Windows XP Offline File Restore Nightmare

[brianmcmahon78]

Hi all

They say some things in life are painful but worth it - like childbirth,
learning to swim or supporting Liverpool. Well maybe not the last one.

I would appreciate any guidance or input from anyone who has been
through the hell of restoring offline files in Windows XP.

I've outlined everything I've tried below, and my next stop is lighting
a candle in a Church and saying a Novena to St. Jude.

Offline files - "more complex than the offside rule."
I have the lfiles from a laptop of a friend who has a load of files archived
as "offline files" in Windows XP and needs to recover them.

For several weeks, the laptop was storing any files they
saved as "offline". Anyway, they have stopped this and
the laptop is now saving the the network folders again.

However, there are loads of files saved as offline files
that they cannot access. This is because Windows XP
stores these in a special archive format.

Here is what I've learned, and what I've tried.


1. The CSC folder- "Hidden in plain sight - like a bad fart"
I have done some research and learned that the archived files
are in a hidden Windows folder called CSC.

Here's where it start to get tricky.

You cannot go to C/Windows/CSC - It is a hidden folder.
But not a normal hidden folder.

Normally, to show hidden files and folders, you usually got to:

• Tools Menu on any Window
• Folder Options
• View tab
• Click on "show hidden files and folders"
• Click Apply

I then go in to C/Windows and expect to see CSC - no joy!

From looking around online I found that if you go to:

• Start
• Run
• Type in %SYSTEMROOT%\CSC
• Press enter

Then the mystery CSC folder will appear.

For convenience, I've made a shortcut to this folder:

• Right click on desktop
• Go to New
• Click Shortcut
• insert %SYSTEMROOT%\CSC into the dialog box

a handy shortcut to this mystery folder will appear on the desktop.


In CSC are several folders:

d1
d2
d3
d4
d5
d6
d7
d8

and the files

csc1.tmp
00000001
00000002

The folders d1, d2 etc. contain the archived files in a compressed format.

The blogs and forums I've looked around recommend that you
take the contents of the CSC folder and copy them
to another computer running the same verrsion of Windows,
in this case Windows XP Professional Service Pack 3. I have done this.

Then you need to get a program to rebuild the archived folders into readable files -
it's called CSCCMD, and is rarer than GAA trophies in Louth.


2. CSCCMD Program "is it a version or an aversion?"

To access these files you use a program called csccmd.

There are two versions of this program, 1.0 and 1.1 and the 1.1 version program
of them has the "extract" feature that you need. Here is where I found version
1.1 and a general guide that got me started with trying to solve this problem:

http://www.tubblog.co.uk/blog/2008/08/21/recovering-offline-files-in-windows-xp/



3. Using the CSCCMD Program - "Rubbing my lamp but no Genie pops out"

Here's where it gets me stuck.

Some of the guides say You unzip the to the CSC folder in Windows, some don't -
they just say "Run from the command line"

I've tried both. but not got anywhere. From looking around online, I've found
the below commands and followed them to the letter, but no joy. Here is an
extract of what I tried today

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\user>cd\

C:\>cd\windows

C:\WINDOWS>cd\windows\csc

C:\WINDOWS\CSC> csccmd/enable
The command completed successfully.

C:\WINDOWS\CSC>csccmd /extract


C:\WINDOWS\CSC>csccmd /extract /target:c:\temp /recurse
The command completed successfully.

The files are supposed to magically start appearing in the folder C:\temp but
nothing happens. It's a bit like watching Ireland play football - a lot of fancy
fiddling with the promise of treasure, but you never get anywhere.

Any ideas?

 

[Paul]

Hi all

They say some things in life are painful but worth it - like childbirth,
learning to swim or supporting Liverpool. Well maybe not the last one.

I would appreciate any guidance or input from anyone who has been
through the hell of restoring offline files in Windows XP.

I've outlined everything I've tried below, and my next stop is lighting
a candle in a Church and saying a Novena to St. Jude.

Offline files - "more complex than the offside rule."
I have the lfiles from a laptop of a friend who has a load of files archived
as "offline files" in Windows XP and needs to recover them.

For several weeks, the laptop was storing any files they
saved as "offline". Anyway, they have stopped this and
the laptop is now saving the the network folders again.

However, there are loads of files saved as offline files
that they cannot access. This is because Windows XP
stores these in a special archive format.

Here is what I've learned, and what I've tried.


1. The CSC folder- "Hidden in plain sight - like a bad fart"
I have done some research and learned that the archived files
are in a hidden Windows folder called CSC.

Here's where it start to get tricky.

You cannot go to C/Windows/CSC - It is a hidden folder.
But not a normal hidden folder.

Normally, to show hidden files and folders, you usually got to:

• Tools Menu on any Window
• Folder Options
• View tab
• Click on "show hidden files and folders"
• Click Apply

I then go in to C/Windows and expect to see CSC - no joy!

From looking around online I found that if you go to:

• Start
• Run
• Type in %SYSTEMROOT%\CSC
• Press enter

Then the mystery CSC folder will appear.

For convenience, I've made a shortcut to this folder:

• Right click on desktop
• Go to New
• Click Shortcut
• insert %SYSTEMROOT%\CSC into the dialog box

a handy shortcut to this mystery folder will appear on the desktop.


