Windows NT drive recovery without ERD or backups

Question

I have decided to take on this project to help another company that has been using a Windows NT system to run some of their critical field equipment.

Unfortunately there is now an error which appears to be along the lines of either a drive failure or a corruption within essential boot files. Unfortunately there is no backup or ERD of any kind and they do not have access to the original install floppy diskettes for NT 4.0.

Transcript of the error:

OS Loader V4.01
  multi(0)disk(0)rdisk(0)partition(1)\WINNT\System32\ntoskrnl.exe
  multi(0)disk(0)rdisk(0)partition(1)\WINNT\System32\hal.dll
  multi(0)disk(0)rdisk(0)partition(1)\WINNT\system32\config\system
Disk I/O error: Status = 00001000
  multi(0)disk(0)rdisk(0)partition(1)\WINNT\system32\config\system.alt
Disk I/O error: Status = 00001000

Windows NT could not start because the following file is missing or corrupt:
\WINNT\SYSTEM32\CONFIG\SYSTEM

You can attempt to repair this file by starting Windows NT
Setup using the original Setup floppy disk or CD-ROM.
Select 'r' at the first screen to start repair.

At this time I have proposed that repair of the drive is the best option as it would present a quick and elegant solution.

I was looking for any advice from other users who may have spent more time with this era of technology my proposed solution looks like this.

1. Find a Windows NT 4.0 install diskette image
2. Create a new set of Windows NT 4.0 boot diskettes using a floppy burner (I believe that the installer was spread over 3 total)
3. Use the Windows repair tools included with the installer to attempt repair of the drive

I believe that this may result in a pretty quick fix that can bring their system back online such that proper ERD and backups can be made for the future.

If anyone has any criticism or concerns or thinks that this wont work, please comment below,

Answer 1

Windows NT 4.0 does NOT have any "repair" option on the install disc (or disks). At least not as you're familiar with from newer versions of Windows. Instead the repair option will just drop-in blank vanilla system files, just like you installed the system from scratch.

While NT4 doesn't have any "safe mode" unlike 2000, what you can do (and I regularly needed to do) is hit Spacebar at the first boot progress bar, and choose "Last Known Good Configuration" from the options.

As others have said, you need to stop using the damaged disk right away, and make a full, sector by sector copy (preferably with ddrescue) to another hard drive of about the same size, or to a disk image file, compatible with a virtualization system (KVM, VirtualBox, etc.) Then you can work on the copy safely.

NT 4.0 had serious disk size limitations with the original release and earlier service packs. There was no option to slipstream service packs in those days, either. So the proper option is to install NT4 on a small NTFS partition, install service pack 6a, then you can either add additional larger partitions, or you can use a partition resizing tool to expand the small NTFS partition you've already created. THEN your NT4 system will be able to read from the image you created of the damaged drive.

However, you might find some hardy soul has manually upgraded their NT4 ISO with SP6a files, or you might even find a later NT4 install CD with a later service pack integrated into it to save you a step. The place to look is on WinWorldPC. No doubt you'll find the install data you need there.

You can then try copying all readable files from the damaged drive to your new installation, however, that unreadable "SYSTEM" file is a big chunk of the registry, so you'll need to find a copy from the damaged system, or else you'll be reinstalling and reconfiguring all installed software anyhow.

Another option is a live Linux CD like SystemRescueCD. NTFS support is quite reliable these days. Tools like TestDisk will allow you to analyze the disk, or even a single file disk image on your hard drive, and possibly recover the missing/deleted files. PhotoRec is worth a try if TestDisk doesn't work, and there are surely others to try as well.

NT4 is pre-plug-and-play, and unfortunately doesn't handle changing the storage driver under it without warning and proper prep, so getting it to work will require the same brand of SCSI or IDE controller to stand any chance. Of course once you have a running system you can install the driver (under "SCSI devices" in the Control Panel) which would allow you to boot-up on the new controller. This means booting-up a disk image in a virtualization program will necessitate finding one with the exact same disk controller. For comparison, Windows 2000 and XP could be made to boot on any IDE controller with Microsoft's "MergeIDE.reg" registry changes, and copying about 4 dlls from cab files into the proper folder. And of course you're familiar with even more recent versions of Windows having a repair option on the install disc that allows changing the boot device driver as needed. No such options with NT4 I'm afraid.

As ancient as NT4 is, you should spend your efforts getting them off of that system onto a more modern platform, rather than recovering NT4.

Good luck.