SafeGuard Enterprise Client fails to boot, Windows error: Recovery from "File: \Boot\BCD Status: 0xc000000f" or File: Boot\BCD status 0xc0000098

  • Article ID: 112846
  • Rating:
  • 44 customers rated this article 3.9 out of 6
  • Updated: 27 Jan 2015

While booting a SafeGuard Enterprise encrypted client machine, the operating system boot-up process is interrupted and one of the following BCD (Boot Configuration Data) error messages is displayed,

  • File: \Boot\BCD Status: 0xc000000f Info: "an error occurred while attempting to read the boot configuration data"
  • File: \Boot\BCD Status: 0xc0000098. The Windows Boot Configuration data file does not contain a valid OS Entry"

Known to apply to the following Sophos product(s) and version(s)
Sophos SafeGuard Disk Encryption 5.60.1
Sophos SafeGuard Disk Encryption 5.60.0
Sophos SafeGuard Disk Encryption 5.50.8
Sophos Disk Encryption 5.61.0
SafeGuard Easy 6.0
SafeGuard Easy 5.60.1
SafeGuard Easy 5.60.0
SafeGuard Easy 5.50.8
SafeGuard Device Encryption 6.0
SafeGuard Device Encryption 5.60.1
SafeGuard Device Encryption 5.60.0
SafeGuard Device Encryption 5.50.8

Operating systems
Windows Vista
Windows 7

What To Do

Please note the following disclaimer:

  1. The errors: "File: \Boot\BCD Status: 0xc000000f" and "File\Boot\BCD Status: 0xc0000098" are generic operating system related errors, and are not caused by SafeGuard. These errors occur when either of the following conditions is true:
    • The Windows Boot Manager (Bootmgr) entry is not present in the Boot Configuration Data (BCD) store
    • The Boot\BCD file on the active partition is damaged or missing.

      Please mind: A corruption of the Windows Boot Configuration Data store has often been observed when Windows failed to start and the consecutive restart of the machine booted into Windows Startup repair ("Windows Error Recovery -> Launch Startup Repair (recommended)") boot entry.

      To prevent Windows from showing the "Windows Startup Repair" selection after a system failure but boot straight into Windows instead, the "Windows Startup Repair" can be disabled using the following command: "bcdedit /set {default} bootstatuspolicy ignoreallfailures". Administrative permissions are required to change the bootstatuspolicy.

      To revert the changes again, run the following command: "bcdedit /set {default} bootstatuspolicy displayallfailures"

  2. Difficulty in recovery lays in the fact that the disk is encrypted and standard bootrec /rebuildbcd procedure will not work. The disk needs to be unlocked before any recovery attempts can be made.

Ensure that you follow this procedure closely:

  1. Download one of the following Windows Preinstall Environments (WinPE) with SafeGuard Enterprise filterdriver subsystem and burn it to a CD:
  2. Boot the affected machine from the CD.
  3. Use the Virtual Client procedure to gain access to the encrypted partition (please use our Recovery Guide from Knowledge Base Article 108805: Recovering data from a volume-based encrypted SafeGuard Device Encryption Client > Page 27, "Retrieving data using Virtual Client").
    Please note: When running Sophos SafeGuard Disk Encryption 5.61, please follow Knowledge Base Article 118497: Recovering data from a Sophos Disk Encryption 5.61 Client using a bootable recovery media based on WinPE to unlock the partition.
  4. Once you have access to the encrypted partition, attempt the repair from the Windows Preinstall Environment:

Repairing the Windows Boot Configuration Data from Windows PE:

  1. Open a command prompt
  2. Run the command: Bootrec /RebuildBcd
    Expected outcome: "Successfully scanned Windows installations: 1 Add installation to boot list? Yes(Y)/No(N)/All(A):"
  3. Select 'Yes(y)', press Enter.
    Expected outcome: "The operation completed successfully."
  4. Remove the WinPE disk from the drive
  5. Reboot machine

    thank you for the feedback

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent