Running system restore off second hard drive

[the K]

My primary hard drive has been corrupted so I can't boot my computer. I have
a second drive I can boot from. When I boot from this hard drive, I can view
the system files on the corrupted drive. If I run the system restore
executable, rstrui.exe, stored on the corrupted hard drive,will it attempt
the restore the corrupted hard drive, or the one I'm booting from?

 

[John John - MVP]

My primary hard drive has been corrupted so I can't boot my computer. I have
a second drive I can boot from. When I boot from this hard drive, I can view
the system files on the corrupted drive. If I run the system restore
executable, rstrui.exe, stored on the corrupted hard drive,will it attempt
the restore the corrupted hard drive, or the one I'm booting from?

It will try to restore the up and running installation (the one you
booted from).

John

 

[Jose]

My primary hard drive has been corrupted so I can't boot my computer. I have
a second drive I can boot from. When I boot from this hard drive, I can view
the system files on the corrupted drive. If I run the system restore
executable, rstrui.exe, stored on the corrupted hard drive,will it attempt
the restore the corrupted hard drive, or the one I'm booting from?

If your first drive is corrupted and does not boot and you boot on
your second drive and then run rstrui.exe (however you do it), it will
run the executable from the drive you booted on - it will not run from
the afflicted drive and even if you navigate to rstrui on the
afflicted drive and run it from there, all the information about what
to restore, all the registry entries pointing to where the system
restore information is will be taken from the drive you boot from -
not from the afflicted drive.

If you run rstrui.exe and somehow think you would like to use all of
the the SR information from your afflicted drive to fix your corrupted
drive, that expectation may exceed reality.

It may make more sense to figure out why your hard drive will not boot
(what does corrupted mean?) and fix it. It may not be fixable, but if
you tell us what you see when you try to boot from it, maybe we can
help.

When XP has even simple, easily fixable problems, it seems to have a
penchant for displaying misleading messages about missing or corrupt
files when the reality is that the files are not missing or corrupt at
all.

 

[Twayne]

In

If your first drive is corrupted and does not boot and you
boot on your second drive and then run rstrui.exe (however
you do it), it will run the executable from the drive you
booted on - it will not run from the afflicted drive and
even if you navigate to rstrui on the afflicted drive and
run it from there, all the information about what to
restore, all the registry entries pointing to where the
system restore information is will be taken from the drive
you boot from - not from the afflicted drive.

If you run rstrui.exe and somehow think you would like to
use all of the the SR information from your afflicted drive
to fix your corrupted drive, that expectation may exceed
reality.

It may make more sense to figure out why your hard drive
will not boot (what does corrupted mean?) and fix it. It
may not be fixable, but if you tell us what you see when
you try to boot from it, maybe we can help.

When XP has even simple, easily fixable problems, it seems
to have a penchant for displaying misleading messages about
missing or corrupt files when the reality is that the files
are not missing or corrupt at all.

Amen to that! The same is true of bluescreens that indicate
hardware failure. In every instance I've come across, the
hardware failed due to corrupted "software". Fixed the SW, all
was fine.

HTH,

Twayne`

 

[the K]

When I attempt to boot from the drive that isn't booting I see a message
stating the

Windows\system32\config\system file is corrupt. I also hear a clicking noise.

 

[the K]

I think I may have to perform a a repair install. Is it possible for that to
wipe out the settings that would be re-applied by performing a system restore?

 

[John John - MVP]

You can copy the system hive from one of your restore points over to the
\WINDOWS\system32\config folder. Rename the existing SYSTEM hive to
SYSTEM.old and then copy the hive from a recent Restore Point over to
the config folder. That is explained here in Part two, copy one of the
REGISTRY_MACHINE_SYSTEM files over to the \Windows\System32\Config
folder and rename it SYSTEM.

http://support.microsoft.com/kb/307545

This should allow you to boot the machine and you should then be able to
perform a System Restore.

You said in another post that the drive is making clicking noises, that
is not a good sign, the drive might be failing. If you have important
files on the drive back them up before you do anything else. You can
then run a Chkdsk on the drive and see if the file system is healthy.
You should also get a disk diagnostic utility from the drive
manufacturer's web site and run it to see if the drive itself is healthy.

