Weird HDD problem

[Andrew Rossmann]

I have a drive that is causing Windows to reboot during bootup.

It's a 40G Maxtor, formatted 40G NTFS with XP. The person was having
problems for quite awhile. It reached the point when trying to boot up
would stop after loading AMDAGP.SYS (as seen when trying Safe mode),
then reboot. Normal boot, Safe Mode, and Safe Mode Command Prompt all
failed. Trying to use the XP CD and Recovery Console caused a blue
screen the moment it went to look at the drive.

I took the drive out and tried it as slave in another computer with
Win2KSP4. Shortly into booting, it blue-screened out with a Stop
000000E3 error. Some checking shows this is related to the NTFS driver.
The only notes were to use the latest SP, which it's already at. Trying
the XP CD again caused a blue-screen when trying to start up Recovery
Console.

I then tried ANOTHER computer. Same issue.

I then tried Partition Magic 7 (boot floppy version). The only issue
it found was that the partition had not properly dismounted (I assume
that just means it wasn't shut down cleanly??)

I then tried Ghost 2003 (DOS version), and it successfully cloned over
to a spare 20G drive. I tried the 20G drive, and it blue-screened, too!

I then put the 40G back in the original computer, used PM to delete
the partition (the XP setup bombed the moment it tried to look at the
drive with the partition enabled), and succesfully created a new
partition and installed XP. XP was fully updated with SP2 and all
patches.

I then tried hooking up the 20G drive. Blue-screen on boot-up!

Any clues as to what is going on? I'm assuming it's some corruption in
the NTFS information causing NTFS.SYS to barf. Since it does it on
multiple computers and drives, I don't think it's hardware. The only
hardware issue I can think is that the fan for one of the support chips
(it's a 1G AMD CPU) wasn't working. I got it running, but no change,
although it's possible it might have caused corruption in the past.

I'd like to be able to get some files off of it. At the moment, the
only thing I can think of is to possibly Ghost to an image and then use
Ghost to read the image and extract files off of it? (I've never used
Ghost for anything other than cloning before.)

 

[CJT]

I have a drive that is causing Windows to reboot during bootup.

It's a 40G Maxtor, formatted 40G NTFS with XP. The person was having
problems for quite awhile. It reached the point when trying to boot up
would stop after loading AMDAGP.SYS (as seen when trying Safe mode),
then reboot. Normal boot, Safe Mode, and Safe Mode Command Prompt all
failed. Trying to use the XP CD and Recovery Console caused a blue
screen the moment it went to look at the drive.

I took the drive out and tried it as slave in another computer with
Win2KSP4. Shortly into booting, it blue-screened out with a Stop
000000E3 error. Some checking shows this is related to the NTFS driver.
The only notes were to use the latest SP, which it's already at. Trying
the XP CD again caused a blue-screen when trying to start up Recovery
Console.

I then tried ANOTHER computer. Same issue.

I then tried Partition Magic 7 (boot floppy version). The only issue
it found was that the partition had not properly dismounted (I assume
that just means it wasn't shut down cleanly??)

I then tried Ghost 2003 (DOS version), and it successfully cloned over
to a spare 20G drive. I tried the 20G drive, and it blue-screened, too!

I then put the 40G back in the original computer, used PM to delete
the partition (the XP setup bombed the moment it tried to look at the
drive with the partition enabled), and succesfully created a new
partition and installed XP. XP was fully updated with SP2 and all
patches.

I then tried hooking up the 20G drive. Blue-screen on boot-up!

Any clues as to what is going on? I'm assuming it's some corruption in
the NTFS information causing NTFS.SYS to barf. Since it does it on
multiple computers and drives, I don't think it's hardware. The only
hardware issue I can think is that the fan for one of the support chips
(it's a 1G AMD CPU) wasn't working. I got it running, but no change,
although it's possible it might have caused corruption in the past.

I'd like to be able to get some files off of it. At the moment, the
only thing I can think of is to possibly Ghost to an image and then use
Ghost to read the image and extract files off of it? (I've never used
Ghost for anything other than cloning before.)

I vaguely recall reading about a virus with those symptoms.

 

[Eric Gisin]

Ghost copies over a lot of metafiles with minimal change, like the MFT. You do
have NTFS corruption that ntfs.sys barfs on.

You can delete the partition and recover files with findntfs or findpart under
XP. They need the starting CHS (usually 0/1/1).

 

[Andrew Rossmann]

Ghost copies over a lot of metafiles with minimal change, like the MFT. You do
have NTFS corruption that ntfs.sys barfs on.

You can delete the partition and recover files with findntfs or findpart under
XP. They need the starting CHS (usually 0/1/1).

Thank you for the hint. BIG thank you to Svend for creating these
programs.

I put the drive as slave in a dual-boot computer and booted into
Win98. I then used FINDNTFS to copy the entire drive to someplace safe.
I was then able to recover the files I needed.