Data recovery

Hey guys, I have a problem and I'm hoping someone can solve it... One day I went to turn on my computer and it said the following file is corrupt, deleted, or whatever, and the file it was everyone's talking about in this topic... Windows\system32\hal.dll... And then it said please reinstall Windows. So I did, and that's when I couldn't get into the drive all of the sudden.. Then not only that, the bigger drive was the c drive before this happened, but now that drive and the smaller drive switched places. Weird... I have no idea what could've caused this. I've used this computer for over five years now and nothing like this has ever happened. It is an old computer though.. But anyway, the drive that I can't get into happens to have all my important files in it. And everytime I try to get inside, it says "This drive needs to be reformatted."... And if I do that I'll erase everything. And I really can't... I've been having a bad two weeks all over this. Someone please help me. I just want my files back!

 

Re: "<Windows root>\system32\hal.dll" is corrupt

Active@ Partition Recovery will usually recover things. Maybe someone knows of a freeware solution.

 

Re: "<Windows root>\system32\hal.dll" is corrupt

Thanks a bunch.. I just downloaded the demo version. I hope no matter what I do in the program I can't mess anything up. Because looking at it I don't understand any of this.

 

Does your 'old' C drive appear at all in My Computer, and if so what drive letter does it have? I doubt it, but check. If it does appear you should be able to recognize which is which because of your own files being on it.

Assuming it isn't there can you type diskmgmt.msc into the Start > Run box <OK> and tell us exactly what is shown there? A pic would be good if possible.

Finally, what sort of XP disk do you have, retail, OEM or just a Recovery disk?

 

Yes the old c drive is under 'my computer'.. It was turned into the f drive after someone put a bigger drive on there. Then that became the new c drive... But now that all of this has happened, the f drive (smaller drive) reclaimed it's place as the c drive, and the bigger drive (the one I can't get into) is now the 'd' drive, which used to be the DVD drive. And the DVD drive is now the f drive... Sorry if I confused you.

 

Oh and I forgot to answer your other question... My friend is sending me a new Windows XP disk in the mail.. And he told me to just reinstall everything.. I know my files should be fine after that, but I don't know if that will stop the drive from saying it needs to be formatted. I doubt it.

 

Not confused, thanks. This is really good news, but what happens exactly if you try to access the D drive in My Computer?

 

I'm glad that you just said that. But how is it really good news? What do you think is going on here?.. The hour glass shows for about forty seconds and then a box comes up that says, 'The disk in drive D needs to be formatted. Do you want to format it now?'

 

It's good news that it is showing in My Computer, as I didn't expect it to after the hal.dll error earlier, and it means we have a reasonable chance of gaining access again.

Type chkdsk d: /r in the Start > Run box <OK> It may say it wants to reboot to do it, so let it. Then cross your fingers We recovered an inaccessible drive here just yesterday, so good luck.

 

'The type of the file system is NTFS. CHKDSK is verifying files [stage 1 of 5]'... And then all the file record segments they show are unreadable!... But then they have a lot of 'recovered orphaned file's... Now I see a few 'Inserting data attribute's... At this point it's only 20% completed. lol

 

Patience

 

Oh believe me, I wouldn't care if it took all day... I just wanna make sure that all of this is what was being said in the chkdsk before the the other person got their stuff recovered. lol (Update: Windows replaced bad clusters in file blah.. 39 percent completed).

 

Sounds as if that disk has suffered some serious damage. You will definitely be able to access it once it's finished, but we'll just have to wait and see whether any files have been lost. Even if some have there are still other tools that can be used to try and recover them.

 

Can't hold my breath for much longer

 

Yeah really.... Well, I think what happened is that because I lost internet service for a few minutes, I might have to redo the run, because it's been saying the same thing for over an hour now, which is, 'Correcting errors in the Boot File'... But I thought you didn't even need to have an internet connection to run the disk check?.. Well anyway, should I restart the run? Will it pick up right where it left off?

 

It's nothing to do with the internet connection. More likely, as the errors get corrected, we may be getting conflicts as the 'live' XP system detects the presence of a second XP system.

It's quite possible that your own files are now visible again, but the issue is how best to try to access them. The best way would be to boot the computer with a boot disk, such as BartPE. This would enable your files - if they are there - to be copied off. I'm trying to avoid a reboot just atm.

Do you have another comp, or a friend who could d/load and burn the BartPE iso for you? Here's the link -

http://www.nu2.nu/pebuilder/

 

I don't have anyone nearby who could download and burn it.. Why can't I do it on my computer?.. Is it safe to try to get into the drive now? Should I run the disk check again?