In CSC are several folders:

d1
d2
d3
d4
d5
d6
d7
d8

and the files

csc1.tmp
00000001
00000002

The folders d1, d2 etc. contain the archived files in a compressed format.

The blogs and forums I've looked around recommend that you
take the contents of the CSC folder and copy them
to another computer running the same verrsion of Windows,
in this case Windows XP Professional Service Pack 3. I have done this.

Then you need to get a program to rebuild the archived folders into readable files -
it's called CSCCMD, and is rarer than GAA trophies in Louth.


2. CSCCMD Program "is it a version or an aversion?"

To access these files you use a program called csccmd.

There are two versions of this program, 1.0 and 1.1 and the 1.1 version program
of them has the "extract" feature that you need. Here is where I found version
1.1 and a general guide that got me started with trying to solve this problem:

http://www.tubblog.co.uk/blog/2008/08/21/recovering-offline-files-in-windows-xp/



3. Using the CSCCMD Program - "Rubbing my lamp but no Genie pops out"

Here's where it gets me stuck.

Some of the guides say You unzip the to the CSC folder in Windows, some don't -
they just say "Run from the command line"

I've tried both. but not got anywhere. From looking around online, I've found
the below commands and followed them to the letter, but no joy. Here is an
extract of what I tried today

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\user>cd\

C:\>cd\windows

C:\WINDOWS>cd\windows\csc

C:\WINDOWS\CSC> csccmd/enable
The command completed successfully.

C:\WINDOWS\CSC>csccmd /extract


C:\WINDOWS\CSC>csccmd /extract /target:c:\temp /recurse
The command completed successfully.

The files are supposed to magically start appearing in the folder C:\temp but
nothing happens. It's a bit like watching Ireland play football - a lot of fancy
fiddling with the promise of treasure, but you never get anywhere.

Any ideas?

OK, I got a copy from a site other than Microsoft, and
here is what I tried (so far). The version I got is 1.1,
with file properties showing "5.2.3790.1269 built by: dnsrv".
File is 65536 bytes. Version 1.1 has the Extract option,
whereas apparently 1.0 did not.

sha1sum csccmd.exe

e52261e328cd2a531703fe5e1510bc602afa90a9 csccmd.exe

You can search on virustotal.com using that checksum value
or upload it to scan it.

If you don't have an sha1sum, you can get one here
(after you scan it of course).

ftp://ftp.gnupg.org/gcrypt/binary/sha1sum.exe

*******

I unpacked mine in C:\Downloads, so the file
location is C:\Downloads\csccmd.exe

Now, open a command prompt window.

C: <--- You would normally be here anyway
cd \ <--- Returns to root of C:
cd downloads <--- Adds path to current directory level
csccmd /? <--- Attempt to execute cmd, and ask for help

And it returns

Microsoft(R) Windows(TM) CSC Utility Version 1.1
Copyright (C) Microsoft Corporation. All rights reserved.

Usage: csccmd [/OPTIONS]

Options:

/ISENABLED or /ISCSCENABLED
/ENABLE
/DISABLE
/RESID
/CHECKDB [/QUICK]

/ENUM[:<\\server\share[\path]>] [/RECURSE]

/PIN2:<\\server\share\path> [/USER] [/SYSTEM] [/USERINHERIT] [/SYSTEMINHERIT]
/PIN2:<filename> /FILELIST [/UNICODE] [/USER] [/SYSTEM] [/USERINHERIT] [/SYSTEMINHERIT]

/UNPIN2:<\\server\share\path> [/USER] [/SYSTEM] [/USERINHERIT] [/SYSTEMINHERIT] [/RECURSE] [/RECURSE2]
/UNPIN2:<filename> /FILELIST [/UNICODE] [/USER] [/SYSTEM] [/USERINHERIT] [/SYSTEMINHERIT]

/FILL:<\\server\share\path>
/FILL:<filename> /FILELIST [/UNICODE]

/DELETE:<\\server\share\path> [/RECURSE] [/RECURSE2]

/ISSERVEROFFLINE:<\\server>
/DISCONNECT:<\\server\share>

/MOVESHARE:<\\server\share> <\\server\share>

/EXTRACT[:<\\server\share[\path]>] /TARGET:<path> [/RECURSE] [/ONLYMODIFIED] [/STOPONERROR]

/SETSPACE:<bytes to set>

For this usage information, use /? or /HELP
For additional options, use /?? or /HELPHELP

The command completed successfully.

That tells me the command executed OK. Windows has a
%path% variable, like other OSes have a $PATH. Windows
happens to search the current working directory. I
stored "csccmd.exe" in C:\Downloads, but I also
worked the "cd" command so that the command prompt
windows is currently also working in C:\Downloads.
Without modifying the %path% environment variable,
the shell in the command prompt window can find the
executable program. Any time you work in a Command
Prompt window, your executable is either in a system
folder (which is already stored in %path%), or you
can use the "cd" dodge to allow execution.

I have no csc contents to test with, but your
full command would undoubtedly do something.

Ref: http://www.jacksontechnical.com/article.htm?id=34

And no, I still can't find any details on file format
in there. Since my csc has nothing of consequence in it,
pointing 7ZIP at it to attempt decompression would not help.
Neither would me running the command to extract the csc,
do anything, as there are no files in it.

csccmd /enable
csccmd /extract /target:C:\Restore /recurse

HTH,
Paul