- Jul 19, 2013
- 22
- 0
- 10,510
In a bit of a pickle, and in need of someone with hard drive, file system, and file recovery experience. Long story short, for a while now I've been getting NTOSKRNL.EXE BSODs (mostly IRQL_NOT_LESS_OR_EQUAL, but recently a PFN_LIST_CORRUPT and a MEMORY_MANAGEMENT). After what seemed like a hard crash, some registry files were changed. The cause (I believe) was a text file with incorrect number of processors and total memory which caused an incorrect boot configuration. I used a Windows 7 OEM system repair tool on a retial copy of Windows 7. It worked and rolled back the registry to a previous working state. Ran chkdsk which fixed a few errors and memtest came up clean.
I use Microsoft Security Essentials so I don't think malware is the cause. There is roughly 5 days worth of work on the drive I'd like to save if at all possible.
Few days later another "hard" crash. This time after the crash report finished dumping (much longer than usual), my PC says "operating system missing"
Again boot into system recovery tool, but this time the OS is not listed, no backups or restore points can be found. In command prompt DISKPART the drive no longer has a volume letter. It's recognized in BIOS and in disk list, but with four 79GB EISA configuration partitions.
Originally there was only one ~232GB OS partition.
In Linux Live boot there are four 85GB partitions and one 41GB unallocated block. The SSD is 250GB, and these partitions put it at a total of ~350GB (what?!?!). I can't seem to mount the drive in Linux as the partition type is listed as Hibernation 0x84 (might have been Hibernation 0xa0) and is not NTFS. Contents are 'Unknown'. Linux recognizes the drive as MBR, which gives me hope that the OS is still there, somewhere.
What I BELIEVE happened was the OEM recovery tool wrote a boot file into the MBR that turns a drive into a drive with integrated backups (which would explain the EISA partitions and altered partition table). At this point I'd imagine the OS is beyond functionality, so if there is a way to access stored files and folders somewhere on the drive it would be godsend. If you need any additional info I am more than willing to provide it.
Additional Notes:
The drive is set to active.
bootrec.exe will rebuild a new MBR, although bootrec scanOs returns zero found operating systems.
Slaving the drive in another machine results in the drive showing up in Disk Managment, but not Windows Explorer (no volume letter).
My last attempt at fixing this is in Linux I can create disk images of each partition. Once I find the partition offsets I hope that I can mount each image and see what might be inside. Another thing is that Linux gives me the option to format a volume with 'Don't overwrite existing data' with NTFS, though I am skeptical of a format that doesn't wipe a drive. Other than that I am at a total loss. is there anything else that might give me access to my files and folders?
I use Microsoft Security Essentials so I don't think malware is the cause. There is roughly 5 days worth of work on the drive I'd like to save if at all possible.
Few days later another "hard" crash. This time after the crash report finished dumping (much longer than usual), my PC says "operating system missing"
Again boot into system recovery tool, but this time the OS is not listed, no backups or restore points can be found. In command prompt DISKPART the drive no longer has a volume letter. It's recognized in BIOS and in disk list, but with four 79GB EISA configuration partitions.
Originally there was only one ~232GB OS partition.
In Linux Live boot there are four 85GB partitions and one 41GB unallocated block. The SSD is 250GB, and these partitions put it at a total of ~350GB (what?!?!). I can't seem to mount the drive in Linux as the partition type is listed as Hibernation 0x84 (might have been Hibernation 0xa0) and is not NTFS. Contents are 'Unknown'. Linux recognizes the drive as MBR, which gives me hope that the OS is still there, somewhere.
What I BELIEVE happened was the OEM recovery tool wrote a boot file into the MBR that turns a drive into a drive with integrated backups (which would explain the EISA partitions and altered partition table). At this point I'd imagine the OS is beyond functionality, so if there is a way to access stored files and folders somewhere on the drive it would be godsend. If you need any additional info I am more than willing to provide it.
Additional Notes:
The drive is set to active.
bootrec.exe will rebuild a new MBR, although bootrec scanOs returns zero found operating systems.
Slaving the drive in another machine results in the drive showing up in Disk Managment, but not Windows Explorer (no volume letter).
My last attempt at fixing this is in Linux I can create disk images of each partition. Once I find the partition offsets I hope that I can mount each image and see what might be inside. Another thing is that Linux gives me the option to format a volume with 'Don't overwrite existing data' with NTFS, though I am skeptical of a format that doesn't wipe a drive. Other than that I am at a total loss. is there anything else that might give me access to my files and folders?
Facebook
Twitter
Instagram