Archived from groups: microsoft.public.windowsxp.security_admin (
More info?)
On Mon, 20 Jun 2005 14:43:33 -0600, "Wesley Vogel"
>C:\$Mft
>Mft = Master File Table
>[[If chkdsk cannot fix it then you should copy off all the important data
>you have from that machine while you still can.
If ChkDsk does "fix" it, you could be left with massively corrupted
data that's no longer detectable as such. By then it's too late to
try and copy stuff off, or try to manually repair the file system.
>Every writing activity you do on that partition can
>potentially destroy data.]]
And that is true too. There's not a thing from MS that the user can
use, that can (a) read NTFS and (b) not automatically write to it.
Such a thing would be a maintenance OS (mOS), as per...
http://cquirke.mvps.org/qhatmos.htm
If he runs Windows, it WILL write temp files etc. all over the place,
even if he uses Safe Mode Cmd Only.
If he runs the Recovery Console (RC), that may be safe from the
perspective of writes, but unless it can see the installation, he
won't be allowed into it. And unless he's *already* done some
non-standard settings to facilitate the Set commands, he won't be
allowed to copy files off C:, or to access files anywhere other than
on C:. If he's got everything in place, he can only copy off files
one at a time (no subtree copy), by name (no wildcards). For data
recovery, RC is next to useless.
If he drops the sick HD into another XP system and starts up, then at
least that system won;t be puking Temp and pagefile writes to it. But
AutoChk will try to maul (sorry, "fix") the file system first, unless
he's first gone into RegEdit to suppress that, or is smart (and quick)
enough to Esc it when it says "I'm going to blunder around 'fixing'
your HD in X seconds...".
Having batted that away and started XP, System Restore (SR) will start
creating a new subtree on the HD, because SR defaults to "on" for any
HD not seen before (after all, all hard drives are "part of the
system", right?). Then there's the indexer, and the thumbnail
generator, and the av, and who knows what other "helpful" background
trash that always drools on every HD they see, as well as the OS
updating the last-accessed time stamps of anything you touch.
No thanks to MS, there *is* something that he can use to get data off,
even though there's no tools like DiskEdit that he can use to repair
broken core NTFS structures like $MFT.
It's called Bart's PE, and it's the maintenance OS that MS should have
made. On a good PC, he'd have to find it, download it, and build a
bootable XP CDR with it. Then he could plug in a fat USB stick (Bart
can only see these from boot) and boot the CDR, and from there he can
copy off files in bulk, using Cmd.exe or Bart's non-Explorer shell.
But if the file structure's bad, the chances are the contents may be
bent. At least this way, without file system "fixing", he'd get a cue
as to what's bent by what files give errors when copying - he'll know
what's definately bent, and the rest will only be possibly bent.
>-- Risk Management is the clue that asks:
"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"
>----------------------- ------ ---- --- -- - - - -
Facebook
Twitter
Instagram