Need help after P2V Cold Cloning -> 7B

[mansarde]

Hi there!

I wrote quite a lot, sorry for that. I tried to be as thorough as possible in describind what I did, so please forgive me for the length of this post.^^

Ok, last week my Windows OS broke after an update.
It still does work in general, but there are many things which have gone haywire, especially many windows internals.
Therefore I decided to reinstall the whole system. But before I do that I wanted to convert my physical harddrive into a virtual machine.
Why convert a broken Windows drive? Because I want to have the convenience to always take a look at my old windows via a virtual machine to see what I might have forgotten in my new install.
I did this in the past with Windows XP and it worked like a charm.
Nowadays I have Windows 7 64-bit and "normally" I could use hotcloning. But since one of the things that broke is the Volume Shadow Service, I had to resort to cold cloning.
The last few days have been an odyssey for me and I arrived at a point where I have no idea how to continue.

This is everything I did so far:

My physical system drive is a "Hitachi HDT725025VLA380 ATA Device" with Windows 7 64-bit on it.
The whole drive is encrypted with Truecrypt.
I used MOA to coldclone my drive, i.e. in combination with the vmware-vmdiskmanager.exe I created a raw.vmdk of the drive.
That worked pretty well.

Then I followed the instructions on http://sanbarrow.com/p2v2008r2.html in order to prevent the 7B Bluescreen.
In order to do that to my encrypted vmdk I booted the virtual machine into MOA and mounted the vmdk with truecrypt as drive C:
Then I opened the registry editor and loaded the hive from C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM and made the changes according to the previously mentioned webpage.
Afterwards I unloaded the hive again and rebooted the VM.
The Truecrypt bootloader came up where I entered my password, like I used to do on my physical machine.
It accepted my password and....... the Windows-Starting screen, along with the animation appeared! *yay* (which means the on-the-fly decryption of truecrypt works)
But then I STILL got the 7B Bluescreen, right before I would expect to see the Windows Logon.

Since that didn't work I then tried to inject drivers.
So I reverted the virtual machine to my earlier snapshot and booted into MOA again.
Started Truecrypt and mounted the partition with my Windows 7 64-bit on it onto C: again.
Started DRIVERINJECT gui and chose Windows 2008 (there was no Windows 7 in the list and I think 2008 is basically the same core?) and when it asked for the SYSTEM hive I navigated to it on C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
The program went through with its injection, everything seemed to work fine, green lights and all.
Rebooted -> Still 7B Bluescreen.

Between that and me writing this post several hours have gone by where I tried to find out how to boot Windows.
I found many infos on how to get it to work, but always with Windows XP, 2003, or the like. But never with Windows 2008 or Windows 7.

Do I need to inject the drivers I used back in the physical system?
OR do I need to install VMWare drivers?
I THINK I have to inject some VMWare drivers into the Windows on the vmdk.
But why then doesn't the standard injection method of DRIVERINJET gui work?
Is it because I have a 64-bit OS on the vmdk?
So what files/drivers do I have to place inside the vmdk, and where to exactly?
And what registry changes do I have to make? Are they always the same or does it depend on the drivers?
I've gone through the old forum, the new forum, the FAQ, the vmware forum, random googled sites.
My head hurts after inhaling so much information and not getting anywhere.

Sorry for all the questions, it's just that I don't know what to do anymore.
Please, I hope you can help me, or at least point me in the right direction?
Any help would be greatly appreciated!

Thanks in advance and thanks for such a great tool like MOA, without which I would've never been able to cold clone my drive this easily in the first place!

Greetings,
Mansarde

[continuum]

Hi
I would not expect that driverinjection GUI works on win7 64.

Interesting task - I guess you made a mistake with writing the vmx-file for that VM - the registry hack from the 2008 R2 howto usually works.
Please post the vmx-file - I guess you are nearer to results then you think ...
lets see ...

Ulli

[mansarde]

First of all: Thx for helping!

Please post the vmx-file - I guess you are nearer to results then you think ...

