Corrupted file system?

August 20, 2011 at 10:16:28
Specs: Windows XP, 700 Mhz/512 MB
Ohh, I love my grandparents. My grandfather especially. He simply refuses to believe that anyone could possibly know about computers more than him. Which is sort of how this problem started.

He called me up last night, and finally conceeded defeat, telling me that his computer would no longer boot, and he was stumped. I asked how it got to be that way, and this is the information I got:

He was browsing through "sites", when his computer suddenly slowed down tremendously (he's got a Win 7 64 with 8 gigs RAM and an i7, so it takes quite a bit to slow that down). Him, being very paranoid, immediatly did a hard shut-down, and pulled out his KAV rescue disk.

That's all well and fine. But apparently he didn't realize that it can be dangerous to run a rescue disk like that when your OS wasn't shut down properly. The disk even warned him that bad things could happen if he mounted the drive and it wasn't shut down properly. But, of course, no one at Kaspersky knew about computers as well as he did, so he told it to mount anyway.

Well, it did, and he did his scans, and it found nothing. So, he rebooted, ejected the CD, and rebooted again.

Now, here's the fun part. He gets the BIOS screen like normal, but after that, all he sees is a black screen with a cursor blinking about 4 lines from the top of the screen. No beeps, no warnings, no windows. He was clueless.

So, smiling to myself, I went over to his house with my bootable Ubuntu CD, to see if maybe I could fix it myself. Well, now I'm stumped, too.

If I use the Terminal in Ubuntu too see a directory of his C:\ drive, there appears to be no WINDOWS folder... it's like whatever he managed to delete his WINDOWS install. His "Documents and Settings" folder is still there, but inside of it his account is strangely missing. I didn't want to run any recovery programs until I got a second opinion. Did he manage to corrupt his filesystem because of his computer genius? If not, then what DID he manage to do?

See More: Corrupted file system?

Report •

August 20, 2011 at 10:40:22
First of all Documents and Settings is of no use to you. You need to look under Users in Windows 7 for any personal files. Copy them off to a usb or network share and then consider one of two options. One is to use a live linux cd to attempt a repair. The other is to use Windows 7 to attempt a repair or better still a reload. Why use terminal? If the drive mounted in linux then it is clean enough to read. Use gui.
Just don't mount it ntfs3g.

Try testdisk. If not part of the live cd just sudo apt-get install testdisk.

Boot to Windows 7 dvd and try it's repair tools.

Consider a complete reload back to OEM state.

Can't hurt to run memtest or memory diagnostics.

1/3 of highway deaths are caused by drunks. The rest are by people who can't drive any better than a drunk.

Report •

August 20, 2011 at 11:30:16
Also, make sure you're not looking at his recovery partition. If he has a real Win7 DVD, boot off of that and see if it can't repair the file system. If you're lucky, the Win7 disk will see and fix the problem. This assumes neither his anti-virus disk nor your Ubuntu disk attempted to "correct" the error first. (You did mount the partition read-only, right?)

I would run a check on the disk for bad clusters (chkdsk /r). The drive going bad would explain the random "slow down."

EDIT: But his computer wisdom includes an active backup plan, right? So this should be more of an annoyance than anything.

How To Ask Questions The Smart Way

Report •

August 20, 2011 at 11:57:18
@ Jefro

That's my bad. I meant Users, but I'm normally working on XP, so it just came up as that. He still doesn't show up. && I use the terminal because I prefer the text mode to guis. I'm a huge DOS fan. I think guis just make dumb people feel computer literate.

@Razor 2.3

I'm not an idiot. Of course it's read only. He's got a second 1TB drive that I mounted as read/write, so anything i can find will be saved there.

His computer's install is OEM, so no acutal disk, but I've got one sitting at home that I can grab. I should be able to use his key with my disk, right?

And his idea of computer back up is CDs once a month. He now has a pile of CD-Rs (I couldn't convince him to get CD-RWs so that after a year he could write over the files). But he apparently has a lot of files on there he never backed up, and backup day is two days away... (eye roll)

Report •

Related Solutions

August 20, 2011 at 12:50:30
Re "I'm not an idiot". Remarks like that come across like arrogance.

