Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

Nuked SD card after chkdsc or BCD change - any file forensics help?

microsoft.public.windows.vista.file management






Speedup My PC
Reply
  #1 (permalink)  
Old 12-26-2007
a.k.a.
 

Posts: n/a
Nuked SD card after chkdsc or BCD change - any file forensics help?
Greetings, everyone!

Can anyone provide advice on forensic approaches or utilities to try on a
nuked SD card? Or suggest the best forums to cross-post in?

In the middle of installing a multiboot of Server x64 RC2 and Vista x64 SP1
RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
began to hang in Vista, and even on the occasions I could get into a Safe
Mode boot, the BSOD would reappear.

Somewhere in there, the path for the Vista boot was erased, and I used
EasyBCD to restore the entry successfully. That triggered Chkdsc instead of
Autochk on the next reboot, but no change in Vista's behavior. Amidst all of
this, I'd inadvertently left an SD card in a reader slot, and the contents
at some point got nuked.

(For those who begin to tut-tut, please know that Server has given me none
of the instability issues that the Vista x64 SP1 RC has. It installs drivers
without balking that Vista refuses to, and has none of the BSODs or Autochk
hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the source
of the problem -- reacting to non-threatening driver problems and directory
mismatches by making the situation a whole lot worse.)

The SD card shows a large number of folder and blank file icons, with
gibberish as names and file extensions. (It's possible that these are
elements of the pre-existing folder and file structure, as there was about
1GB of info on it.) Double-clicking on anything leads to unreadable file
errors.

Undelete Plus finds the volume unscannable.

Thanks for offering your insights.
a.k.a.

Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 12-26-2007
Sharon F
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensics help?
On Wed, 26 Dec 2007 15:46:50 -0500, a.k.a. wrote:

> Undelete Plus finds the volume unscannable.


How old is the card? These have a limited lifetime (shorter than what I had
hoped for). It's possible yours has bit the dust?

--
Sharon F
MS-MVP ~ Windows Shell/User
Reply With Quote
  #3 (permalink)  
Old 12-26-2007
Malke
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensicshelp?
a.k.a. wrote:
> Greetings, everyone!
>
> Can anyone provide advice on forensic approaches or utilities to try on
> a nuked SD card? Or suggest the best forums to cross-post in?
>
> In the middle of installing a multiboot of Server x64 RC2 and Vista x64
> SP1 RC, I began encountering BSODs on shutdown of Vista. On reboot,
> Autochk began to hang in Vista, and even on the occasions I could get
> into a Safe Mode boot, the BSOD would reappear.
>
> Somewhere in there, the path for the Vista boot was erased, and I used
> EasyBCD to restore the entry successfully. That triggered Chkdsc instead
> of Autochk on the next reboot, but no change in Vista's behavior. Amidst
> all of this, I'd inadvertently left an SD card in a reader slot, and the
> contents at some point got nuked.


(snippage)

> The SD card shows a large number of folder and blank file icons, with
> gibberish as names and file extensions. (It's possible that these are
> elements of the pre-existing folder and file structure, as there was
> about 1GB of info on it.) Double-clicking on anything leads to
> unreadable file errors.
>
> Undelete Plus finds the volume unscannable.


You can run data recovery software on the card. I've heard that Undelete
Plus is good but I'd try some others, too. The ones that cost usually
will let you download a trial to see if they can recover the files. I
use Easy Recovery Pro, but it is expensive. People whom I respect have
recommended R-Studio and Restoration. YMMV.

http://www3.telus.net/mikebike/RESTORATION.html
PCInspector File Recovery -
http://www.pcinspector.de/file_recovery/welcome.htm
Executive Software “Undelete” -
http://www.execsoft.com/undelete/undelete.asp
R-Studio - http://www.r-tt.com/
File Scavenger - http://www.quetek.com/prod02.htm
Ontrack's EasyRecovery - http://www.ontrack.com/software/

I've also had very good luck with PhotoRescue:
http://www.datarescue.com/photorescue/

If consumer-level data recovery software will not help, then your only
recourse is a professional data recovery company such as DriveSavers.
This is quite an expensive proposition ($500+), but only you know the
value of your data.


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User
Reply With Quote
  #4 (permalink)  
Old 12-27-2007
a.k.a.
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensics

Sharon, in this case, the card is at most 2 months old, bought based on a 4+
star rating at Newegg, so presumably reliable. I'll eventually reformat to
see if the card is corrupt, but of course it's too early to do so. Most
likely this was another one of those hidden Windows death traps. Grr.

a.k.a.

"Sharon F" wrote:

> On Wed, 26 Dec 2007 15:46:50 -0500, a.k.a. wrote:
>
> > Undelete Plus finds the volume unscannable.