That would be nice indeed.^^
Alright then, here is the content of my .vmx as requested:

Code: Select all

.encoding = "windows-1252"
config.version = "8"
virtualHW.version = "7"
numvcpus = "2"
cpuid.coresPerSocket = "2"
scsi0.present = "TRUE"
scsi0.virtualDev = "lsisas1068"
memsize = "1024"
mem.hotadd = "TRUE"
scsi0:0.present = "TRUE"
scsi0:0.fileName = "converted-000003.vmdk"
ide1:0.present = "TRUE"
ide1:0.autodetect = "TRUE"
ide1:0.deviceType = "cdrom-image"
ide1:0.startConnected = "TRUE"
floppy0.startConnected = "FALSE"
floppy0.fileName = ""
floppy0.autodetect = "TRUE"
ethernet0.present = "TRUE"
ethernet0.startConnected = "FALSE"
ethernet0.virtualDev = "e1000"
ethernet0.wakeOnPcktRcv = "FALSE"
ethernet0.addressType = "generated"
usb.present = "TRUE"
usb.generic.autoconnect = "FALSE"
ehci.present = "TRUE"
sound.present = "TRUE"
sound.fileName = "-1"
sound.autodetect = "TRUE"
mks.enable3d = "TRUE"
serial0.present = "TRUE"
serial0.fileType = "thinprint"
pciBridge0.present = "TRUE"
pciBridge4.present = "TRUE"
pciBridge4.virtualDev = "pcieRootPort"
pciBridge4.functions = "8"
pciBridge5.present = "TRUE"
pciBridge5.virtualDev = "pcieRootPort"
pciBridge5.functions = "8"
pciBridge6.present = "TRUE"
pciBridge6.virtualDev = "pcieRootPort"
pciBridge6.functions = "8"
pciBridge7.present = "TRUE"
pciBridge7.virtualDev = "pcieRootPort"
pciBridge7.functions = "8"
vmci0.present = "TRUE"
roamingVM.exitBehavior = "go"
displayName = "My Old Desktop Win7 x64"
guestOS = "windows7-64"
nvram = "My Old Desktop Win7 x64.nvram"
virtualHW.productCompatibility = "hosted"
printers.enabled = "TRUE"
extendedConfigFile = "My Old Desktop Win7 x64.vmxf"
uuid.location = "56 4d a9 35 a4 94 f8 ec-f3 13 a4 50 b1 b1 ae 66"
uuid.bios = "56 4d a9 35 a4 94 f8 ec-f3 13 a4 50 b1 b1 ae 66"
ide1:0.fileName = "D:\CD-Images\MOA.iso"
bios.forceSetupOnce = "FALSE"
ethernet0.generatedAddress = "00:0c:29:b1:ae:66"
cleanShutdown = "FALSE"
replay.supported = "FALSE"
replay.filename = ""
scsi0:0.redo = ""
pciBridge0.pciSlotNumber = "17"
pciBridge4.pciSlotNumber = "21"
pciBridge5.pciSlotNumber = "22"
pciBridge6.pciSlotNumber = "23"
pciBridge7.pciSlotNumber = "24"
scsi0.pciSlotNumber = "160"
usb.pciSlotNumber = "32"
ethernet0.pciSlotNumber = "33"
sound.pciSlotNumber = "34"
ehci.pciSlotNumber = "35"
vmci0.pciSlotNumber = "36"
scsi0.sasWWID = "50 05 05 65 a4 94 f8 e0"
vmotion.checkpointFBSize = "134217728"
usb:0.present = "TRUE"
usb:1.present = "TRUE"
ethernet0.generatedAddressOffset = "0"
vmci0.id = "-1313755546"
usb:1.deviceType = "hub"
usb:0.deviceType = "mouse"


If there's anything else you need, screenshots, whatever, don't hesitate to ask.

EDIT:
In case you need it, here's the content of the .vmdk:

Code: Select all

# Disk DescriptorFile
version=1
encoding="windows-1252"
CID=8ecf4408
parentCID=ffffffff
createType="twoGbMaxExtentSparse"

