cgsecurity.org

Hello,

Recently, I have had problems with starting my laptop (Windows 7 Home Premium SP 1) after an inexpected shutdown, namely:

When trying to start the laptop normally, I get a 0xc0000098 error (The Windows Boot Configuration Data file does not contain a valid OS entry).

Using a Recovery Environment I have (from the OEM, not a Windows installation disc, since I bought the laptop with the OS preinstalled), I am able to get to a command prompt. Following advice found online, e. g. here https://neosmart.net/wiki/0xc0000098/, I try to rebuild the BCD (bootrec /rebuildBCD), but I get a "Total identified Windows installations: 0" message.

Going into diskpart, there are 3 partitions on the disc, 2 are listed as NTFS, and the other one - the "big" one, with most of the space assigned to it and where I assume the OS must be installed - as RAW.

Yet, if I run chkdsk in read-only mode (without attributes) on this partition, using the same dive letters as in diskpart, it scans it and comes up with, as far as I can tell, only one error in an index. (If necessary, I can post the output here, or send it via a private message). I have avoided running chkdsk /f so far, since I am not sure if it will not damage some of the files.

sfc /scannow returns a pending restart message, thus does not complete (I don't remember the exact wording).

A few people have advised me to "run TestDisk", so my questions:

From the information above, can it be told if the utility will be able to help? If so, what has to be done - I am not even sure if this would be a partition recovery or filesystem repair case, so I don't know which part of the documentation to follow.

Also, since this is a problem with the bootable partition, apparently I will need to boot from a live USB - I can create one using the Fedora image and Rawrite32 as suggested, but does TestDisk come already installed with this, or do I need to do anything further? If booting from a USB, are logs stored, and where? The link in the documentation is to the French version of the Fedora website, does it matter if the English one is used?

I seem to have 3 options at the moment - run chkdsk /f, in case it will be of use, but this is not certain, try to use the OEM recovery media with the option of "Recovery with user's data", which is said to "attempt to back up all data from C:\Users" (but I am reluctant to do this, since I might have some data outside this directory I would want to save too), or see what can be done with TestDisk.

Any advice on how to proceed would be welcome.

Thanks.

Please do not use abbreviations such as "TD" because issues with

https://www.td.com/us/en/personal-banking

should be solved with their support and not at cgsecurity.org.

It basically suggests me that you are not willing to invest the time to be precise whereas I often invest much more time than forum users!

QMark wrote: 24 Sep 2024, 18:02 Hello,

Recently, I have had problems with starting my laptop (Windows 7 Home Premium SP 1) after an inexpected shutdown, namely:

If your secret timeless laptop came with Windows 7, it is definitively an older one which suggests it might be wore down or overheated.

When trying to start the laptop normally, I get a 0xc0000098 error (The Windows Boot Configuration Data file does not contain a valid OS entry).

Using a Recovery Environment I have (from the OEM, not a Windows installation disc, since I bought the laptop with the OS preinstalled), I am able to get to a command prompt. Following advice found online, e. g. here https://neosmart.net/wiki/0xc0000098/, I try to rebuild the BCD (bootrec /rebuildBCD), but I get a "Total identified Windows installations: 0" message.

You are making a mistake here assuming that you just need to repair some boot files.

Going into diskpart, there are 3 partitions on the disc, 2 are listed as NTFS, and the other one - the "big" one, with most of the space assigned to it and where I assume the OS must be installed - as RAW.

You have learned here that the partition where the OS is supposed to be has become RAW. That means that there is no readable structure for the code that is executed during the startup process of Windows 7. There is no repair of your startup possible if it points to a broken partition. You startup data might be perfectly OK.

Yet, if I run chkdsk in read-only mode (without attributes) on this partition, using the same dive

What are "dive" letters?

letters as in diskpart, it scans it and comes up with, as far as I can tell, only one error in an index.

What is "this" partition?
I doubt that you did not provide a screenshot of that important fact anyway.

For my understanding that partition is not RAW
(If necessary,

That is just your opinion. Your operating system has a different one!

