Common Corruption Scenarios:
1. Registry corruption (50% of failures)
2. Active Directory database corruption
3. File system corruption (NTFS)
4. System file corruption
5. Driver conflicts
6. Virus/malware damage

:: Essential built-in recovery tools

:: Check Disk utility
chkdsk C: /f /r

:: System File Checker
sfc /scannow

:: Registry checker
scanreg /fix

:: Recovery Console commands
fixboot
fixmbr
bootcfg /rebuild

:: Build Windows PE 1.0 for recovery
:: Requires Windows XP SP1 CD

1. Install Windows AIK for XP
2. Create WinPE image:
   mkimg.cmd C:\winpe_x86 C:\winpe_x86\winpe.iso

3. Add recovery tools:
   copy recoverytools\*.* C:\winpe_x86\i386\system32\

4. Create bootable CD/USB

:: Stage 1: Assess damage
chkdsk C: /v > chkdsk_report.txt

:: Stage 2: Attempt automatic repair
chkdsk C: /f /r

:: Stage 3: Manual MFT recovery
:: Boot from recovery media
nfi.exe C: > mft_analysis.txt

:: Stage 4: Recover orphaned files
mkdir C:\Recovered
chkdsk C: /f /v /i

// Simple MFT parser for data recovery
// Compile with Visual C++ 6.0

#include <windows.h>
#include <stdio.h>

#define MFT_RECORD_SIZE 1024
#define MFT_SIGNATURE 0x454C4946  // "FILE"

typedef struct {
    DWORD Signature;
    WORD UpdateSequenceOffset;
    WORD UpdateSequenceSize;
    ULONGLONG LogFileSequenceNumber;
    WORD SequenceNumber;
    WORD HardLinkCount;
    WORD FirstAttributeOffset;
    WORD Flags;
    DWORD UsedSize;
    DWORD AllocatedSize;
    // ... more fields
} MFT_RECORD;

void RecoverMFTRecord(HANDLE hDisk, ULONGLONG offset) {
    MFT_RECORD record;
    DWORD bytesRead;

    SetFilePointerEx(hDisk, offset, NULL, FILE_BEGIN);
    ReadFile(hDisk, &record, sizeof(record), &bytesRead, NULL);

    if (record.Signature == MFT_SIGNATURE) {
        printf("Valid MFT record found at offset: %llu\n", offset);
        // Process attributes and recover file data
    }
}

:: Recover FAT32 partitions
:: Using DOS-based tools

1. Boot from DOS floppy/CD
2. Run SCANDISK:
   scandisk C: /autofix /surface

3. Recover lost clusters:
   chkdsk C: /f

4. Manual FAT recovery:
   debug
   -l 100 2 0 1  (load boot sector)
   -d 100 L 200  (display)

:: Recover corrupted AD database

:: 1. Boot into Directory Services Restore Mode
:: 2. Stop AD services
net stop ntds /y

:: 3. Check database integrity
ntdsutil
files
integrity
quit
quit

:: 4. Attempt soft recovery
esentutl /r edb /l "C:\WINNT\NTDS" /s "C:\WINNT\NTDS"

:: 5. If soft recovery fails, try repair
esentutl /p "C:\WINNT\NTDS\ntds.dit" /8

:: 6. Rebuild indices
ntdsutil
files
compact to C:\NTDS_Temp
quit
quit

:: Recover SYSVOL and Group Policies

:: 1. Check FRS database
esentutl /mh "C:\WINNT\NTFRS\jet\ntfrs.jdb"

:: 2. Restore from backup
ntbackup restore /f "sysvol_backup.bkf" /s C:\WINNT\SYSVOL

:: 3. Force authoritative restore
:: Stop FRS
net stop ntfrs

:: 4. Set BurFlags for D2 restore
reg add "HKLM\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup" /v BurFlags /t REG_DWORD /d 2 /f

:: 5. Restart FRS
net start ntfrs

:: Emergency schema recovery

:: 1. Export current schema
ldifde -f schema_backup.ldf -s localhost -d "cn=schema,cn=configuration,dc=domain,dc=com"

:: 2. Analyze schema for corruption
dcdiag /test:CheckSDRefDom

:: 3. Restore schema partition
ntdsutil
authoritative restore
restore subtree "cn=schema,cn=configuration,dc=domain,dc=com"
quit
quit

-- Emergency database recovery procedures

-- 1. Set database to emergency mode
ALTER DATABASE CorruptedDB SET EMERGENCY

-- 2. Set single user mode
ALTER DATABASE CorruptedDB SET SINGLE_USER

-- 3. Attempt repair
DBCC CHECKDB ('CorruptedDB', REPAIR_ALLOW_DATA_LOSS)

-- 4. If repair fails, extract data
SELECT * INTO NewTable 
FROM CorruptedDB..OldTable
WHERE 1=1  -- Force row-by-row processing

-- 5. Rebuild database
CREATE DATABASE RecoveredDB
-- Copy schema and data

:: Exchange Information Store recovery

:: 1. Check database consistency
eseutil /mh "C:\Program Files\Exchsrvr\MDBDATA\priv1.edb"

:: 2. Perform soft recovery
eseutil /r E00 /l "C:\Program Files\Exchsrvr\MDBDATA" /s "C:\Program Files\Exchsrvr\MDBDATA"