John

 

[Jose]

When I attempt to boot from the drive that isn't booting I see a message
stating the

Windows\system32\config\system file is corrupt.  I also hear a clickingnoise.

Unless you want a frustrating day, please do NOT start with KB307545
as will may be soonly suggested. It is often not necessary with this
error, but when you see that error you should always start with
chkdsk /r as the first thing. Nothing else makes sense if chkdsk /r
will not complete successfully.

Was the issue preceded by a power interruption, aborted restart, or
improper shutdown?

These can cause corruption in the file system which must be fixed
before you do anything else.

If any of those events have occurred, you should boot into the Windows
Recovery Console using a bootable XP installation CD, or create on a
bootable XP Recovery Console CD. This is not the same as any recovery
disks that might have come a store bought system.

For each of your hard disks, you should then run:

chkdsk /r

For example, from the Recovery Console prompt, enter:

chkdsk c: /r

You can create a bootable XP Recovery Console CD when no XP media is
available:

http://www.bleepingcomputer.com/forums/topic276527.html

For each of your hard disks, you should then run:

chkdsk /r

For example, from the Recovery Console prompt, enter:

chkdsk c: /r

 

[Jose]

InJose <[email protected]> typed:










Amen to that! The same is true of bluescreens that indicate
hardware failure. In every instance I've come across, the
hardware failed due to corrupted "software". Fixed the SW, all
was fine.

HTH,

Twayne`

The Windows updates broke my system!

 

[the K]

Jose,

First of all, thanks for your help. Chkdsk must have run automatically since
the following log was found in the event viewer of the drive that boots up:

Checking file system on D:
The type of the file system is NTFS.
Volume label is Seagate.

One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.
Read failure with status 0xc0000185 at offset 0xc3b40000 for 0x10000 bytes.
The file reference 0x61000000002824 of index entry coFFPlgn of index $I30
with parent 0xabfd is not the same as 0x62000000002824.
Deleting index entry coFFPlgn in index $I30 of file 44029.
The file reference 0x440000000026df of index entry SETTIN~2.BAK of index $I30
with parent 0xad99 is not the same as 0x4a0000000026df.
Deleting index entry SETTIN~2.BAK in index $I30 of file 44441.
Index entry SYMEFA.DB-journal of index $I30 in file 0x10943 points to unused
file 0x31cb.
Deleting index entry SYMEFA.DB-journal in index $I30 of file 67907.
Index entry SYMEFA~1.DB- of index $I30 in file 0x10943 points to unused file
0x31cb.
Deleting index entry SYMEFA~1.DB- in index $I30 of file 67907.
Cleaning up minor inconsistencies on the drive.
Deleting an index entry with Id 973 from index $SDH of file 9.
Deleting an index entry with Id 1513 from index $SDH of file 9.
Deleting an index entry with Id 989 from index $SDH of file 9.
Deleting an index entry with Id 984 from index $SDH of file 9.
Deleting an index entry with Id 1063 from index $SDH of file 9.
Deleting an index entry with Id 1042 from index $SDH of file 9.
Deleting an index entry with Id 999 from index $SDH of file 9.
Mirror security descriptor block different from that of
master security descriptor at offset 0x80000.
Fixing mirror copy of the security descriptors data stream.
CHKDSK is verifying Usn Journal...
The remaining of an USN page at offset 0x44df718 in file 0x10942
should be filled with zeros.
Repairing Usn Journal file record segment.
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

78148160 KB total disk space.
32487688 KB in 43119 files.
16240 KB in 6426 indexes.
0 KB in bad sectors.
138884 KB in use by the system.
65536 KB occupied by the log file.
45505348 KB available on disk.

Looks like some aspects of the drive were fixed. However, this drive still
does not boot. Is it worth following the steps in KB307545 or should I just
perform a system repair which doesn't require as much effort?

 

[Jose]

Jose,

First of all, thanks for your help. Chkdsk must have run automatically since
the following log was found in the event viewer of the drive that boots up:

Checking file system on D:
The type of the file system is NTFS.
Volume label is Seagate.

