Any kind analysis or integrity check to undo mistakenly moved files ?

Stewox · 02 Apr 2013

Hello

Browsing through TreeSize, looking just around, deleting temps and finding some stuff about some unrelated issue, because it's new PC, new desk, new everything i don't even have the mousepad set, so I accidentially clicked and issued a move command of System32 -> to -> winsxs, probably the stupidest thing I ever did.

Teracopy hanged real hard, because the folder was huge of small files and tons of access issues it did not disengage, but because of that also nothing get moved yet since it was just scanning, gathering files but reporting a lot of errors. Even pausing did not help, it just kept going.

SFC verifyonly made a very big CBS.log that I have no idea what to look for in there.

I will try to only scan system32 directory. Also I don't want to use scannow since I have tweaked files and registery (termsrv.dll patch for example) for my unrelated tweaks and other optimizations so that's the problem.

However, there doesn't seem to be an sucessfully completed operation in the dropdown, or it doesn't report it, hope it does, the only thing that I don't know what it did is the 4 operations in the middle called "freed: .... " ... now what is that ?

EDIT: stopped operation by logging off, did not reboot yet

EDIT2: I have searched with windows and treesize and it does not find any files beginning with CNBJ

Stewox · 02 Apr 2013

Any help, please, im waiting to reboot!

Gary · 02 Apr 2013

Let it boot and then post the CBS.log Oh you can find that log just by doing a search for it. Like *.Log should find it. AS to the freed it probably means that TC unlocked them..

Stewox · 02 Apr 2013

I meant that I am still inside the OS, didn't shut it down yet.

Stewox · 02 Apr 2013

Code:

2013-04-02 13:23:17, Info                  CSI    0000015c [SR] Beginning Verify and Repair transaction
2013-04-02 13:23:18, Info                  CSI    0000015e [SR] Verify complete
2013-04-02 13:23:18, Info                  CSI    0000015f [SR] Verifying 100 (0x0000000000000064) components
2013-04-02 13:23:18, Info                  CSI    00000160 [SR] Beginning Verify and Repair transaction
2013-04-02 13:23:19, Info                  CSI    00000162 [SR] Verify complete
2013-04-02 13:23:19, Info                  CSI    00000163 [SR] Verifying 100 (0x0000000000000064) components
2013-04-02 13:23:19, Info                  CSI    00000164 [SR] Beginning Verify and Repair transaction
2013-04-02 13:23:20, Info                  CSI    00000166 [SR] Verify complete
2013-04-02 13:23:20, Info                  CSI    00000167 [SR] Verifying 100 (0x0000000000000064) components
2013-04-02 13:23:20, Info                  CSI    00000168 [SR] Beginning Verify and Repair transaction
2013-04-02 13:23:21, Info                  CSI    0000016b [SR] Verify complete
2013-04-02 13:23:21, Info                  CSI    0000016c [SR] Verifying 100 (0x0000000000000064) components
2013-04-02 13:23:21, Info                  CSI    0000016d [SR] Beginning Verify and Repair transaction
2013-04-02 13:23:22, Info                  CSI    0000016f [SR] Repairing corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:22{11}]"termsrv.dll" from store
2013-04-02 13:23:22, Info                  CSI    00000171 [SR] Verify complete
2013-04-02 13:23:22, Info                  CSI    00000172 [SR] Verifying 100 (0x0000000000000064) components
2013-04-02 13:23:22, Info                  CSI    00000173 [SR] Beginning Verify and Repair transaction
2013-04-02 13:23:22, Info                  CSI    00000175 [SR] Verify complete

Allright just as I expected, termsrv patch, but there is nothing else so I am relieved, thanks anyways, I actually did go to find more about the logfile and at a glance I didn't notice it until I made the txt extract. It's just the part, it's not whole file since it's too long for posting.