Cloning hdd to ssd

It seems that your %systemroot%\system32\drivers\filecrypt.sys file is either corrupt or missing. Are you able to boot into Safe Mode at all with the problematic drive?
 
Hi BlueRobot,

%systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same.
Something else must be causing problem for BSOD.
It says Critical Service Failed, which service is failed , how can we find it?
 
I also can not boot to safe mode with graphics or network, only to command prompt.
When trying to boot to safe mode , it gives Stop code 0xc00002
Also surprisingly I can see the ssd in command prompt mode from the problematic os on the hdd.!
 
burzek said:
%systemroot%\system32\drivers\filecrypt.sys , file is intact , I compared both hdd and ssd , they are exactly same.
Something else must be causing problem for BSOD.
Click to expand...
It's not, that is the problematic file. It's failing to load that driver for some reason. How did you compare them? Only because they "look" the same, it doesn't mean that the hashes haven't changed.

Rich (BB code): 
CRITICAL_SERVICE_FAILED (5a)
Arguments:
Arg1: 0000000000000001 << Start type of service?
Arg2: ffffa089773759a0 << Symbolic link to file system directory
Arg3: ffffc9007d447300 << File path to the driver we're trying to load
Arg4: ffffffffc0000103 << Exception being thrown

Rich (BB code): 
0: kd> du ffffa089773759a0
ffffa089`773759a0  "\FileSystem\FileCrypt"

Rich (BB code): 
0: kd> !du ffffc9007d447300
\SystemRoot\system32\drivers\filecrypt.sys

Rich (BB code): 
0: kd> knL
 # Child-SP          RetAddr               Call Site
00 ffffeb87`ff406a78 fffff801`43c16d58     nt!KeBugCheckEx
01 ffffeb87`ff406a80 fffff801`43e4efa3     nt!IopLoadDriver+0xebd58 << Dynamically load filecrypt.sys
02 ffffeb87`ff406c50 fffff801`43e4392a     nt!IopInitializeSystemDrivers+0x157
03 ffffeb87`ff406cf0 fffff801`43b87fcb     nt!IoInitSystem+0x2e
04 ffffeb87`ff406d20 fffff801`43755a15     nt!Phase1Initialization+0x3b
05 ffffeb87`ff406d50 fffff801`437feef8     nt!PspSystemThreadStartup+0x55
06 ffffeb87`ff406da0 00000000`00000000     nt!KiStartSystemThread+0x28

Interestingly, the symbolic link doesn't appear to exist, which would explain the reason for the exception code. It should exist under /FileSystem as a driver type. The driver itself is responsible for creating the symbolic link.

Rich (BB code): 
0: kd> !object \FileSystem\
Object: ffffc9007d5375e0  Type: (ffffa08975890220) Directory
    ObjectHeader: ffffc9007d5375b0 (new version)
    HandleCount: 0  PointerCount: 18
    Directory Object: ffffc9007d41e740  Name: FileSystem

    Hash Address          Type                      Name
    ---- -------          ----                      ----
     04  ffffa08977265ac0 Driver                    Wof
     11  ffffa089771e8060 Device                    CdfsRecognizer
     12  ffffa08977283060 Device                    UdfsDiskRecognizer
         ffffa089772677f0 Driver                    Fs_Rec
     19  ffffc9007d537b20 Directory                 Filters
     21  ffffa089771c3390 Driver                    FltMgr
     22  ffffa089772832a0 Device                    FatCdRomRecognizer
     23  ffffa089771bf100 Driver                    Ntfs
     24  ffffa089773a6c40 Driver                    Mup
         ffffa0897719fde0 Driver                    RAW
     25  ffffa08977269a70 Device                    ReFSRecognizer
         ffffa08977267310 Driver                    WdFilter
     28  ffffa089771c3e50 Driver                    FileInfo
     31  ffffa0897726ba70 Device                    FatDiskRecognizer
     32  ffffa08977269cb0 Device                    ReFSv1Recognizer
     33  ffffa0897726bcb0 Device                    ExFatRecognizer
     35  ffffa089772834e0 Device                    UdfsCdRomRecognizer

The exception in question:

Rich (BB code): 
0: kd> !error c0000103
Error code: (NTSTATUS) 0xc0000103 (3221225731) - A requested opened file is not a directory.



Could you please boot into Safe Mode with Command Prompt and then enter the following command:

Rich (BB code): 
reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FileCrypt /s

Please provide a screenshot of the output.
 
I have mixed Safe mode with command prompt with other command prompt which brings out the drive as X in Winpe mode.
I guess I can load the system hive from other windows by attaching it to the regedit , and copy the key you mentioned from it ?
 
This is what I could came up with.
I attached the system hive with the name qqq
I could only find ControlSet001 , instead of CurrentControlSet
Exported as filecrpty.reg.txt , you can find it attached.

I hope this helps.


1652363625494.png
 

Attachments

I think that the memory dump might be old , after sfc /scannow and dism some missing files might be restored.
I will try to boot again and submit srt logs and a new memory dump if happens.
 
I first deleted memory.dmp and srt logs, then tried to enter safe mode command prompt, received stop error 0xc000021a
Please find related memory.dmp and all files in srt logs in following link containing Logs.7z

Download logs.7z (19.72 MB) now. Fast and easy at workupload.com

Password is Marker47

Then I removed memory.dmp and srt logs again and now I am performing offline sfc and dism restorehealth on the drive.
Sfc finished without any violations , dism is working on.
I will then try to reboot and send any other dmp and srt logs.
 
Stop 0xC000021A will mean that a system file or a registry setting is corrupt, however, since SFC has returned no issues then it will likely be something related to your registry. It increasingly seems that performing a clean install is the most suitable option.
 
After the above sfc and dism , rebooted the pc from the hdd.
During booting from hdd , again gave the critical service failed bsod.
After rebooting again from hdd automatic repairs began and a disk checking also performed, how can I see the details?
Again automatic repair failed. I rebooted from ssd.
I could not find any memory.dmp in hdd \windows folder.
After booting ssd, the email box were on the hdd and inbox was missing, I restored from a backup but this is getting very strange.
I performed chkdsk it seems fine on hdd.
Please find the attached logs. I hope we can catch what is happening or I am about to give up.

Thanks.
 

Attachments

As already sad in post #110, performing a clean install is the only way to fix this problem.
 
Ok , at least we tried, thank you for all your help.
I will continue with the ssd and move everything from hdd to ssd manually.
Have a nice weekend...
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top