Solved Altered(?) Boot folder/files attributes and Keriver 1Click Restore Pro

[no15]

Greetings,

I recently installed W7 Ultimate 32bit, on my machine, without the "System Reserved" partition, based on the pre-installation instructions that i found here (clean all (x2) --> create partition primary... --> format... --> active). The first thing i did, after booting on my newly installed W7 System, was to install Keriver 1 Click Restore Pro, which automatically took a baseline snapshot of the system partition. Right after that, i browsed my system partition and found out that:

(usage of present time intended)

a1. The "Boot" folder (C:\Boot) is visible. Its "Read-only (Only applies to files in folder)" attribute is "grey"-checked, while its "Hidden" attribute is not checked at all. Also, its "Allow files in this folder to have contents indexed in addition to file properties" advanced attribute is checked.

a2. Inside the "Boot" folder: Both BCD and memtest.exe files are visible/accessible. They both have unchecked "Read-only" and "Hidden" attributes and checked "File is ready for archiving" and "Allow this file to have contents indexed in addition to file properties" attributes. Also, there are various language folders, each one containing an accessible localized (i assume) version of bootmgr.exe.mui.

Today, i browsed that baseline snapshot, through a virtual drive, and, after enabling the "show hidden files, folders and drives" and "show protected operating system files" options, i additionally found out that:

b1. There are 1 file in the root directory (BOOTSECT.BAK (R-only, H, Archiving, Indexed)) and 3 files in the "Boot" folder (BCD.LOG1 (H, Archiving, Indexed), BCD.LOG2 (H, Archiving, Indexed), BOOTSTAT.DAT (H, Archiving, Indexed)), all having been modified at the exact same date (16/10/11) and time. What puzzles me the most is that the installation of W7 and the initial system-imaging (baseline snapshot) took place on 15/10/11!!!

b2. The BCD file had been modified at the exact same time/date (15/10/11) that the Keriver 1CR Pro installed (it adds a pre-(OS)boot Recovery Console). BTW, in some system snapshots that i have taken, the BCD file has a "future" modification date (e.g., snapshot taken at 18/10 and BCD mod dated 19/10)!!! In these particular snapshots, there is also a hidden folder in the root directory named "Config.Msi".

Obviously, i 'm not an expert when coming to MBR, BCD, bootmgr etc., so i 'm, really, going to need help with this one. So, to anyone willing to help/answer me, my questions are as follows:

q1. Shouldn't the "Boot" folder be hidden and, probably, system protected ?

q2. Have i done something wrong during the pre-installation procedure (regarding the partition's settings) OR is my installation corrupted OR has Keriver's Recovery Console messed up any boot files attributes?

q3. How the "future modification dates" are explained?

and the most important

q4. What do i have to do in order to set back the correct file/folder attributes? + Which of the above-mentioned files can/should i delete?

Thank you for your time.


P.S. So far, i have tried to manually hide the "Boot" folder (even though i assume that it should be an automatically protected operating system folder) and i have run the Windows Resource Protection scanning procedure that i found here. Nothing worked (the sfc command returned no integrity violations).

 

[no15]

Let's narrow it down a little,

To anyone having a W7 Ultimate System without a "System Reserved" partition:

q1. Is C:\Boot visible(= non hidden)?

To anyone mastering Windows:

q4. How can i reset -in a consistent way- the folder attributes of C:\Boot and the file attributes of its contents? Is it safe to delete BOOTSECT.BAK, BOOTSTAT.DAT, BCD.LOG1 and BCD.LOG2?

 

[Corazon]

q1. Yes, it's normal for the Boot folder and its contents to be visible. This is nothing to be alarmed about.

q2. To put it simple: no. Everything you've described is as it should be.

q3. I have seen similar phenomena before, and I suspect it has something to do with different processes operating on different timezones, i.e. disregarding your system's actual timezone setting or something like that. I'm not completely sure, but I believe this is perfectly harmless if a little bit confusing.

q4. There's nothing you need to do. If you want, you can safely delete BOOTSECT.BAK, BCD.LOG1 and BCD.LOG2. (The only two files in my own C:\Boot folder are BCD and BCD.LOG, and everything works fine.)

