WD My Book Live Duo NAS Array
NAS Array Recovery Case Study: My Book Live Duo Reformat
April 27, 2017
FileVault data recovery
FileVault Data Recovery Case Study: Half Baked Hard Drive
May 2, 2017

Error Code 0xc00000e9: Lenovo Data Recovery Case Study

Lenovo data recovery: Hard drive 0xc000009 boot error

Hard drive error code 0xc00000e9: Windows failed to load because the system registry file is missing or corrupt.

The client in this Lenovo data recovery case was having a frustrating time with their computer. It just wouldn’t boot up anymore. Upon powering on the computer, the familiar Lenovo BIOS loading screen would give way not to the Windows logo, but to an ugly Windows boot error message. The boot message had the error code 0xc00000e9, indicating that “the system registry file” was “missing or corrupt”. Bad news for their computer. And further bad news for their computer’s hard drive: the drive had failed Lenovo’s hard drive diagnostic tests.

Lenovo Data Recovery Case Study: Error Code 0xc00000e9
Drive Model: Hitachi HTS725050A7E630
Drive Capacity: 500 GB
Operating/File System: Windows NTFS
Data Loss Situation: Lenovo boot error code 0xc00000e9: Failed Lenovo hard drive diagnostics test. The system registry file is missing or corrupt.
Type of Data Recovered: Documents, photos
Binary Read: 99.9%
Gillware Data Recovery Case Rating: 10

It looked like this hard drive just wasn’t in any position to give up its data. Removing the drive and plugging it into another computer confirmed it. This drive had failed.

To make matters worse, the hard drive had full-disk Bitlocker encryption. Of course, full-disk encryption is a great thing to have. It keeps data from falling into the wrong hands and helps you maintain your privacy, which, in the modern world, seems constantly under attack. But when you have to struggle to retrieve data from a failing hard disk, full-disk encryption starts to become somewhat of a pain. After all, everything has its drawbacks—hard drive encryption included.

That said, this situation wasn’t anything our data recovery engineers hadn’t triumphed over before. Our Lenovo data recovery specialists were fully prepared to do whatever it took to recover this client’s important business documents and family photos from their failed Hitachi hard drive.

Why This Hard Drive Produced Error Code 0xc00000e9

Any sort of failure will prevent a hard drive from passing a diagnostic test. But some failures are worse than others. The drive could have intermittent read/write errors due to dying read/write heads or a faltering circuit board preventing data from reliably being read or written. These are signs that a hard drive is on its last legs, although it hasn’t completely failed yet.

It could also have severe physical issues preventing access to the drive altogether and requiring cleanroom intervention. Usually, severe physical issues make themselves known with loud, abnormal sounds, such as hard drive clicking or beeping.

In this Lenovo data recovery case, the failed hard drive had a bug in its firmware. Firmware works like the “operating system” of the drive, regulating and managing its behavior. Firmware controls how the drive reads and writes data, and how it handles changes in operating conditions (such as sectors on the disk platters wearing out). When this complex firmware fails, it can grind the drive’s operations to a halt.

Firmware differs from one brand of hard drive to the other, just like how Windows 10 differs dramatically from OS X or Ubuntu. To repair the firmware in a Hitachi drive, a Hitachi hard drive repair specialist must use special tools to access and carefully modify the affected firmware module.

Lenovo Data Recovery Results

After getting the hard drive up and running again, our Lenovo data recovery engineers could make a nearly-complete disk image of the encrypted drive. With the help of our fault-tolerant data recovery tools, we could read and copy all but a few of the sectors on the hard drive’s disk platters.

One of the hurdles encrypted hard drive recovery places in our engineers’ paths is that, unlike with unencrypted disks, we can’t target used areas of the drive. Because everything is encrypted, there’s no way to distinguish between used and unused areas. This means using more machine time to image the whole drive instead of just the parts with data on them. That in itself isn’t such a big deal for our engineers, because machine time is much less valuable than a living engineer’s time. But it’s a big issue when a drive requires physical repairs, because our engineers can’t strategically target the client’s data.

Fortunately, the issue with this client’s hard drive did not require any physical repairs, and ran smoothly once our Hitachi hard drive recovery experts had fixed its firmware.

With the hard drive nearly completely imaged, we could move onto decrypting it. With the client’s password in hand (of course—if we didn’t need their password, it would defeat the whole purpose of encryption, wouldn’t it?), we could create a new, decrypted disk image and explore its contents, making sure the few sectors we hadn’t read didn’t happen to lie smack dab in the middle of any of the client’s important files.

All of the client’s most important photos and documents functioned perfectly. We rated this Lenovo data recovery case a perfect 10 on our ten-point case rating scale.

Will Ascenzo
Will Ascenzo
Will is the lead blogger, copywriter, and copy editor for Gillware Data Recovery and Digital Forensics, and a staunch advocate against the abuse of innocent semicolons.