SOLVED Large Hard Drive on old system accessible from Safe Mode Windows XP only

Old Athlon XP nForce2 chipset motherboard with Silicon Image 3512 PCI Card to which 500GB Hard Drive is connected.

Everything works when I boot into Windows XP Safe Mode but as soon as I reboot it into regular desktop - it freezes after desktop starts to load. If hard drive is disconnected - everything is normal.


Trying to figure out why it works in Safe Mode only.

I tried uninstalling everything from display drivers to Antivirus software - still no luck. Tried disabling everything from startup - no luck.


EDIT: SOLVED!

c627627 said:

So here's the full story:

This is an old machine on which PowerQuest Drive Image 7 was installed. PowerQuest was bought out by Symantec then promptly killed. Symantec then abandoned their old Norton Ghost and more or less renamed PowerQuest Drive Image 7 to their new Norton Ghost. To this day that's what Norton Ghost is based on.


Drive Image 7.0 ISO was version 2.0.0.305

Update to version 2.0.1.309 updates the program to the last version [v7.01a] made by PowerQuest before it was purchased by Symantec. This is the version that caused my problems.


However, Symantec did update the program before renaming it and re-issuing it as Norton Ghost. Version 2.0.3.402 updates Drive Image 7 to the last version [v7.03] made by Symantec.


So I found the out the hard way that v7.01 is not compatible with large SATA hard drives drives. Update to v7.03 *before* connecting any SATA hard drives is required.

Click to expand...

i think you should merge this with your other thread
http://www.overclockers.com/forums/showthread.php?p=6912136
titled "how i cant give up the old stuff, and continue to plauge myself"
(been there done that)

has some software ever been applied to the Drive OR the OS , that finds the larger hard drives and attempts to make them compatable with any aspect of the system that cant deal with over 1T drives?
Some driver software that was supposed to "fix" that? or a drive change that presents itself different to the controller or os?
usually this is some sort of cheap trick software provided by hard drive manufacture, or (low possible) some cheap trick being done via the controller it was on.

was it ever GPT formatted?

hard to look on the drive itself, but there have been so many cheap tricks that were applied to overcome stuff. what can you do IN safe mode to see the "layout" of the disk?

you cleaned up that stuff, before you installed the drive did you clean up the device manager completly?
show hidden devices, and toss out all "disk" "volume" and "generic volume" items that are ghosted.
then the OS will not be able to recognise it , in the case that it recognises it by "ID" and has some configuration differance?

look around device manager for any cheap trick Drivers for hard drives?
do one of them diagnostic type of boots, where you select each driver that you want to load or not. i forget how to do that, but you can say NO to specific drivers and attempt to find out which oen it is.

Get the program AUTORUNS (cause it is easy) and look in "filters" section for any filters that are attached to the hard drive device items. (with it not on the system)

i doubt anything usefull is going to show up in the event viewer, so there is Bootlogging, before and after, and trying to decipher anything from the bootlog and failed bootlog. but something like this you probably have not got to a place where the bootlog will "have a place to save itself". :-(

grasping at straws, was the hard drive ever initlised in a Raid controller item? i dont know what exactally happens, but almost all raid devices will write TO the drive itself, often this can make a drive incompatable as a single drive on some systems, until this thing the raid put on is removed. If this has been on a raid controller and initalised (not just on it as a drive) , stuff it back on that card, and undo that. or do it then undo it again, to be sure.

i read the other thread, and that is one tough cookie.
.

Actually this is a 500 GB drive. It is fully accessible from the Safe Mode.

I tried to Enable Hidden Devices in Safe Mode but saw nothing out of the ordinary in the Device Manager. I tried using the 'Enable Boot Logging' option. After the system froze, I disconnected the 500 GB drive from my PCI SATA card and booted in to read the ntbtlog.txt file. Last entry was
Did not load driver \SystemRoot\System32\DRIVERS\ipnat.sys



The drive is fine in Safe Mode. Something loads with Windows XP that causes the freeze, but what?

The drive was never part of any RAID configuration - just connected to a PCI RAID card since the motherboard has no SATA connectors.



Full ntbtlog.txt is attached:

sorry about that chief.

last entry there is ipnat, but what would the next entry be? when you log when the drive isnt there and it does go all the way through?
Take the 1/2 log, and put it next to the full log, and see what would come next, but instead failed.

You are giving me some good suggestions.

Here is the full ntbtlogGOTHROUGH.txt and I attached the one when the drive is connected and Windows XP freezes a couple of posts above. But here is the good one when everything goes through:

Good Boot on the left - Bad Boot on the right:

they both show the same things basically?
if it made it just as far on the list , then the drivers are all done, and it is going to the run and startup menu items at that point? which you disabled.

you got some cleaning up of drivers that you could do, but i dont think that is the issue

partitionmagic 8 IMO obsolete, causes prolems nowdays, using it, the drivers idling there would not cause a problem. you could disable all those drivers.
shows an ATI AIW drivers , older ones, probably no file for them now?

there is some gear aspi, a cd rom writer thing, for itunes or other gear using software

you have parellel port drivers running, sreial port, and floppy drivers , do you need them?

