Cannot use Ntfs.sys after image restore

My computer is hosed. Here are the facts as well as I can tell them:

1) Last night, XP was running without problems. I had made and checked a full disk image on 7/21. Last night, I made and checked an incremental image based on the 7/21 full image.

2) After making the incremental, I downloaded and installed the ZoneAlarm 6 update. This required me to reboot the PC. The PC rebooted and started Win XP, successfully.

3) The computer ran all last night and all day today. When I got home from work, a severe thunderstorm was coming up. I shut down Win XP gracefully and turned off the PC. Then I unplugged the PC from the AC power.

4) When the thunderstorm was over, I powered the PC up and when it tried to start XP, it gave the message: "Windows could not start because the following file is missing or corrupt: System32\Drivers\Ntfs.sys". The message goes on to suggest an XP repair using the original Setup CD. Of course, my recent model computer did not come with an Original Setup CD.

5) I thought, no problem, I just made that good incremental image last night. I restored the image, successfully, doing a full disk restore (not just the C:\ partition). But, rebooting and trying to start XP gave the same message about a missing or corrupt Ntfs.sys

6) WTF? I rebooted last night AFTER that incremental image was created. Ntfs.sys must have been okay, then. But, anyway, I restored again to the full image I made on 7/21. And I'm still getting the same problem!!!

Why can't it restore that file so it will work? How can I fix my PC so it will run?

I NEED HELP!

Note that I don't have a floppy drive, either.

Thanks,
Tim

 

Hello ratcheer,

Thank you for choosing Acronis Disk Backup Software.

This problem may occur if the Ntfs.sys file is missing or becomes corrupted.

To resolve this problem, replace the missing or corrupted Ntfs.sys file:

1. Use the Windows XP startup disks or the Windows XP CD to restart your computer.
2. When the "Welcome to Setup" screen appears, press R to select the To repair a Windows XP installation using Recovery Console, press R option.
3. Type the number of the Windows installation that you want to access from the Recovery Console, and then press ENTER.
4. Type the administrator password when you are prompted, and then press ENTER. If no administrator password exists, just press ENTER.
5. At the command prompt, type the following commands (press ENTER after each command):

cd \windows\system32\drivers

ren ntfs.sys ntfs.old

Note This step renames the corrupted Ntfs.sys file to Ntfs.old. If the Ntfs.sys file is not found, the file is missing.

6. At the command prompt, type the following command, and then press ENTER:

copy cd:\i386\ntfs.sys drive:\windows\system32\drivers

Where cd is the drive letter for the CD-ROM drive that contains the Windows XP CD, and drive is the drive where you installed Windows XP.
7. Remove the Windows XP CD from your CD-ROM drive, type quit at a command prompt, and then press ENTER to quit the Recovery Console.
8. Restart the computer.

Thank you,
--
Oleg Shegay

 

Ratcheer,

If you can't get your Windows CD to work I've thought of another way to replace that file. Make a BartPE CD on the computer you are presently using. Boot to the CD in your broken computer and use the A43 prog to copy the file from the BartPE I386\System32\Drivers folder on the CD to your computer. The file is present on the CD.

http://www.nu2.nu/pebuilder/

As Source (in Bart) you could use the i386 folder in your CD (should be there) but choose the folder which CONTAINS the i386 folder.

This will work as far as replacing the file but I don't know if your boot problem will be fixed. Your excellent description of the sequence of events suggests a hardware problem, probably memory.

 

Hi Ratcheer

I understand you have no windows CD
So if you want to try a replacement ntfs.sys file why don't you ask somebody to EMail one to you (it is approx 560kb) or if you try a search engine there may be a site where you can download it from.
Save the old file in a different location before you implement the new one, then if there are any problems you can revert back.

Hope this helps
Tex

 

Thanks Brian K and Texcritter,

Yes, I thought I had made it clear that my computer did not come with a Windows CD. I think this (not shipping PC's with OS CD's) is the worst situation that has developed in personal computing except for malware.