>
> How old is the card? These have a limited lifetime (shorter than what I had
> hoped for). It's possible yours has bit the dust?
>
> --
> Sharon F
> MS-MVP ~ Windows Shell/User
>

Reply With Quote
  #5 (permalink)  
Old 12-27-2007
a.k.a.
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensics

Malke, thanks for all of these leads! I'll give them a shot, and in a while,
will post back with whatever results they give.

a.k.a.

"Malke" wrote:

> a.k.a. wrote:
> > Greetings, everyone!
> >
> > Can anyone provide advice on forensic approaches or utilities to try on
> > a nuked SD card? Or suggest the best forums to cross-post in?
> >
> > In the middle of installing a multiboot of Server x64 RC2 and Vista x64
> > SP1 RC, I began encountering BSODs on shutdown of Vista. On reboot,
> > Autochk began to hang in Vista, and even on the occasions I could get
> > into a Safe Mode boot, the BSOD would reappear.
> >
> > Somewhere in there, the path for the Vista boot was erased, and I used
> > EasyBCD to restore the entry successfully. That triggered Chkdsc instead
> > of Autochk on the next reboot, but no change in Vista's behavior. Amidst
> > all of this, I'd inadvertently left an SD card in a reader slot, and the
> > contents at some point got nuked.

>
> (snippage)
>
> > The SD card shows a large number of folder and blank file icons, with
> > gibberish as names and file extensions. (It's possible that these are
> > elements of the pre-existing folder and file structure, as there was
> > about 1GB of info on it.) Double-clicking on anything leads to
> > unreadable file errors.
> >
> > Undelete Plus finds the volume unscannable.

>
> You can run data recovery software on the card. I've heard that Undelete
> Plus is good but I'd try some others, too. The ones that cost usually
> will let you download a trial to see if they can recover the files. I
> use Easy Recovery Pro, but it is expensive. People whom I respect have
> recommended R-Studio and Restoration. YMMV.
>
> http://www3.telus.net/mikebike/RESTORATION.html
> PCInspector File Recovery -
> http://www.pcinspector.de/file_recovery/welcome.htm
> Executive Software ā€œUndeleteā€ -
> http://www.execsoft.com/undelete/undelete.asp
> R-Studio - http://www.r-tt.com/
> File Scavenger - http://www.quetek.com/prod02.htm
> Ontrack's EasyRecovery - http://www.ontrack.com/software/
>
> I've also had very good luck with PhotoRescue:
> http://www.datarescue.com/photorescue/
>
> If consumer-level data recovery software will not help, then your only
> recourse is a professional data recovery company such as DriveSavers.
> This is quite an expensive proposition ($500+), but only you know the
> value of your data.
>
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>

Reply With Quote
  #6 (permalink)  
Old 12-27-2007
a.k.a.
 

Posts: n/a
RE: Nuked SD card after chkdsc or BCD change - any file forensics help

Incidentally, the weird thing about the Vista x64 Autochk hang was that,
waiting a bit, you could hear the audio Vista startup jingle! I even tried
ctrl+alt+del -> password -> enter on the premise it might actually log in.
The screen remained in B&W verbose mode, but the hard drive activity kicked
in again for several long minutes.

The Autochk hang occurred at the point where it said it was done with the
scan of all of the volumes.

Anyone know another forum where this issue should be reported?

a.k.a.

"a.k.a." wrote:

> Greetings, everyone!
>
> Can anyone provide advice on forensic approaches or utilities to try on a
> nuked SD card? Or suggest the best forums to cross-post in?
>
> In the middle of installing a multiboot of Server x64 RC2 and Vista x64 SP1
> RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
> began to hang in Vista, and even on the occasions I could get into a Safe
> Mode boot, the BSOD would reappear.
>
> Somewhere in there, the path for the Vista boot was erased, and I used
> EasyBCD to restore the entry successfully. That triggered Chkdsc instead of
> Autochk on the next reboot, but no change in Vista's behavior. Amidst all of
> this, I'd inadvertently left an SD card in a reader slot, and the contents
> at some point got nuked.
>
> (For those who begin to tut-tut, please know that Server has given me none
> of the instability issues that the Vista x64 SP1 RC has. It installs drivers
> without balking that Vista refuses to, and has none of the BSODs or Autochk
> hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the source
> of the problem -- reacting to non-threatening driver problems and directory
> mismatches by making the situation a whole lot worse.)
>
> The SD card shows a large number of folder and blank file icons, with
> gibberish as names and file extensions. (It's possible that these are
> elements of the pre-existing folder and file structure, as there was about
> 1GB of info on it.) Double-clicking on anything leads to unreadable file
> errors.
>
> Undelete Plus finds the volume unscannable.
>
> Thanks for offering your insights.
> a.k.a.
>
>

Reply With Quote
  #7 (permalink)  
Old 12-27-2007
Richard Urban
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensics help
If a drive constantly hangs when doing an auto check, or when running
chkdsk, I would certainly run the drive manufacturers hard drive test
utility from a bootable floppy or CD.

