Cloning hdd to ssd

x BlueRobot · May 12, 2022

It seems that your %systemroot%\system32\drivers\filecrypt.sys file is either corrupt or missing. Are you able to boot into Safe Mode at all with the problematic drive?

burzek · May 12, 2022

Hi BlueRobot,

%systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same.
Something else must be causing problem for BSOD.
It says Critical Service Failed, which service is failed , how can we find it?

burzek · May 12, 2022

I also can not boot to safe mode with graphics or network, only to command prompt.
When trying to boot to safe mode , it gives Stop code 0xc00002
Also surprisingly I can see the ssd in command prompt mode from the problematic os on the hdd.!

x BlueRobot · May 12, 2022

burzek said:
%systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same.
Something else must be causing problem for BSOD.

It's not, that is the problematic file. It's failing to load that driver for some reason. How did you compare them? Only because they "look" the same, it doesn't mean that the hashes haven't changed.

Rich (BB code):

CRITICAL_SERVICE_FAILED (5a)
Arguments:
Arg1: 0000000000000001 << Start type of service?
Arg2: ffffa089773759a0 << Symbolic link to file system directory
Arg3: ffffc9007d447300 << File path to the driver we're trying to load
Arg4: ffffffffc0000103 << Exception being thrown

Rich (BB code):

0: kd> du ffffa089773759a0
ffffa089`773759a0  "\FileSystem\FileCrypt"

Rich (BB code):

0: kd> !du ffffc9007d447300
\SystemRoot\system32\drivers\filecrypt.sys

Rich (BB code):

0: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffffeb87`ff406a78 fffff801`43c16d58     nt!KeBugCheckEx
01 ffffeb87`ff406a80 fffff801`43e4efa3     nt!IopLoadDriver+0xebd58 << Dynamically load filecrypt.sys
02 ffffeb87`ff406c50 fffff801`43e4392a     nt!IopInitializeSystemDrivers+0x157
03 ffffeb87`ff406cf0 fffff801`43b87fcb     nt!IoInitSystem+0x2e
04 ffffeb87`ff406d20 fffff801`43755a15     nt!Phase1Initialization+0x3b
05 ffffeb87`ff406d50 fffff801`437feef8     nt!PspSystemThreadStartup+0x55
06 ffffeb87`ff406da0 00000000`00000000     nt!KiStartSystemThread+0x28

Interestingly, the symbolic link doesn't appear to exist, which would explain the reason for the exception code. It should exist under /FileSystem as a driver type. The driver itself is responsible for creating the symbolic link.

Rich (BB code):

0: kd> !object \FileSystem\
Object: ffffc9007d5375e0  Type: (ffffa08975890220) Directory
    ObjectHeader: ffffc9007d5375b0 (new version)
    HandleCount: 0  PointerCount: 18
    Directory Object: ffffc9007d41e740  Name: FileSystem

    Hash Address          Type                      Name
    ---- -------          ----                      ----
     04  ffffa08977265ac0 Driver                    Wof
     11  ffffa089771e8060 Device                    CdfsRecognizer
     12  ffffa08977283060 Device                    UdfsDiskRecognizer
         ffffa089772677f0 Driver                    Fs_Rec
     19  ffffc9007d537b20 Directory                 Filters
     21  ffffa089771c3390 Driver                    FltMgr
     22  ffffa089772832a0 Device                    FatCdRomRecognizer
     23  ffffa089771bf100 Driver                    Ntfs
     24  ffffa089773a6c40 Driver                    Mup
         ffffa0897719fde0 Driver                    RAW
     25  ffffa08977269a70 Device                    ReFSRecognizer
         ffffa08977267310 Driver                    WdFilter
     28  ffffa089771c3e50 Driver                    FileInfo
     31  ffffa0897726ba70 Device                    FatDiskRecognizer
     32  ffffa08977269cb0 Device                    ReFSv1Recognizer
     33  ffffa0897726bcb0 Device                    ExFatRecognizer
     35  ffffa089772834e0 Device                    UdfsCdRomRecognizer

The exception in question:

Rich (BB code):

0: kd> !error c0000103
Error code: (NTSTATUS) 0xc0000103 (3221225731) - A requested opened file is not a directory.