# Extent description
RW 4192256 SPARSE "converted-s001.vmdk"
RW 4192256 SPARSE "converted-s002.vmdk"
RW 4192256 SPARSE "converted-s003.vmdk"
RW 4192256 SPARSE "converted-s004.vmdk"
RW 4192256 SPARSE "converted-s005.vmdk"
RW 4192256 SPARSE "converted-s006.vmdk"
RW 4192256 SPARSE "converted-s007.vmdk"
RW 4192256 SPARSE "converted-s008.vmdk"
RW 4192256 SPARSE "converted-s009.vmdk"
RW 4192256 SPARSE "converted-s010.vmdk"
RW 4192256 SPARSE "converted-s011.vmdk"
RW 4192256 SPARSE "converted-s012.vmdk"
RW 4192256 SPARSE "converted-s013.vmdk"
RW 4192256 SPARSE "converted-s014.vmdk"
RW 4192256 SPARSE "converted-s015.vmdk"
RW 4192256 SPARSE "converted-s016.vmdk"
RW 4192256 SPARSE "converted-s017.vmdk"
RW 4192256 SPARSE "converted-s018.vmdk"
RW 4192256 SPARSE "converted-s019.vmdk"
RW 4192256 SPARSE "converted-s020.vmdk"
RW 4192256 SPARSE "converted-s021.vmdk"
RW 4192256 SPARSE "converted-s022.vmdk"
RW 4192256 SPARSE "converted-s023.vmdk"
RW 4192256 SPARSE "converted-s024.vmdk"
RW 4192256 SPARSE "converted-s025.vmdk"
RW 4192256 SPARSE "converted-s026.vmdk"
RW 4192256 SPARSE "converted-s027.vmdk"
RW 4192256 SPARSE "converted-s028.vmdk"
RW 4192256 SPARSE "converted-s029.vmdk"
RW 4192256 SPARSE "converted-s030.vmdk"
RW 4192256 SPARSE "converted-s031.vmdk"
RW 4192256 SPARSE "converted-s032.vmdk"
RW 4192256 SPARSE "converted-s033.vmdk"
RW 4192256 SPARSE "converted-s034.vmdk"
RW 4192256 SPARSE "converted-s035.vmdk"
RW 4192256 SPARSE "converted-s036.vmdk"
RW 4192256 SPARSE "converted-s037.vmdk"
RW 4192256 SPARSE "converted-s038.vmdk"
RW 4192256 SPARSE "converted-s039.vmdk"
RW 4192256 SPARSE "converted-s040.vmdk"
RW 4192256 SPARSE "converted-s041.vmdk"
RW 4192256 SPARSE "converted-s042.vmdk"
RW 4192256 SPARSE "converted-s043.vmdk"
RW 4192256 SPARSE "converted-s044.vmdk"
RW 4192256 SPARSE "converted-s045.vmdk"
RW 4192256 SPARSE "converted-s046.vmdk"
RW 4192256 SPARSE "converted-s047.vmdk"
RW 4192256 SPARSE "converted-s048.vmdk"
RW 4192256 SPARSE "converted-s049.vmdk"
RW 4192256 SPARSE "converted-s050.vmdk"
RW 4192256 SPARSE "converted-s051.vmdk"
RW 4192256 SPARSE "converted-s052.vmdk"
RW 4192256 SPARSE "converted-s053.vmdk"
RW 4192256 SPARSE "converted-s054.vmdk"
RW 4192256 SPARSE "converted-s055.vmdk"
RW 4192256 SPARSE "converted-s056.vmdk"
RW 4192256 SPARSE "converted-s057.vmdk"
RW 4192256 SPARSE "converted-s058.vmdk"
RW 4192256 SPARSE "converted-s059.vmdk"
RW 4192256 SPARSE "converted-s060.vmdk"
RW 4192256 SPARSE "converted-s061.vmdk"
RW 4192256 SPARSE "converted-s062.vmdk"
RW 4192256 SPARSE "converted-s063.vmdk"
RW 4192256 SPARSE "converted-s064.vmdk"
RW 4192256 SPARSE "converted-s065.vmdk"
RW 4192256 SPARSE "converted-s066.vmdk"
RW 4192256 SPARSE "converted-s067.vmdk"
RW 4192256 SPARSE "converted-s068.vmdk"
RW 4192256 SPARSE "converted-s069.vmdk"
RW 4192256 SPARSE "converted-s070.vmdk"
RW 4192256 SPARSE "converted-s071.vmdk"
RW 4192256 SPARSE "converted-s072.vmdk"
RW 4192256 SPARSE "converted-s073.vmdk"
RW 4192256 SPARSE "converted-s074.vmdk"
RW 4192256 SPARSE "converted-s075.vmdk"
RW 4192256 SPARSE "converted-s076.vmdk"
RW 4192256 SPARSE "converted-s077.vmdk"
RW 4192256 SPARSE "converted-s078.vmdk"
RW 4192256 SPARSE "converted-s079.vmdk"
RW 4192256 SPARSE "converted-s080.vmdk"
RW 4192256 SPARSE "converted-s081.vmdk"
RW 4192256 SPARSE "converted-s082.vmdk"
RW 4192256 SPARSE "converted-s083.vmdk"
RW 4192256 SPARSE "converted-s084.vmdk"
RW 4192256 SPARSE "converted-s085.vmdk"
RW 4192256 SPARSE "converted-s086.vmdk"
RW 4192256 SPARSE "converted-s087.vmdk"
RW 4192256 SPARSE "converted-s088.vmdk"
RW 4192256 SPARSE "converted-s089.vmdk"
RW 4192256 SPARSE "converted-s090.vmdk"
RW 4192256 SPARSE "converted-s091.vmdk"
RW 4192256 SPARSE "converted-s092.vmdk"
RW 4192256 SPARSE "converted-s093.vmdk"
RW 4192256 SPARSE "converted-s094.vmdk"
RW 4192256 SPARSE "converted-s095.vmdk"
RW 4192256 SPARSE "converted-s096.vmdk"
RW 4192256 SPARSE "converted-s097.vmdk"
RW 4192256 SPARSE "converted-s098.vmdk"
RW 4192256 SPARSE "converted-s099.vmdk"
RW 4192256 SPARSE "converted-s100.vmdk"
RW 4192256 SPARSE "converted-s101.vmdk"
RW 4192256 SPARSE "converted-s102.vmdk"
RW 4192256 SPARSE "converted-s103.vmdk"
RW 4192256 SPARSE "converted-s104.vmdk"
RW 4192256 SPARSE "converted-s105.vmdk"
RW 4192256 SPARSE "converted-s106.vmdk"
RW 4192256 SPARSE "converted-s107.vmdk"
RW 4192256 SPARSE "converted-s108.vmdk"
RW 4192256 SPARSE "converted-s109.vmdk"
RW 4192256 SPARSE "converted-s110.vmdk"
RW 4192256 SPARSE "converted-s111.vmdk"
RW 4192256 SPARSE "converted-s112.vmdk"
RW 4192256 SPARSE "converted-s113.vmdk"
RW 4192256 SPARSE "converted-s114.vmdk"
RW 4192256 SPARSE "converted-s115.vmdk"
RW 4192256 SPARSE "converted-s116.vmdk"
RW 2095472 SPARSE "converted-s117.vmdk"