One of your disks needs to be checked for consistency. You
may cancel the disk check, but it is strongly recommended
that you continue.
Windows will now check the disk.                        
Read failure with status 0xc0000185 at offset 0xc3b40000 for 0x10000 bytes.
The file reference 0x61000000002824 of index entry coFFPlgn of index $I30
with parent 0xabfd is not the same as 0x62000000002824.
Deleting index entry coFFPlgn in index $I30 of file 44029.
The file reference 0x440000000026df of index entry SETTIN~2.BAK of index $I30
with parent 0xad99 is not the same as 0x4a0000000026df.
Deleting index entry SETTIN~2.BAK in index $I30 of file 44441.
Index entry SYMEFA.DB-journal of index $I30 in file 0x10943 points to unused
file 0x31cb.
Deleting index entry SYMEFA.DB-journal in index $I30 of file 67907.
Index entry SYMEFA~1.DB- of index $I30 in file 0x10943 points to unused file
0x31cb.
Deleting index entry SYMEFA~1.DB- in index $I30 of file 67907.
Cleaning up minor inconsistencies on the drive.
Deleting an index entry with Id 973 from index $SDH of file 9.
Deleting an index entry with Id 1513 from index $SDH of file 9.
Deleting an index entry with Id 989 from index $SDH of file 9.
Deleting an index entry with Id 984 from index $SDH of file 9.
Deleting an index entry with Id 1063 from index $SDH of file 9.
Deleting an index entry with Id 1042 from index $SDH of file 9.
Deleting an index entry with Id 999 from index $SDH of file 9.
Mirror security descriptor block different from that of
master security descriptor at offset 0x80000.
Fixing mirror copy of the security descriptors data stream.
CHKDSK is verifying Usn Journal...
The remaining of an USN page at offset 0x44df718 in file 0x10942
should be filled with zeros.
Repairing Usn Journal file record segment.
Usn Journal verification completed.
Correcting errors in the master file table's (MFT) BITMAP attribute.
Correcting errors in the Volume Bitmap.
Windows has made corrections to the file system.

78148160 KB total disk space.
  32487688 KB in 43119 files.
     16240 KB in 6426 indexes.
         0 KB in bad sectors.
    138884 KB in use by the system.
     65536 KB occupied by the log file.
  45505348 KB available on disk.

Looks like some aspects of the drive were fixed. However, this drive still
does not boot. Is it worth following the steps in KB307545 or should I just
perform a system repair which doesn't require as much effort?

Can you tell us how you think this situation came about? Power
interruption, aborted startup, ungraceful shutdown, power button, etc.

Is your primary drive your C drive and if so, how are you booting on
this second drive and is the second drive D? Did you change the BIOS
or something when C quit working and tell it to use D as the primary
boot device? I am jut trying to understand your C nad D
configuration.

If I was working on your system I would use my own bootable Recovery
Console CD that I know works because I made it myself using that link
I posted before.

I would boot on that CD and run chkdsk /r on all your HDDs and make
sure it is not complaining about anything. No errors, no clicking,
etc.

You have to make sure of that part first and you need to do it
manually so there is no question about what might have happened
earlier.

You need to first be sure that chkdsk /r runs OK on your afflicted
drive, and it may not if it is physically broken and clicking.

Then I would change things back to try to boot on the afflicted drive
and see what happens next.

The thing about the error message is, I personally do not believe what
it says - ever (and I can read), there is always a power something or
another that precedes the message, folks immediately are advised or
want to implement KB307545 because that is what a Google search and MS
tells them to do, but having fixed this many, many times, I find that
KB307545 it is often not necessary. A chkdsk /r will sometimes fix
you right up if the problem was preceded by any of the conditions I
listed.

When chkdsk /r runs clean on what you want to be your boot drive, if
you still have the same error message, sure - you can implement
KB307545. It is just copying some files around, but that is risky if
the integrity of your file system is suspicious, so always run chkdsk /
r first. If it fails, you have some other problem and copying files
around might work and it might not work.

The directions work perfectly if you follow them exactly and it is
easy if you are the Recovery Console (they look intimidating but just
read it all the way through first and it makes sense). It just
renames 5 suspicious XP system files, copies in 5 really old XP system
files - just long enough so XP will boot, and the last step after XP
boots using the really old system files is to use System Restore to
the last last RP created when XP was working to restore your good
system files. Sounds very easy - and it works. I have practiced it
many times.