--

Regards,

Richard Urban
Microsoft MVP Windows Shell/User


"a.k.a." <aka@discussions.microsoft.com> wrote in message
news:FBE4CE80-9599-4DB0-8AD4-A22F0F081671@microsoft.com...
>
> Incidentally, the weird thing about the Vista x64 Autochk hang was that,
> waiting a bit, you could hear the audio Vista startup jingle! I even tried
> ctrl+alt+del -> password -> enter on the premise it might actually log in.
> The screen remained in B&W verbose mode, but the hard drive activity
> kicked
> in again for several long minutes.
>
> The Autochk hang occurred at the point where it said it was done with the
> scan of all of the volumes.
>
> Anyone know another forum where this issue should be reported?
>
> a.k.a.
>
> "a.k.a." wrote:
>
>> Greetings, everyone!
>>
>> Can anyone provide advice on forensic approaches or utilities to try on a
>> nuked SD card? Or suggest the best forums to cross-post in?
>>
>> In the middle of installing a multiboot of Server x64 RC2 and Vista x64
>> SP1
>> RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
>> began to hang in Vista, and even on the occasions I could get into a Safe
>> Mode boot, the BSOD would reappear.
>>
>> Somewhere in there, the path for the Vista boot was erased, and I used
>> EasyBCD to restore the entry successfully. That triggered Chkdsc instead
>> of
>> Autochk on the next reboot, but no change in Vista's behavior. Amidst all
>> of
>> this, I'd inadvertently left an SD card in a reader slot, and the
>> contents
>> at some point got nuked.
>>
>> (For those who begin to tut-tut, please know that Server has given me
>> none
>> of the instability issues that the Vista x64 SP1 RC has. It installs
>> drivers
>> without balking that Vista refuses to, and has none of the BSODs or
>> Autochk
>> hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the
>> source
>> of the problem -- reacting to non-threatening driver problems and
>> directory
>> mismatches by making the situation a whole lot worse.)
>>
>> The SD card shows a large number of folder and blank file icons, with
>> gibberish as names and file extensions. (It's possible that these are
>> elements of the pre-existing folder and file structure, as there was
>> about
>> 1GB of info on it.) Double-clicking on anything leads to unreadable file
>> errors.
>>
>> Undelete Plus finds the volume unscannable.
>>
>> Thanks for offering your insights.
>> a.k.a.
>>
>>


Reply With Quote
  #8 (permalink)  
Old 12-27-2007
whiteurls@gmail.com
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensicshelp?

> The SD card shows a large number of folder and blank file icons, with
> gibberish as names and file extensions. (It's possible that these are
> elements of the pre-existing folder and file structure, as there was about
> 1GB of info on it.) Double-clicking on anything leads to unreadable file
> errors.
>
> Undelete Plus finds the volume unscannable.
>
> Thanks for offering your insights.
> a.k.a.


For the successful recovery of pictures from SD card, take the help of
Stellar Phoenix Digital Media Recovery Software. Stellar Phoenix
recovers lost, deleted and formatted digital photos / pictures /
images / audio files from removable media, after an accidental
deletion, media format or corrupt media. Apart from the SD card it
also provides data recovery from Memory Sticks, Flash Cards, Sony
Memory Stick, IBM Micro Drive, MMC Cards, XD Cards, Secure Digital
Card, Zip Disks, Mini Disks.
For more information visit: http://www.stellarinfo.com/digital-media-recovery.htm
Reply With Quote
  #9 (permalink)  
Old 12-27-2007
a.k.a.
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensics

Richard,
I'll do so. This is a brand new drive, though, with the latest firmware
flash. What's puzzling about the hangs is that they only occur in Vista x64.
The Server 2008 x64 that's mounted on the same drive has never seen a single
hang of this sort.
a.k.a.