We have no means on here to tell whether folk are idiots or brilliant.
Razor2.3 only mentioned it as an aside, or assumption, just in case.

I have often had folk come back and confirm that they had missed
some basic point that I mentioned. Anyone can make a mistake.

Report •

August 20, 2011 at 13:05:49
supergeek: I'm normally working on XP, it just came up as that
I'm going to continue to state the obvious and point out Win7 (and Vista) have both Users, and an un-enumerable junction point called Documents and Settings.

If you don't have a Win7 install disk, you can make your own WinPE 3.0 environment. I'd suggest making it a bootable USB key, but that assumes you have a USB key you don't mind wiping, and he has a PC capable of booting from USB.

supergeek: I'm a huge DOS fan.
Don't be. It was a horrible OS that died in 1995.

It's cool, Derek. I wouldn't last long around here if I didn't have thick skin. And I was jerking his chain.

How To Ask Questions The Smart Way

Report •

August 20, 2011 at 14:47:04

OK, nuf sed. I guess I'm a bit over protective of folk on this forum who give up their spare time for free to help others.

As for DOS, yeah, as in Dodo. However I do find that batch files made in command prompt can be really handy to make Windows do what you want (rather than what MS foist upon you). Reg files too for that matter.

Report •

August 20, 2011 at 14:53:30
Haha, to both, thanks for the help so far, and I didn't mean to come off as arrogant or rude. I'm just a little puzzled over it. I'm on the GUI now, so he can see exactly what I'm doing, and, aside from pointing out 45 different things that I must be doing wrong, I'm at


It doesn't actually say C:\, but I'm too lazy to copy the serial number it gave me.

His account isn't there. There's one for Administrator and one for Guest. Nothing else.

Report •

August 20, 2011 at 15:28:40
Still sounds like you're on the recovery partition. Check the other partition and see what it looks like. If they're identical, then someone performed a factory recovery, or whatever they're calling it these days.

Also, once you get everything running again, set up automatic backups for him. I don't care if you sign him up for a cloud service, or you use Windows Backup and that 1TB external. (Cloud's better.)

How To Ask Questions The Smart Way

Report •

August 21, 2011 at 07:28:54
Okay, here's what I've been able to figure out so far:

I've checked both partitions on his main drive, and neither have his account listed under Users. However, using some file recovery software included on the LiveCD, I was able to find quite a few (over a thousand) various files, from dlls to xls. I'm on my Windows XP system right now, seeing which of those files can be recovered, because I've used this program in the past, and it doesn't always do a good job of recovering the entire file. I've put nothing on that hard drive, so it would make sense that the actual file is still there, right?

Report •

August 21, 2011 at 09:27:32
The data itself should be intact. It's more of a question of the MFT.

NTFS is a journaling file system, so it should be fairly hard to corrupt. Run that program if it lets you recover the files to the external drive without modifying anything on his drive.

Once you've done that, use chkdsk to repair the FS. If everything goes as designed, he'll recover his files, even if the opened files were corrupted. This will require you to either move the drive to a Windows environment, or bring a WinPE environment to the drive. In theory, chkdsk/Windows should see the MFT as bad, grab the mirror copy, apply the journal, and call the end product the new MFT. This assumes nothing has modified those three parts.

How To Ask Questions The Smart Way

Report •

August 21, 2011 at 09:35:00

Ignore this - noticed later that my input had already been covered.

Report •

August 21, 2011 at 13:55:42
Might be time to do a clean install and work on backups. Windows 7 has a few good backup plans.

Might boot to a VistaPE disk instead of the linux cd. Could the folders be encrypted?

1/3 of highway deaths are caused by drunks. The rest are by people who can't drive any better than a drunk.

Report •

August 22, 2011 at 09:52:40
No, he never encrypted his files, so that's unlikely. But how would I go about setting up a VistaPE cd?

Report •

August 22, 2011 at 11:49:37
supergeek: how would I go about setting up a VistaPE cd?
The instructions have been linked to already.

How To Ask Questions The Smart Way

Report •

Ask Question