After researching my problem until midnight last night, I also fear that my RAM has gone bad. The computer has been solid since I bought it last November, but we have so many severe thunderstorms in this area it is certainly possible.

I should be able to copy Ntfs.sys from this PC (my son's is identical to mine) and do the Bart's PE CD to copy it to mine. If that doesn't work, I guess I'll try buying new RAM. And if that doesn't work, woo hoo!

Tim

 

Try swapping your RAM sticks in and out to see if you can isolate the possible bad one. Try your son's RAM in your computer with your RAM on the table.

 

Good thinking, Brian. I hope I don't end up with two broken PC's instead of one.

Tim

 

Why didn't Acronis True Image replace that file when Tim did the restore of the full image? I thought that was what this program was for!

 

It probably did and that's why I also think ratcheer has now got a hardware problem.

Regards

 

The boot failure occurred before the image was restored. I wouldn't blame Acronis TI for anything here.

My guess is that replacing ntfs.sys will not help. It's probably a "false" error message.

 

Yes, I am basically in agreement with Brian K and Menorcaman - I think it is probably a RAM problem and I think that was probably caused by all the severe thunderstorms. At this time of year, there are one or two storms every afternoon and often one or two more between midnight and 6 AM.

I never blamed True Image for the problem, but until I learned about the message being issued for a bad file when the problem is really bad RAM, I was wondering/blaming TI for not restoring the file, properly.

I found what looks like a good deal - 1 GB (2X512) of Kingston PC3200 for a little less than $200. I think I will go ahead and order it, tomorrow.

Thanks, everyone!
Tim

 

Let us know the outcome Tim.

 

Things are getting weirder.

I have created an Ultimate Boot CD and run memtest86+. My memory passed with flying colors. It is also very high-grade memory (Kingston HyperX) and I would hate to have to throw it out. But, I already ordered the new memory (1 GB for $145 from Crucial), so I guess I can end up with two 1 GB machines instead of two 512 MB's.

However, as UBCD is an ISO image, I don't see a way to use it to copy the ntfs.sys file from my son's PC to mine. I can't use the suggestion of Bart's PE Builder, because, once again, that requires having an original XP setup CD. Further, it requires slipstreaming SP2. Maybe I am mis-reading the instructions, but they seem very clear, to me.

Can someone tell me a fairly simple way to copy one file to my PC without needing a Windows Setup CD or a floppy drive?

Thanks,
Tim

 

Hello ratcheer,

We suggest you to unplug the hard drive from the PC having the issue and connect it to the other PC which is working properly.

Boot into Windows and then replace Ntfs.sys file with the one from the system which boots properly.

Connect your hard drive back to the first PC and see whether the problem still persists.

If the problem still persists then we also recommend you to check your hardware, because the error message you receive can be deceptive and the problem might be caused by the hardware malfunction.

Thank you.
--
Alexey Popov

 

What a challenge Tim.

I assume you son's computer contains WinXP SP2. Instead of the WinXP CD you can use an i386 folder as the "Source" of Windows files for building BartPE (CD is not needed). It's likely the computer has C:\i386. If so, use C:\ as the Source, not C:\i386. It requires the "folder" which contains the i386 folder.

Can you run Hard Drive diagnostics on your computer from a boot CD or a preinstalled partition? What is the computer brand?

 

Well, never mind, I guess.

I restored to a full image dated June 25 and XP started just fine.

I am still very confused because of several points:

1) I made and checked the incremental image before I installed the Zone Alarm update. I had to reboot the PC after installing Zone Alarm. XP started okay, so ntfs.sys had to be okay when I made the incremental image. What am I missing?

2) Another thing I had attempted was to restore to the full base image that I had made on July 21. I had rebooted and restarted XP many times since 7/21. But that restore hadn't fixed the problem, either. Same question as above.

So, I am pretty much back to wondering why ATI restores to 7/27 and 7/21 did not eliminate the problem, but a restore to 6/25 did? It is easy to say the problem was there when the images were made, but the fact is that I restarted XP successfully at least once after the 7/27 incremental and many times after the 7/21 full image.

