Solved

Unable to capture blue screen of death during boot

Posted on 2008-10-06
20
1,449 Views
Last Modified: 2011-10-03
During boot of a compaq nc6220 I receive a blue screen.  I am unable to capture the error information by hitting the function pause key.  Put drive in a enclosure hoping to salvage the data but it says drive is not formatted.  The properties show the drive as having a file system of RAW.   I did put the drive in another laptop of the same model which showed the same signs, to rule out the MB.
0
Comment
Question by:montero284
  • 8
  • 5
  • 4
  • +2
20 Comments
 
LVL 10

Expert Comment

by:kukno
ID: 22652922
It's essential to get the information of the blue screen. Take your digicam and make a movie while the bluescreen happens. If you've got the information of the BSOD, post it here.

Regards
Kurt
0
 
LVL 15

Assisted Solution

by:tenaj-207
tenaj-207 earned 300 total points
ID: 22652992
I agree with KuKno that it would be very useful to read the blue screen.  But there are some other things you can try too.

I would try booting off a CD and running a check disk. This is done by putting in your XP CD (I assume you have XP) booting off of it and going into the restore mode.  If the HD is at all usable it'll drop you into the C:\windows directory (if you have a administrator password it'll prompt you for that too).  Then type in chkdsk /f /r.  This will check and attempt to repair the drives hard drive errors.  After this I would put the drive in your enclosure and backup your data.

If you are unable to clean up the HD or boot of the CD I'd use spinrite (http://www.grc.com/sr/spinrite.htm) to try to repair the HD then try the enclosure again.
0
 
LVL 27

Assisted Solution

by:Jonvee
Jonvee earned 50 total points
ID: 22653579
To capture the BSOD during boot you'll need to disable auto restart:
Right click My Computer > Properties > Advanced > Startup and Recovery Settings and uncheck Automatically Restart.

There you can look for a dump of the state of your system at the time it crashed.
The dumps are normally located in c:\windows\minidump\    
or  %systemroot%\minidump\

It (or they) will contain information about the bugcheck that was generated.
Can you paste the latest dump(s) in the "Attach Code Snippet" box and hopefully we'll be able to see the cause of the crash.
0
 

Author Comment

by:montero284
ID: 22653657
Thanks for the suggestions.  I will try those solutions and post back.
0
 
LVL 15

Assisted Solution

by:tenaj-207
tenaj-207 earned 300 total points
ID: 22653985
Jonvee:  The system can't boot up to windows to make that change.

Montero284: Have you tried safemode?  If the issue is with a driver or new piece of software then you might be able to get around the blue screen.  Did you recently install any new hardware (like a PCMCIA card) or software?  To get into safe mode push F8 right after the BIOS flash screen and before the windows splash screen.  Choose safe mode from the list.  If you can get into safe mode then you could follow Jonvee's suggestion and turn off the auto restart setting. And back up the computer while you're at it.
0
 
LVL 59

Assisted Solution

by:LeeTutor
LeeTutor earned 150 total points
ID: 22654479
You can turn off the automatic reboot on error option without even getting into Windows if you can get into what is called the Advanced Options Menu:  as your computer boots up (before you get to the Windows logo), keep pressing and releasing the F8 function key (don't just hold it down as you are likely to get a "stuck key error" from the BIOS).  Then, when that menu comes up, choose the option called "Disable automatic restart on system failure".
0
 

Author Comment

by:montero284
ID: 22659780
Thanks LeeTutor,  I disabled the automatic reboot and now am able to see the error.  The error I receive is unmountable_boot_volume.
Technical information:
*** STOP:  0x000000ED  (0x89EA0590, 0xC000014F,0x00000000,0x00000000)

BTW,  tenaj  I tried the spinrite but I am still unable to read the drive.  Is there any way to get past this error so that the drive contents can be recovered?
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22659828
The info from this page may be of some help:

http://aumha.org/a/stop.htm
TROUBLESHOOTING
WINDOWS STOP MESSAGES

0x000000ED: UNMOUNTABLE_BOOT_VOLUME
(Click to consult the online Win XP Resource Kit article.)
The kernel mode I/O subsystem attempted to mount the boot volume and it failed. This error also might occur during an upgrade to Win XP on systems that use higher throughput ATA disks or controllers with incorrect cabling. In some cases, your system might appear to work normally after you restart.
0x000000ED: UNMOUNTABLE_BOOT_VOLUME {KB 297185} Win XP (During reboot while upgrading to Win XP)
0x000000ED Error Message When Volume on IDE Drive with Caching Enabled Is Mounted {KB 315403} Win XP (NTFS volumes on some IDE drives)


Go to the actual page to click on the embedded links.
0
 
LVL 10

Expert Comment

by:kukno
ID: 22659876
hm.. either the disk is severely damaged or the partition table has been deleted.