# The Disk Data Base
#DDB

ddb.virtualHWVersion = "7"
ddb.geometry.biosCylinders = "30401"
ddb.geometry.biosHeads = "255"
ddb.geometry.biosSectors = "63"
ddb.uuid = "60 00 C2 96 e8 41 cd b8-85 5b a5 8b fe ed 2c d3"
ddb.geometry.cylinders = "30401"
ddb.geometry.heads = "255"
ddb.geometry.sectors = "63"
ddb.adapterType = "lsilogic"


[continuum]

Hmm - looks ok - did you set the start-option for the lsi-sas controller to 0 ?

[mansarde]

I'm not exactly sure what you mean.
Do you mean in the advanced properties of the hard disk ettings of the VM?
If yes, I have it on "SCSI 0:0 Hard Disk (SCSI)".
Or do you mean the setting in the registry?
I've loaded the hive into "p2v" and then went to:
HKLM\p2v\ControlSet001\services\LSI_SAS

There I set "Start" from 3 to 0.
Since that didn't work I also tried to set "Type" to 0.
And after that I set every "Start" of every HKLM\p2v\ControlSet001\services\LSI_* to 0.
Then the same for "Type".
But nothing worked, always a 7B.

Is the registry tweak the only thing one needs to do with Win7 and Win2008?
Does it matter if my system was on an ATA drive? Or that I use 64-bit?

Currently I created a snapshot and try to decrypt the drive.
That's my last resort, because it takes a VERY long time to "cold-decrypt" the drive (2-4 days).
The good thing is I can pause the decryption at any time, save a snapshot and revert back to the beginning to try something else to get the system to boot.
And if that didn't work I just go to the snapshot and continue decrypting.

