Microsoft Diagnostics and Recovery Toolset

Microsoft Diagnostics and Recovery Toolset 5.0 (Microsoft DaRT) enables you to find and fix problems that are preventing a system from starting. Microsoft DaRT includes the following tools:

  • Crash Analyzer Wizard. Enables you to examine a Windows crash dump (either a full dump or a minidump) for the problem that most likely caused the system to fail. For more information about analyzing a system crash, see Crash Analyzer Wizard.

  • File Restore. Enables you to recover files that have been removed from the Recycle Bin. You can also recover files that might have bypassed the Recycle Bin because they were deleted by using the Command Prompt, by using a networked application, or while uninstalling an application. For more information about restoring files, see File Restore.

  • ERD Commander. Provides utilities and wizards that will help you to perform system diagnosis and repair procedures, such as recovering data, disabling problematic drivers, and removing hotfixes. For more information about diagnosing and repairing systems, see ERD Commander.

Copyright © 2007 by Microsoft Corporation. All rights reserved.


Microsoft DaRT Copyright and Disclaimer

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2007 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

All other trademarks are property of their respective owners.


Crash Analyzer Wizard

The Crash Analyzer Wizard enables you to debug a Windows crash dump and diagnose related system errors. The Crash Analyzer Wizard uses the Microsoft Debugging Tools for Windows to examine a Windows crash dump (either a full dump or minidump) for the driver that most likely caused the system to fail.

Important
The Crash Analyzer Wizard will attempt to locate the Debugging Tools for Windows on your system. If the directory path box is empty, you must enter the location or browse to the location of the Debugging Tools for Windows (you can download the files from Microsoft). You must also provide a path to where the symbol files will be located. For more information about the Microsoft Debugging Tools for Windows and the symbol files, see "Debugging Tools for Windows — Overview" at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=30565).

The Crash Analyzer Wizard provides a diagnosed result that you can use to decide the appropriate course of action. For example, you can use the Services and Drivers Manager in ERD Commander to remove the driver that caused the crash. For more information about using ERD Commander, see ERD Commander.

Note
If you include the Microsoft Debugging Tools for Windows and the symbol files on the boot CD that you create for ERD Commander, you can ensure that they will be available when they are needed.

To run the Crash Analyzer Wizard

  • Click Start, point to All Programs, point to Microsoft Diagnostics and Recovery Toolset, and then click Crash Analyzer Wizard.

The following steps will be completed in the process of analyzing a crash.

  1. You must ensure that you have the necessary tools and files installed on your system:

    • Microsoft Debugging Tools for Windows.

    • Symbol Files. For more information about symbol files, see Ensure Access to Symbol Files.

  2. You select a crash dump file (either a full dump or a minidump) that you want to analyze.

  3. The Crash Analyzer Wizard scans the crash dump file and reports a probable cause of the crash. You can view further information on the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis.

  4. You decide upon an appropriate course of action, which can include disabling or updating the device driver responsible for the crash using the Services and Drivers Manager in ERD Commander.

Ensure Access to Symbol Files

Symbol files are automatically downloaded during the analysis process. If the system does not have an Internet connection or the network requires the system to access an HTTP proxy server, the symbol files will not be downloaded.

The following options are available for ensuring access to symbol files:

  • Copy the dump file to another system. If the symbols cannot be downloaded because of a lack of an Internet connection, you can copy the crash dump file to a system that does have a connection and run the Crash Analyzer Wizard from that system.

  • Access the symbol files from another system. If the symbols cannot be downloaded because of a lack of an Internet connection, you can download the symbols from a system that does have a connection and then copy them to the system that does not have a connection or you can map a network drive to a location where the symbols are available on the local network. If you are running the Crash Analyzer Wizard in ERD Commander, you can include the symbol files on the boot CD for ERD Commander. For more information, see How to Create a Boot CD for ERD Commander.

  • Use an environment variable to access an HTTP proxy server. If the symbols cannot be downloaded because an HTTP proxy server must be accessed, you can perform the following procedure. This option only applies to running the Crash Analyzer Wizard in ERD Commander.

To access an HTTP proxy server

  1. Open a Command Prompt window.

  2. Change the directory to the location of the CrashAnalyzer.exe program.

  3. Set the _NT_SYMBOL_PROXY environment variable to the HTTP proxy server address. The HTTP proxy server address should be in the format hostname:port. For example, you can type the following command (replace myproxy and mycompany with the appropriate names for your proxy server and company domain):

    set _NT_SYMBOL_PROXY=myproxy.mycompany.com:80

  4. In the Command Prompt window, run the Crashanalyze.exe program.

See Also

Concepts

ERD Commander


ERD Commander

ERD Commander enables you to access any Windows 2000, Windows XP, or Windows Server 2003 file system, which includes FAT, FAT32, and NTFS. ERD Commander offers both a graphical environment and a command-line console.