 

Serious problems could possibly arise with two XP systems seeing each other, but we probably have to risk it. Kill the disk check with Task Manager and take a look at your disks.

 

Nothing else left to do huh?

 

I'm not too sure how operational your comp is at present. You have internet, so without a reboot would you be able to d/load and burn the iso? It's the safe way to try to recover your files. You might need a burning program but I'm sure we could find one.

 

And you're saying I have to put in the BartPE boot disk in before shutting down the Task Manager?.... Well in that case, if you think I'm taking a big risk, maybe I should just leave my computer and the Task Manager up until I get it, which will be Sunday. lol

 

Oh yeah I can download it. I downloaded something earlier. I could've told you that before. I just thought you meant I shouldn't do it on this one. And I don't think I'll need a burning program. I have a cd and a dvd burner.. I'll try it.

 

Burning an iso is not just a case of copying it to CD. You do need software such as Nero that can burn ISOs. Hopefully someone can point us to one.

If the disk check is still hung you might as well kill it now and see if you can get into the drive. Just don't reboot.

 

"This would enable your files, if they are there, to be copied off"... Wait, if this check disk thing worked, wasn't is supposed to just recover my files, along with the disk, and all the disk space would still be there? I didn't know I'd have to copy anything!

 

Okay, well I just tried to x out of the task manager, but a box came up entitiled, 'End Program - C:\system32\chkdsk.exe'... And then it reads, 'Windows cannot end this program. It may need more time to complete an operation.. To return to Windows and check the status of the program, click Cancel.. If you choose to end the program immediately, you will lose any unsaved data. To end the program now, click End Now'... What should I do!

 

No choice really, end it.

 

It's still doing the same thing! Why?! I saw it working!.. I even saw it repairing one of my jpg files, so I know my stuff's still there! Can I run the task manager again?.... Also you said, "This would enable your files, if they are there, to be copied off"... Wait, if this check disk thing works, isn't it supposed to just recover my files, along with the disk, and all the disk space would still be there? I didn't know I'd have to copy anything.

 

What I'm trying to avoid Andrea is rebooting into XP, as doing so could cause a load of additional problems if the original XP system has been restored by chkdsk. By rebooting with a boot disk there is no chance of this happening and we might be able to copy off your files to a CD or whatever. But there is no certainty in this situation, rebooting might be OK and the drive might be accessible.

The boot CD is the safe option, but it's up to you to decide whether to chance a reboot or not.

 

I see what you're saying, but again you're saying that I might be able to copy off my files to a cd.. That's what I don't understand.. If everything's recovered, why would I need to copy everything? Everything should be there, including the disk space... I don't have enough disk space on the other drive to copy files, and as far as putting them on cds, I'd probably need like a hundred to do that. Because I have many songs and videos on there aside from my pictures... Anyway until I get this resolved, I can't turn off my computer correct? Because I have to leave soon, and I'm guessing turning it off and turning it back on later will be considering booting it.... And the reason why I was asking if I should run the task manager again or not, was because it might've not finished what it was doing

 

The issue is that the disk that went down was marked Active and had XP on it. The system you are using atm is also marked Active and also has XP on it. The two systems are not set up to dual boot so I have no way of knowing what might happen if you reboot in that scenario, but there is a risk the system might crash completely. Or it might be OK.

However if you are saying there is no way you could copy off your files then I think you may just have to reboot and hope for the best. Remember, chkdsk was unable to complete for reasons unknown, so this really is a suck it and see situation now.

If it does reboot OK I would first off run chkdsk again, but check first in case the drive letters change.

 

Okay so I might just go with that option depending on what your answer to this question is... If it does crash, all my files will definitely be gone after I install Windows to it again? Because I believe one time it crashed and my files were all still there.. It was a blue screen with white writing on it.. That's usually what you see when a computer crashes right?.. And if I choose not to take the risk, should I leave my computer on before I leave? Again I don't know if turning your computer off and on again is the same as rebooting. I know restarting is...

 

My understanding is that there are two physical drives in your machine, let's call them small and large. If I've understood correctly your files are on large, so if we could reinstall XP to small then large would not be affected and your files would be safe, or at least not affected one way or the other. A full reinstall of XP to large would definitely destroy your files, though there is such a thing as a repair install which allegedly would not. Wouldn't advise that though.

I think you might as well shut it down now and we'll have to see what happens when you restart it. btw, turning off and on is rebooting.

