Need help recovering XP

November 26, 2010 at 11:15:01
Specs: Windows XP Media Center

I am working on a friend's system for him. When I got it, the PC would not boot. Attempting all options - safe mode, last known good, express recovery, etc., would simply lead to endless reboot cycle.

System is an HP Pavilion running XP Media Center edition. I believe it had all the latest security updates from MS but cannot be sure.

Doing some research, I downloaded an XP Pro SP-2 setup CD from MS in order to boot from CD (post indicated version would not matter) and use recovery console.

After booting, selected the H:\I386 option for windows installation to boot from (H being cd drive letter assigned). Aftter doing this was able to see the C: drive along with directories etc.

Tried runnning chkdsk on c: but encountered blue screen unmountable drive error. Doing some further research, several posts suggested running fixboot to resolve this. Running fixboot however did not resolve. Result was that C: could still be seen, however now no directories could be listed. Attempting a "dir c:" resulted in " an error occurred during directory enumeration" error message.

Tried fixmbr as last resort, but no effect.

I have since tried booting from CD and runnning bootcfg /scan but it fails. Wondering where to from here?

FWIW, my friend does not have his original XP setup disc (doesn't know if he received one with computer or lost it at some point).

Any help anyone can give me would be greatly appreciated!

One good thing to note - there is no data of any consequence on this machine - so whatever the path of least resistance is to getting this machine back on it's feet - anything goes!

Happy Holidays and thanks to all in advance!


See More: Need help recovering XP

Report •

November 26, 2010 at 11:51:42
Could be due to corrupted/Lost partition / FAT tables

Try TestDisk from:

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table).

I have used it myself several times with very good results.

Knowing the original geometry (partitioning) of the HDD you are attempting to fix will be a distinct advantage.

When everything else fails, read the instructions.

Report •

November 26, 2010 at 12:06:57
Before attempting to use testdisk be sure to read all the tutorials.

Testdisk is just one option.

If the computer came with WinXP installed originally then there should be a hidden restore partition which can be accessed at start up using various keystrokes. This would restore the computer to the same state it was in when it came from the factory.

That means all personal files, updates, third party programs, etc, will be gone.

If all that is necessary to recover are some personal files then there are recovery programs available. Both free and paid.

Finally, you could remove the hard drive and temporarily connect it to another computer to access and copy the personal files. Then reinstall the drive to the original location and perform a factory restore.

Due to the fact that you haven't indicated why the computer won't boot we can't say if your issue was originally a hardware or software issue. Most likely software from what you have said, but still could be a non essential hardware failure caused the original problem.

Report •

November 26, 2010 at 12:08:38
Thanks for the testdisk suggestion. Will try this and post back with results.

Report •

Related Solutions

November 26, 2010 at 12:14:19
OtheHill - thanks for your reply also. Can you be more specific re: hidden pre-install partitions? I suspect there is a good chance XP came pre-installed on his system and given the junkware and virus issues he has had in the past, a clean reinstall to factory original settings could be a good thing if possible. I will be offline for about an hour but back to investigate both suggestions posted so far. Thanks again to both of you for your responses.


Report •

November 26, 2010 at 12:39:43
Go to the link below and read the section on:
Recovering the system without using Windows

Report •

December 2, 2010 at 14:02:36
OK - sorry for the delay in posting back everyone - holiday got in the way. :)

Picking up where I left off -

I downloaded the testdiskk utility as part of a Parted Magic boot cd. I booted the system from the disc and ran testdisk. On startup it correctly detected the drive (ATA Samsung SP2504C). Selecting this drive and choosing [Analyze] yielded -

Partition Start End Size in Sectors
1 * HPFS - NTFS 0 1 1 29276 254 63 470334942 [HP_PAVILLION]
2 P FAT32 LBA 29278 0 1 30400 254 63 18040995 [HP_RECOVERY]

Doing [Quick Search] to locate partitions yielded

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63

Partition Start End Size in Sectors
* HPFS - NTFS 0 1 1 29276 254 63 470334942 [HP_PAVILLION]
P FAT32 LBA 29278 0 1 30400 254 63 18040995 [HP_RECOVERY]

Structure: OK

Selecting 1st partition (NTFS, 240 GB / 224 GiB) and choosing [Deeper Search] yielded no additional partitions.

Before choosing [Write] or trying any of the other utilities available via Parted Magic GUI - thought I would check in. Is it possible file system was changed from FAT32 to NTFS or vice versa by fixboot/fixmbr attempts noted previously? Wasn't sure why the two different file systems were noted by testdisk.

If anyone can point me in the right direction it will be greatly appreciated. Thanks!

Report •

December 2, 2010 at 14:22:30
It would appear that testdisk cannot find anything wrong with your hard drive per se.

Partition 1 - is where your XP is resident
Partition 2 - Is where your factory fresh image resides.

You may well have to go with the suggestion made by OtheHill in post #5

The following two links (in addition to the one provided by OtheHill) may also be of help to you.

Bear in mind that if you go down this route then you will loose all your personal data. So you might want to think about backing it up first.

When everything else fails, read the instructions.