The ERD Commander interface includes a taskbar, Start menu, and desktop shortcuts. You cannot edit the items on the Start menu, move or modify existing desktop shortcuts, or create new desktop shortcuts.

ERD Commander provides utilities and wizards that will help you to perform many different types of system diagnoses and repairs. The following table lists some of the problems that can be solved with the utilities and wizards that are provided with ERD Commander.

Diagnose Windows-based system crashes | The Crash Analyzer Wizard can be used to diagnose Windows-based system crashes and pinpoint the driver that caused the failure.
Remove or replace problematic drivers or services | The Service and Driver utility can be used to delete or replace services or drivers that prevent a Windows-based system from starting.
Recover deleted files | File Restore can be used to find and restore deleted files from any supported Windows-based file system.
Regain access to a system | Locksmith Wizard can be used to list the local user accounts and change passwords.
View event logs | The Event Log Viewer can be used to help diagnose a problem by viewing event logs.
Restore Windows XP restore points | The ERD System Restore Wizard can be used to restore a system that cannot be started to a previous restore point.
Uninstall Windows hotfixes and service packs | The Hotfix Uninstall Wizard can be used to remove Windows hotfixes or service packs from a system that cannot be started.
Partition and format disks | Computer Management can be used to delete, format, and create partitions and volumes.
Salvage and repair partitions, volumes, or files | The Disk Commander Wizard can be used to salvage or repair partitions, volumes, or files.
Erase disks and volumes | Disk Wipe can be used to erase disks and volumes.

The following Help documentation sections provide information about preparing to run ERD Commander.

  • ERD Commander has system hardware and software requirements that must be considered. For more information, see ERD Commander System Requirements.

  • To run ERD Commander on a computer, you must have a boot CD. For more information, see How to Create a Boot CD for ERD Commander.


ERD Commander System Requirements

ERD Commander requires that the target system use one of the following operating systems:

  • Windows 2000

  • Windows XP (x86 versions)

  • Windows Server 2003 (x86 versions)

The ERD Commander Boot Media Wizard runs on x86 versions of Windows 2000, Windows XP, and Windows Server 2003. It is not supported for use on earlier versions of Windows, 64-bit versions of Windows XP, or Windows Server 2003 that run on Intel Itanium or 64-bit Extended systems.

Many of the ERD Commander components work properly with 64-bit versions of Windows XP and Windows Server 2003 that run on an Extended 64-bit (x64, often referred to as AMD64) system. However, there are several components that are known to not work correctly, such as the Crash Analyzer Wizard, the Hotfix Uninstall Wizard, and the System File Repair Wizard.

ERD Commander has the following hardware requirements:

  • A minimum of 64 MB (128 MB recommended) of system RAM

  • An Intel Pentium (or compatible) 166 MHz or faster processor

  • A CD drive

  • BIOS support for booting from a CD drive

The Crash Analyzer Wizard requires a writable disk volume that is formatted with NTFS or FAT. The Disk Wipe utility requires at least one working hard disk drive or floppy disk drive.

All of the utilities provided with ERD Commander, except ERD System Restore Wizard, are compatible with Windows 2000, Windows XP, and Windows Server 2003. ERD System Restore Wizard is compatible only with Windows XP.

See Also

ERD Commander


How to Create a Boot CD for ERD Commander

The ERD Commander Boot Media Wizard is used to create a bootable International Organization for Standardization (ISO) image. An ISO image is a file that represents the raw contents of a CD, which can be written to a recordable CD. If your system includes a CD-R or CD-RW drive, the ERD Commander Boot Media Wizard will offer to burn the ISO image to a blank CD. If your system does not contain a drive that is supported by the ERD Commander Boot Media Wizard, you can burn the ISO image onto a CD using most programs that can burn a CD.

Caution
You should not use ERD Commander on a system that is running Windows Vista. If you start ERD Commander on a system that is running Windows Vista, the restore points will be deleted.

Important
You cannot use the CD burning program that is included with Windows XP.

You will need the following items to successfully create a bootable CD from the ISO image that the ERD Commander Boot Media Wizard creates:

  • A CD-R or CD-RW drive.

