Error Stop 0x000000C5 (0x6e496D4D 0x0000000002 0x000000001 0x805529EC) DRIVER_CORRUPTED_EXPOOL  secondary slave drive

Posted on 2005-03-15
Medium Priority
Last Modified: 2012-06-27
Error Stop 0x000000C5 (0x6e496D4D 0x0000000002 0x000000001 0x805529EC) DRIVER_CORRUPTED_EXPOOL

A customer brought in a hard drive that, no matter what system I put it on, slave, master, USB attached, whatever,
it brings down the system with the above hard stop.  The customer wants me to get the data off the drive.      

The error stop message goes on to say that one can try to stop caching or shadowing memory options.  I haven't
seen any such options in bios setup for the systems I've tried attaching this drive to.  

I’m trying to understand the mechanism by which a secondary hard drive could cause such a stop at system startup,
and if there’s any way on any system to get around it at least long enough to get the data off it,
even using something like GetDataBack over a network link.  

Searches indicate that the problem is supposedly caused by a bad driver.  But I would think that a bad driver would
only apply to the drivers defined on the system being booted up.   In this case the drive is not being booted.  It’s a slave drive.  

Question by:alanlsilverman
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
  • +3
LVL 92

Assisted Solution

nobus earned 400 total points
ID: 13542760
ok, maybe you tried it but : did you try a pci to ide card?
did you try booting from a bootable cd, like ultimatebootcd?
When exactly does it give the stop error?

Author Comment

ID: 13543342
I have a highpoint pci to ide card.  It still happens with that.
I can get into the bios setup.  It's after that.  The windows xp startup screen goes on and then it stops.
Haven't tried a bootable cd yet.  I was thinking of just putting in the xp home cd and booting from there.
LVL 12

Accepted Solution

GinEric earned 600 total points
ID: 13543422
Microsoft says it is "nearly always" caused by a bad driver.  That means sometimes it's not.

Any virus on the hard drive could very easily cause that error.

How to get the data is another issue.  There are a couple of tools.

One is NT Resource Kit, which probably won't care about the disks existence in the Operating System, as it goes directly to the hard drive, formatted, labelled, Drive letter, or not.

The second is the install disk for the hard drive.  Western Digital usually supplies a floppy that can copy the entire disk as an image.  That's to make in case the drive gets corrupted.

Some BIOS will allow you to make an image copy of any hard drive.

Surely, there must be a section in BIOS for caching, I haven't seen on in years that doesn't have at least caching for the video area.  Most have all the areas that can be cached.  You should look again.

In the end, it sounds more like the disk got virused than anything else.  Something on the disk is trying to write to the system area; that is not allowed.  Windows polls disks on a regular basis, and sometimes allows disks to execute code before being used, for whatever reasons.

If you can get NT Resource Kit, or something similar, you might want to try that first before using disk data recovery software.  Many of them are very limited in what they can do.  And if the disk is virused, they will recover that too.

Sometimes it just comes down to using the old brain.

When you do get to the disk, make sure that it is not infected.  If it is, you'll have to copy it to a quarantined area and scan out viruses first.

How big is the disk and what directories does he want to recover?
Need protection from advanced malware attacks?

Look no further than WatchGuard's Total Security Suite, providing defense in depth against today's most headlining attacks like Petya 2.0 and WannaCry. Keep your organization out of the news with protection from known and unknown threats.

LVL 92

Expert Comment

ID: 13543437
can it boot into safe mode? Then it is probably a driver issue
LVL 69

Assisted Solution

Callandor earned 200 total points
ID: 13544259
If you want to avoid the Windows driver, there is NTFSDOS http://www.sysinternals.com/ntw2k/freeware/ntfsdos.shtml
LVL 14

Assisted Solution

JohnnyCanuck earned 200 total points
ID: 13544458
Can you boot with a PE CD?


If you can, have your drive as PM and the screwy drive on secondary and boot Bart's PE.  Make a folder on your hard drive called "baddrive" or something like that and copy the entire bad drive to your drive.  Reboot without the PE disk and immediately scan the "baddrive" folder for viruses.  After that, you can pick and choose which data to extract from the folder for the client.
LVL 14

Expert Comment

ID: 13555280
Looks like the other drives Boot sector is corrupted. You can attach it to a Bootable disk containing FDISK and then remove the main partition from being the ACTIVE partition and then try.

Alternatively you can try to use the WIndows XP CD to do a repair install of the installation on that Hard Disk. Maybe you wont need to extract data at all and things wud be better automatically. Its worth a  shot. However its not advisable if the Hard Disk has bad sectors. You can even try and repair the bootsector and the MBR using the Fixboot and the Fixmbr command from a manual recovery console once u boot from the Windows Boot CD.


Author Comment

ID: 13557035
Safe mode doesn’t work.  I even booted from a Windows XP CD and it died in the same way.  
I didn’t expect that.  

But here’s an interesting development.  I put it as a slave on a system running Windows 98.  
The system was able to come up but it didn’t show the drive under my computer.  But when
I went to a dos prompt and did an ‘fdisk’ it showed that it was there as a NTFS drive.  I would
have thought that Win98 would have seen it as an unformatted disk.

So what now?  If the disk had a drive letter I could probably run GetDataBack NTFS and copy the files over to the fat32 drive.  

