View C:\$Extend from a Windows Environment - Trying to fix a 0xC1F5 bc....

Cant see it in a Windows Environment. Thats why I am trying Linux...... And it bsods a Win environment booted by CD/DVD...

Knoppix failed to load.....Trying Slax......

Guessing I need root access to delete the file. Assuming I am logged on as root, as under switch user it shows ....

"root: default(:0, vt7)"

Owner of the file is root, so if anyone has any ideas under SLAX how to delete the file, or if there is a command line method to do it, I would be grateful. Like I said before I am a dumb end user in linux.... I know enough to be very very dangerous......

Sorry about the big paste, but I found this some time ago and it works with the following edit. Where he says cd /mnt/windows/\$Extend/RmMetadata, I found that I needed to get there one level at a time, e.g. cd /mnt enter, cd windows enter, cd \$Extend etc. and if you back out one level, it loses the plot and you have to start again. Watch the backslash before $ .....

Last night, I did something stupid on my primary desktop computer (a Vista box) and needed to restore the system to a recent backup. I use Windows Home Server on my home network, so I was confident in my ability to roll back the system to a previous night's backup. I booted my machine using the WHS Client Restore CD, chose the appropriate backup, waited (im)patiently for about two hours while the bits were restored, the system rebooted...

...and that's when I saw the Blue Screen of Death... specifically, a STOP 0x0000C1F5. ****.

Now, my first instinct was that I had a sketchy backup image in WHS, and perhaps I should try a slightlly older one. I repeated the restore process with three older backups and got the same result. On the verge of going off on a major "WHS sucks" tirade, I instead opted for some Googling on a still-working system to see if I could find any clues. It seems as though the frequency of reports of STOP 0x0000C1F5 problems is increasing, with most people attributing the issue to a bad Vista SP1 (or prepare-for-SP1) update or patch. Microsoft acknowledges the problem in KB946084, but there is no public hotfix or workaround save for "clear the MBR and reinstall", which IMHO is unacceptable.

Looking at the problem a little more closely, it seems that if the $TxfLog file is corrupted, the Common Log File System Driver shits the bed at boot time, causing the BSOD. The particularly nasty thing about this problem is that you cannot even boot the Vista distribution DVD to use its repair tools; the BSOD occurs when you boot from DVD too! Basically, it crashes whenever a Windows box tries to mount the file system.

Soooo... a fix might be possible by accessing the disk using an operating system that doesn't give a rat's about Windows file systems (e.g. Linux).

At this point, I broke out one of my favorite sysadmin tools, SystemRescueCD. This is a Linux-based live distro that has all sorts of diagnostic and repair goodies on it. I figured that if I booted the SystemRescueCD disk, I might be able to diagnose, and maybe even repair, the problem.

(Unsolicited plug alert: take a minute to download SystemRescueCD, burn a copy, and add it to your sysadmin bag of tricks. The folks who make and maintain this disc do a helluva good job... it has saved my bacon more than once. Check it out.)

So, here's an overview of how I fixed my system. For part 1, you need a SystemRescueCD disc (and don't forget that Linux commands are case-sensitive):

1. Boot the SystemRescueCD disc, answering any localization questions as required, until you get to a command prompt.
2. Mount your hard drive at /mnt/windows using ntfs-3g, e.g. "ntfs-3g /dev/sda1 /mnt/windows". You may have to look at /dev/hd* and /dev/sd* to figure out the correct device to mount. Also, if the NTFS file system is corrupted (which it probably is if you are reading this post) you may have to add the "-o force" flag to the mount, e.g. "ntfs-3g /dev/sda1 /mnt/windows -o force".
3. Verify that you have the correct file system mounted by "ls /mnt/windows". You should see the content of "C:\"... if you don't, repeat (2) until you mount the correct device.
4. Navigate to the hidden folder: "cd /mnt/windows/\$Extend/RmMetadata". Note the backslash before the $; that is important as it keeps the command shell from interpreting the $ (it is really part of the file name).
5. Take a deep breath and recursively remove the $TxfLog file: "rm -rf \$TxfLog". Use "ls" to verify that it has been deleted.
6. "cd /", "umount /mnt/windows", and "init 6" to reboot, removing the CD when appropriate.

At this point, your system will no longer bluescreen, but it won't boot, either. To fix that, here's part 2, for which you'll need a Vista DVD:

7. Boot the Vista DVD and choose "Repair my computer".
8. When the system looks for Vista installations to repair, it probably won't find any. Don't panic; just click Next.
9. In the System Recovery Options list, choose Startup Repair. The system will process for a minute or two, then state that it needs to reboot to finish its repair. Allow it to reboot.
10. Remove the DVD at the appropriate time and allow the system to boot from the hard drive.
11. If the system complains that it was not shut down properly, choose "boot normally".

That's it. With any luck at all you should have a bootable system again.