I can post the output here,

You need to post your TestDisk logfile.

or send it via a private message). I have avoided running chkdsk /f so far, since I am not sure if it will not damage some of the files.

You made the right decision!

sfc /scannow returns a pending restart message, thus does not complete (I don't remember the exact wording).

A few people have advised me to "run TestDisk", so my questions:

From the information above, can it be told if the utility will be able to help?

What do you mean exactly by help? For me TestDisk is always a helpful tool. If you want a guaranteed outcome of using TestDisk I can't promiss that to you. Your question can only be answered by somebody who can foresee. I am lacking this abilities.

If so, what has to be done - I am not even sure if this would be a partition recovery or filesystem repair case, so I don't know which part of the documentation to follow.

https://www.cgsecurity.org/wiki/TestDisk

Also, since this is a problem with the bootable partition, apparently I will need to boot from a live USB - I can create one using the Fedora image and Rawrite32 as suggested, but does TestDisk come already installed with this, or do I need to do anything further?

When I tried out the Fedora distribution that Christophe Grenier mentions in TestDisk.pdf I was missing TestDisk for instance. At the time that part of the documentation was written, I guess they were some reasons for to refer to Fedora.
The following picture of an older comparison of me shows you some information about some linux distributions. You do not need to understand German to read the key facts of the table:


SystemRescueCD and Gparted seem to be updated regularly. A lazy Windows user like me prefers the Linuxmint XFCE edtion which has a nice graphical user interface that allows to mount and unmount additional storage by clicking on device symbols (for instance to mount pen drives to store your log files, see your questions above)
The disadvantage is that you need to install all the important recovery tools which require a working internet connection. It might happen that the mint repositories do not dispose over the most recent version of a needed software. At least Linuxmint recognizes your commands and proposes you to install the needed software automatically.
If Linuxmint does not install the most recent version (7.2) of TestDisk you can alternatively manually download the TestDisk package and store it on your second pen drive. You would unpack its content and run the static version of TestDisk which does not need to be installed.

If booting from a USB, are logs stored, and where? The link in the documentation is to the French version of the Fedora website, does it matter if the English one is used?

No, as only the language changes. But that really applies to nearly every software, I think!
Without using a second pen drive to store data upon such as logs, logs are being stored in RAM and will get lost upon the next restart.

I seem to have 3 options at the moment - run chkdsk /f

I doubt that chkdsk will run a RAW file system and if it does, it does not recover anything. It brings back the system into a defined state which successfully destroys evidence for third party software. It is always a good thing to clone the disk using ddrescue as described in the manual especially when you are dealing with a dammaged file system like in your case.

, in case it will be of use, but this is not certain, try to use the OEM recovery media with the option of "Recovery with user's data", which is said to "attempt to back up all data from C:\Users" (but I am reluctant to do this, since I might have some data outside this directory I would want to save too), or see what can be done with TestDisk.

The simple standard recipe is:

1. read SMART parameters ( post the log file here!)
2. clone the disk using ddrescue
3. Run TestDisk against the clone to see if what data it can reach. ( post the log file here!)
4. If TestDisk does not succeed use a commercial software to see if it does better.
5. If everything fails, run PhotoRec from the TestDisk package.

Hello, and first of all, thanks for the reply.

Second:

It basically suggests me that you are not willing to invest the time to be precise whereas I often invest much more time than forum users!

If there is anything specific that needs further precision, please let me know what, I will be happy to comply - that is what I post here for.

recuperation wrote: 27 Sep 2024, 09:22

QMark wrote: 24 Sep 2024, 18:02 Hello,

Recently, I have had problems with starting my laptop (Windows 7 Home Premium SP 1) after an inexpected shutdown, namely:

If your secret timeless laptop came with Windows 7, it is definitively an older one which suggests it might be wore down or overheated.