Report •

December 2, 2010 at 14:31:14
The boot partition HP_PAVILION being NTFS, and the HP_RECOVERY being FAT32 is absolutely normal.

The option to use the HP_RECOVERY comes before Safe Mode, Last known configuration, etc. using F10.

Your C:\Boot.ini should probably look like this:

[boot loader]
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Media Center" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

You are ready to use the response #5 by the very knowledgeable: OtheHill.

Report •

December 2, 2010 at 14:35:25
Oh, also be sure to follow the suggestion to remove any added peripherals that may not have been part of the original installation (who knows, doing this may even resolve the original problem anyway!).

Report •

December 2, 2010 at 15:09:21
Thanks guys for the posts. One more thing to note - while waiting for replies I ran the Partition Editor in Parted Magic (GParted - Gnome Partition Editor) just to see what it reported.

I noticed an exclamation point icon next to the ntfs partition. Checking the details it reported the following -

Warning -

ntfsresize v2.0.0 (libntfs 10:0:0)
Error reading $Mft record(s): Input/Output error.
(above repeated several times)
Device name: /dev/sda1
NTFS volume version 3.1
Cluster size: 4096 bytes

(skipping Current volume size and device size lines - both reported as 240812 MB)

Checking filesystem consistency -
Cluster 3935918 is referenced multiple times!
(entries continue through Cluster 3935927)

ERROR: filesystem check failed!
ERROR: 144 clusters are referenced multiple times
NTFS is inconsistent: Run chkdsk /f on Windows then reboot it TWICE!
The usage of the /f parameter is very IMPORTANT! No modification was and will be made to NTFS by this software until it gets repaired.

Unable to read the contents of this file system!
Because of this some operations may be unavailable.

The following list of software packages is required for ntfs file system support: ntfsprogs

That's it. It may not change anything that's been suggested, but I thought I would post in case it makes a difference or sheds some light on anything.

FWIW, I will be offline for a few hours then back online to check in after 9:30. Thanks again for the help!

Report •

December 2, 2010 at 15:48:19
In that case I am surprised that testdisk did not spot this.

I did notice that you said you used testdisk utility as part of a Parted Magic boot cd. The one I was referring to is the one provided here. I do not know whether the two are the same.

Read This:
Advanced NTFS Boot and MFT Repair

When everything else fails, read the instructions.

Report •

December 2, 2010 at 20:51:09
Thanks for the reply and link Mosaddique. The TestDisk utility I used I believe is the one you are referring to. I got the Parted Magic link via the one you provided - see link below

I will read the article you referred me to and see what it tells me. I will post back with any results. Thanks again to you, Othehill and IMpatient for your help and suggestions thus far.

Report •

December 2, 2010 at 22:06:20

I tried to run testdisk and have it attempt to repair the MFT. When I chose [Rebuild] it asked me if i would like to repair the MFT mirror using MFT? Y/N. I selected Yes then it indicated the MFT mirror had been fixed.

Partion Editor still showed file system hosed - but i figured what the heck let's try booting the OS without rescue or recovery cd's in and see what happens.

And to my utter amazement - the system booted!

I am now looking at an XP desktop! I am almost afraid to touch anything for fear of a BSOD, :) but this certainly looks like progress!

What do you think of trying to run chkdsk now from within Windows? Any benefit? Or if aint broke (yet) don't fix it?

Report •

December 3, 2010 at 00:16:30
It will not do any harm to run it.
If you are going to run it then use:
chkdsk /f /r
It will then say it will run it at the next reboot

When everything else fails, read the instructions.

Report •

December 4, 2010 at 23:08:56
just as a courtesy to help others - as a follow up to what's been posted so far -

I believe using testdisk to repair the MFT on the hard drive was the answer here (see steps above). After I did this I was able to boot into Windows again. A few things to note -

Once i booted into Windows I immediately used the Windows Run command to run CHKDSK. The exact command I used was

CHKDSK C: /f /r

CHKDSK reported a variety of problems on the drive and fixed them.

Ran CHKDSK a second time with just /f option and it cleaned up a few more things.

At this point i believe drive and OS were fairly healthy but wanted to see if any nasties were on board since the PC's firewall/ A/V subscription had recently lapsed.

I loaded Malwarebytes (free program available on C/Net among other sites), installed it and ran a scan. Sure enough the PC was crawling with virueses/trojans etc. -probably why file sysem was hosed in the first place. Used Malwarebytes to clean out a bunch of stuff, then used Spybot Search and Destroy (another freebie) to get some of the stuff Malwarebytes missed. Also ran Adaware, AVG Antivirus and activated Windows Firewal to make sure everything was OK.

Since then system has been working fine. No recovery, reinstall or hard drive replacement was necessary.

Thanks again to all of you who helped with this one!

Report •

December 5, 2010 at 02:41:17
It's good of you to provide feedback.

Too many people can't be bothered.

This might be of help to others in the future.

A thank you would be nice, if I have helped.

Report •

December 5, 2010 at 07:27:16
Well done and good on you for providing feedback.

I wish more people woiuld do that as this kind of feedback confirms working solutions and helps others suffering from similar problems.

When everything else fails, read the instructions.

Report •

Ask Question