  • A recordable CD (supported by your recordable drive).

  • CD burning software that supports your recordable drive and supports burning an ISO image directly to CD.

    Note
    You should test the CD that you create on all systems that you intend to support because some systems are not capable of starting from all types of recordable CDs.

When you run the ERD Commander Boot Media Wizard, you should be prepared to provide the following information:

  • Debugging Tools for Windows. You will be asked to provide the location of the Debugging Tools for Windows. For more information, see How to Add the Debugging Tools for Windows.

  • Original Equipment Manufacturer (OEM) Drivers. You will be asked if you want to add OEM drivers for storage and network devices to the ISO image. For more information, see Original Equipment Manufacturer Drivers.

  • Additional Files. You can add files to the ISO image that you might need to help diagnose problems. For more information, see How to Add Files to the CD.

  • ISO Image Location. You will be asked to specify where the ISO image should be located. For more information, see How to Select an Image Location.

  • CD Drive. You will be asked to specify the CD drive that should be used to burn the CD. For more information, see How to Burn the CD.

Note
The ISO image can range in size from 130 MB to 230 MB depending on the tools that you select when you run the Boot Media Wizard.

To start the ERD Commander Boot Media Wizard

  • Click Start, point to Microsoft Diagnostics and Recovery Toolset, and then click ERD Commander Boot Media Wizard.

You can also create a bootable CD that can only be used for a certain number of days after it is generated. You must run the ERD Commander Boot Media Wizard from a Command Prompt window to create the bootable CD that has a time limit. The following syntax is used to create a time-limited CD:

ERDC /e NumberOfDays

NumberOfDays is a positive integer that represents the number of days that the bootable CD will be usable.

To create a bootable CD that has a time limit

  1. Open a Command Prompt window.

  2. Change the directory to the location of the Erdc.exe program.

  3. Run the ERD Commander Boot Media Wizard with the /e parameter and specify the number of days that the bootable CD can be used.

See Also

ERD Commander


How to Add the Debugging Tools for Windows

If you include the Crash Analyzer Wizard in the International Organization for Standardization (ISO) image, you will be asked to specify the location of the Debugging Tools for Windows. (If you do not have a copy of the tools, you can download them from Microsoft.) You can either specify a location on the system where you are running the ERD Commander Boot Media Wizard or you can specify to use the tools that are located on the target system. If you choose to use a copy on another system, you must ensure that the tools are installed on each system on which you are diagnosing a crash.

Note
If you include the Crash Analyzer Wizard in the ISO image, it is recommended that you also include the Debugging Tools for Windows.

To add the Debugging Tools for Windows

  1. (Optional) Click the hyperlink to download the Debugging Tools for Windows.

  2. In the Crash Analyzer Support dialog box of the ERD Commander Boot Media Wizard, select one of the following options:

    • Use the Debugging Tools for Windows installation located at. If you select this option, you can click … to browse to the location of the tools.

    • Locate the Debugging Tools for Windows installation located on the target computer.

  3. Click Next.
Important
The Crash Analyzer Wizard will not work if the Debugging Tools for Windows are not available.

See Also

How to Create a Boot CD for ERD Commander


Original Equipment Manufacturer Drivers

You should include Original Equipment Manufacturer (OEM) drivers on the boot CD for ERD Commander when you are repairing a computer that has SCSI adapters or network controllers that are not supported by the Windows operating system.

You can use the following procedures to add OEM drivers to the boot CD:

  • How to Add OEM Storage Controller Drivers You can add OEM drivers that support SCSI adapters.

  • How to Add OEM Network Controller Drivers You can add OEM drivers that support network controllers.

See Also

How to Create a Boot CD for ERD Commander


How to Add OEM Network Controller Drivers

Windows operating systems do not provide drivers for all network controllers that can be installed on a computer. Perform the following procedure in the ERD Commander Boot Media Wizard to add Original Equipment Manufacturer (OEM) drivers to the boot CD for the network controllers that are not supported.

To add an OEM network controller driver

  1. In the Additional Network Controller Drivers dialog box of the ERD Commander Boot Media Wizard, click Add Device.

  2. Browse to the .inf file for the driver, and then click Open.

    Note
    The .inf file is provided by the manufacturer of the network controller.

