Re: Fixing a corrupt Windows Registry with Ubuntu (Linux)

RaSh,

I read your above instructions which seem to be doing manually what
system restore does.

Yes, but it only restores the Registy, not changed files or drivers. That is
the reason a full System Restore is recommended after successful boot.

So if i need to only restore my registry, what
should I do? Does copying all _registry_machine_system etc. files to
system32\config\system as you have mentioned above do that??

Yes, but that is all it does.

Note that the proceedure is a last resort.

First, you should try F8 and select Last Known Good Configuration.

If that fails, try F8 and a Safe Mode boot, then System Restore.

If that fails, copy the files from C:\WindowsRepair to \Config. If one or
more of the files is missing from \Repair, or if the attempt fails, the
proceedure I documented is the last resort that I'm aware of to restore a
previous registry. I've included a more detailed version of the instructions
below.

There is also a way to use a functining system to inspect/edit a registry
hive from a dead sytem. It is accomplished by "loadhive.exe", which loads a
selected hive file as a subkey in the current registry. There, it may be
inspected/edited and saved back to the original location.

http://www.veder.com/nwdskpe/loadhive.htm

I've never used it to 'fix' a registry, but have used it to recover the
encrypted XP Key, other product keys or serials, or other data, from the
registry of a defunct system. Dagon Design has an XPKey decrypter that may
be run either online or downloaded. Instructions for finding the key and
decrypting it are at

http://www.dagondesign.com/articles/windows-xp-product-key-recovery/

Allan



Partially restoring a checkpoint from the command line
(when system will not boot to Safe Mode)

This proceedure should only be used when a boot of Last Known Good has
failed, and when files are either missing from the 'C:\Windows\repair'
folder, or loading them fails.

The objective is to boot the system to Windows. It is not a full checkpoint
restore. Once the system will boot, System Restore must be used to fully
restore a selected chekpoint. After a successful restore, any files missing
from \repair should be replaced with the same files from \config.

Boot Recovery Console. Do a directory list of the System Volume Information
folder to get the name of the Restore Point folder.

dir "c:\system volume information"

Change to the Restore Point folder by entering (an example, as the number
will vary)

cd "c:\system volume
information\_restore{bb7e35f9-d278-45fa-9dde-fe709cd0f23d}"

List the Restore Points with a dir command, choose one, and change to its
\snapshot folder. Note that pressing the up-arrow key twice will put the
previous cd command on the line, and it can be edited to add the Restore
Point and snapshot folders. Below is an example, but the 'rp' number will
vary.

cd "c:\system volume
information\_restore{bb7e35f9-d278-45fa-9dde-fe709cd0f23d}\rp1219\snapshot"

Copy the config files to the \config folder by entering

copy _registry_user_.default c:\windows\system32\config\default
copy _registry_ machine _sam c:\windows\system32\config\sam
copy _registry_machine_security c:\windows\system32\config\security
copy _registry_ machine _software c:\windows\system32\config\software
copy _registry_ machine _system c:\windows\system32\config\system

Exit the command prompt and restart the system, then use System Restore to
restore the latest working checkpoint.

If the above proceedure does not work, it may be repeated using earlier
checkpoints.

Replace any files missing from C:\Windows\repair by copying the file from
\Windows\system32\config.



.

Quantcast