 1 8549 254 63 84935655

X extended 31653 238 32 57542 205 56 415904731

NOTE: Does NOT show deleted Linux / partition! (FC12 / was in extended, that's why extended LBA mismatch ???)

***When I ran Quick search***

Disk /dev/hda - 80 GB / 74 GiB - CHS 9729 255 63

Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]

2 P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [software]

3 E extended LBA 3263 0 1 8549 254 63 84935655

4 P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos]

5 L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]

6 L Linux Swap 5352 1 1 5416 254 63 1044162

7 L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research]

8 L HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma]

NOTE: Again, doesn't show FC12 / partition.

**When I ran Deep search***

Disk /dev/hda - 80 GB / 74 GiB - CHS 9730 255 63

Partition Start End Size in sectors

* HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2] OK - 16 GB

P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [software] OK - 10 GB

L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data] OK - 17 GB

L Linux Swap 5352 1 1 5416 254 63 1044162 OK

L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [Research] OK - 6+ GB

D HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Pharma] NOTOK - 10 GB - When 'P - shows correct data.

D HPFS - NTFS 6200 1 1 8549 254 63 37752687 [Pharma] NOTOK - 19 GB - NTFS found using backup sector! When 'P' - Can't open filesystem. Filesystem seems damaged.

D Linux 7506 1 1 8549 254 63 16771797 <= FC12 / - 8+ GB - NOTOK- EXT4 Large file Sparse superblock Backup superblock. When 'P' - No file found, filesystem seems damaged.

P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos] OK - 9+ GB

NOTE: Here, it shows FC12 / partition...at last :) Please note the duplicated 'D' NTFS partitions and observations.

Please post your analysis and suggestions on how to tackle this complex situation.

PS: What is the meaning of L : load backup?

Thank you very much for your efforts, hope tomorrow I could put an end to this vexing problem :(

[Akula2]

Thank you very much for your efforts, hope tomorrow I could put an end to this vexing problem :(

UPDATE:

Wrote the TestDisk Quick search result to the disk, it said to be to Reboot. I did that and I got the same:

I get the windows crashed options:

Safe Mode

Safe Mode with Networking

......

......

......

Start Windows Manually.

*****TestDisk Quick Search file system result*****

Disk /dev/hda - 80 GB / 74 GiB - CHS 9729 255 63

Partition Start End Size in sectors

1 * HPFS - NTFS 0 1 1 1957 254 63 31455207 [WinXP_SP2]

2 P HPFS - NTFS 1958 0 1 3262 254 63 20964825 [senna] Software

3 E extended LBA 3263 0 1 8549 254 63 84935655

4 P HPFS - NTFS 8550 0 1 9728 254 63 18940635 [Videos]

5 L HPFS - NTFS 3263 1 1 5351 254 63 33559722 [Data]

6 L Linux Swap 5352 1 1 5416 254 63 1044162

7 L HPFS - NTFS 5417 1 1 6199 254 63 12578832 [study] Research

8 L HPFS - NTFS 6200 1 1 7505 254 63 20980827 [Fedora] Pharma

NOTE: Again, doesn't show FC12 / parition.

Now I rebooted with Windows XP SP2 CD.....

First SUCCESS sign - CD is booting now :) (it refused to boot after I changed the default boot flag to Windows, remember?):

Now I pressed 'R' and I got a very positive dialogue - Recovery console asking me:

1: C:\Windows

Which Windows installation would you like to log onto

(To Cancel, press ENTER)? 1 <=== I remember I have give the input here as 1

Now, Type the Adminstrator's Passord: I DID THAT

Now, recovery console jumped to

C:\Windows (never happened till this step to me earlier).

Now I did type FIXMBR, I got this **CAUTION**

This computer appears to have a non-standard or invalid master boot record.

FIXMBR may damage your partition tables if you proceed.

This could cause all the partitions on the current hard disk to become inaccessible

If you are not having problems accessing your drive, do not continue (BUT AM HAVING THE PROBLEM, ISN'T IT?)

Are you sure you want to write a new MBR?

NOTE: I didn't get NTFS Boot sector recovery screen after Quick Search write with Parted Magic

I clicked 'Y'. It said....

Writing new MBR on physical drive \Device\Harddisk0\Partition0

The new MBR has been succesfully written....and am back to:

C:\WINDOWS

I got the windows crashed options, again:

Safe Mode

Safe Mode with Networking

......

......

......

Start Windows Manually

I clicked on the Start Windows Manually..........

Yep! Yep!!!

Windows BOOTED, and am into Admin account :):)

Once I booted into the Admin account, Windows quickly detected VOLUME changes and updates it. Then for the safety sake I Started the Logical Disk Manager Administrative Service in AUTO mode (Logical Disk Manager I keep always AUTO) and I rebooted again.

No problem...lol in fact machine seems to got little more faster in restart/reboot :D

Next, I opened Event log, NO ERROR MESSAGES or anything warning.

Next, opened important thing Disk Management...........

I can see ALL WINDOWS and Linux /swap as healthy....ONLY Linux / is showing as FREE space...very funny....I DEL the H drive it's INTACT....instead Linux / has gone :(:(

I suspect that because I opened Explorer window and click the mouse on the H drive and forgot?

Updated KIS 2010 and logged into my account to check the mails...tons of mails lol.

Rebooted..

Logged into Admin account....and opened Event log...wow not a single error or warning :)

I am so happy it ended in a good way....now it's almost all over. Yes, I can re-install the FC 12 and hand that PC back to my Mom.

But, I feel bad for Linux / partition :(:(

SOLVED THE PROBLEM