Diagnostic and Recovery Toolset (Part 3)

by [Published on 19 April 2011 / Last Updated on 19 April 2011]

This article demonstrates how to use your DaRT 6.5 boot media for troubleshooting unbootable Windows-based computers.

If you would like to read the other parts in this article series please go to

Introduction

In the first article of this series we learned about Microsoft's Diagnostic and Recovery Toolset (DaRT) which provides various tools for troubleshooting and repairing Windows-based computers that won't boot because of system file corruption, driver incompatibility issues, malware infection, and other types of problems. DaRT 6.5, which is part of MDOP 2009 R2, lets you troubleshoot computers running Windows 7, Windows Server 2008 R2, or earlier versions of Microsoft Windows. In the second article we learned how to install DaRT and create bootable DaRT media you can use to boot Windows-based computers that won't boot using the Windows Recovery Environment (WinRE). Once in the WinRE, you then have access to the various tools and wizards provided by DaRT and can attempt to repair the problem computer. In this article and ones that follow, we'll see how you can use your DaRT CD to try to resolve issues that are preventing Windows-based computers from successfully booting.

Booting from your DaRT CD

Let's say you start a Windows 7 computer and after the Starting Windows splash screen is displayed, you simply get a blank black screen. In other words, the boot process fails with no logon screen and no errors, just an empty black screen. Or maybe you get a stop error a.k.a. bugcheck error a.k.a. blue screen of death (BSOD) familiar from earlier versions of Windows. Either way, what might be causing your problem and making your computer unbootable? Corrupt files? A corrupt registry? A virus?

It's time to pull out the bootable DaRT CD you created by following the steps outlined in the previous article of this series. Insert your DaRT CD into the CD-ROM drive of the computer and turn the computer on, then press a key when prompted to boot from the CD instead of the hard drive. After the Starting Windows splash screen appears, you're presented with a series of dialog boxes. The first box asks you whether you want to initialize networking:


Figure 1: Step 1 of booting from your DaRT CD.

What DaRT is asking you here is whether you want to have DaRT acquire an IP address for the computer from a DHCP server on your network. If you have a DHCP server on the network, you can click Yes. If not, click No and then later use the TCP/IP Config utility of DaRT to manually assign an IP address to the computer if you think network connectivity will be needed to resolve your problem.

The next dialog box asks you whether you want to remap the drive letters used by DaRT to match the drive letters used by the problem computer's operating system:


Figure 2: Step 2 of booting from your DaRT CD.

What this somewhat cryptic dialog box means the following. If you click Yes, then when you Windows Explorer from DaRT you'll see the C: drive of the boot volume on the problem computer and the X: drive of Windows RE, plus other drive letters for floppy drive, CD-ROM drive, and so on. But if you click No, then C: drive will represent the hidden System Partition where the Boot Configuration Database (BCD) and other special files are stored, while the boot volume will be labeled D: instead of C: drive. So it's usually best to click Yes here unless you think you need to mess around with the hidden System Partition to try and fix things.

The next dialog box is straightforward and asks you what keyboard layout you want to use:


Figure 3: Step 3 of booting from your DaRT CD.

Click Next and DaRT now begins searching the computer's hard drive for Windows installations:


Figure 4: Step 4 of booting from your DaRT CD.

After a short time a list of Windows installations on the computer will be displayed. Unless you have a multiboot system, only one instance of Windows should be visible, so select it:


Figure 5: Step 5 of booting from your DaRT CD.

Click Next and the System Recovery Options dialog is displayed. On first glance this looks like the typical System Recovery Options dialog of the Windows Recovery Environment (Windows RE) but there is a sixth recovery option listed at the bottom that isn't available in Windows RE. That additional option is called Microsoft Diagnostic and Recovery Toolset and it's your gateway into the world of DaRT:


Figure 6: Step 6 of booting from your DaRT CD.

Clicking the DaRT link at the bottom of the System Recovery Options dialog displays the MSDaRT Tools screen, which lists the various DaRT tools you decided to put on your DaRT CD when you created the CD (we put all the available tools on the CD):


Figure 7: Accessing the DaRT tools.

You are now ready to use these tools to try to repair your Windows installation.

Checking for Corrupt or Missing System Files

The first thing we'll check for is whether we have any missing or corrupt operating system files that might be preventing Windows from booting successfully. To do this, click the SFC Scan link on the MSDaRT Tools screen shown above. This launches the wizard shown below, which basically does the same thing as running the sfc /scannow command from a command prompt on a working Windows installation. This command scans all protected operating system files and replaces missing, corrupt or incorrect versions of these files with their correct versions.


Figure 8: Step 1 of running the System File Checker.

After clicking Next, you have two options to choose from on the Repair Options wizard page. The default is the scan the system and automatically repair any problems found with missing, corrupt or incorrect version system files. We'll choose the second options which will prompt us before performing any repairs as that way we can know what problems (if any) were found:


Figure 9: Step 2 of running the System File Checker.

Of course, even if you chose the first option of having repairs performed automatically, you can still view the log file later to see what problems were found and how they were resolved. As you can see from the next wizard page, the path to this log file is X:\Windows\Logs\CBS\CBS.log where X: drive is the Windows RE drive which exists only in volatile memory (RAM) on the computer (X: drive is also where your DaRT tools are running from).:


Figure 10: Step 3 of running the System File Checker.

Checking the system files may take some time (DaRT can be slow) but eventually you may find yourself lucky, and the next figure shows that DaRT has found two missing or corrupt operating system files in the Windows installation:


Figure 11: System File Checker has found missing or corrupt operating system files.

Clicking Next causes SFC to try and replace the missing or corrupt files, and if the repair works then you will see something like this:


Figure 12: The repair was successful—or was it?

Clicking Next prompts you to close the System File Checker wizard:


Figure 13: Close the System File Checker wizard.

Clicking Finish returns you to the MSDaRT Tools screen shown earlier in Figure 7. At this point, take the DaRT CD out of your computer, turn the computer off and then on again, and see if it successfully boots into Windows.

Conclusion

Guess what? After performing the steps described above, my computer still displays an empty black screen after Starting Windows, and I never get to the logon screen, so it still won't boot properly. This could mean either (a) SFC identified and repaired some problems but failed to identify other problems with system files on the computer, or (b) the computer has additional problems such as a corrupted registry, virus, or something else, or (c) perhaps both (a) and (b) are true. From my own experience, I've observed that SFC doesn't always find all problems with missing or corrupt system files. For example, I once used Windows RE to delete the system file svchost.exe from the C:\Windows\System32 folder on a working Windows 7 installation, and then of course it wouldn't boot properly. Then I tried running SFC from DaRT and it said that no problems were found, so SFC failed to detect that a critical system file was missing. In either case, we can try using some of the other DaRT tools to repair our system, and we'll attempt to do so in the next article of this series.

If you would like to read the other parts in this article series please go to

Featured Links