When it's finally decrypted, then I wanted to try some recovery stuff using a windows recovery CD.
Or maybe install a second Windows 7 so that "maybe" VMWare Workstation installs what it needs and makes the second installation also available?
The thing is, if I create a new VM and do a fresh install of Windows 7 on it, then there's no problem. So this proves I CAN start a Windows 7 inside a VM on my server.
But then there has to be a way to make my P2V'ed system also start.
Don't I have to inject some drivers into the system?

If not, and if the registry hack is the only thing that should suffice, then I guess I'll have to wait until the drive is decrypted and try some recovery options.
Anyway, thanks for trying to help, I appreciate it very much!
If there's anything else you can think of, let me know. If I find a solution myself then I'll definitely post it here.
I always hated it when the last post of a problem thread was something like "Just found out for myself, bye".^^

[continuum]

Hi
in all win7 and 2008r2 I have seen so far the registry hack was enough to get around the BSOD 7b.|

Maybe the file lsi_sas.sys is missing in your case ?

I am getting curious - can we look into it together using teamviewer or rdp ?

Ulli

[mansarde]

Hmm, that's very strange then.
I paused the decryption process, reverted back and mounted the drive inside a BartPE environment (with Truecrypt) to see if lsi_sas.sys is in the windows\system32\drivers directory.
And it is, along with all the other lsi_*.sys files (fc, sas2, scsi).
Can there be another cause for the 7B? I mean, some of the windows internals weren't working on the physical system, which was the reason for the P2V conversion to begin with. But I'm writing this very post with exactly that physical system (which I continue to use until I'm sure the P2V went fine) and everything else works fine.
I can reboot it, "watch" videos (no sound anymore), have Aero, etc. Network works (obviously), but windows doesn't recognize it in its network center anymore.
I can't use VSS, I can't open the MMC Snapin thingy, I can't use the windows picture preview, etc. stuff like that.
Maybe something got broken in such a way that I cannot boot it as a virtual image (even though booting from a physical system seems to be no problem)?
It's a mystery to me, especially since I can access the data inside the vmdk and there seems to be no corruption.
Hmm... it's really a mystery to me.

Therefore I gladly accept your offer to take a look at it for yourself via teamviewer. Maybe you can find the culprit.^^
I won't be able to do the session during the week though, would the weekend be ok?
If that's ok with you then I'll write you a PM the next few days where we can discuss the details.
Also, the vmdk should be decrypted by then so that encryption won't be a possible point of failure anymore.

Thanks again for the offer, very nice of you!

EDIT:
I just had an idea. I don't know if it's a viable option, but let me know what you think:

Creating a raw .vmdk from the physical disk via vmware-vmdiskmanager wasn't the first option I tried with MOA.
My first plan was to use the VMWare Converter. But what I didn't know beforehand was that the converter needs to recognize a windows system on the drive which is going to be cold cloned.
I guess this is because the converter will prepare the converted image later on to make it bootable inside a virtual machine.
Now, since my physical drive was encrypted the converter obviously couldn't recognize any windows on it and therefore quit.
(I also tried to mount the drive with Truecrypt, but still the converter didn't recognize that. I guess it looks only in one place for it, whatever.)

But what if...
At the moment I'm decrypting the .vmdk disk.
Now what if, when it's done, I try to use the VMWare converter again, but this time on the decrypted .vmdk instead of on the real thing?
I mean, after decryption is done, I boot the virtual machine with the .vmdk on it into MOA and then the converter should recognize the windows on this (virtual) drive, shouldn't it?
True, I then have to convert it again, but it should work nonetheless, yes?

P.S.:
By the way, the only reason I didn't decrypt the physical drive BEFORE P2V'ing it was because I want to keep the data on it secure at ALL times.
The .vmdk was created by attaching my physical drive to my server, which is also fully encrypted.
Therefore no data was ever in the clear, which is how I prefer it.

[continuum]

Have you tried to install converter 4.3 directly inside the half broken Windows or did that fail because of thtose VSS issues ?

