The blue screen of death is alive and well

October 17, 2006 6:48 AM

Please help me recover my hosed NTFS partition(s).

My ThinkPad G40 running Windows XP Professional SP2 has been blue screening when I try Last Known Good Configuration, Safe Mode, the recovery console from the XP install CD, and even a BartPE CD. I think this is due to data corruption caused by bad RAM (after I took the offending stick out, MemTest86 now reports my RAM is okay). Here is the error:

STOP 0x00000024 (0x001902F8, 0xF7B8E704, 0xF7B8E404, 0xF739C411)

ntfs.sys == address F739C411 base at F732E0006 DateStamp 3b7dc5d0

I can still access the drive using an Ubuntu Linux live CD. I also have an external hard drive that is approximately half the size of the drive, some DVD-Rs, and hopefully I can find a friend with a DVD burner. So first, how can I best backup this data so that it will be accessible from a future Windows XP install.

Secondly, it would be nice after things are backed up, if I could recover the disk without doing another full reinstall. Online searches indicate that I should try to fix the disk with CHKDSK but I can't even load the recovery console or BartPE. A Microsoft support article indicates that in Windows 2000 one could create setup disks that didn't load ntfs.sys and run CHKDSK from there (apparently it has its own code for accessing NTFS partitions). Would this be possible with these Windows XP boot disks?

Also, I do have recent backups of super-important stuff, but would really like to recover changes since then.

Originally on MetaChat, thanks to everybunny there for their suggestions

posted by grouse to computers & internet (12 comments total)

For what it's worth, you can install WinXP overtop of the existing partition without reformatting, but you'll still lose all of your application settings, etc. You'll then have a bunch of not-quite-installed programs and random crufty system files laying around. I'd personally boot into loonix and copy what files I could to the external hard drive and reinstall.

It's a rough situation, to be certain; sorry I couldn't offer more help! Best of luck.
posted by TheNewWazoo at 7:20 AM on October 17, 2006

Even if your XP installation is hosed your actual data is probably fine. But as far as retaining system state, I doubt you will be able to recover Windows XP. I have been in a situation like this before and had spent hours trying to recover my original installation before reinstalling XP clean, reinstalling all my device drivers, and restoring my data. Since this has happened to me more than once, I handle it this way now:

I rebuilt my system installing all device drivers and critical apps then made an image of the installation using acronis true image. I then make frequent backups of my data partitions even though that data resides on mirrored drives. So if (when) my system does tank, I just restore the image, copy my data, and can be up and running within the hour.

I know that this didn't technically answer your question but it has been my experience that errors like this are often fatal. I have tried boot disks, reinstalling XP over top of itsself (ie. not formatting the disks and installing windows into the same folder as the original). I have tried to use the Last Known Good Config or CHKDSK /f and the end result was that my time would have been better spent reinstalling clean.

In regards to your question about the boot disks, if you cannot boot your system on its own and get to the safe mode with command prompt, I would suggest trying them. You can make one in XP which seems easier than making three for win2k. It can get you to a command prompt and give you the opportunity to try CHKDSK. You can get some more info on creating one for XP here: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/win_create_dos_startup_disk.mspx
If you have no access to another XP machine, you can download boot disk images here: http://www.svrops.com/svrops/dwnlddisk.htm

Good luck... and let us know how it goes.

ro50
posted by ro50 at 7:31 AM on October 17, 2006

The main question I had was how to use Linux to put the data in a place that would be accessible via Windows. I guess I could use ext2fsd for that.

you can install WinXP overtop of the existing partition without reformatting

No, I can't. Windows won't even boot if this partition is on the system.
posted by grouse at 7:43 AM on October 17, 2006

You don't need to boot XP to reinstall windows over the top. You put in the installation CD and boot your system from the CD. You run the installation making sure that you do not format drives and that you keep the system root folder in the same place. It works but as thenewWazoo stated, it is sketchy at best once completed.
posted by ro50 at 7:47 AM on October 17, 2006

You put in the installation CD and boot your system from the CD.

As soon as the installation CD software accesses the partition even to use the recovery console, it blue screens. I am skeptical that the very same installation CD has a totally different driver (that does not crash) for accessing the partition to install.
posted by grouse at 8:23 AM on October 17, 2006

Hmm... that is no fun. If windows cannot even access the disk without bluescreening, you probably have a corrupt boot sector. If you try the boot disk scenario, you can type "fixboot" from a command prompt and that is supposed to be able to repair your boot sector. You might be able to run the re-install then if that works. Honestly, the re-install of the OS is not an ideal scenario anyway since you would still have to reinstall all of your apps and you'd have tons of orphaned files floating around.

I think you will have the most success if you go the route of a clean windows XP install. And I would recomend trying to get your files backed up off of that disk by connecting it to another windows machine. Linux can be a little flaky with NTFS though it can read it. If you live near Tampa I can help you out with getting your data backed up. Otherwise, now might be a good time to invest in an external hdd and use that to move the data around until you can get your machine rebuilt.
posted by ro50 at 11:05 AM on October 17, 2006

Back your data up to the external drive- hook that up to a friend's computer and burn it, then rinse and repeat till you get what you need.