  3. Repeat steps 1 and 2 for all of the drivers that you want to include.

  4. Click Next.
Important
Wireless connectivity (Bluetooth or 802.11a/b/g/n) is not supported in ERD Commander.

See Also

Original Equipment Manufacturer Drivers


How to Add OEM Storage Controller Drivers

Windows operating systems do not provide drivers for all SCSI adapters that can be installed on a computer. Perform the following procedure in the ERD Commander Boot Media Wizard to add Original Equipment Manufacturer (OEM) drivers to the boot CD for the adapters that are not supported.

To add an OEM storage controller driver

  1. In the Additional Mass Storage Drivers dialog box of the ERD Commander Boot Media Wizard, click Add Device.

  2. Browse to the txtsetup.oem file for the driver, and then click Open.

    Note
    The txtsetup.oem file is provided by the manufacturer of the storage device.

  3. In the Select SCSI Driver dialog box, select the driver that you want to add, and then click OK.

  4. Repeat steps 1 through 3 for all of the drivers that you want to include.

  5. Click Next.
Note
SCSI is not the only type of storage controller driver that you might need to add. SCSI, Serial-ATA (SATA), and IDE RAID are examples of devices that often require drivers that are not included in Windows.

See Also

Original Equipment Manufacturer Drivers


How to Add Files to the CD

Perform the following procedure in the ERD Commander Boot Media Wizard to add additional files to the boot CD.

To add additional files

  1. In the Additional Files dialog box of the ERD Commander Boot Media Wizard, click Explore.

  2. On the Windows taskbar, right-click Start, and then click Explore.

  3. Browse to the file that you want to add, and then select the file.

  4. On the Edit menu, click Copy.

  5. On the Edit menu of the Explorer window that was opened from the ERD Commander Boot Media Wizard, click Paste.

  6. Repeat steps 3 through 5 for all of the files that you want to add to the CD.

  7. Close both of the Explorer windows.

  8. Click Next.

See Also

How to Create a Boot CD for ERD Commander


How to Select an Image Location

Perform the following procedure in the ERD Commander Boot Media Wizard to specify the location where the International Organization for Standardization (ISO) image is created.

To specify the location of the ISO image

  1. In the Write CD Image File dialog box of the ERD Commander Boot Media Wizard, click Browse.

  2. Browse to the location in the Save As window, and then click Save.

  3. Click Next.

The ISO image can range in size from 130 MB to 230 MB depending on the tools that you select and the files that you add in the ERD Commander Boot Media Wizard.

The ERD Commander Boot Media Wizard requires the ISO image to have an .iso file extension, because most programs that burn a CD require that extension. If you do not specify a different location, the ISO image will be created on your desktop with the name ERD50.ISO.

See Also

How to Create a Boot CD for ERD Commander


How to Burn the CD

If the ERD Commander Boot Media Wizard detects a compatible CD drive on your system, it will offer to burn the International Organization for Standardization (ISO) image to a disc for you. If the wizard does not recognize your drive, you will need to use another program to burn the CD, such as the program that came with your drive. You can use a CD duplicator, a duplicating service, or CD-burning software to make any additional copies that you might need.

To burn the CD

  1. In the Burn to a recordable CD dialog box of the ERD Commander Boot Media Wizard, select Burn to the following recordable drive now.

  2. Select the CD drive.

    Note
    If a drive is not recognized and you install a new drive, you can click Refresh Drive List to force the ERD Commander Boot Media Wizard to refresh the list of available drives.

  3. Click Next.

See Also

How to Create a Boot CD for ERD Commander


File Restore

File Restore recovers files that have been deleted from FAT, FAT32 and NTFS volumes. File Restore recovers files that have been removed from the Recycle Bin and recovers files that might have bypassed the Recycle Bin because they were deleted by using the Command Prompt, by using a networked application, or by uninstalling an application.

File Restore runs on Microsoft Windows 2000, Windows XP, and Windows Server 2003. File Restore recovers files from local drives only. Because File Restore provides access to all deleted files on a system, you must have Administrator privileges to run it.

To help you search for and recover deleted files, the following Help documentation sections provide step-by-step procedures for using File Restore:

  • How to Search for Deleted Files You can use a set of search parameters in File Restore to find files that have been deleted.

  • How to Restore Deleted Files After you have used File Restore to search for deleted files, you can select the files that you want to restore.

This documentation supports File Restore in Microsoft Diagnostics and Recovery Toolset 5.0.


How to Search for Deleted Files

Perform the following procedure to use File Restore to search for files that have been deleted.

The following parameters can be used to search for deleted files.