 

Earthling, I just turned on my computer since the last time we talked, and everything's still the same.. Both drives are in the same places that they were in, and I still can't get into the big drive... Wasn't the disk check supposed to do something at least?.. Should I run the task manager again and see if it does anything different? It couldn't hurt could it?

 

Andrea, at the beginning of this thread you said you reinstalled windows, and then your "drives switched places" [sic]

That sounds like you installed XP over your data, did yu format before you installed XP?

Q

 

Hey Q, no I didn't.. And this bigger drive I have was actually put onto my computer only about a month before all this happened.

 

What drive letter is windows booting from now?

 

Well if that's the same thing as the drive that I can get into now, that would be the c drive.

 

So windows is on C: and the data you want is on another drive?


If that is right.... Download this --> http://www.cgsecurity.org/testdisk-6.11.3.win.zip

It is a file system/partition recovery bootable disc, so you will need to extract it and then burn it to CD as an ISO image file, NOT just like a normal data CD.

Q

 

Okay thanks. But before I try that, could I run the chkdsk in the task manager again like Earthling was telling me about, and see if it does anything different? It couldn't hurt could it?... Also, someone told me I should try taking the drive out, and put it on an external enclosure. And then I should be able to see my files... Does that sound about right?

 

Yeah run the chkdsk it can't do any harm.

Trying the HDD in an external enclosure would be good too

***********

BTW, I should have said before.... DO NOT do anything with that disc when you burn it, it is a comlpicated lil devil, their only a couple of specific tools on it that will be of use, and if you use the wrong thing you can make things worse!

I am off to bed now, so ill check in tomorow evening (GMT) and talk you through that disc if you have had no joy by then.



Q

 

Thanks a lot Q. I'm turning in now anyway. haha Talk to you later. And Earthling, about six hours after we last talked, I turned on my computer, and everything was and is still the same.. Both drives are in the same places that they were in, and I still can't get into the big drive. That's weird. It should've at least done something. I mean geez, you were worried that the computer was gonna crash! But nope, nothing's even happened with the disk!.. I'm gonna run the chkdsk again tomorrow. Thanks a lot for your help too.

 

Hi again andrea, yes, definitely run the chkdsk d: /r command again. It failed to complete of course last time, which we have to assume explains why you still can't access the drive. Unless it hangs again it shouldn't take anything like as long this time, as it's already fixed many of the files, but it failed to complete the repair of the filing system. Hope we have better luck this time.

AFAIK chkdsk is the most powerful tool available for fixing busted NTFS systems. Maybe someone else looking in knows of other tools we could try.

BTW this suggestion of putting the drive in an enclosure probably does eliminate the risk I was concerned about - that if the disk suddenly became accessible the two XP systems might come into conflict - but I can't see how it's going to help with the access issue itself.

I'm in the UK and it seems we have a significant time difference, which doesn't help much.

 

andrea, re-reading M$ technical notes about using chkdsk I suggest the next run should also include the /f switch

chkdsk d: /f /r

However the article also says that with very large disks, which it describes as 'over 70GB', the check might take several days and the computer will not be available during that time.

You will have to decide how you feel about that possibility.

 

Okay, I'll just do that Earthling. I've already had this problem for almost a few weeks now. So what's a few days more anyway? Thanks a lot and I'll be doing that now. I'll keep you posted!

 

"Windows cannot find 'chkdsk'. Make sure you typed the name correctly, and then try again.. To search for a file, click the Start button, and then click Search"... And yes, I didn't only type chkdsk.. I typed, chkdsk d: /f /r

 

Sorry, that was a typo.

The correct command is chkdsk d: /f /r

 

lol I should've known that. Thanks

 

Hi andrea, How is it going?

 

Not so good Q. I had a dream last night that I was on my computer and I got into my files. Haha, now that's sad! I really still can't get into them.... Hey Earthling, I did the chkdsk d: /f /r , and it did the same thing as the last command you gave me... The last thing I saw it doing was 'Correcting errors in the Boot File'... And then after a while I went to x it out and it gave me that same message about what would happen if I ended it.... *SIGH* .... And yes, I restarted the computer and everything's still the same.. I know you said the changes might not happen for a few days, but I could tell the chkdsk didn't finish what it was doing.. Why oh why didn't it finish!!

 

Well, in view of M$ saying it might take days, I'm thinking maybe we just need to give it more time. How about starting it again and leaving it overnight? Nothing to lose after all.

EDIT - just seen your edit. I didn't say the changes might take a few days, I said the chkdsk itself might take a few days. But try leaving it ovenight.