:: 3. If needed, hard repair (data loss possible)
eseutil /p "C:\Program Files\Exchsrvr\MDBDATA\priv1.edb"

:: 4. Defragment after repair
eseutil /d "C:\Program Files\Exchsrvr\MDBDATA\priv1.edb"

:: 5. Run Information Store integrity check
isinteg -s SERVER -fix -test alltests

:: Generic RAID recovery steps

:: 1. Document current configuration
:: - RAID level
:: - Stripe size
:: - Drive order
:: - Hot spare configuration

:: 2. For RAID 1 (Mirror)
:: - Try each drive independently
:: - Clone good drive to new media

:: 3. For RAID 5 (Parity)
:: - Maximum 1 drive failure tolerated
:: - Replace failed drive immediately
:: - Force rebuild if necessary

:: 4. Using manufacturer utilities
:: Adaptec:
arcconf getconfig 1 > raid_config.txt
arcconf getlogs 1 device tabular > raid_logs.txt

:: LSI:
MegaCli -LDInfo -Lall -aALL > raid_status.txt
MegaCli -PDList -aALL > drive_status.txt

:: Windows 2000 software RAID recovery

:: 1. Check disk management
diskpart
list disk
list volume

:: 2. Reactivate failed mirror
select disk 1
online disk
select volume 2
retain

:: 3. Rebuild mirror set
select disk 0
convert dynamic
add disk=1

:: 4. Resynchronize
select volume 2
repair disk=1

:: Recover recently deleted files

:: 1. Stop all write operations immediately
net stop server /y
net stop workstation /y

:: 2. Create sector-level backup
dd if=\\.\PhysicalDrive0 of=E:\diskimage.img bs=512

:: 3. Search for file signatures
:: For Office documents (DOC)
findstr /C:"ÐÏࡱ" E:\diskimage.img > doc_locations.txt

:: For ZIP files
findstr /C:"PK" E:\diskimage.img > zip_locations.txt

:: 4. Use specialized recovery tools
photorec /d E:\Recovered image.img

' Shadow Copy recovery for Windows 2000
' Limited functionality compared to newer versions

Set objWMI = GetObject("winmgmts:\\.\root\cimv2")
Set colShadows = objWMI.ExecQuery("SELECT * FROM Win32_ShadowCopy")

For Each objShadow in colShadows
    WScript.Echo "Shadow Copy: " & objShadow.ID
    WScript.Echo "Created: " & objShadow.InstallDate
    ' Mount and copy files as needed
Next

:: Emergency registry recovery

:: 1. Boot from Recovery Console or PE
:: 2. Backup current registry
md C:\RegBackup
copy C:\WINNT\System32\Config\*.* C:\RegBackup\

:: 3. Restore from last known good
copy C:\WINNT\Repair\RegBack\SYSTEM C:\WINNT\System32\Config\
copy C:\WINNT\Repair\RegBack\SOFTWARE C:\WINNT\System32\Config\
copy C:\WINNT\Repair\RegBack\SAM C:\WINNT\System32\Config\
copy C:\WINNT\Repair\RegBack\SECURITY C:\WINNT\System32\Config\
copy C:\WINNT\Repair\RegBack\DEFAULT C:\WINNT\System32\Config\

:: 4. If that fails, use original setup registry
copy C:\WINNT\Repair\SYSTEM C:\WINNT\System32\Config\
:: etc...

:: Recover corrupted system files

:: 1. Extract from installation media
expand D:\i386\kernel32.dl_ C:\WINNT\System32\kernel32.dll
expand D:\i386\ntdll.dl_ C:\WINNT\System32\ntdll.dll

:: 2. Verify system file integrity
sigverif.exe

:: 3. Replace protected files
:: Boot from Recovery Console
copy D:\i386\userinit.ex_ C:\WINNT\System32\userinit.exe
copy D:\i386\msgina.dl_ C:\WINNT\System32\msgina.dll

# Script to organize recovered data
# Run on newer Windows system after mounting recovered drive

$RecoveredPath = "E:\Recovered"
$OrganizedPath = "F:\Organized"

# Create directory structure
$Types = @{
    ".doc" = "Documents\Word"
    ".xls" = "Documents\Excel"
    ".mdb" = "Databases"
    ".jpg" = "Images"
    ".pdf" = "Documents\PDF"
}

foreach ($ext in $Types.Keys) {
    New-Item -Path "$OrganizedPath\$($Types[$ext])" -ItemType Directory -Force
}

# Organize files by type
Get-ChildItem -Path $RecoveredPath -Recurse | ForEach-Object {
    if ($Types.ContainsKey($_.Extension)) {
        $dest = "$OrganizedPath\$($Types[$_.Extension])"
        Copy-Item $_.FullName -Destination $dest
    }
}

:: Validate recovered data integrity

:: 1. Check file headers
:: For Office documents
findstr /M /C:"ÐÏࡱ" *.doc > valid_docs.txt

:: 2. Test database integrity
:: For Access databases
for %%f in (*.mdb) do (
    msaccess.exe "%%f" /compact /repair
)

:: 3. Verify archive integrity
:: For ZIP files
for %%f in (*.zip) do (
    7z t "%%f" >> archive_test.log
)