"Richard Urban" wrote:

> If a drive constantly hangs when doing an auto check, or when running
> chkdsk, I would certainly run the drive manufacturers hard drive test
> utility from a bootable floppy or CD.
>
> --
>
> Regards,
>
> Richard Urban
> Microsoft MVP Windows Shell/User
>
>
> "a.k.a." <aka@discussions.microsoft.com> wrote in message
> news:FBE4CE80-9599-4DB0-8AD4-A22F0F081671@microsoft.com...
> >
> > Incidentally, the weird thing about the Vista x64 Autochk hang was that,
> > waiting a bit, you could hear the audio Vista startup jingle! I even tried
> > ctrl+alt+del -> password -> enter on the premise it might actually log in.
> > The screen remained in B&W verbose mode, but the hard drive activity
> > kicked
> > in again for several long minutes.
> >
> > The Autochk hang occurred at the point where it said it was done with the
> > scan of all of the volumes.
> >
> > Anyone know another forum where this issue should be reported?
> >
> > a.k.a.
> >
> > "a.k.a." wrote:
> >
> >> Greetings, everyone!
> >>
> >> Can anyone provide advice on forensic approaches or utilities to try on a
> >> nuked SD card? Or suggest the best forums to cross-post in?
> >>
> >> In the middle of installing a multiboot of Server x64 RC2 and Vista x64
> >> SP1
> >> RC, I began encountering BSODs on shutdown of Vista. On reboot, Autochk
> >> began to hang in Vista, and even on the occasions I could get into a Safe
> >> Mode boot, the BSOD would reappear.
> >>
> >> Somewhere in there, the path for the Vista boot was erased, and I used
> >> EasyBCD to restore the entry successfully. That triggered Chkdsc instead
> >> of
> >> Autochk on the next reboot, but no change in Vista's behavior. Amidst all
> >> of
> >> this, I'd inadvertently left an SD card in a reader slot, and the
> >> contents
> >> at some point got nuked.
> >>
> >> (For those who begin to tut-tut, please know that Server has given me
> >> none
> >> of the instability issues that the Vista x64 SP1 RC has. It installs
> >> drivers
> >> without balking that Vista refuses to, and has none of the BSODs or
> >> Autochk
> >> hangs of Vista x64. If anything, it's Autochk and Chkdsc that are the
> >> source
> >> of the problem -- reacting to non-threatening driver problems and
> >> directory
> >> mismatches by making the situation a whole lot worse.)
> >>
> >> The SD card shows a large number of folder and blank file icons, with
> >> gibberish as names and file extensions. (It's possible that these are
> >> elements of the pre-existing folder and file structure, as there was
> >> about
> >> 1GB of info on it.) Double-clicking on anything leads to unreadable file
> >> errors.
> >>
> >> Undelete Plus finds the volume unscannable.
> >>
> >> Thanks for offering your insights.
> >> a.k.a.
> >>
> >>

>
>

Reply With Quote
  #10 (permalink)  
Old 12-27-2007
a.k.a.
 

Posts: n/a
Re: Nuked SD card after chkdsc or BCD change - any file forensics
Thanks for this suggestion. I'll check it out as well.

Of the many docs that were stored temporarily on the SD card, the most
important were PDFs. I've heard PDF described as a hi-performance graphics
format, so this one may be worth it if it decodes PDF.
a.k.a.

"whiteurls@gmail.com" wrote:

>
> > The SD card shows a large number of folder and blank file icons, with
> > gibberish as names and file extensions. (It's possible that these are
> > elements of the pre-existing folder and file structure, as there was about
> > 1GB of info on it.) Double-clicking on anything leads to unreadable file
> > errors.
> >
> > Undelete Plus finds the volume unscannable.
> >
> > Thanks for offering your insights.
> > a.k.a.

>
> For the successful recovery of pictures from SD card, take the help of
> Stellar Phoenix Digital Media Recovery Software. Stellar Phoenix
> recovers lost, deleted and formatted digital photos / pictures /
> images / audio files from removable media, after an accidental
> deletion, media format or corrupt media. Apart from the SD card it
> also provides data recovery from Memory Sticks, Flash Cards, Sony
> Memory Stick, IBM Micro Drive, MMC Cards, XD Cards, Secure Digital
> Card, Zip Disks, Mini Disks.
> For more information visit: http://www.stellarinfo.com/digital-media-recovery.htm
>

Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
BCD: who or what creates the BCD file? Fabelus microsoft.public.windows.vista.installation setup 2 11-23-2007 00:19
Patch Tuesday nuked my network connection M1cr0s0ft microsoft.public.windows.vista.general 19 10-13-2007 21:36
Move BCD store to other partition Nick Wouters microsoft.public.windows.vista.installation setup 5 07-25-2007 15:14
I change Graphical card Fernando Berodia Herrera microsoft.public.windows.vista hardware devices 4 06-28-2007 16:07
How do you change file name extension in File/Dir Explorer? maruk2@hotmail.com microsoft.public.windows.vista.general 5 02-18-2007 02:18




All times are GMT +1. The time now is 21:45.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120