Laptop locks at startup, NTFS file system question, just need one file off the hard drive!

Jan 12, 2003
3,498
0
0
Someone gave me their laptop to look at, which contains one very, VERY important spreadsheet; it locks at startup and the IT people gaves us the ol' "Yea, you need a new hard drive" nonsense. I can boot it with a startup disk and see everything in the C:\ root...but no <winnt> directory. In fact, there is only a <temp> and <dat> directory. I <cd> to <temp> and there are 3 files/directory looking things listed :) ..."1" and "2" and a "3" listed..no extensions...can't change directory to them...nothing. If I type <type 1> it lists all the gems I am looking for...all files I would expect to see in a windows directory...documents and settings...winnt directory stuff...my documents....etc, etc...all shows the path to each, but I can't figure out how to get in these...NTFS file system stuff?

In short, is there a way to get into these 1, 2, 3 directory looking partitions? It boots to the WIN NT splash screen and just locks....can't boot to safe mode...locks there, too....so there is some windows junk on the hard drive....suspect in these partitions...how can I get in? :)

 

Smilin

Diamond Member
Mar 4, 2002
7,357
0
0
Originally posted by: xxxxxJohnGaltxxxxx
I would try to install the O/S right on top, but want to get the file I need before playing around :)

I think you're short on replies because some stuff doesn't make sense. Just to clarify, do you mean NFS or NTFS?

What OS are you talking about? You mention winnt but it doesn't have the safe mode you mention. NFS is unix. What kind of startup disk are you talking about? Most outside of linux will only read fat32.



Much confusion. Can't give answer.
 
Jan 12, 2003
3,498
0
0
The spalsh screen shows Windows NT, and it does prompt for an F8 to enter safe mode...yea, NTFS.

I thought it was hanging there, but after letting it sit there at the startup screen for a half hour, it did finally return the blue screen of death...I have the stop fault written down at home and will post it, but it was a boot_drive problem.

I just need to figure out how to get into those 1,2,3's things :)

Looks like this when I go to the C:\temp dir.

.
..
1
2
3


Can't cd 1
Can't type 1:
Can't do anything except <type 1> and it lists every file I would expect to normally see.


 

OffTopic1

Golden Member
Feb 12, 2004
1,764
0
0

I don't know what cause it, however you can use Knoppix or Damn Small Linux to read the NTFS partition & email the file, copy it onto a floppy or CD.

good luck
 

TechnoPro

Golden Member
Jul 10, 2003
1,727
0
76
Originally posted by: OffTopic
I don't know what cause it, however you can use Knoppix or Damn Small Linux to read the NTFS partition & email the file, copy it onto a floppy or CD.

good luck

Agreed. Knoppix is definitely worth a shot.
 

Smilin

Diamond Member
Mar 4, 2002
7,357
0
0
Originally posted by: xxxxxJohnGaltxxxxx
The spalsh screen shows Windows NT, and it does prompt for an F8 to enter safe mode...yea, NTFS.
You're still trying to trick me but that's ok. :) You have windows 2000 probably.

Can't cd 1
Can't type 1:
Can't do anything except <type 1> and it lists every file I would expect to normally see.[/quote]

If you actually type in "TYPE 1" and it lists the files you would expect to see then guess what?

You're looking at a list of files you would normally expect to see. Period. You might as well be looking at a list of groceries. The list of groceries can't be eaten and your list of files can't be read.

If you type "DIR 1" does it give a list of files or does it give another directory listing that this time just shows "1"?


Someone perhaps did executed a "Dir > 1" just before deleting everything. Dunno. Maybe some monkey used a weird recovery program on the drive.

The fact that you can traverse the disk means the filesystem is somewhat intact.
The fact that you have a directory listing in a text file means at one point those files were intact long enough for someone to take down the listing.
The fact that you can boot with an (I assume) DOS boot floppy means it's fat32 on 2000 and your IT guys are retards.

I'll let you put that all together.

I don't think you're getting your spreadsheet back I'm afraid. Sorry dude.
 

Amused

Elite Member
Apr 14, 2001
57,132
18,660
146
Yank the HDD out of the laptop and hook the it up as a secondary drive on another XP/NTFS computer and pull the files off of it. You can use either a USB drive enclosure for 20 bucks or an IDE adapter for under 10.

Frankly I'm shocked no one else has suggested this.
 

AnitaPeterson

Diamond Member
Apr 24, 2001
5,992
494
126
I hope you're reading this...

Amused has posted an excellent suggestion.

Here's another. There are several applications *out there8 that allow you to revive even a dead computer. I'm thinking of Winternals Administrator's Pak, but there should be a few others, including a freeware (Volkov Commander, I believe). These things bypass the OS on your machine completely, but allow you to access the HD, floppy and primary CD-ROM. Basically, they run off a CD.