I also have something called mbrtool that works with the mbr.  When I display the mbr with this I see some verbiage
that says “invalid partition table”  “error loading operating system” and “missing operating system”.

What happens if I try and fix the partition table/mbr on an NTFS drive on a Win98 system?  
Is there any danger that I’ll lose the disk completely?  This tool also has an option to write/refresh
the boot code, remove and restore the volume bytes, and restore the mbr.  

What do you think?
LVL 92

Expert Comment

ID: 13557072
try diskpart :

Microsoft DiskPart versie 1.0
Copyright (C) 1999-2001 Microsoft Corporation.
Use the 'diskpart' utility within Windows to do assign drive letter...
1. Enter command prompt (Start => Run... => type 'cmd' and press 'Enter').
2. Winthin command prompt type 'diskpart' and press 'Enter'.
3. Type 'list disk' and press 'Enter'.
4. Type 'select disk <the number of the destined drive>'.
5. Type 'assign [[letter=l]/[mount=path]] [noerr]'.
1. Enter the command prompt (Start => Run... => type 'cmd' and press 'Enter').
2. Within the command prompt type 'diskpart' and press 'Enter'.
3. After the 'diskpart' utility initializes; type 'list disk' and press 'Enter' to view the list of drives available on the computer.
4. Type 'select disk <destned drive's number>' and press 'Enter'.
5. Now type 'list partition' and press 'Enter'.
6. Type 'detail disk' and press 'Enter'.
LVL 14

Assisted Solution

mysticaldan earned 600 total points
ID: 13562206
Attach this corrupted drive as the Primary Master, Put in the XP CD and go to recovery>manual recovery. This will bring you to a command prompt and after u have logged on as administrator you can run commands fixboot and fixmbr in succession and then Exit out and reboot the system. That will make sure that if the MBR or the BOOT sector of the hard disk is corrupted you can recover it.

You can also use GetDataBack NTFS under Windows98 but do not use any MBR tool etc from under Windows 98 as it might corrupt the Slave Hard Disk, unless it s athird party tool specifically meant for this job like maybe Partition Magic or something which might be capable of handling such a situation. You can give PM a try for sure if its available.

Another good idea is to use the driver Callandor mentioned http://www.sysinternals.com/ntw2k/freeware/ntfsdos.shtml

and if u use the config.sys and autoexec.bat file on the Win98 Hard disk to put the correct entries in then the drive wud be visible under Win98 as well.

Howevere ur work can also be done with http://diskinternals.com/products/ntfs-reader/ which will help you to read files of ur NTFS partition. Better still try and use http://www.freewarefiles.com/programs.php?ProgramID=11100&categoryid=9&subcategoryid=90 which is also free and might help you out better.

LVL 12

Expert Comment

ID: 13570661
silverman, are you getting anywhere with this problem?

I forgot about the sysinternals tools, good stuff.

NT Resource Kit docs at Microsoft will explain all about the MBR and what should be in it.
As well as the partition tables, where the copy is saved at, middle and end of voluem, etc..

Author Comment

ID: 13572988
Got it.  I used GetDataBack for NTFS to get the data.  I ran it on the Win98 system that allowed me to boot with the drive in.  
I also ran SpinRite but it showed that the drive itself was OK.  That means it’s just the mbr/partition table that’s bad.  

I gave the client a CD with her critical data on it and she’s happy.

The only thing now is how to recover the mbr/partition table.  I downloaded a free program called diskpatch that I thought would do it,
but I can’t get it running correctly.  I can’t do an XP fixmbr or fixboot from the recovery console because on any xp system it dies.
 There are a ton of utilities out there that do this type of recovery.  I just need to find one that works in this environment.  
Worse comes to worse I could just wipe the drive and give it back to her to use as a secondary hard drive.  
She’s got just about everything off it she needs.  
LVL 14

Expert Comment

ID: 13573429
USe a Windows XP CD to boot up and then choose recovery > manual recovery  and that will put u to the console. make sure u have the admin passwd. If for any reason the system hangs then attach a Win98 Hard disk too and when prompted for which windows to recover choose the one on D:\windows and that shud be fine. You can also use something like ERD commander  but its paid so i am not sure u wanna go in gfor it.

Normally the recovery console shud not give any problems cause thats what its meant for in case the partition table or the MBR is corrupted. If that doesnt work then u wud be better off to reformat the drive and send it back. Howvere Windows works best if its installed on the system its attached too. So loading windows on one system and then putting the hard disk on another system wont work.

Besides maybe what caused the MBR to get corrupted is still on the system so u restore the MBR and then sent it back only to discover its gone bad again. Its not worth a risk. Any chance the lady can get her system to you so thaat u can reload windows on it and give it back to her? This wud be best IMO.


Author Comment

ID: 13575231
My customer has already rebuilt her computer using another hard drive. She’s happy and that’s what counts.  
I think I’ll give her the drive back to let her wipe it if she wants.  I’m going to close this one out.  
I’m splitting the points.  All the advice was so good I just wish I had more to give.
Thanks to all,  

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the modern office, employees tend to move around the workplace a lot more freely. Conferences, collaborative groups, flexible seating and working from home require a new level of mobility. Technology has not only changed the behavior and the expe…
If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question