S.O.S. !! WIn2000 BSOD ........ I'm totally screwed

[Jason251]

Please help. I'm close to tears here. I think I might have lost all my work.

Just last night I was thinking how great my computer was and how stable Win2000 was. This afternoon, after 8 months of problem free computing, I get my first BSOD. And it looks like a bad one. Can't even get into Safe Mode.

STOP: c0000218 {Registry File Failure}
The registry cannot load the hive (file):
\SystemRoot\System32\Config\SOFTWARE
or it's log or alternate.
It is corrupt, absent, or not writable.

blah blah check your hardware,
software blah blah..

Can't get into Safe Mode.
Can't do anything.
Mourned the loss of my well tuned and tweaked OS installation.
Booted from secondary hard drive partition with old, installation of Win2000 (from when I first got Win2000)
Reinstalled fresh Win2000 on that drive.
Reinstalled some of my urgently needed apps.
Big job ahead in re-installing everything else.
Tried salvaging from other hard drive.

I can handle having to reinstall after having no problems for so long, but:
This is the big problem:
I always use NTFS.
I set the encrytion attribute for My Documents.
I thought 'why not?' at the time.
I remember reading somewhere that you should make a certificate or something and save it on a floppy. I never got around to doing that.

Have I lost everything in My Documents? Is there any way of getting them back?

Does anybody know what the BSOD means and if it's fixable?
I tried 'repair installation' with W2k CD-ROM. Didn't work.

This is really really bad news for me.
Unless there is a way of salvaging the files from the new installation, is there anyway of fixing this BSOD?

The reliability of my system until now has made me too complacent to back up.

Thank you.

Jason 🙁

 

[rbV5]

<< Does anybody know what the BSOD means and if it's fixable? >>



Yes, it sure sounds like the infamous large HD cache, shut down too fast before it writes back to the system bug to me. Yes, it is completely fixable...with an ERD with a copy of your last registry saved to it that is.

It happened to me twice before I figured out what was happening. You need to make an ERD and faithfully copy your Registry to it(won't help you now unfortunately). I got around the problem by not shutting down my computer(I rarely do anyway), there was a registry key to fix it, but I believe SP2 took care of the problem.



<< I set the encrytion attribute for My Documents. >>



Uh oh! good luck.

 

[Elledan]

Let me guess: you never made backups of important documents and files?

In that case you're seriously screwed. I've no idea how to solve this problem, but I'm certain there is a way (can cost some $$$).

Good luck.

 

[Jason251]

Well thanks for the luck guys

I was running with SP2 and I have no idea what an ERD is.

And I do occassionally backup, like once a month or so.
I'm an architectural student. The older stuff that I've got backed up not really that important. I've lost all my recent coursework, and a complete unsubmitted project, which I haven't made plots and prints from.

So I guess it's all gone forever?

Shall I just kill myself now?

 

[Jason251]

Is there any way of making an encrytion key in retrospect.
Is there any way?

 

[serialb]

<< I've lost all my recent coursework, and a complete unsubmitted project, which I haven't made plots and prints from. >>



Ouch... All those work from Form-Z... Sorry to hear that.

ERD stands for Emergency Rescue Disk. If you had created one with your registry backed up, try repairing your windows installation with that.

I don't know if this is going to work, but you can try getting into the Windows Repair console and extract your documents into your other partition. Can anyone confirm on this one?

Just a little piece of advice here, ALWAYS burn your important data to CDs in case a catastrophe or a sudden burst of solar EMP hits. 🙂

serialb

 

[rbV5]

ERD = Emergency Repair Disk, make one as soon as you are setup again.

Where does your Cad application save intermediate files? Perhaps you have backups in a temp directory, try a search for *.bak files or perhaps *.tmp. The only thing lost maybe is just your &quot;my Documents&quot; folder(due to encryption) look in &quot;Documents and Settings&quot;>&quot;your profile&quot;>&quot;Local Settings&quot;>&quot;temp&quot; or did you encrypt your entire NTFS partition?

I use NTFS partitions for a capture drives for my video/audio files not security, so I'm not real familiar with what your options are, someone more knowlegeable with the NTFS security features/encryption may be able to point you the right direction.

 

[Rick25]

Win2000 makes a backup of SystemRoot\System32\Config\SOFTWARE
you've got to be able to drill down to that directory and access the
hidden files. At that point change the extentions so that the backup
becomes the main file. Did you try booting up using the Last Know Good Configuration
option? That'll usually work.
From your error message I'm going to guess you're running a AMD system and have the
Via 4in1 drivers installed, and that it's ver 4.26-4.28. Those versions contain an
IDE busmaster driver that will cause corruption exactly like you got. Same thing happened
to me. As for the encryption I'm not sure, best of luck.

 

[Woodie]

W2K EFS--a really immature technology.

There is a recovery key for your data--but don't cheer yet. There are two IDs that can decrypt your data:
1. Your original user ID. You have to login to your original W2K build, with the ID that encrypted the files.
2. The original local Administrator ID. You have to login to your original W2K build, with the original Local Administrator ID.

Either login will load encryption/decryption keys, that will allow you to decrypt all file encrypted with that OS.

Let me do some more research...it get's REALLY ugly if 1 or 2 won't work. 🙁

--Woodie

 

[Woodie]

🙁 dude...you're screwed.

Your only hope is to recover the original W2K installation/registry where you booted from when you encrypted the stuff.

What/where/how did you do backup? Some methods retain encryption, some don't.

We're not aware of any brute-force EFS cracker. Even if there was, it could only do one file at a time, because the key for each file is different, and they're all 128 bit keys.

Keep us posted.

--Woodie