If you get one of these, retrieving the file should be as simple as 1-2-3.
 

fw3308

Member
Dec 12, 2003
168
0
0
yes, the sugesstion to hook it up as a slave in another system is a great idea. You could also boot with Knoppix or a similar boot disk and if you have a copy of NTFSPro from Winternals you can read the drives and get the data you need. Good luck!
 

SUOrangeman

Diamond Member
Oct 12, 1999
8,361
0
0
Should the drive be 'alive' and it's 'only' the OS that's corrupted (hehe, only), you can also Ghost it to somewhere and use Ghost Explorer to extract the needed file.

-SUO
 
Jan 12, 2003
3,498
0
0
Okay, yea, it's 2000 pro. :) It does have some IBM recovery nonsense on it, but it would go back a long time...there is also an image file <ximage0.dat> on there that's like a gig...that might be ticket if the guy backed it up or created an image after completing the spreadsheet...what's strange is that I can find no windows files, yet it does startup, shows the flash screen....runs for about 5 minutes, then returns the blue screen of death with a stop fault: inaccessible boot device.


Yea, I was wondering what kind of software there is out there that would enable me to hookup a cable (USB, for example) and copy the entire drive onto my system...or even that image file and then see what's in it...

no ideas on that 1, 2, 3 nonsense? :)

I'll try "Dir 1" and the like...tried everything but that...type 1 was the only thing I could get to work, and again, it listed all the windows files, their paths, everything...just what I am looking for :)

 

Amused

Elite Member
Apr 14, 2001
57,132
18,660
146
I'm telling you, yank the drive and connect it as a secondary (non-boot) drive on another computer, Then you will have full access to all the files on the drive. No need to copy anthing or fool with any esoteric recovery programs... and risking the files you want to save. A simple 2.5" USB HDD enclosure is 20 bucks. Yank the drive, install it in the enclosure and hook it up to a USB port on your system. It's that freakin' easy.

I'm sure your friend will reimburse you 20 bucks for saving his file.

This is all you need right here:

http://www.newegg.com/app/ViewProductDesc.asp?description=17-145-329&depa=1
 
Jan 12, 2003
3,498
0
0
Thanks for the idea on removing the hard drive, but if he doesn't get the file by morning, he'll spend 2 days cranking it out again :) Deadlines suck.

Anyway, I think it's a bad partition...did an fdisk and here's what it shows:

............... Status..............Type
.....1............A...................NTFS.............6Gig.................80% of drive (where I think the windows crap with the file is)

C: 2...............................Pri Dos............1Gig.................20%



No letter or anything set to the first partition...if the partition is bad, is there a dos-based partition magic type of program that could fix this? Also, the numbers that looked like directories were 1..3...7....did a "dir 1" and it just showed the information (size, label, etc) of the thing...still can type "type 1" and it lists all the files and paths...but discovered you can also delete these :( Types "del 7" and voila...gone! :)

Think it's a bad partition? This would explain the "inaccessible boot device" stop fault, too, no?
 

CaptnKirk

Lifer
Jul 25, 2002
10,053
0
71
Got hit by a hack that came through Zone-Alarm, Pest Patrol, Ad-Aware, SpyBot, and Trojan Remover.
Background runner that didn't display in Task Manager - just a 'Flash' on screen late in the boot sequence.
no display of programs running on Task Bar either. Minify a program & it just dissapeared - but stayed running.
Caught it running from Hard Drive to Memory.
It deleted the partition manage program & everything was scrambled.

It was unreadable when moved to slave.

Had to 'Zero' write the Hard Drive.

But trying it as a slave is the proper step, pulled a lot of data that way.

 

Smilin

Diamond Member
Mar 4, 2002
7,357
0
0
Originally posted by: xxxxxJohnGaltxxxxx
..one last try...any partition gurus? :)

Yes I am a partition guru. I can completely rebuild your partition by hand just by using traces of the primary and backup boot sectors within the partitions. However, as I've stated a number of times your shiz is gone. If you type "DIR 1" and get a directory listing that has the file "1" in it and then you type "TYPE 1" and get a list of files then all you are looking at is a frickin file with some text in it. That text happens to be a listing of your directory before it got deleted. It in no way is the actual directory itself.

To over simplify:
Your disk is a library.
The Books are files.
A directory/MFT is a card catalog listing where those file are in the library (disk).
What you have is not a card catalog...it is a photograph of the cabinet where the card catalog used to be.

 
Jan 12, 2003
3,498
0
0
...but that's on the C: partition; no windows files whatsoever, so how does it boot to the splash screen? I believe the files are behind the partition with 80% usage...