2 virus helper software drivers, is there only 1 still installed?
ssmdrv.sys , avira virus protect software. is this still installed?
pc anywhere, is that still installed?

MBM has a driver in there too, i bet you use that still?
the Silicon image driver(s) is still there, that is good right?
and some Nforce type sata driver? and n-force audio, thats good?

lvusbsta.sys <- logitech web cam, still got it ?

agg i cant look
all in all i dont see anything "bad" so far, and it isnt that messy even.
.

I have an image of this so where do I go to disable drivers in blocks of several of them so I can see when it goes through and go back and narrow it down?

What would I use and where would I go in Windows XP?

autoruns , it is a system internals program, free.
http://technet.microsoft.com/en-us/sysinternals/bb963902
you can disable stuff in there, and reenable easily.

i dont percive that any of your drivers are the cause of this.
but with auto runs you could see all run times, and startup, and filters.

Since everything is cool in Safe Mode - then whatever is not loaded during the Safe Mode is the culprit, correct?

It has to be software because it works in Safe Mode perfectly. How do I find out what didn't load in Safe Mode? I don't want to disable things which make Widows XP run - just whatever did not load in Safe Mode.

right, differance is a few driver items that are not on the safe list
and ALL run and startup items.

hmm, and running drives in "compatability mode" no write cache, and compatability mode drivers for them. instead of the Si or N-Force drivers.
gee wouldnt that be the biggest thing that would effect a drive itself? updating the 2 contoller driver softwares. or diabling those temporarily, and forcing them back to compatability mode.
there is a test. disable Just the contoller driver that the disk that fails is on.

one more thing i was thinking of, but i couldnt see how it would effect it "autoplay" a standard system has all drives marked for autoplay.

Have you tried to disable everything from the startup in msconfig?

Start Menu > Run... > msconfig > Diagnostic Startup - load basic devices and services only

and... YES!! drive is accessible - everything works.


It's going to be a while before I find which specific item was the culprit - but I will find it, thanks for the suggestion which led me to this.

I see it picked one that makes sence.
no use making this easy.

the wizard that checks a disks first blocks and tells you if it needs formatting or initlisation?
mabey something to do with dynamic or different formatting

something on those first few blocks of that disk that is bad or unrecognisable < read by that service?
a dll or the exe that would have run, like the init wizard software? < something that was going to run or auto run when that is on.
whatever pops up the delayed write failure , and disk failure software?


Veritas? the Picture, its right there staring me in the face

http://www.symantec.com/business/support/index?page=content&id=TECH49393
When Storage Foundation for Windows (SFW) is installed, the Microsoft Logical Disk Manager (LDM) drivers are replaced by Veritas Volume Manager (VxVM) equivalents. This means that messages that would normally be reported by dmio are now reported by vxio. Read or write errors reported by vxio can be interpreted as if they were being reported by the standard Microsoft dmio driver.

what could that have to do with it? My LDMA does not have veritas replacement in my XP here. Yours shows that it is.


First do:
A quick check of the system using the SFC /Scannow to insure that any normal files that are corrupt or replaced, This checks against the SFC.Files database, would insure any normal OS components are the right ones for the service pack, and should fix any "software" aspect of the system.

Test this:
turn off just the LDMA , leaving the LDM itself still on. Fail or No fail? (its a game show)

.

I then started to think what this service was connected to and found out that it is drive imaging software which uses the Logical Disk Manager Service was causing the problem.

So uninstalling the drive imaging software then enabling Logical Disk Manager Service also worked.

do you tell what drive imaging software it is after the commetials?
mabey there is supposed to be a google add between these 2 post

So here's the full story:

This is an old machine on which PowerQuest Drive Image 7 was installed. PowerQuest was bought out by Symantec then promptly killed. Symantec then abandoned their old Norton Ghost and more or less renamed PowerQuest Drive Image 7 to their new Norton Ghost. To this day that's what Norton Ghost is based on.


Drive Image 7.0 ISO was version 2.0.0.305

Update to version 2.0.1.309 updates the program to the last version [v7.01a] made by PowerQuest before it was purchased by Symantec. This is the version that caused my problems.


However, Symantec did update the program before renaming it and re-issuing it as Norton Ghost. Version 2.0.3.402 updates Drive Image 7 to the last version [v7.03] made by Symantec.


So I found the out the hard way that v7.01 is not compatible with large SATA hard drives drives. Update to v7.03 *before* connecting any SATA hard drives is required.

ahh, i had to toss ghost, even bought the new version tested it, and called the company and returned it to them. (attempting to tell them exactally why)

that then explains the other PQ driver items.

Yeah both Symantec Norton Ghost and Acronis True Image are pretty bad. I found Acronis to be better for imaging when you boot from their CD and Ghost better when you image one Operating System from the other (if you have a multi-boot system.)


But that's as far as modern machines go, this thread's problem was about an old machine with decent drive imaging software for its time - but new larger hard drives which didn't exist at the time don't work unless you either uninstall the old drive image software or if you have an update for it.

Thanks everyone for your suggestions and help.