BleepingComputer.com: Can't boot Missing hal.dll on RAID 1 array

Thank you so very much for clarifying that Louis. I have been a bit confused about that for a long time and I appreciate you making it clear.

No, I'm still unable to boot.

I did the bootcfg command in recovery console. I looked at the rebuilt boot.ini via the type command and it was exactly the same as the one that wouldn't work - and it didn't work. There is no edit command in recovery console so you can't try editing boot.ini, but you can copy from the floppy drive if you have one. So I used my sister's computer, which also has a floppy drive, to create a boot.ini w/ partition at 1 because the only boot.ini I've seen w/ partition at 2 was a multiboot one w/ 2 as one of the options. I copied it over and rebooted - didn't work.

Then I did the system restore via recovery console. Didn't work. I'll try some earlier versions later, but I'll be surprised if they work.

While I'm booting and rebooting I kept noticing keyboard failure messages, but the keyboard worked x for one time. So I'm wondering about motherboard failure. I don't know if the message has been there on recent boot-ups, because I don't usually hang around while windows boots. I'm probably about to learn another lesson about periodically watching the computer boot.

So I'm thinking I ought to run the Dell bootable diagnostic cd and see what hardware it checks out - after I try another restore point since the OS CD is still in the drive. It would also be nice if I could figure out how to scroll thru the BIOS event log. I think the Dell tech that replaced the sound card went off w/ the MB manual - it's not in the Dell hanging folder w/ all the other booklets & papers. Can't find one at Dell support. Can't find anything useful at Dell support.

Re. optical vs a flash drive bu. I only have MB-sized thumb drives and they're old and I've never had any problem with their not working moving from computer to computer or any file corruption. I've come across a few woeful tales of people who only backed up to their flash and then broke it at an inopportune time. If you have a big enough flash drive to backup your data it would certainly be quicker and probably more secure than bu to optical. Backing up to optical media is a pain for a lot of reasons I could rant on for at length but won't.

I was really commenting on the fact that an ext hd, like an internal hd, can die suddenly at any time w/out any warning. Which is the reason behind RAID 1. So those who bu to external hd and who have my luck should also backup periodically to optical and also before any reformat or monkeying w/ RAID array's. For those of us in hurricane territory and for those who are in tornado territory having optical discs in your safety deposit box is also a good idea. If you loose your house and computers, you've at least got all the neat stuff you collected from the web over the years. Unless the bank goes too.

Re. RAID. With 2 hds you can only copy [raid 1] or stripe [0]. I thought maybe you could raid 1+0 w/ 3 but I read what you read - that it takes 4 hds. If I understood RAID 1 better and was comfortable w/ it and had statistics on hd failure I might see an advantage for it . Having a computer fried by a lightning surge is my biggest risk - that's happened to me once. And old windows whatever version failing to boot and failing to restore and failing to repair is my experience w/ windows - without any hardware problems. So I have to religiously bu anyway and I'd rather put my time into figuring out how to clone my installation than figuring out RAID.

I don't know exactly what kind of RAID controller I have - it's listed as "hard drive controller Integrated Serial ATA with RAID 0, 1, 5, 10". As far as I know "integrated" means it 's on the motherboard. That may mean it's more software than hardware function. Assuming the MB isn't dying, it would be nice if I could remove one HD, reformat/reinstall the other, put in the 2nd hd and access its data.

Basic raid explanations are as follows:

Raid 0 - Stripping - uses two or more drives to stripe data across every drive (i.e. write blocks to alternating drives). Increases read and write speeds. If any of the drives fail all information is lost

Raid 1 - Mirroring - Creates an exact real time duplicate of the main drive. Provides basic data protection against a single drive failure.

Raid 5 - Stripping with parity - uses three or more drives to stripe data across every drive as well as a writing a parity bit to a different drive. increases read and write speeds. Provides data protection by allowing one of the drives being used to fail without losing data. drive can be replaced and data on that drive rebuilt from the parity on the remaining drives. Certain controllers allow access to the array even with a failed drive but at a performance hit. If more than one drive fails all information is lost.

While there are more types of Raid these are the most common basic ones.

It sounds as if the worst option has happened to you. That being the partion information is corrupt. I have two suggestions. First remove the main drive and swap the secondary drive into its place. Boot normally. You may get an error message about the drive being missing. If your lucky it will boot up and you will be good.

If not remove one of the drives and reformat and install windows on the other. Then you can hook back up the secondary drive and transfer whatever files you may need.

Thanks Baltboy and to everyone else,

Somehow I've missed seeing some of the posts until after I've reposted. So I just saw the post by hamluis about the Dell's DSR. My 380 is from 2005, but what good is a recovery option that dell doesn't tell anyone about? I was wondering if a hidden partition was the reason for the partition 2. Anyway, when changing the partition to 1 didn't work, I did another bootcfg and when I checked it was back to partition 2, but it also now had 2 "multi<0>disk<0>rdisk<0>partition<2>\ Windows ="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /bootlog" lines under [operating systems] where before it had only one. And when I tried booting into windows it had two Windows XP Professional boot options, which makes me wonder if my array has come undone. Also the message has changed from a missing hal to "computer disk hardware config problem. Could not read from selected boot disk."

