Recovery Console Restore Points

Recovery Console Restore Points
_________________________________________________

Being computer technicians we all dread to see that little screen that comes up during start up that says one of these things:
“Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM”
“Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE”
“Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate”
So what do these errors mean? Well simply put, it PROBIBLY means you have a corrupt registry. Not only does that mean time, it also means that if you don’t have another computer to Daisy-Chain your Hard Drive in, your data is pretty much screwed. (Unless you use some other more advanced methods that I will not be going into today).

This tutorial will guide you through restoring the registry hives using Windows restore points IN the Recovery Console. Now as you may or may not know Microsoft has a KB article devoted to restoring a corrupt registry however it will not allow you to make a choice of what date you wish to restore to... Also it’s not meant for OEM versions of Windows because it misses the Repair folder at the root level…. The MS article is located at http://support.microsoft.com/?kbid=822705 …

This process described below can be used on OEM versions of Windows, I’ve tried it and it works quite well. So, lets get started shall we...


What you will need:
-Bootable Windows CD with Recovery Console

What to do:
-Configure your computers BIOS boot order to boot from the CD-ROM first.
(For instructions on how to do this go to the vender’s website)
-Boot off the CD

-When you get the menu that says “Press Enter to continue with the installation of Windows XP, or press R to repair a Windows installation using the recovery console, ----press R-----

- Now select the windows install. Most likely its number 1 unless you have multiple windows partitions.


Here is the real fun!!!!
At the “C:\WINDOWS>” prompt type:
___________________________________________
1. Type cd \ and press the <Enter> key.

2. Type cd system~1\_resto~1 and press the <Enter> key.

3. Type dir and press the <Enter> key. A list of the restore points appears listed chronologically beginning with RP1. Choose the restore point folder which is dated the day prior to the occurrence of the error reported.

4. Type cd rpX (where X is the restore point you chose in the step above) and press the <Enter> key.

5. Type cd snapshot and press the <Enter> key.

6. Type dir and press the <Enter> key.

7. Type copy _registry_machine_system c:\windows\system32\config\system and press the <Enter> key. Overwrite _registry_machine_system? (Yes/No/All): appears.
8. Type Y and press the <Enter> key.

9. Type copy _registry_machine_software c:\windows\system32\config\software and press the <Enter> key. Overwrite _registry_machine_software? (Yes/No/All): appears.
10. Type Y and press the <Enter> key.

11. Type copy _registry_machine_sam c:\windows\system32\config\sam and press the <Enter> key. Overwrite _registry_machine_sam? (Yes/No/All): appears.
12. Type Y and press the <Enter> key.

13. Type copy _registry_machine_security c:\windows\system32\config\security and press the <Enter> key. Overwrite _registry_machine_security? (Yes/No/All): appears.
14. Type Y and press the <Enter> key.

15. Type copy _registry_user_.default c:\windows\system32\config\default and press the <Enter> key. Overwrite _registry_user_.default? (Yes/No/All): appears.
16. Type Y and press the <Enter> key.

17. Remove the operating system CD and type exit to restart the computer.
____________________________________________

Congratulations you have just restored your computer to an earlier date by using the Recovery Console…
I found this out while playing around in the recovery console…

Please excuse my spelling, i did use a spell check