Laptop locks at startup, NTFS file system question, just need one file off the hard drive!

[xxxxxJohnGaltxxxxx]

Someone gave me their laptop to look at, which contains one very, VERY important spreadsheet; it locks at startup and the IT people gaves us the ol' "Yea, you need a new hard drive" nonsense. I can boot it with a startup disk and see everything in the C:\ root...but no <winnt> directory. In fact, there is only a <temp> and <dat> directory. I <cd> to <temp> and there are 3 files/directory looking things listed ..."1" and "2" and a "3" listed..no extensions...can't change directory to them...nothing. If I type <type 1> it lists all the gems I am looking for...all files I would expect to see in a windows directory...documents and settings...winnt directory stuff...my documents....etc, etc...all shows the path to each, but I can't figure out how to get in these...NTFS file system stuff?

In short, is there a way to get into these 1, 2, 3 directory looking partitions? It boots to the WIN NT splash screen and just locks....can't boot to safe mode...locks there, too....so there is some windows junk on the hard drive....suspect in these partitions...how can I get in?

 

[xxxxxJohnGaltxxxxx]

I would try to install the O/S right on top, but want to get the file I need before playing around

 

[Smilin]

Originally posted by: xxxxxJohnGaltxxxxx
I would try to install the O/S right on top, but want to get the file I need before playing around

I think you're short on replies because some stuff doesn't make sense. Just to clarify, do you mean NFS or NTFS?

What OS are you talking about? You mention winnt but it doesn't have the safe mode you mention. NFS is unix. What kind of startup disk are you talking about? Most outside of linux will only read fat32.



Much confusion. Can't give answer.

 

[xxxxxJohnGaltxxxxx]

The spalsh screen shows Windows NT, and it does prompt for an F8 to enter safe mode...yea, NTFS.

I thought it was hanging there, but after letting it sit there at the startup screen for a half hour, it did finally return the blue screen of death...I have the stop fault written down at home and will post it, but it was a boot_drive problem.

I just need to figure out how to get into those 1,2,3's things

Looks like this when I go to the C:\temp dir.

.
..
1
2
3


Can't cd 1
Can't type 1:
Can't do anything except <type 1> and it lists every file I would expect to normally see.

 

[OffTopic1]

I don't know what cause it, however you can use Knoppix or Damn Small Linux to read the NTFS partition & email the file, copy it onto a floppy or CD.

good luck

 

[TechnoPro]

Originally posted by: OffTopic
I don't know what cause it, however you can use Knoppix or Damn Small Linux to read the NTFS partition & email the file, copy it onto a floppy or CD.

good luck

Agreed. Knoppix is definitely worth a shot.

 

[Smilin]

Originally posted by: xxxxxJohnGaltxxxxx
The spalsh screen shows Windows NT, and it does prompt for an F8 to enter safe mode...yea, NTFS.

You're still trying to trick me but that's ok. You have windows 2000 probably.

Can't cd 1
Can't type 1:
Can't do anything except <type 1> and it lists every file I would expect to normally see.[/quote]

If you actually type in "TYPE 1" and it lists the files you would expect to see then guess what?

You're looking at a list of files you would normally expect to see. Period. You might as well be looking at a list of groceries. The list of groceries can't be eaten and your list of files can't be read.

If you type "DIR 1" does it give a list of files or does it give another directory listing that this time just shows "1"?


Someone perhaps did executed a "Dir > 1" just before deleting everything. Dunno. Maybe some monkey used a weird recovery program on the drive.

The fact that you can traverse the disk means the filesystem is somewhat intact.
The fact that you have a directory listing in a text file means at one point those files were intact long enough for someone to take down the listing.
The fact that you can boot with an (I assume) DOS boot floppy means it's fat32 on 2000 and your IT guys are retards.

I'll let you put that all together.

I don't think you're getting your spreadsheet back I'm afraid. Sorry dude.

 

[Amused]

Yank the HDD out of the laptop and hook the it up as a secondary drive on another XP/NTFS computer and pull the files off of it. You can use either a USB drive enclosure for 20 bucks or an IDE adapter for under 10.

Frankly I'm shocked no one else has suggested this.

 

[AnitaPeterson]

I hope you're reading this...

Amused has posted an excellent suggestion.

Here's another. There are several applications *out there8 that allow you to revive even a dead computer. I'm thinking of Winternals Administrator's Pak, but there should be a few others, including a freeware (Volkov Commander, I believe). These things bypass the OS on your machine completely, but allow you to access the HD, floppy and primary CD-ROM. Basically, they run off a CD.

