New
#1
Can You Tell Me If I Have Saved My PC?
My Windows 7 has been put through the ringer. It looks like I might have saved it but I don't know Windows well enough to be certain. My questions to you:
1) Considering SFC and Disc Checks are completing without issue, is Windows back to its old self or do I need to do a clean install to have a truly healthy machine again?
2) Are there any other steps that I can take to "repair" Windows or the damage done?
What follows is a recount of what happened. This is not required reading. I've done my best to organize it into sections for easy skimming.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
How Was It Damaged?
I was having issues with my recycle bin. I decided to empty it via the command prompt but mistyped the command "rd /s C:\%systemdrive%\$Recycle.bin".
It immediately started deleting files from C:\Windows. It took me a minute to figure out what it was doing. I did a hard reset and afterwards trying to get into Safe Mode or Normal Windows resulted in a BSOD. I tried a System Repair Disc but it reported it "could not repair this computer automatically".
What Did You Do To Fix It?
Undeleting Files
I used an EaseUS Data Recovery Wizard boot image to perform a quick scan and restore the Windows directory that was recently deleted. 5.54GB of files were restored to a non-Windows drive.
Copying Files Back To Windows Folder
I used an Ubuntu Live CD to copy the restored files back into the original Windows folder. It never once asked me if I wanted to overwrite an existing file, though some files could not be copied due them being system files (according to Ubuntu). The following files could not be restored:
- Windows/pss/boot.backup.LOG1
- Windows/pss/boot.backup.LOG2
- Windows/ServiceProfiles/LocalService/NTUSER.DAT.rctemp.LOG1
- Windows/ServiceProfiles/LocalService/NTUSER.DAT.rctemp.LOG2
- Windows/ServiceProfiles/LocalService/AppData/LocalLow/Microsoft/CryptnetUrlCache/Content/94308059B57B3142E455B38A6EB92015
- Windows/ServiceProfiles/NetworkService/NTUSER.DAT.rctemp.LOG1
- Windows/ServiceProfiles/NetworkService/NTUSER.DAT.rctemp.LOG2
- Windows/ServiceProfiles/NetworkService/AppData/LocalLow/Microsoft/CryptnetUrlCache/Content/94308059B57B3142E455B38A6EB92015
- Windows/System32/config/RegBack/SECURITY.LOG1
- Windows/System32/config/RegBack/SECURITY.LOG2
- Windows/System32/config/RegBack/SOFTWARE.LOG1
- Windows/System32/config/RegBack/SOFTWARE.LOG2
- Windows/System32/config/RegBack/DEFAULT.LOG1
- Windows/System32/config/RegBack/DEFAULT.LOG2
- Windows/System32/config/RegBack/SYSTEM.LOG1
- Windows/System32/config/RegBack/SYSTEM.LOG2
- Windows/System32/config/RegBack/SAM.LOG1
- Windows/System32/config/RegBack/SAM.LOG2
- Windows/System32/config/systemprofile/AppData/Local/Microsoft/Windows/UsrClass.dat.LOG2
Every one of these files was 0 bytes in size. I checked a different Win7 PC and found that these files existed and were also 0 bytes in size.
Running System File Checker
Next I booted into Safe Mode successfully and ran SFC /scannow from the command prompt. It reported success, specifically; "Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log."
Scanning For Drive Errors & Corrupted Sectors
Next I scheduled scans for drive errors. These have finished without any major issues (I assume, I can't find any logs to verify). I have now booted back into Windows 7.
Restoring The Files Ubuntu Couldn't Copy Over
I was able to copy and paste all of the system protected files (listed above) from my EaseUS Restored Files back into the Windows directory (now that I was using Win7 instead of Ubuntu).