Doing a Manual System Restore on a Corrupted XP Installation

[Blue Banana]

How To Do a Manual System Restore on a Corrupted Windows XP Installation
By TechNibble Member Blue Banana
____________________________________

A while ago I had a computer come in with a corrupted system file and would not boot into Windows. When I tried entering the Recovery Console, I got a 0x00000051 STOP error.
This also occurred when I tried reinstalling Windows.

With this guide, you’ll basically be doing a manual system restore.
I’m not sure how far this method can be used to repair other corrupted and missing system configuration files, but for this particular problem it worked great.

I know there are other ways of going about this, like using a bootable Linux disc and such, but this works just as well.


I recommend reading through the whole guide before going ahead with the repair.


Step 1. You will need access to another PC. Take out the HDD with the corrupted windows on it and slave it to the other PC.

Step 2. When you can access the drive, open any folder, then on the Tools menu, click Folder options.
Click the View tab. (For WinXP). If you are running Win7, click Organize, then Folder & Search Options.

Step 3. Under Hidden files and folders, click to select Show hidden files and folders, and then clear the "Hide protected operating system files (Recommended)" check box.

Step 4. Click Yes when the dialog box is displayed that confirms that you want to display these files.

Step 5. Double-click the drive with the damaged installation of Windows XP. Remember to select the correct drive!

Step 6. Go to Windows\system32\config, then delete these files, not the saves:


\windows\system32\config\system

\windows\system32\config\software

\windows\system32\config\Sam

\windows\system32\config\security

\windows\system32\config\default


Step 7. Now open the System Volume Information folder on the same drive. If you can’t access this folder, you’ll need to change its permissions.
This folder contains one or more _restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}"

Step 8. Open a folder that was not created at the current time, you may have to click Details on the View menu to see when these folders were created.
These folders, starting with "RP x" are restore points.

Step 9. Open one of these folders to locate a snapshot sub folder; to make sure you are on track, the following path is an example of a folder path to the snapshot folder:

\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\snapshot

Step 10. In this snapshot folder, copy the following files to the Windows\system32\config

_registry_user_.default
_registry_machine_security
_registry_machine_software
_registry_machine_system
_registry_machine_Sam

Note: These file names may have different cases, eg. _registry_machine_SECURITY

Step 11. Now rename each file. ie remove _registry_user_; registry_machine. etc so you just have:

default
security
software
system
Sam

NOTE: These file names are case sensitive, so make sure you rename them so they are the same as the files you deleted in Step 6.

Step 12. Place the HDD back in the problem PC.

All done!

Let me know what you think and how the process can be improved according to you.

 

[Techlogon]

In Step 6, I would rename those files (e.g. with .old extension) rather than delete them - just in case.

"This works just as well" - maybe so but using a Knoppix/Puppy CD means you don't need to take the drive out - saves time and is less risky. Why make life harder for yourself?

 

[iisjman07]

Very nice. You may want to put this in the wiki; it'd be nice to have a home for useful little tutorials

 

[Blue Banana]

In Step 6, I would rename those files (e.g. with .old extension) rather than delete them - just in case.

"This works just as well" - maybe so but using a Knoppix/Puppy CD means you don't need to take the drive out - saves time and is less risky. Why make life harder for yourself?

Sure, no argument there, wasn't much of a hassle for me at the time though as and I needed to backup the HDD contents. Oh and I'll add your suggestion. Thanks for the tip.

 

[othersteve]

This is a mainstay of my system repair techniques. In Vista it's easier because you have the Regback folder to rely on, but in XP, this method is killer!

Thanks for posting the tutorial.

 

[edtech]

Doesn't this method only work if restore points are turned on? I've had some corporate systems come in with system restore turned off.

 

[johnrobert]

I use this method all the time, if the computer is really bad.
Faster than the usual method and never comes back your system could not be restored after waiting 20 mins
If only it could be done in Vista and Win 7
the system restore pionts are hidden somewhere in shadow copy and not readable.

I dont know why anybody would turn off system restore its the best feature windows has

 

[FoolishTech]

If only it could be done in Vista and Win 7
the system restore pionts are hidden somewhere in shadow copy and not readable.

Check for %systemroot%\system32\config\regbak - if it exists you've at least got one copy of the registry to restore to, and easier than the above, the hives don't have to be renamed.

As for where the actual restore points are, I don't know myself, but I'm sure an app called Shadow Explorer would help us find out, if we were so inclined to do some exploring...

Also, FYI to D7 users, the 11 step process outlined by the OP is exactly what "RegReplace (WinXP)" is for on the Offline tab. It doesn't slave the HDD to another machine for you lol but it does seek out the restore points, copies the hives, and renames them appropriately.

 

[gazza]

I use this method all the time, if the computer is really bad.
Faster than the usual method and never comes back your system could not be restored after waiting 20 mins
If only it could be done in Vista and Win 7
the system restore pionts are hidden somewhere in shadow copy and not readable.

I dont know why anybody would turn off system restore its the best feature windows has

Use Shadow Explorer http://www.shadowexplorer.com/