When I rechecked in BIOS config under SATA Operation "RAID Autodetect/AHCI" was selected, whereas before my notes say RAID On was checked, but my handwriting is hard to decipher at that point. I haven't been in and out of BIOS, so RAID Autodetect/AHCI was probably its initial setting altho it doesn't sound right. RAID autodetect turns raid on if it detects "signed drives", otherwise it goes w/ AHCI.

So I'm going w/ Baltboy's option 2 and hope I can still access my data when I take the drives out. While I'm reading up on RAID and SATA I'm going to order one of those enclosures for HD's to make an internal SATA an external USB HD - I think they have that combination. Then I can check both Dell drives in case one's data is accessible and one is not before doing the reformat/reinstall on one and putting in the 2nd as an extra drive. The enclosures are kinda expensive, but I have eide drives I can stick in there once I put the SATAs back in the Dell and most of the enclosures seemed to have multiple connection types.

I'd still like to figure out what the most likely cause was with what I know at this time. I thought since the recovery console from the OS installation disc could access c:\ and c:\windows\etc. files that the partition table for the C volume, the MFT & the RAID array were intact. In order to read & write files to c:\ and c:\...\config recovery console has to work w/in the logical structure on the disk as well as the MFT, right? or wrong?

Could recovery console get to c:\windows without reading the partition tables for partition 1 and partition 2? I was wondering if there was a problem w/ a boot record. Boot CDs would bypass the MBR wouldn't they? The BIOS going to boot files on the CD? I thought one of the things you could do within RC was rebuild the MBR.

The avira scan was supposed to scan the mbr, I checked that option. I know if there's a virus that either the virus itself or removing the virus can corrupt the mbr, but no virus was found and I didn't check for any fixes 1)because of the mbr and 2) because I didn't want to write on the disk(s) from a memory-loaded app before I understood the Dell's RAID structure. Could a viral scan of the mbr corrupt it or was it just a coincidence that I ran the scan and couldn't boot?

Doing the system restore did have an effect, even tho it didn't fix the problem. When I first accessed the recovery console it didn't require my admin pw, but after I copied sam from a restore point to config and rebooted I had to put in the pw to access rc. So there was a problem either w/ sam or with something sam needs from one of the other registry hives I restored. Which is all very confusing because a problem w/ a missing hal suggests an early boot problem and the registry a later problem. And restoring the registry, extracting hal and rebuilding boot.ini didn't fix the problem.

I'm hoping this is just windows being windows and demanding a reformat/reinstall and not a motherboard or hd going bad problem or some really sneaky virus. I did figure out how to scroll in the BIOS post event log and the keyboard failures go back to 2006. There are a few other isolated post failures, but nothing recent except the keyboard failures. So I'm thinking not a bad motherboard but some quirk, but I have to do..... more reading.

This post has been edited by MaryBet82: 18 March 2010 - 07:54 PM

Partial corruption of the MFT or partition tables will allow access to the drive but will corrupt files or sectors associated with them. Hal.dll comes after ntoskrnl I believe and is one of the last steps before the XP splash screen so it is in the later part of the inital boot. Virus scans should not damage things but anything is possible if the files are seen as infected. I'm all for fixing things but sometimes the most effective and timely fix is a re-install of the OS and replacement of the essential files.

Yes, I think hal loads after ntoskrnl. And according to my notes ntldr "opens" the registry before that. But I thought the registry got "loaded" later - I thought if there was a registry corruption you would still get past hal. So hal missing + registry problems = more corruption.

I finally got to the Dell support pages w/ RAID info and I think my raid was created using the Intel ROM utility and there are two steps: turning RAID On in the BIOS and then using the CTRL-i to enter the utility and create the RAID. You install the OS onto the RAID volume.

So my bios config should have RAID ON - it got switched to RAID Detect/AHCI at some point, but I don't know how [well, obviously I'm the culprit] or when - if that is what caused the initial hal missing. It seems more likely I did it when I was going up and down the BIOS tree trying to figure out how to read the event log while troubleshooting hal missing. I don't know if turning RAID ON off deleted the array, if I was reading/writing to one drive or the array using recovery console or both at different times.

I'm hoping that the array has to be deleted thru Ctrl-i and that if I turn raid back on in the bios the system might boot now that hal's been replaced. I'll have to do some more info searching - maybe intel would have more detailed info and maybe I can find it.

I was thinking that the RAID logical structure was "loaded" before the OS boot process and that if the array had been deleted I wouldn't be able to access c:\windows w/ the boot recovery console. That was probably an incorrect assumption based on not thinking hard enough. Ntldr switches the processor from 16 bit to 32 bit and so at some point raid has to "load" into the 32 bit environment during the winxp boot process. Recovery console may work in 16 bit and I don't know what happens in that environment raid-wise. It still seems to me that if the OS was installed onto the raid volume, then if the raid had been deleted I wouldn't have access to c:\windows in 16 or 32 bit.

