Possible corrupt file system?

[securitynoob]

Ohh, I love my grandparents. My grandfather especially. He simply refuses to believe that anyone could possibly know about computers more than him. Which is sort of how this problem started.

He called me up last night, and finally conceeded defeat, telling me that his computer would no longer boot, and he was stumped. I asked how it got to be that way, and this is the information I got:

He was browsing through "sites", when his computer suddenly slowed down tremendously (he's got a Win 7 64 with 8 gigs RAM and an i7, so it takes quite a bit to slow that down). Him, being very paranoid, immediatly did a hard shut-down, and pulled out his KAV rescue disk.

That's all well and fine. But apparently he didn't realize that it can be dangerous to run a rescue disk like that when your OS wasn't shut down properly. The disk even warned him that bad things could happen if he mounted the drive and it wasn't shut down properly. But, of course, no one at Kaspersky knew about computers as well as he did, so he told it to mount anyway.

Well, it did, and he did his scans, and it found nothing. So, he rebooted, ejected the CD, and rebooted again.

Now, here's the fun part. He gets the BIOS screen like normal, but after that, all he sees is a black screen with a cursor blinking about 4 lines from the top of the screen. No beeps, no warnings, no windows. He was clueless.

So, smiling to myself, I went over to his house with my bootable Ubuntu CD, to see if maybe I could fix it myself. Well, now I'm stumped, too.

If I use the Terminal in Ubuntu too see a directory of his C:\ drive, there appears to be no WINDOWS folder... it's like whatever he managed to delete his WINDOWS install. His "Documents and Settings" folder is still there, but inside of it his account is strangely missing. I didn't want to run any recovery programs until I got a second opinion. Did he manage to corrupt his filesystem because of his computer genius? If not, then what DID he manage to do?

[ZOU]

I have heard of the occasional rare event that a hard shutdown can crash Windows.
When something slows a system, with 8G of RAM, down that much, it is something very WRONG. There must be some event that caused some serious registry corruption before he shut down. That, or his hard drive is defective.

[securitynoob]

It really wouldn't surprise me if he managed to do something really stupid to his computer beforehand. So registry corruption is possible. But he just bought this computer, so I'm not thinking a hard drive failure is likely. Although they say a hard drive will either last two months or ten years...

[ZOU]

I have misused a registry cleaner before and it made all programs run extremely slow and caused Windows to take about 10 times as long to boot. That was easily fixed by utilizing a restore point though, and the PC would still boot.

It is a new computer. Either he wiped some drivers, or deleted a core system file.

Maybe his particular copy of Windows or the hard drive are lemons. These things can happen, though rare.

Depending heavily on how risky the "sites" that he was surfing may have been, it is possible that he actually did acquire a nasty infection just before the hard shut down. Then, as you described, maybe upon boot, his rescue cd wasted the rest of his OS. That seems like the most likely scenario without guessing wildy, as I have done so well. lol

[securitynoob]

Well, I've found part of computer repair is guessing based upon what information the client is willing to give you, until you're able to get in there and make a few discoveries yourself. As for the sites he was one, I'll leave it as he has a problem that his wife won't help with ...

But anyway, on the Linux CD, I've got the drive mounted as read-only, so my CD certainly didn't corrupt anything. Using some file recovery tools that came with the CD, I was able to find over a thousand various files, from dlls to xls. So whatever happened didn't wipe the drive. It's like the arrows pointing to where the files are located just disappeared.

Which brings me back to my original assumption: did he manage, through his using of the KAV rescue disk, without properly shutting down the system, to corrupt the file system?

[ZOU]

It is looking like it, especially if everything is present, yet nothing is synchronized.

[googoo1876]

Try chkdisk and a recovery install.

[ZOU]

I could be way off base, but I have found chkdisk to be useless. The only thing that it tells you is that it is slow, as everything else is when your registry or hardware is fried. IMHO (I have seen it too many times).

Note: I am not cracking on you, googoo. I have been guilty of relying on it too. If I am mistaken, feel free to enlighten me. I need it from time to time. LOL

[googoo1876]

Well all it does is check the file system so ya. I does not check the reg or anything else.

[bogdan]

I am not sure if this is a HDD problem but here is a nice article that explains why shutting down a computer like that could damage the HDD: Link. The Read/Write heads are suspended above the Platters (Disks). They float on a layer of air that’s created by the rotation of the disks. If disks stop rotating (because you shut down the PC inappropriately) they can fall and damage the disks.

As for CHKDSK: The MFT (Master File Table) contains the information necessary to retrieve files from the NTFS partition, in its first stages, chkdsk checks the MFT for consistency, then it checks the directories and if you specify the /r parameter it will also check for bad sectors and attempt to recover them. Bad sectors could be caused by inappropriate shutdowns. However, chkdsk gives up too fast on recovering bad sectors while other tools like Spinrite will try harder and should succeed in recovering data. Spinrite is a great tool but is a bit too expensive. I am not aware of any free alternatives that could directly access the disk and recover bad sectors... maybe you could try some Linux recovery tools like ddrescue (you will need a second drive as large as the partition you are trying to recover).