WinXP Corrupt (this is news?) ...Desktop Disaster in Process

August 24, 2009 6:42 AM

Win XP corrupted system and SAM files... disaster in process, need expert input and recommendation for a data recovery service I can trust.

My backup strategy is to clone my hard drive periodically. Last time I did it in April, Windows told me I had changed hardware configurations too often and made me 'reauthorize' my installation, which I did, but with some trepidation.

This month, prior to installing some new development software, I went to do my normal tricks and while I am not sure what happened, after Windows asked me to reauthorize, apparently the operation did not complete.

Now, my backup is a broken and faithful version of my hard drive, and neither boot. Windows reports that the file \windows\system32\config\system is corrupt.

If I replace the system and SAM files with the last version I had, I have a computer that is a snapshot of my 4/2009 computer, with all the recent info that I stored on the desktop gone. If I were not in a quite literal frenzy of activity, I would simply tolerate this and go on, but the last four months have been a blizzard of work, and I am thinking that my only hope of recovering a lot of creative work is to send the drive out to a data recovery service.

I've only been experimenting with one of the two drives, so I do have one that has not been tampered with. I don't use restore points, and usually do this backup thing monthly, as it requires disassembly of my desktop machine, and I know I've been living on borrowed time, but that's life. The issue for today is recovery; punishment will come later!

The questions are:

Has anyone else here ever done this and how did you recover?

Who has the best (not cheapest, BEST) recovery service (with bonus points for Boston or NYC),


Secondary question:

In WinXP, where does the 'desktop' live... in the system file or SAM file? (It is there where a bunch of my most valuable files live.) XP needs both the SAM and system files to boot. Any way to extract its content if the OS won't boot?

Thanks in advance for uber tech advice....

posted by FauxScot to computers & internet (10 comments total)

I doesn't sound as if you lost a hard drive, so check "C:\Documents and Settings". This is where XP stores desktop files. XP might not be able to match your user login name with a profile, so you are being presented a default profile.
posted by Climber at 6:45 AM on August 24

You don't need a recovery service because your system files are corrupted. You only need such a service if the actual disk is damaged or if the files were deleted. You just need to find the files you're missing. You could do searches for them. Your desktop is in

C:\Documents and Settings\[your login name]\Desktop
posted by Obscure Reference at 6:51 AM on August 24

Oh yeah... this is getting even better by the microsecond...

I am getting the distinct feeling that the backup proceeded backwards. I meant to ForeUp! Damn.

None of my recent stuff is in the documents and settings folder... everything is otherwise fine. Searching all users, including files that I know I have recently changed... all back to April. Analyzed like this, it makes perfect sense, but wow.. it's not like this is the first time I did this!

Where can I claim my reward as owner of the most stupendous screwup of 2009? Jeez.

(Poof. In a flash.... 4 months gone. Ouch.)
posted by FauxScot at 7:19 AM on August 24

I'd yank the drive and plug it into a working system, browse the directory structure and grab the entire c:/documents and settings directory.

That'll give you favorites, your desktop, your my docs, pics, etc.

After you back it up, I'd pop in the WinXP disc and see if you can do a non-destructive repair, which I think would probably work in this case. Don't do this until AFTER you get your files, though.
posted by TomMelee at 7:20 AM on August 24

On the drive that had the data, can you try an application like undelete? I have had success with this before, but they were just deleted files. If you haven't done much with the disk, it is possible that the documents are still there, waiting to be overwritten. If they are that important, this might be worth a shot.
posted by Climber at 7:32 AM on August 24

Wait, I'm lost.

You haven't altered the disk you WERE using, you just corrupted it, right? You didn't attempt to restore an image on it, right?

You've just got a busted boot and all your files are on the disk, right?

If I'm reading that right, do what I said. If you can't do it yourself, I believe Staples/OfficeDepot charges ~$100 for this service. (I charge $40.)
posted by TomMelee at 7:40 AM on August 24

Thanks TomMelee.

My backup process clones the drive, and the drives I use are identical. That means the partition sizes are identical and there's no way to make sure disk 1 is the newer one or if disk 2 is the newer one. I must have just accidentally pointed the cloning operation in the wrong direction. That means that its a byte-for-byte overwrite, so I'm not sure an undelete would help much.

I've been tinkering with the backup drive to get it working again, and while there was some sort of corruption that happened as a result of my cloning software and/or the Windows reauthorizing process that Microsoft demanded just before I commenced the cloning process, the data files are all perfectly intact and sadly missing my recent work. I've looked at all the user accounts and there is nothing there beyond April. The system boots and works, but it's like time transport! I'm back in April.

At this point, I am starting to catalog what I know to be missing work and assessing where I may have sent copies of various works.
posted by FauxScot at 8:30 AM on August 24

For anyone who's interested... the original drive that was in the machine and which I was attempting to back up is now reporting that it's horked... unformatted and with but one of four partitions present.

Not sure that it's relevant, but it is an unexpected development. (These two drives are Hitachi Deskstar 750 GB... HDS721075KLA330)

(I have finally decided to move on and recover from what I am sure was my mistake, but was really surprised to discover that the original drive is now a dud.) WTF?!
posted by FauxScot at 11:09 AM on August 24

Sounds like you overwrite your working copy with an old backup. This is why you should maintain regular backups.

Also, that drive has a fairly high rate of failure.
posted by wongcorgi at 1:03 PM on August 24

I would find some way to create a knoppix live cd, boot from that cd (it's a live cd, so you can boot into the knoppix OS without installing anything), and see what files you can see on your hard drive partitions.

Knoppix has worked wonders for me in the past - even on disks that Windows says are borked.

(If you had ever used System Restore, you could use these instructions from Microsoft on how to recover a corrupted registry - it's a cumbersome process but usually works.)
posted by wearyaswater at 1:08 PM on August 24