Search for files named | The search pattern that you enter can contain any subset of the file or path names. The search pattern can also include the asterisk (*) wildcard character.
Look in | Search in the drive that is listed, or browse to a drive or folder.
Search for files in deleted directories | Search for files in directories that have been deleted.
Last modified | Search for files that have been deleted in the last number of months, or for files that have been deleted between specific dates.
Size between | Search for files that are within a specific size range.

File Restore attempts to determine whether a deleted file is recoverable or not and reports the result in the Recoverability column. The following are possible levels of recoverability for files:

  • Likely None of the data in the file is known to be overwritten by other files. This is only an estimate of the file’s condition, and it is possible that a file marked Likely will contain corrupt data. In general, the longer the time since a file has been deleted, the less likely that it can be recovered.

  • Unlikely Some of the clusters have been overwritten by other files. It is unlikely that they can be recovered.

The first letter of the file name cannot always be retrieved for files on FAT or FAT32 volumes. For this reason, File Restore displays files that match all characters entered in Search for files named, as well as those matching all characters but the first letter. When the first letter cannot be retrieved, it is replaced by a question mark (?) when it is displayed in the right pane of File Restore and by an underscore (_) when it is copied to a new location.

If a file is found, but the directory where it belongs cannot be determined, it is placed in a directory labeled "...Unknown Folder #..." It is possible for there to be multiple orphan directories that correspond to different directories that no longer exist.

To locate all of the deleted files on a selected drive, click Search Now without entering any search parameters.

To search for files

  1. If you are running File Restore in ERD Commander, click Start, point to System Tools, and then click File Restore. If you are running File Restore in Windows, click Start, point to All Programs, point to Microsoft Diagnostics and Recovery Toolset, and then click File Restore.

  2. In the Search for files named box, enter the search pattern to use.

  3. In the Look in list, click the location of the search folder. You can click Browse to find a folder.

  4. Select the Last modified range.

  5. Select the Size between range.

  6. Click Search Now.

    The files that match the search criteria will appear in the right pane.

After you have successfully searched for deleted files, you can select the files that you want to restore. For more information about restoring files, see How to Restore Deleted Files.


How to Restore Deleted Files

File Restore helps you to recover files that have been deleted from FAT, FAT32, and NTFS volumes. Perform the following procedure to use File Restore to recover files that have been deleted.

To restore deleted files

  1. If you are running File Restore in ERD Commander, click Start, point to System Tools, and then click File Restore. If you are running File Restore in Windows, click Start, point to All Programs, point to Microsoft Diagnostics and Recovery Toolset, and then click File Restore.

  2. Search for deleted files. For more information, see How to Search for Deleted Files.

  3. In the right pane, select the files to restore.

  4. On the File menu, click Copy to Folder. You can also right-click the selected files, and then click Copy to Folder.

  5. The Browse For Folder dialog box will appear. Browse to the folder where you want to place the files, and then click OK.

    Important
    To reduce the possibility of overwriting data that you might want to recover, you should restore files to a location other than the source volume. Options include other disks or volumes on the same system or a mapped network drive.

File Restore attempts to determine whether a deleted file is recoverable or not and reports the result in the Recoverability column. The following are possible levels of recoverability for files:

  • Likely None of the data in the file is known to be overwritten by other files.

  • Unlikely Some of the clusters have been overwritten by other files.

If a file is marked Likely, none of the file’s data is known to be overwritten by other files. However, this is only an estimate of the file’s condition, and it is possible that a file marked Likely will contain corrupt data. In general, the longer the time since a file has been deleted, the less likely that it can be recovered. The following conditions might also cause a file to not be recovered:

  • The file was overwritten by other file data.

  • The internal file system structures could have been reallocated, which prevented access to the file location.

  • The file existed long enough to only be in the cache and never written to the disk.

The first letter of the file name cannot always be retrieved for files on FAT or FAT32 volumes. For this reason, File Restore displays files that match all characters entered in Search for files named, as well as those matching all characters but the first letter. When the first letter cannot be retrieved, it is replaced by a question mark (?) when it is displayed in the right pane of File Restore and by an underscore (_) when it is copied to a new location.

If a file is found, but the directory where it belongs cannot be determined, it is placed in a directory labeled "...Unknown Folder #..." It is possible for there to be multiple orphan directories that correspond to different directories that no longer exist.

To view more information about a file that has been deleted

  1. In the right pane, select a file.

  2. On the File menu, click File Properties. You can also right-click an entry, and then click File Properties.

  3. After you have reviewed the file properties, click OK to close the Properties dialog box.