If you boot RC and chkdsk /r runs clean and you are really sure of
that let us know if you are still getting the same error message.

 

[the K]

This is what happened immediate below I couldn't boot the drive:

I was running a Norton virus scan when the computer froze and I heard a
clicking noise. I then held the power button to turn the computer off. The
next day, I couldn't boot to my newer drive, so I changed the BIOS to boot
from my older hard drive. I'll follow your suggestions and see what happends.
The weird thing is yesterday I wasn't able to boot to my old hard drive,
which is the good one. I changed the BIOS to boot from the newer drive with
the corrupted system file out of panic, and it booted to the ...GOOD drive.
Very odd.

 

[Jose]

This is what happened immediate below I couldn't boot the drive:

I was running a Norton virus scan when the computer froze and I heard a
clicking noise. I then held the power button to turn the computer off. The
next day, I couldn't boot to my newer drive, so I changed the BIOS to boot
from my older hard drive. I'll follow your suggestions and see what happends.
The weird thing is yesterday I wasn't able to boot to my old hard drive,
which is the good one. I changed the BIOS to boot from the newer drive with
the corrupted system file out of panic, and it booted to the ...GOOD drive.
Very odd.

If you have clicking, you have a drive hardware failure - like perhaps
a bad spot on a platter. The clicking is repeated attempts to try to
read the area until whatever is trying to do whatever it is trying to
do finally gives up and crashes,. reports it, skips it or moves on.
You will probably never "fix" it if it is a media (platter) or
mechanical issue. Clicking is usually going to be a physical problem
- not a software or XP problem.

You may be able to get a program from your HDD manufacturer that can
diagnose the entire drive, mark the bad area as totally unusable and
it will never be looked at again by any program. Maybe. The down
side is such diagnostics sometimes need to wipe out all the data on
the drive to do the test and a thorough test will take a long time.
Even if the test finds something and implements some fix, I would
consider the drive suspicious forever. The test may just say the
drive cannot be fixed and you have still lost all your data. It may
not find anything and you still lost your data, but clicking is not
good. So, check with the HDD manufacturer (they may have a forum for
support) and see what they say. XP is not causing your clicking.

Sometimes you can try some tools from the HDD manufacturer WWW site.
You may have to just cut your loses and make the drive some kind of
non critical secondary. It might last a long time in that capacity,
but it is not something you would want to depend on. Someday it will
not work at all. You need it to be used in some capacity that if it
totally fails some day, it is just an annoyance and not a catastrophe.

I have a clicker too, but if it poops out on me one day, I really
don't care since I don't use it for anything except quick access to a
bunch of PDFs I have stored on some other permanent media. It keeps
me from using FTP all the time for file transfers. If it becomes
totally unaccessible (and I expect it will someday), I would most
certainly curse it and then maybe replace it, but I don't have to have
it.

Anytime you use the power button, if something goes haywire, chkdsk /r
can sometimes fix it because the problem is not a physical defect, it
is a file allocation table or a journal problem and that something
chkdsk can sometimes fix.

If there is a power button in the past history on some afflicted
system that I see, I am not going to do anything until I run chkdsk /r
from Recovery Console on it first.

You still have not said if you have booted RC and run chkdsk /r on
your HDDs. Are you not doing that on purpose, you did it and things
are fine now, you did it, it all looks good and you still can't boot
or what...

 

[the K]

Yeah. I ran chkdsk and everything was fine. No clicking and I was able to
boot up and go on the online with the formerly corrupted drive. However, I
unfortunately got the great idea to to install Norton Ghost to back the drive
up. During the backup process, the message:

"An unhandled exception occured in explorer.exe. Just in time debugging
failed. No just in time debugging enabled."

I didn't think anything of it until since I wasn't running Visual C# express
until I rebooted the drive... and ended up in the SAME scenario as before
where I couldn't boot the OS on the drive. Before the logon page would
display, the computer would restart. I ran chkdsk, disabled everything I
could with MSConfig, and did part one of KB807545. Afterewards, when I
disabled auto restart for errors, I saw the following message:

"Stop c000021a {Fatal system error} Windows Logon process terminated
0xc0000005."

I've researched this error message and haven't noticed any reliable
solutions other than running a repair install. Is there another way to
resolve this? Thanks again.