If you use knoppix and the drive is FAT 32 you're golden. Knoppix can read NTFS but I think write is a little rough still. You're data will be fine even in ext2 or ext3 but there should be no reason why you disk is formatted like that unless you meant to. Use parted or qtparted if you need the GUI with a live cd of ubuntu or knoppix and format your drive.

OR, you can try the previous suggestion and install XP over the previous installation... If you're blue screening with the cd when it says loading windows then you're better off going the back up and format route. Also, what kind of computer are we talking about here? If it's a desktop be ready to have your SATA/RAID drivers handy for the reinstall. Also, you could just pull the drive and back it up on another system...

More details would be helpful. I recently had my own encounter with the BSOD and had to slipstream my own version of XP with the right drivers to fix it...
posted by eleongonzales at 11:48 AM on October 17, 2006

It's a laptop but I have a 2.5" IDE enclosure so I can take the drive anywhere. But I'd rather not. What other details do you want?

I am currently backing up the data on my external HDD to DVD. So I can then reformat it as ext3 and copy stuff off the internal HDD onto it.
posted by grouse at 1:46 PM on October 17, 2006

This might be none of my business, but why are you so incredibly reluctant to reinstall your OS?

IMHO, your best option (and what I would do) is to move your internal hard drive and your external hard drive to a second computer (assuming one is available) and move the data from one drive to the other, then reinstall Windows.

However, you could try these things:

1. Run CHKDSK from the Recovery Console

2. If you have 2 sticks of memory, try removing one at a time and booting your system. This is a long shot, but you never know.

3. Using a boot disk, replace the ntfs.sys (in the C:\windows\system32\drivers folder) file with a copy from your XP CD (in the i386 folder).

Why won't BartPE load when a linux boot disk will? I always thought it ran completely out of memory. Are you sure the BartPE disk was compiled properly? It can be a little tricky the first time you build one.
posted by bda1972 at 4:31 PM on October 17, 2006

This might be none of my business, but why are you so incredibly reluctant to reinstall your OS?

It is time-consuming and I have a deadline coming up. Nonetheless, I am almost done with the backup and will be commencing reinstall soon.

1. Run CHKDSK from the Recovery Console

As I said in the question, the Recovery Console will not boot. It bluescreens immediately.

2. If you have 2 sticks of memory, try removing one at a time and booting your system. This is a long shot, but you never know.

No, I know that won't work. I've already removed the bad stick of RAM, and tested the other one overnight with MemTest86.

3. Using a boot disk, replace the ntfs.sys (in the C:\windows\system32\drivers folder) file with a copy from your XP CD (in the i386 folder).

As I said in the question, Windows cannot boot when this drive is connected to this system. It is not a problem with the copy of ntfs.sys on the partition. It is a problem with all copies of ntfs.sys—they apparently cannot handle a drive corrupted in this way, while Linux can (in read-only mode at least). Additionally since I cannot get read-write access to the disk, I cannot change a file on it.

Thanks for all the advice.
posted by grouse at 11:52 PM on October 17, 2006

Have you completely replaced the memory from the system? If you just removed what you believed to be the "offending" stick, you may still have memory problems. I suggest you take out all the memory and try a new, different stick for now. The ntfs.sys BSOD can come from memory problems.

If your install is corrupted, there is another method you can try besides a complete reinstall or an in-place install (installing over the current install.)

The method I am speaking of is known as a repair install. If you can boot into Windows Setup, don't go into Recovery Console, but continue as though you were going to reinstall. After you hit F8 to accept the agreement, setup will check for existing Windows installations. If it can find your install, it will ask you if you want to attempt to repair the installation or continue with a new install. Hit R at this point to try the repair install.

A repair install will reinstall all essential drivers, etc. for the system, WITHOUT removing your application installations, additional drivers, etc.

Also, if you are going to try repairing the boot sector, I would suggest rebuilding the BOOT.INI as well. You can do this from Recovery Console. Remove the hidden, system, and read-only attribs on boot.ini and then del it. Then run bootcfg /rebuild and name your install and add the /fastdetect /noexecute=optin switches. After that, run fixboot.
posted by doomtop at 8:06 PM on October 18, 2006

Have you completely replaced the memory from the system? If you just removed what you believed to be the "offending" stick, you may still have memory problems. I suggest you take out all the memory and try a new, different stick for now.

I ran MemTest86 on the other stick overnight and it seemed to pass. I have no reason to believe that a new stick would be better, and every reason to believe that only one of the RAM sticks was bad.

The method I am speaking of is known as a repair install.

As I said earlier, I am skeptical that this would work because I imagine that Windows Setup would use the same ntfs.sys as any other preinstallation environment and would bluescreen upon trying to access the disk. But we will never know because I did a format and reinstall.

Thanks for all the help!
posted by grouse at 1:35 AM on October 19, 2006