Well, as one can guess, it is not brand new exactly, but, although I am more inclined to assume some power shock as the cause, whatever the reason may be, the problem is present, and so a way to address it must be sought.

recuperation wrote: 27 Sep 2024, 09:22

When trying to start the laptop normally, I get a 0xc0000098 error (The Windows Boot Configuration Data file does not contain a valid OS entry).

Using a Recovery Environment I have (from the OEM, not a Windows installation disc, since I bought the laptop with the OS preinstalled), I am able to get to a command prompt. Following advice found online, e. g. here https://neosmart.net/wiki/0xc0000098/, I try to rebuild the BCD (bootrec /rebuildBCD), but I get a "Total identified Windows installations: 0" message.

You are making a mistake here assuming that you just need to repair some boot files.

Well, for the "original" error in question - 0xc0000098 - I posted one link as an example, but there are others too (e. g. https://www.partitionwizard.com/disk-re ... 00098.html , https://www.partitionwizard.com/disk-re ... 0-006.html), and they all give about the same advice, namely, executing the bootrec commands (fixmbr, rebuildbcd, etc.) - I will not list everything here to avoid verbosity.

recuperation wrote: 27 Sep 2024, 09:22

Yet, if I run chkdsk in read-only mode (without attributes) on this partition, using the same dive

What are "dive" letters?

"Drive" letters, such as C:, D:, etc. as assigned by diskpart, since diskpart seems to assign different ones than what you see from within Windows - for example, from Windows my "main" (bootable, OS) partition was C:, but in diskpart it was given another letter.

recuperation wrote: 27 Sep 2024, 09:22

letters as in diskpart, it scans it and comes up with, as far as I can tell, only one error in an index.

What is "this" partition?
I doubt that you did not provide a screenshot of that important fact anyway.

"This" partition is the one referred to in the previous sentence, "the 'big' one, with most of the space assigned to it and where I assume the OS must be installed", which is listed as RAW by diskpart, and because of which all the debating here is going on.

I have nothing to take a screenshot with in Recovery Command Prompt, but I have copied the chkdsk output to a txt file, and if safe/necessary, can post it here (also, please see after the double quote below).

recuperation wrote: 27 Sep 2024, 09:22

For my understanding that partition is not RAW
(If necessary,

That is just your opinion. Your operating system has a different one!

Now could you tell me where this quote came from, I neither remember writing it, nor do I see it in my post?

recuperation wrote: 27 Sep 2024, 09:22

If so, what has to be done - I am not even sure if this would be a partition recovery or filesystem repair case, so I don't know which part of the documentation to follow.

https://www.cgsecurity.org/wiki/TestDisk

Any part of it, more precisely?

recuperation wrote: 27 Sep 2024, 09:22

Going into diskpart, there are 3 partitions on the disc, 2 are listed as NTFS, and the other one - the "big" one, with most of the space assigned to it and where I assume the OS must be installed - as RAW.

You have learned here that the partition where the OS is supposed to be has become RAW. That means that there is no readable structure for the code that is executed during the startup process of Windows 7. There is no repair of your startup possible if it points to a broken partition. You startup data might be perfectly OK.

recuperation wrote: 27 Sep 2024, 09:22

I seem to have 3 options at the moment - run chkdsk /f

I doubt that chkdsk will run a RAW file system and if it does, it does not recover anything. It brings back the system into a defined state which successfully destroys evidence for third party software. It is always a good thing to clone the disk using ddrescue as described in the manual especially when you are dealing with a dammaged file system like in your case.

So, this part in particular I might have not worded very well, but: what I am saying is that while in diskpart the partition is listed as RAW, chkdsk scans it (that is, it "sees" it) as NTFS, and seems to find only one error in an index. Thus, it seems that:

1. diskpart and chkdsk "look" at/for different things
2. Whatever chkdsk looks for is there
3. Whatever diskpart looks for is not

Whether this gives anything useful as information, I am not sure, but I thought it might help narrow down possible causes.

Anyway, it seems the thing to do now would be to run TestDisk from a bootable environment and get a log - I will do so and post it here. Meanwhile, if there is any other information to provide that might help, please let me know.

Thanks.