XP Recovery

Thanks for the link. It does provide interesting information, but it doesn't change my understanding of the process. However, mentioned in the link is a folder (dllcache) and the role it plays in the scheme of the matter should not be lost on the reader. This is the first search when there is a change in a protected file. We all know when a device is added the system searches for the best driver. I beleive that has been the procedure for a long time.

It is the file to be replace in an up and running machine that is protected from being overwritten. Nothing read in the link suggests otherwise, and it is not inconsistent to my understanding. My source and experience has been SFP (ME), but I don't see much difference as explained in the link.

Corrolating the link with my comments the link goes on to comment that after receiving a trigger that there is a directory change to a protected file the system initiates a search (compare). If the the newly introduced file's parameters ( MS verification and encryption, and version) do not match (compare) the replacement is from the dll directory. If there is a match, then the replaced file is archived and the new is installed.

Hal.dll may be protected from a newly introduced file that may be inappropriate for the system. I don't know. If there ever is an introduction of a new file, the addressed file will be protected from an overwrite nothing more, nothing less. My advice is to stop deleting files that are part of the system and registered. MS does not protect one from there own foolishness, but it does give a warning. I would be more impressed, find it instructive and it would be in keeping with the subject of this thread, if one discovers and comments that the restore feature does not restore the specific system files! Now that the file has/had been deleted does restore, restore?

 

I have found that PowerQuest's Drive Image program provides reliable backups in a compressed image format. The program also supports restores of individual files from the image.

 

Edsel,

That sounds promising. I'll check it out but I'm afraid I'll find that in order to restore a single file from it's backup, you will need to be booted to a Windows session.

Can you confirm this?

 

XP Recovery - hal.dll

Interesting thread - what would the world do without MS and their OEM kabal to keep us guessing!!

I guess I was lucky to have purchased a Dell Dim 4300 - it does come with a OS Reinstallation CD . I compared the contents with a OEM full install XP Pro CD and the contents are almost identical. The Dell OS Reinstall CD does have an extra $OEM$ folder with some of the Dell customizations. I bet one could use this CD to do an regular fresh install - of course with the appropiate license from the gnomes in Redmond .

Did a search for hal.dll and found it in C:\I386 folder as well as C:\WINDOWS\SYSTEM32 . Not in dllcache directory .
PS: Windows search only finds it in I386 folder - and I have search configured for hidden and system files .

Finally, I read through the MS article at the developers link mentioned earlier, Windows File Protection and Windows, and then checked my system registry out. Apparently the registry entry for the location of the dllcache directory does not need to be entered, if the default location is use, since it does not appear in my registry.

As far as the recovery console - I installed it as soon as I found out about it - hopefully I won't ever have to use it!

 

I did the same research on my Dell 4400 and came to exactly the same conclusions. It is my understanding after opening the cd and inspecting the folders that the reinstallation disk is different from a recovery disk provided by other vendors.

"I bet one can use this cd to do a regular fresh install--of course with the appropriate license..." It is my understanding one can reinstall or restore individual files any number of times on the original Dell system unless there is a major configuration change ".

 

Zephyr,

Yes, the individual file restore is done from the Image Explorer program after Windows boot.

From what I've read, the hal.dll file is generated during Windows install and therefore is unique to the system configuration. I think it is used only on multi-boot systems...may be wrong there.

The bottom line is that you'd better have a reliable backup system in place before the system doesn't boot.

A possible workaround: With backup CDs in hand, copy them to another computer with Drive Image installed. Extract the file(s) and copy them back to the required locations.

 

Z,

I found an additional entry on my system for hal.dll. There are several, but no entry in dllcache. The entry that may interest you is in the Driver Cache (C:\Windows\ Driver Cache). With my system, I am able to extract the file from that location.

 

Thanks Edsel and Ken,

I'm still up against a catch 22 since I have no install cd and can't initialize the Recovery Console without it. With the NTFS file system, the drive isn't viewable with a boot disk of any kind, hence I can't do any file replacement even if I had an accessible backup.

I just fired off a message to HP Instant Support:

I'll post any results so you can make sport of me for buying the wrong brand.

BTW, I looked in my C:\WINDOWS\Driver Cache and it didn't have any files listed. There was one lone directory i386 inside which contained 5 files. None were the hal.dll. One was named driver.cab so I looked inside it with using WinZip. Sure enough, it had a long list of files and one of them was the hal.dll. Funny though the version in there was much smaller in size than my active version and I would hesitate to exchange it without some fail safe protection. I have GoBack so when I get aroung to it I may give that a shot. It's my understanding that this hal.dll file is hardware dependent and varies with different machines.

 

Viewing Driver Cache, I believe there may be as many as 1000 entries, and there are as many in windows\Driver Cache\1386\Driver.cab . Hal.dll in the Driver.cab is compressed to 101KB.

 

I've been following this thread for a couple of days, and I'm beginning to believe that each system is even more unique than we think. My Driver Cache folder has no files in it ... just the i386 folder, which contains one file, driver.cab. That file, however, contains 4,657 compressed files. Go figure!

Jim

 

JSS3rd,

There is some common ground! I have a c:\windows\drivers cache directory that contains only the i386 folder. The i386 folder contains only the following files:

ntkrnlmp.exe
ntkrnlpa.exe
ntkrpamp.exe
ntoskrnl.exe
DRIVER.CAB
imapi.sys

And within the DRIVERS.CAB files is contained exactly 4,657 files, the same as yours.

The hal.dll file therin is 102,528 bytes fully expanded.
My active hal.dll file is 128,768 bytes.

I suppose that would mean the smaller version is merely an empty shell that Windows uses to build upon based on your own particular hardware. Just guessing.

We can only wonder why those other files are present in mine and not yours. They may be as a result of some update patch but I'm guessing again.

 

Hi Westwind,

My numbers are identical to yours. Re the five files in your i386 folder, you may be right about their having to do with updates, as several of them seem to have kernal connotations. Have you looked at the properties of those files? That might tell you something more about them.

I've been using XP Pro on this computer since March, and haven't found the need to install any upgrade patches, so can't compare notes on that point; I'm waiting for SP1 to come out.

BTW, my atlas puts "2 mi. north of the Matterhorn" at the end of a spit of land surrounded on three sides by glacier, about 4½ miles WSW of Zermatt. How'm I doing, so far?

Jim

 

Apparently the size shown in the cabs' folder for individual files are the expanded size. Compressed size has some relevance if one is interested in how many compressed files will fill a given floppy or zip! Strange that compressed size is not given in the cabs' folder as I had assumed. Anyway I show 101 KB for hal.dll with that given where is the compressed file's size?

In $OEM$ there is an open folder and a cmdlines.bak file that shows commands to patch and change entries in the registry made by Dell.

My estimate of a thousand files in discussed folders are revised to the exact number without any problem.

 

Hi Ken,

"...where is the compressed file's size? "

I can't answer that specific question, but I can tell you the size of the compressed file, assuming standard WinZip compression ... I extracted the hal.dll file from driver.cab, then zipped it. The compressed file is 58,247 bytes in size, and occupies 61,440 bytes on disk.

Jim

 

Thanks JSS3rd. You are correct, but stored as a cab and not compressed is misleading. May have something to do with file size and space resources available.

 

My understanding is that all files contained in a .cab file are compressed, but that the compressed filesizes aren't reported by WinZip. It's possible that other Zip programs may have the capability, but I've never used anything but WinZip, so I can't say.

Jim