So I need to find out if I've deleted the array, if I just need to turn raid back on in the bios, or if turning raid back on the in bios will actually complete the raid deletion process and remove any partition, mft, files remaining.

From the info I have at this point it seems like the dell's intel raid may be more software than hardware, but I haven't found a definite yea or nay on that either.

I started out editing my last post, but then it wouldn't let me. You can skip the above post.

Altho the Dell 380 support page on raid says to select "raid on" for raid 1 and then use the ctrl-i utility to create your array, I'm not sure how complete or accurate the info is. The instructions say nothing about the fat utility partition [or that DSR partition]. I don't know if I have the dsr, but I do have the fat utility partition. The page also doesn't specify which controller is being used or mention changing the bios setting in the part about deleting the raid 1.

I've only read of RAID 1 being created using whole disks, I don't think you can configure it on a partition. If your disks don't match in size, then you lose the extra space on the larger disk. So the partitioning for both the fat utility partition and the ntfs os partition would have to be done on the created raid 1 volume and the partition tables would be on the raid volume, as well as the mft. I shouldn't be able to access c:\windows from the boot cd if the raid volume isn't first loaded. I also shouldn't be able to get into the utility partition, which I did today.
Edit: just read about Matrix RAID, in which you can raid partitions vs whole disks. The Intel 955X, which is what the 380 has, is one that is supposed to be able to do that. You can raid 0 the os partition for speed and raid 1 the data partition for redundancy.

If "RAID ON" was necessary to load my array and it got switched to "RAID Detect/AHCI" at some point, then on booting from cd the raid autodetect/ahci would default to the non-raid ahci interface and see 2 sata drives rather than the raid volume, but the drives shouldn't appear to have any partitions or data.

It appears to me that raid is loading w/ the raid autodetect/ahci setting - maybe it's loading in 16 bit and I need "raid on" to switch to 32 bit or maybe creating the array "signs" the drives and you can use either raid on or RAID Detect/AHCI after that. Or maybe it's the correct setting and the "raid on" setting is to enable a pci card controller.

According to my Dell 380 Info.doc, the sata raid controller on the system board is the Intel® 82801GR/GH - I probably got that info from Device Manager. I haven't found any info on the 82801GR/GH except at Intel, and their info is limited to its configuration on their "deskboards" and not very informative. Apparently whether you get your 82801GR/GH from Intel or Dell you configure it by Guess.

If my bios settings are correct and raid is on, then I could try a winxp repair installation from the boot cd. And I could run the hardware diagnostics from the fat partition. I'm also back to wondering why a regularly chkdsked, defragged, anti-virus and spybot updated and scanned computer w/ no signs of impending doom went belly-up after an antivirus boot scan that didn't find any infected files.

This post has been edited by MaryBet82: 22 March 2010 - 12:54 PM

Thanks to everyone for their help. The dell mysteriously booted into windows today.

I found another copy of my BIOS settings in which I can read my writing and they say Raid Autodetect/AHCI clearly, so I think the "Raid On" per the Dell 380 support page is incorrect, refers to another possible 380 configuration or you can do it either way. So RAID has been properly on during the troubleshooting and the bootcfg put in that second boot path line for whatever reason.

I hadn't made any changes since I expanded hal, rebuilt boot.ini and did a restore point and the error message went from a missing hal to "windows could not start because of a computer disk hardware configuration problem". Except we had a storm and I unplugged the UPS to which the dell is connected. When I plugged back in I tried and succeeded getting into the ctrl-i utility, which didn't show any bad drives. Exiting the utility the computer went back into windows boot and... yesterday booted into safe mode - then crashed.

Today, however, it booted into windows. I've reconnected to my router and updated antivirus and run chkdsk w/out problems. Yesterday the computer crashed in safe mode when the found new hardware wizard popped up. It popped up again today, but allowed me to cancel w/out crashing.

I think maybe unplugging the computer did that power drain thing where you unplug the computer and push down on the power button, if that's not a myth. I meant to try that, then forgot, then the storm did it for me.

I read the "ntldr is missing" post and was planning to try expanding/copying over ntdetect, ntlder, and notoskrnl, running a chkdsk and maybe trying a fixmbr - then running hardware diagnostics from the utilities partition. Except I had to figure out how to run hdd scans on a raid first.

So now I'm going to do a before-reformatting back up, which is more thorough than a before new-type virus scan bu, if the computer stays stable that long. Then I'm going to scan/test the hardware, and if that checks out take down the raid and reformat/reinstall as 2 independent hdds. I'm going to put os + program files on one partition and my files on another and clone the os + program files. Well, in theory. I bought Norton Ghost-10 awhile back, but didn't get it to work. I read the cloning tutorial here and may try that software.

In my searches to find out how RAID 1 actually works I came across an article, RAID - Not such a clever idea for your home PC, that warns about using RAID 0 and cautions using RAID 1. Altho I think the article is dated because there are only "initial impressions" on Intel's ICH6R and I've seen ICH10R listed, I think some of its warnings are still valid.

Anyway, without adequate documentation RAID 1 is a risk and Dell's documentation is poor.