Could you please boot into Safe Mode with Command Prompt and then enter the following command:

Rich (BB code):

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FileCrypt /s

Please provide a screenshot of the output.

burzek · May 12, 2022

I have mixed Safe mode with command prompt with other command prompt which brings out the drive as X in Winpe mode.
I guess I can load the system hive from other windows by attaching it to the regedit , and copy the key you mentioned from it ?

burzek · May 12, 2022

This is what I could came up with.
I attached the system hive with the name qqq
I could only find ControlSet001 , instead of CurrentControlSet
Exported as filecrpty.reg.txt , you can find it attached.

I hope this helps.

burzek · May 12, 2022

I think that the memory dump might be old , after sfc /scannow and dism some missing files might be restored.
I will try to boot again and submit srt logs and a new memory dump if happens.

x BlueRobot · May 12, 2022

Let us know what happens after running SFC and DISM and then attempting to boot.

burzek · May 12, 2022

I first deleted memory.dmp and srt logs, then tried to enter safe mode command prompt, received stop error 0xc000021a
Please find related memory.dmp and all files in srt logs in following link containing Logs.7z

Download logs.7z (19.72 MB) now. Fast and easy at workupload.com

Password is Marker47

Then I removed memory.dmp and srt logs again and now I am performing offline sfc and dism restorehealth on the drive.
Sfc finished without any violations , dism is working on.
I will then try to reboot and send any other dmp and srt logs.

x BlueRobot · May 12, 2022

Stop 0xC000021A will mean that a system file or a registry setting is corrupt, however, since SFC has returned no issues then it will likely be something related to your registry. It increasingly seems that performing a clean install is the most suitable option.

x BlueRobot · May 12, 2022

The dump file you've uploaded appears to the same one as before?

burzek · May 13, 2022

Hi,

This is the result of offline sfc and dism.

I will boot and submit dump and srt files.

burzek · May 13, 2022

After the above sfc and dism , rebooted the pc from the hdd.
During booting from hdd , again gave the critical service failed bsod.
After rebooting again from hdd automatic repairs began and a disk checking also performed, how can I see the details?
Again automatic repair failed. I rebooted from ssd.
I could not find any memory.dmp in hdd \windows folder.
After booting ssd, the email box were on the hdd and inbox was missing, I restored from a backup but this is getting very strange.
I performed chkdsk it seems fine on hdd.
Please find the attached logs. I hope we can catch what is happening or I am about to give up.

Thanks.

Maxstar · May 13, 2022

As already sad in post #110, performing a clean install is the only way to fix this problem.

burzek · May 13, 2022

Ok , at least we tried, thank you for all your help.
I will continue with the ssd and move everything from hdd to ssd manually.
Have a nice weekend...

Maxstar · May 13, 2022

Have a nice weekend too.

Bearded Blunder · May 13, 2022

Maxstar said:
As already sad in post #110, performing a clean install is the only way to fix this problem.

I'd concluded that at post 37...

Search

Search

Cloning hdd to ssd

x BlueRobot

Administrator, BSOD Academy Instructor

burzek

Well-known member

burzek

Well-known member

x BlueRobot

Administrator, BSOD Academy Instructor

burzek

Well-known member

burzek

Well-known member

Attachments

burzek

Well-known member

x BlueRobot

Administrator, BSOD Academy Instructor

burzek

Well-known member

x BlueRobot

Administrator, BSOD Academy Instructor

x BlueRobot

Administrator, BSOD Academy Instructor

burzek

Well-known member

burzek

Well-known member

Attachments

Maxstar

Sysnative Staff, Windows Update Analyst, Security Analyst

burzek

Well-known member

Maxstar

Sysnative Staff, Windows Update Analyst, Security Analyst

Bearded Blunder

Active member