If you get one of these, retrieving the file should be as simple as 1-2-3.

 

[Smilin]

It's dead jim.

 

[fw3308]

yes, the sugesstion to hook it up as a slave in another system is a great idea. You could also boot with Knoppix or a similar boot disk and if you have a copy of NTFSPro from Winternals you can read the drives and get the data you need. Good luck!

 

[Smilin]

Originally posted by: Smilin
It's dead jim.

 

[SUOrangeman]

Should the drive be 'alive' and it's 'only' the OS that's corrupted (hehe, only), you can also Ghost it to somewhere and use Ghost Explorer to extract the needed file.

-SUO

 

[xxxxxJohnGaltxxxxx]

Okay, yea, it's 2000 pro. It does have some IBM recovery nonsense on it, but it would go back a long time...there is also an image file <ximage0.dat> on there that's like a gig...that might be ticket if the guy backed it up or created an image after completing the spreadsheet...what's strange is that I can find no windows files, yet it does startup, shows the flash screen....runs for about 5 minutes, then returns the blue screen of death with a stop fault: inaccessible boot device.


Yea, I was wondering what kind of software there is out there that would enable me to hookup a cable (USB, for example) and copy the entire drive onto my system...or even that image file and then see what's in it...

no ideas on that 1, 2, 3 nonsense?

I'll try "Dir 1" and the like...tried everything but that...type 1 was the only thing I could get to work, and again, it listed all the windows files, their paths, everything...just what I am looking for

 

[Amused]

I'm telling you, yank the drive and connect it as a secondary (non-boot) drive on another computer, Then you will have full access to all the files on the drive. No need to copy anthing or fool with any esoteric recovery programs... and risking the files you want to save. A simple 2.5" USB HDD enclosure is 20 bucks. Yank the drive, install it in the enclosure and hook it up to a USB port on your system. It's that freakin' easy.

I'm sure your friend will reimburse you 20 bucks for saving his file.

This is all you need right here:

http://www.newegg.com/app/ViewProductDesc.asp?description=17-145-329&depa=1

 

[xxxxxJohnGaltxxxxx]

Thanks for the idea on removing the hard drive, but if he doesn't get the file by morning, he'll spend 2 days cranking it out again Deadlines suck.

Anyway, I think it's a bad partition...did an fdisk and here's what it shows:

............... Status..............Type
.....1............A...................NTFS.............6Gig.................80% of drive (where I think the windows crap with the file is)

C: 2...............................Pri Dos............1Gig.................20%



No letter or anything set to the first partition...if the partition is bad, is there a dos-based partition magic type of program that could fix this? Also, the numbers that looked like directories were 1..3...7....did a "dir 1" and it just showed the information (size, label, etc) of the thing...still can type "type 1" and it lists all the files and paths...but discovered you can also delete these Types "del 7" and voila...gone!

Think it's a bad partition? This would explain the "inaccessible boot device" stop fault, too, no?

 

[xxxxxJohnGaltxxxxx]

...double post...

 

[xxxxxJohnGaltxxxxx]

..one last try...any partition gurus?

 

[CaptnKirk]

Got hit by a hack that came through Zone-Alarm, Pest Patrol, Ad-Aware, SpyBot, and Trojan Remover.
Background runner that didn't display in Task Manager - just a 'Flash' on screen late in the boot sequence.
no display of programs running on Task Bar either. Minify a program & it just dissapeared - but stayed running.
Caught it running from Hard Drive to Memory.
It deleted the partition manage program & everything was scrambled.

It was unreadable when moved to slave.

Had to 'Zero' write the Hard Drive.

But trying it as a slave is the proper step, pulled a lot of data that way.

 

[Smilin]

Originally posted by: xxxxxJohnGaltxxxxx
..one last try...any partition gurus?

Yes I am a partition guru. I can completely rebuild your partition by hand just by using traces of the primary and backup boot sectors within the partitions. However, as I've stated a number of times your shiz is gone. If you type "DIR 1" and get a directory listing that has the file "1" in it and then you type "TYPE 1" and get a list of files then all you are looking at is a frickin file with some text in it. That text happens to be a listing of your directory before it got deleted. It in no way is the actual directory itself.

To over simplify:
Your disk is a library.
The Books are files.
A directory/MFT is a card catalog listing where those file are in the library (disk).
What you have is not a card catalog...it is a photograph of the cabinet where the card catalog used to be.

 

[xxxxxJohnGaltxxxxx]

...but that's on the C: partition; no windows files whatsoever, so how does it boot to the splash screen? I believe the files are behind the partition with 80% usage...