 

[SIW2]

q1. Is C:\Boot visible(= non hidden)?

No, it is usually hidden.

Possibly your imaging app took the hidden attribute off.

Didn't keriver put a wim , a boot.sdi and some sort of cfg files in there ?

Not familiar with the product - but would assume that is how it's wim pre-os would be set up.

 

[Corazon]

re: q1) My mistake...I plainly see the Boot folder, but it still has the hidden/system attribute on my system.

 

[no15]

First of all, thank you both for responding.

q1: If my memory serves me right, in a "default" W7U installation, the "Boot" folder is a hidden protected operating system folder located in the hidden "System Reserved" partition. So, considering its "default" attributes and location, i can only assume that it should be a well protected folder, even in the case of a W7U installation without "System Reserved" partition.

q3: Corazon, your explanation makes good sense to me. I agree that it is harmless, but confusing.

q4: SIW2, you are right. Keriver 1CRP modifies the MBR, as it installs a GRUB pre-OS console. Its files are located in my "Data" partition (2nd internal hdd) though, where, also, Keriver's snapshots are stored.

Ok, here are all the related(i think)-to-the-issue files i have in my computer:

POSF stands for Protected Operating System File/Folder
Green color denotes files installed/created by Keriver 1CRP

disk0 --> WINDOWS (C): System, Boot, Page File, Active, Crash Dump, Primary Partition

C:\BOOTSECT.BAK---POSF
C:\bootmgr---POSF
C:\Boot
C:\Boot\BCD
C:\Boot\BCD.LOG---POSF
C:\Boot\BCD.LOG1---POSF---MANUALLY DELETED
C:\Boot\BCD.LOG2---POSF---MANUALLY DELETED
C:\Boot\BOOTSTAT.DAT---POSF
C:\Boot\memtest.exe
C:\Boot\23 localized versions of bootmgr.exe.mui (each in its folder)
C:\Boot\Fonts
C:\Windows\bootstat.dat
C:\Windows\Boot
C:\Windows\Boot\DVD
C:\Windows\Boot\DVD\PCAT
C:\Windows\Boot\DVD\PCAT\BCD
C:\Windows\Boot\DVD\PCAT\boot.sdi
C:\Windows\Boot\DVD\PCAT\etfsboot.com
C:\Windows\Boot\DVD\PCAT\en-US\bootfix.bin
C:\Windows\Boot\PCAT
C:\Windows\Boot\PCAT\bootmgr
C:\Windows\Boot\PCAT\memtest.exe
C:\Windows\Boot\PCAT\23 localized versions of bootmgr.exe.mui (each in its folder)
C:\Windows\Boot\Fonts
C:\Program Files\Keriver 1-Click Restore Pro

disk1 --> DATA (D): Primary Partition

D:\BOOT---POSF
D:\BOOT\boot.sdi
D:\BOOT\bzh
D:\grubfiles---POSF
D:\grubfiles\grub_back.xpm.gz
D:\grubfiles\grubmbr.bak
D:\sources---POSF
D:\sources\boot.wim
D:\sources\FlcRecoveryConsole
D:\sources\FlcRecoveryConsole\bcdedit.exe, flcwin.exe, rescuemain.exe and various .dll files (also found at C:\Program Files\Keriver 1-Click Restore Pro\)
D:\menu.lst---POSF
D:\zhgrldr---POSF
D:\ZHNTLDR---POSF
D:\Keriver 1-Click Backup Folder (where the snapshots are stored)

Any recommendations about resetting the correct attributes and deleting unnecessary files?

 

[no15]

Anyone? Anything?

 

[no15]

Solved it.

To anyone facing the same problem:

Open an elevated command prompt --> Type attrib +S +H C:\Boot --> Restart

BTW, the +(-)S parameter is the only way to enable/disable the "system file" attribute.