Windows Vista Hard drive dump...

[xrams]

I'm sure this has been covered in someway shape or form.... however, my searches yielded nothing...

I know you geniuses can give me a some what quick solution... I have a HP pc with two 500g HDDs... I've been having a great deal a trouble with hacking... I found scripts and viruses on one drive that I want to use as evidence in a suit (I know who the hackers are).... I copied the whole drive to the clean 500g drive and rebooted/clean installed the other... while booting up for the 1st time it seems my PC now can't boot it blue screens every time... thinking that my pc is still trying to boot to the virus HDD, I removed it from my pc... when I tried to boot from the clean installed HDD it still blue screened.... My question is how do I access the virus HDD...???? To use as evidence...???

I'll be glad to answer any specifics you have....
xrams

 

[kemical]

Hmm..interesting problem.. Does this mean that you can now boot up without Blue screening and just need to access the drive in question for the evidence it contains?
Also do you know which virus is the culprit? If it's a common one then you could always re-attach the drive as a slave and a good anti-virus app should be able to grab it..

 

[xrams]

Hmm..interesting problem.. Does this mean that you can now boot up without Blue screening and just need to access the drive in question for the evidence it contains?

Hi Kem... you honor me... Yes, I can now boot up without the Blue screen... My PC was a two (500g mirrored) setup... I changed the one dynamic drive to a basic for more space (also b/c the hackers were using the redundancy against me)... after identifying the scripts and file locals, I copied the whole C: drive to the D: drive.... then I rebooted the C: drive for a fresh start... after it was complete I input my new user name restarted I could never reach my newly rebooted C: drive again... until I removed the D: drive and even then it still gave a mem dump... so I had to reboot all over again without the D:.....

Also do you know which virus is the culprit? If it's a common one then you could always re-attach the drive as a slave and a good anti-virus app should be able to grab it..

I think I know what your talking about... I really don't want to remove the virus.. I want it to work as intended... the drive was fine with the viruses until I tried booting from a good drive while it was attached....

Kem... Without sounding like a butt licker... I think you guys do a great job with folks questions given that your more-often than not shooting in the dark and still giving the correct answer... this may help in you eval.... I used the HP site to update my one good drive... But I'd still like your input...

LINK:
Link Removed - Invalid URL

 

[kemical]

Hi xrams,
Much thanks for the kind words..

I checked out your link for the firmware update and the only thing that seems amiss is that it say's the firmware is for vista only but as your using one drive without problems then it could just a 'red herring'. I also noticed that there was info' on your system concerning updating to 7 and needing to update the bios?

As for the corrupted drive, if you don't want to remove the virus for evidence reasons then have you considered going to a specialist that deals with recovering data?

 

[xrams]

Hi xrams,
Much thanks for the kind words..

I checked out your link for the firmware update and the only thing that seems amiss is that it say's the firmware is for vista only but as your using one drive without problems then it could just a 'red herring'. I also noticed that there was info' on your system concerning updating to 7 and needing to update the bios?

As for the corrupted drive, if you don't want to remove the virus for evidence reasons then have you considered going to a specialist that deals with recovering data?

Unfortunatlly I'm back to vista ultimate... I have updated to the latest bios for vista not for 7... I agree with you I'm not going to mess with the drive again until it gets eval'd by a Pro...

thanks again for your quick comeback...
xrams...

 

[kemical]

Sorry I couldn't be more help but if you take the drive to a 'pro' would you let me know how you got on?

 

[xrams]

Sorry I couldn't be more help but if you take the drive to a 'pro' would you let me know how you got on?

You may yet still be able to help.... I have some options I think... the problem is I'm not experienced enough to try something for fear of making things worse as in (loosing the info)....

1) I have a complete backup of all good data now.. I didn't before... so why would my PC confuse which drive to boot from even if I direct it via bios to a specific HDD....???

2) I have a the Ref: Text "Windows Vista Inside out" which shows ways to get around a suspect drive, however, I basically instructs on ways to purge viruses not save them... I just want to access the drive to maintain the information... which I thought I was doing by coping it to a backup not realizing that the PC would try a boot to it or as it seems get confused by two drives with boot info....

3) that's what puzzles me.. why didn't it boot from one or the other...??? But that's not my question.. I ask you is there a way of the top of you head that I could safely boot from my good drive while the other drive is in play... b/c I now just want to move the info to an external.....

thanks again.

xrams

 

[xrams]

Why do you need to boot into both? If you open Computer from the drive into which you are booted can't you see & access all drives, even the external? Thereby being able to copy or move data between the drives. Apologise if I've missed something in the thread or scenario.

Drew

"A scan a day keeps the nasties away!"

Hi Drew... no need to apologize.... I don't need to boot both (and as a side question: why do folks have dual boot Drives, I never understood that)..... anyway, I don't know why my PC all the sudden shut down due to this issue... to answer your question, NO; I can't see any of the drives b/c the PC went blue after I copied all the data over and rebooted my other 500g drive..

Although I do have a JPG for you and Kem... I just remembered I took a pic. of the Blue screen b/c I was sooo frustrated at the time... before I post the pic (by the way I'm glad you all updated you site to allow attachments)... I would ask anyone: how the Hell do I get info of the blue screen if it only stays there for 5 or 6 seconds...?!?!?!? is there any way to slow the bootup screen down...????

I hope you guys can read it....
thanks for your help....

 

[kemical]

Much thanks for the blue screen picture, it helped! I did a little googling and found this link:

Link Removed

It seems to offer some alternatives and reasons why?