Urgently need help with system restore after grave crash caused by bad RAM...

Hi All,

I have a really difficult data rescue situation that I can not seem to come to grips with on my own.

I have CTM (newest) on my laptop and all was working fine. Then, from evening to next morning Windows would not boot (iertutil.dll prefix nonmatch error).

I hoped I could return to the previous day’s snapshot from the home console, but this did not change the error message and when I checked on the status of iertutil.dll with a Vista based rescue DVD, it turned out that CTM had reverted the entire system to 15th January 2010, my base snapshot - On its own and without me requesting this! But I did not change anything, because writing would not have been under control of CTM while working from the VistaPE system.

I checked the web and finally found someone pointing to bad RAM as a possible cause of the iertutil.dll error and when I checked with Memtest86+ it turned out that indeed, my RAM was damaged. I changed the RAM and Memtest now returns thumbs up, but the iertutil.dll error persists and reverting to any earlier snapshot still does not do work, probably because the iertutil.dll error stops execution before the snapshot is installed properly.

My problem now is that I can not access the system under the control of CTM since it does not boot or revert back to anything younger than Jan 15th, but if I start rescuing the system from outside CTM I will surely kill my snapshots. The only thing I have dared try so far was to replace iertutil.dll in place in system32 and dllcache, but this did not help and I simply do not dare perform any larger scale copying/rescuing operations from the VistaPE DVD environment for fear of wrecking the snapshot data.

Could someone, preferably directly from the Comodo team please advise me as to the best strategy of preserving the snapshots while trying to rescue the system, which would surely include having to copy backed up versions of Windows DLLs to system32 and dllcache, at minimum? Is there for instance some way in which I can access the snapshot data of a non running system, e.g. with a rescue DVD and a “maintenance” program?

P.S. Needless to say I do have backups of important work, but I reduced their frequency when I started using CTM (else no point in CTM, right?), so there IS important fresh work missing and this is not just academic. Thus, ANY help would be much appreciated!

Thanks in advance,

Ingmar Gutberlet

Well, I’m sorry to say it probably isn’t your ram. These forums are filled with stories of unbootable computers caused from installing or uninstalling CTM. Maybe I’m wrong, but I’m guessing it’s caused by CTM. Once CTM messes up your MBR, you are ■■■■■■■.

Hi Masterblaster,

thanks, but I do not think that this is install/uninstall related since it appeared suddenly and with a system that had been running fine for a longer period. And I DID indeed have a grave RAM issue, which is now solved with new RAM.

The iertutil.dll error message also only pops up way into the WinXP boot process, so my guess is that this is not MBR related either, else I would expect a full no-go such as “please insert a boot disk into drive a:” or whatever, right?

Of course I can see that there is a deeper rooted issue here, because after all, if CTM had not reverted everything back to status quo of 15th Jan 2010 and entirely on its own decision, I would be a happy camper picking out my files from the dead system with a VistaPE boot DVD. In fact it is ONLY due to the fact that CTM decided to throw me back to my baseline snapshot that I am writing and whining at all!

But my misery also shows the major shortcoming of writing important information to supposedly unused sectors, the reasons for which beat me anyway. Either a sector contains data and IS used or it does not and is not. What is the point in fooling the OS and user into believing that there is 90 GB of free space, when - sadly - the space is taken by snapshot data. In essence, anytime anything goes wrong and the system has to be accessed from the “outside”, all hell breaks loose. Why not write snapshot files, secure them with hashes, make them invisible, write protected, system files, whatever, to hide them from the eyes of PC dimwits, but make them files that any sensible program or boot system will honor??? CTM could even have an eye on them and disallow any tampering with them while it is running: THAT sounds sensible.

Anyway, I am not griping, because I knew what I was doing and what the risks were, but exactly BECAUSE this software is about “a sense of security”, this type of problem is going to be a never ending set of threads in this forum (I am certain!). Comodo MUST be aware of this and I am therefore hoping that they will (already) have something up their sleeves that makes dead system rescue possible, something like accessing the Snapshot index and making all sectors into visible files, so file copies do not hurt them, or even making restoration of snapshots possible from a PE version of the CTM console. Either of these would be cool things to have/know and would definitely help to convince me to continue with CTM after I either retrieve or have to ditch my data…