The STOP 0x0000C1F5 bug is a nasty one, and I am confident that Microsoft will release a hotfix and/or Windows Update for it soon. In the meantime, if you are experiencing the problem, I hope this article helps to get you running again.
______

Good Luck

Chris B

Already tried that link....

http://www.delmartian.com/nullpointers/printblog?index_php?view=article&id=50&tmpl=component&print=1

I can mount the disk in the SLAX gui, and I can see the file I need to delete.... Just cant get past the denails....

I have also tried going one step at a time to get to teh files in the SystemRescueCD, but it just isnt working.....

You probably shouldn't delete/remove that file.

$Extend is an NTFS system file. Used for various optional extensions such as quotas, reparse point data and object identifiers.

Reference:
http://www.ntfs.com/ntfs-system-files.htm

As for the 0xC1F5, there is a Microsoft hotfix available for it...

Stop error message when you start a Windows Vista-based computer: "0x0000C1F5"
http://support.microsoft.com/kb/946084

mwecomputers...

Stop error message when you start a Windows Vista-based computer: "0x0000C1F5"
http://support.microsoft.com/kb/946084

Is an inside hotfix to prevent this from happening. Once it happens though, there is no GUI access/Win32 method to boot (BartPE/UBCD4Win etc.) to get into the OS with this drive connected, as once Windows tries to mount the drive it fails because that file is corrupted. Yes it is a criticla file, but in the event to try and fix this, it must be deleted. It will be rebuilt....

Back in the SystemRescueCD, I am back to the drive. Realized that when I loaded SLAX, it mounted in the GUI as SDA2, so back in the SRCD, I mounted using.....

ntfs-3g /dev/sda2/ mnt/windows, and can see the drive's data, so I know I am now on the correct drive. So, from /mnt/windows, I cant see the $Extend directory. Probably a syntax error on my part.

Even tried to use mattrib -h to remove the hidden attribute, but no go....

So I am at least farther than I was....  :)

It is hidden, but you can get to it - cd \$Extend. There was something odd about this bit. The \ doesn't reference the root directory like in dos or windows, it just allows the $ to be part of the directory name. I can't remember how I did this, if you can't catch it I will set up a temp Vista install shortly and work it out. Don't want to play with the working machine.

Chris B

Vista is installing .....

Chris B

I went back in and retried using the full path, and I was able to delete it. Now just got to burn an ISO of Vista 32b to repair the install.... Thats another problem though.....

I do appreciate you going all out in helping to clarify the commands... Sometimes I wish I wasnt so dumb in linux.... Heck, I porefer the command ine in Windows, so you would think Linux would be an ideal alternative?

Thanks again, I will close this part of my problem out for now.....

Thanks again!

Excellent. Glad it worked. I don't "linux" much myself either, but years of SCO Unix covers most of what happens on the command line.

Chris B

The $  symbol is special to the Linux shell is all, nothing special about when using filenames with $,  You escape $ with a \   as above or place the name in single quotes.    Unless you want the shell to expand it as a variable.  

The $Extend  $TxfLog and similar  directory entries on a NTFS filesystem are internal to the NTFS  MFT these directory entries really should not be removed, as it is in effect damage to the NTFS volume.

MS went out of their way to make sure these could not be touched directly, so beware, that removing them using a foreign OS is not supported by MS.

chkdsk may be able to handle this and repair the missing MFT entries, to some extent,  but there is a possibility of data corruption on the volume...   dumping  in-flight operations from a FS transaction log without a proper rollback can result in some serious corruption.

So you might want to examine what you get after running a chkdsk with full repair very carefully. And depending on the importance of the system,  copy  any documents to backup media,  and  re-format/clean-install with a fresh filesystem you'll know to be healthy


Certainly you can take your chances --  if a full chkdsk succeeds without error and the system boots,  the risk from then on is small.

But there's still a possibility of latent corruption of other system files or metadata you may not find immediately.

Mysidia, you obviously haven't experienced this particular error. It is not possible to boot to the DVD once this occurs, so it is a little difficult to take the course you suggest. Microsoft acknowledge this particular issue and offer the hotfix to prevent it.

Chris B

Basically, once I removed the corrupted $TxfLog file, (yes I know it is critical to the funtions of NTFS, but if it is corrupted, youre basically in the same boat you start down by deleting it), I was able to actually use a USB Sata adapter, and browse the drive. Then lo and behold, I found a recovery partition.. Although I BSOD 0xC1F5 booting to a DVD, I could still boot to a Windows ME CD, and I was about to FDISK it, then decided to give the restore a try. I am about to get a logon prompt for the first time on this box, from a fully destructive recovery......

I think the key to it, was removing the file, and allowing it to rebuild...... As before that, I even blue screened a machine that it was slaved to, directly on the controller.........

Cause before that, it was in paperweight mode.....   :^)

FYI, logged back in ok, just need to complete my setup tweaks/install apps and I am good to go.....

Glad it's working, but the plan was to boot to the vista DVD and "Repair My Computer", then no need to reinstall. The repair runs for ages, says it can't fix it, then you reboot and it is back to normal. Ah well, a rebuild is almost as good as a new PC....

Chris B