I guess I will be spending another week trying to recover all of my changes made since June 25. What a mess!

Thanks,
Tim

 

Hi Tim,

Bit of a long shot but does your system drive have more than one partition? If so, perhaps you selected the whole disk by ticking the checkbox next to the drive letter when you created the 6/25 image (see screenshot below) but not when you created the 7/21 full image. Imaging the whole disk ensures that the Master Boot Record is copied into the image, whereas imaging individual partitions doesn't.

That's usually not a problem when restoring back to the original disk containing a good MBR. However, if your HD got trashed during that thunderstorm then restoring the 7/21 image (or any incrementals made thereof) means that the corrupted MBR will not get replaced.

It's just a thought but it could be an explanation for your problem.

Regards

 

Thanks, Menorcaman.

I suppose that it is possible that I made a mistake when I created the 7/21 image, but as a general rule, I always make my images of the entire disk, not just partitions. But, I still note that it was a C:\Windows file that was messed up, not the MBR. The PC booted just fine, it just could not start XP.

I am not trying to argue, I am just trying to make sense out of what happened. I am a professional DBA and a big part of my career is backup and recovery of huge database systems. As such, I have to understand why things sometimes don't work and what steps to take to ensure that they do work, the next time. I guess I still want the same kind of rigor with my home systems.

Also, yes, my disk is a mess with partitions. The PC came with Phoenix FirstVault Recover Pro, which has something very like the Acronis Secure Zone. That is about 7 GB. And when I first started using ATI, I did not have an external drive, so I let it create a 15 GB Secure Zone. I no longer use the SZ, so that space is now wasted. Of my nominal 80 GB internal drive, I now have 46.68 GB usable for my primary partition.

Thanks,
Tim

 

Hi Tim (Ratcheer)

If you don't use the secure zone just delete it and recover the 15gb you had assigned it.

Tex

 

Hello again Tim,

When you say you no longer use the SZ did you in fact remove it via the Manage Acronis Secure Zone Wizard. If so then it's strange that the 15GB it took up wasn't returned to you.

Maybe worth having a read of this <recent thread> and a <somewhat earlier one>.

Regards

 

It was several months ago and I don't recall how I removed it. It gave the space back and I used it for a new 15 GB NTFS partition, but I couldn't figure out any way to merge it back with the C:\ partition without buying more software.

So, it is usable, it is just busted away from my main partition.

Thanks,
Tim

 

Hello ratcheer,

I'm afraid that there is no opportunity to investigate the problem since you have already restored another image archive created on 25.06.05

However, the problem might has been caused by an accident and probably will not appear again.

We recommend you to continue using your PC as usual and creating new full and incremental images using Acronis True Image 8.0.

If once you will face the same problem after you have restored an image, then please do the following:

- Download the following utility:
http://www.acronis.com/files/support/AcronisReport.exe
- Run it from under Windows on any other PC and select the "Create Bootable Floppy" option;
- Insert a blank floppy disk in the A: drive and proceed
with creation of the bootable floppy;
- Boot the computer having the issue from this diskette and wait for
report creation process to finish;
- Compress the report file from the floppy disk with ZIP;
- Send the created file to support@acronis.com along with the link to this thread.

We will investigate the problem and try to provide you with the solution.

What concerns your question on Acronis Secure Zone. When you are going to delete Acronis Secure Zone using Manage Acronis Secure Zone Wizard, wizard asks you to select partitions to which you want to add the space freed from Acronis Secure Zone. It does not give you an option to create a new partition utilizing the space of Acronis Secure Zone.

Please read more in section 3.2.4 of Acronis True Image 8.0 User's Guide which is available at: http://www.acronis.com/homecomputing/download/docs/

I'm afraid that the only way to add the free space of your 15 GB NTFS partition to the C: partition is to use special partition management software, such as Acronis Disk Director Suite 9.0 for example.

Please read more about Acronis Disk Director Suite 9.0 Partition Manager features at:
http://www.acronis.com/homecomputing/products/diskdirector/partitioning.html

Thank you.
--
Alexey Popov