Can You Tell Me If I Have Saved My PC?

[Mulsiphix]

My Windows 7 has been put through the ringer. It looks like I might have saved it but I don't know Windows well enough to be certain. My questions to you:

1) Considering SFC and Disc Checks are completing without issue, is Windows back to its old self or do I need to do a clean install to have a truly healthy machine again?

2) Are there any other steps that I can take to "repair" Windows or the damage done?

What follows is a recount of what happened. This is not required reading. I've done my best to organize it into sections for easy skimming.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

How Was It Damaged?
I was having issues with my recycle bin. I decided to empty it via the command prompt but mistyped the command "rd /s C:\%systemdrive%\$Recycle.bin".

It immediately started deleting files from C:\Windows. It took me a minute to figure out what it was doing. I did a hard reset and afterwards trying to get into Safe Mode or Normal Windows resulted in a BSOD. I tried a System Repair Disc but it reported it "could not repair this computer automatically".

What Did You Do To Fix It?

Undeleting Files
I used an EaseUS Data Recovery Wizard boot image to perform a quick scan and restore the Windows directory that was recently deleted. 5.54GB of files were restored to a non-Windows drive.

Copying Files Back To Windows Folder
I used an Ubuntu Live CD to copy the restored files back into the original Windows folder. It never once asked me if I wanted to overwrite an existing file, though some files could not be copied due them being system files (according to Ubuntu). The following files could not be restored:

1. Windows/pss/boot.backup.LOG1
2. Windows/pss/boot.backup.LOG2
3. Windows/ServiceProfiles/LocalService/NTUSER.DAT.rctemp.LOG1
4. Windows/ServiceProfiles/LocalService/NTUSER.DAT.rctemp.LOG2
5. Windows/ServiceProfiles/LocalService/AppData/LocalLow/Microsoft/CryptnetUrlCache/Content/94308059B57B3142E455B38A6EB92015
6. Windows/ServiceProfiles/NetworkService/NTUSER.DAT.rctemp.LOG1
7. Windows/ServiceProfiles/NetworkService/NTUSER.DAT.rctemp.LOG2
8. Windows/ServiceProfiles/NetworkService/AppData/LocalLow/Microsoft/CryptnetUrlCache/Content/94308059B57B3142E455B38A6EB92015
9. Windows/System32/config/RegBack/SECURITY.LOG1
10. Windows/System32/config/RegBack/SECURITY.LOG2
11. Windows/System32/config/RegBack/SOFTWARE.LOG1
12. Windows/System32/config/RegBack/SOFTWARE.LOG2
13. Windows/System32/config/RegBack/DEFAULT.LOG1
14. Windows/System32/config/RegBack/DEFAULT.LOG2
15. Windows/System32/config/RegBack/SYSTEM.LOG1
16. Windows/System32/config/RegBack/SYSTEM.LOG2
17. Windows/System32/config/RegBack/SAM.LOG1
18. Windows/System32/config/RegBack/SAM.LOG2
19. Windows/System32/config/systemprofile/AppData/Local/Microsoft/Windows/UsrClass.dat.LOG2

Every one of these files was 0 bytes in size. I checked a different Win7 PC and found that these files existed and were also 0 bytes in size.

Running System File Checker
Next I booted into Safe Mode successfully and ran SFC /scannow from the command prompt. It reported success, specifically; "Windows Resource Protection found corrupt files and successfully repaired them. Details are included in the CBS.Log."

Scanning For Drive Errors & Corrupted Sectors
Next I scheduled scans for drive errors. These have finished without any major issues (I assume, I can't find any logs to verify). I have now booted back into Windows 7.

Restoring The Files Ubuntu Couldn't Copy Over
I was able to copy and paste all of the system protected files (listed above) from my EaseUS Restored Files back into the Windows directory (now that I was using Win7 instead of Ubuntu).

 

[richc46]

The best way to be sure is to do a system restore from before all this happened. If you cannot and everything is as it should be, I would think that you are ok. Chkdsk is not really significant in this situation, but if SFC proves ok, you need not to worry.
http://www.sevenforums.com/tutorials/700-system-restore.html
Your personal stuff will not be affected

 

[Mulsiphix]

The best way to be sure is to do a system restore from before all this happened.

I disabled that functionality when I setup Win7. I planned on doing drive images instead, though after a few years I stopped making them. I became too comfortable and lax on my preparations for a disaster like this *lowers head in shame*. Drive imaging will resume as soon as I know I'm in the clear.

 

[aritra2116]

Your best shot would be a repair install if you really want to 'save' your pc.
http://www.sevenforums.com/tutorials/3413-repair-install.html

 

[richc46]

As I said, if SFC checks out and you are not having problems. I think that you are OK. I would just use the computer. Good luck

 

[Mulsiphix]

When I ran the System Repair disc it created a new drive on my computer labeled "System Reserved" and it is 99.9MB. I don't want this on my computer. I'm not sure if this is a partition on my Win7 drive or what. How should I handle removing it?

 

[richc46]

I would suggest that you do not remove it. That partition could be the factory restoration partition. If you ever have a major problem, it gives you the option to go back to the way everything was the day you bought the computer home.
But it is your computer:
http://www.sevenforums.com/tutorials/93322-partition-wizard-use-bootable-cd.html

 

[Mulsiphix]

But I built my computer and it didn't exist before I ran System Repair. I plan on using images to fall back on should terror befall my PC a second time. Is there any safe way to remove it, barring the logic it would be unwise to do so?

 

[richc46]

See prior post
You are in good shape if you use an image. That is my safety net, too. Saved me twice

 

[Mulsiphix]

Thank you very much richc46

 

[richc46]

You are very welcome.