[mansarde]

I couldn't install it, but not because of the VSS issue, but because of some other windows internals which makes me unable to install most things.
One of the first (if not THE first) thing I tried was to access system restore. But that got me the error "0x80042302" -> No VSS.
I suspect that the COM+ Databse got somehow corrupted, since it gives me "unknown class" errors all over the place.
After my attempts to manually registering certain files or pretty much use Window tools to begin with (no MMC) I decided it's a good time to make a fresh reinstall.
It DOES still work though, I mean I can surf, use other programs, etc. Just when it comes to Installation, Windows-Internal functions, etc. I can't do much.

The decryption process could be finished by tomorrow after work. Then I'll try some boottime recovery tactics which I couldn't try before.
And if nothing works, then in the end I'll try the idea I've mentioned in my last post. That is: using the converter (while in MOA) on the image to create a new one and hope that the converter injects what it needs to inject, when it actually can READ the contents by then.^^

So the reason why the simple registry fix didn't work is either ...
... because of the encryption (but I don't really think so),
... or because of the damaged Windows (something essential for VM Booting might've been damaged as well?),
... or because I'm doing something wrong, even though I think I've followed every instruction to the letter,
... or seomthing else?

Well, I don't know, but who knows? Maybe tomorrow after decryption a little Windows-7-Recovery-Disk magic might just be what it needs.
Wish me luck!

EDIT:
Sometimes.... shit just happens.
Like losing power in the middle of a decryption process for example...
If I couldn't deal with stress as good as I do, I just might've lost a couple of years of my life by now.

FORTUNATELY though, I was wise enough to pause the decryption process and make a snapshot sometime yesterday, because...
... you never know what "might" happen, do you?
Alright, I'll have to start decrypting from the last snapshot then, so I guess it's yet another day drinking tee.

Just wanted to give you a status update.

[mansarde]

Just so you know, I didn't abandon this thread!

My VMDK has sucessfully finished the decryption process!
I immediately tried the Registry fix -> didn't work.
Then I tried to fix boot files with the Windows 7 Rescue disk -> didn't work
After that I tried "sfc /scannow /offbootdir=c: /offwindir=c:\windows" -> didn't work

And with "didn't work" I mean 7B BSOD in all cases.

At the moment I'm trying out the idea I've mentioned earlier, i.e. I'm cold cloning from my freshly decrypted .vmdk to another .vmdk, using the VMWare converter this time.
Last time I had to do a raw conversion, because my vmdk was encrypted, but now the converter can actually inject drivers and do all the other preparation stuff he needs to do to HOPEFULLY make the Windows 7 (x64) on my .vmdk be able to boot.

Wish me luck!

P.S.: Although I've chose the minimum size for conversion (used space only), this obviously still is going to take a while.
So don't expect to hear from me anytime before tomorrow.
Except if something goes wrong during conversion (it better not!).^^

_______________________________________________________________________

STATUS-REPORT:
It sure takes its time, but it's converting steadily, without any problems so far.
From ~183 GB only ~40 GB remain to be converted, so in a few hours it should be done.

[mansarde]

It seems I'm out of luck.
I'm still getting the 7B BSOD and I have absolutely no idea why this is happening anymore.
When I try to start the system in safe mode, then the screen where all the drivers are shown loading, stops at CLASSPNP.SYS and sometime after that -> 7B BSOD

I have no idea what to do anymore and I'm pretty exhausted by the whole affair.
So for the moment I let it be and just reinstall my physical system.
*sigh*... this means going through EVERYTHING in the old system, digging really deep, and note everything I have to install again, every settings, etc. pp...
This is exactly what I wanted to circumvent by just making a virtual image out of it. Then I could conveniently boot it up as a VM and look up everything if need be.
Maybe next week I'll try to dig deep into the virtual image and replace its intestines with the ones of a working Windows 7 VM, piece by piece, until it works.^^
But for the moment, I'm neither motivated nor have any hope of finding "something" that will (maybe) work (probably not).
Yeah, I guess you all know this sort of computer frustration. When you have it, resignation is quick to come and then you just say: "F*ck it, I'm just reinstalling now..."
And that's exactly what I'm gonna do. I still have the VM (actually two: the vmware-vmdiskmanager cloned and the one from the VMWare converter), so if need be then I still have all the data at least.

If you've come here hoping to find a solution, then I'm sorry this has come to such an unsatisfactory conclusion.