Get a copy of a disk recovery tool and try to reconstruct the partition table (if that is the problem).

http://www.acronis.com/enterprise/products/diskdirectorsuite/partition-recovery.html
http://www.cgsecurity.org/wiki/TestDisk
http://www.techddi.com/
http://www.stellarinfo.com/partition-recovery.htm
http://trinityhome.org/Home/index.php?wpid=1&front_id=12

Regards
Kurt
0
 
LVL 15

Expert Comment

by:tenaj-207
ID: 22660563
montero284,

Kukno is right that there is some serious drive damage.  My favorite data recovery (that let's you do a raw recover as well as many other things) is Ontrack EasyRecovery Professional.  I use version 6.12.02.  Unfortunately it doesn't work with Vista though.

-tenaj
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 

Author Comment

by:montero284
ID: 22660684
Kurt,  I'm having a problem running test disk under DOS.  Could I make this scenario worse by running FIXMBR?  When I try to run CHKDSK it says that the volume appears to contain one or more unrecoverable problems.
0
 

Author Comment

by:montero284
ID: 22660972
I'm trying to run the RAW recovery now thru Easy recovery.  Looks like its gonna run a long time.  I'll keep my fingers crossed.
0
 
LVL 10

Expert Comment

by:kukno
ID: 22660973
@montero284: Yes you could make things worse!

Please be carefull. If possible, create a full disk  image first (Acronis, Symantec GHOST, Ghost4Linux, etc.). Then you can try anyone of the mentioned Tools. CHKDSK is not "intelligent" enough to rely on it. ;-)
0
 

Author Comment

by:montero284
ID: 22661346
Doesn't look like its working unfortunately.  Its still at 0% after a 1/2 hour.  Back to the question before.  What are the possible implications of running FIXMBR on this drive?
0
 
LVL 15

Expert Comment

by:tenaj-207
ID: 22661405
I've never had an issue running FIXMBR and Ive used it many many times. But theoretically it could mess up how the files are organized to the point that you have to use recovery software to retrieve them.  Did you try the Format recovery thru Easy recovery, or any of the other options?
0
 

Author Comment

by:montero284
ID: 22661463
Thanks Kukno.  Sorry didnt see your previous post.  I will try to do a ghost image.  Thanks again.
0
 

Author Comment

by:montero284
ID: 22661614
Since I cannot boot to windows I'm using the DOS Easy recovery.  Unfortunately it is unable to recognize the file system when trying to identify the partition.
0
 
LVL 10

Expert Comment

by:kukno
ID: 22662974
Try TestDisk (see link above). I had some success with it. However, no guarantee! ;-) It depends on the damages on your disk.
0
 
LVL 10

Expert Comment

by:kukno
ID: 22662993
I forgot to mention the Live CDs that contain TestDisk: http://www.cgsecurity.org/wiki/TestDisk_Livecd
0
 

Accepted Solution

by:
montero284 earned 0 total points
ID: 22670874
Ran Test disk software with laptop drive hooked into an enclosure.  After running a analyze the drive shows as FAT12 and I get a warning message that there are a incorrect number of heads/cyclinders 4 and incorrect number of sectors per track 17.  I tried changing to NTFS but it does not appear to have changed.  It said it would require a reboot to make the change.  I disconnected the drive and reconnected but I dont think that qualifies for a reboot.  Any suggestions would be greatly appreciated.  BTW, Against my better judgement the FIXMBR and FIXBOOT were run successfully but I think it may have scrambled the data.  I am now able to access the drive without the "Drive needs to be formatted message but most of the folders show as empty or show heiroglific characters which dont make sense.  Looks like I will need a disk recovery tool.  I dont mind spending the money as long as it isnt too complicated to use and it works.  Would Acronis be my best bet?
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Suggested Solutions

If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now