How to restore the registry from a System Restore point using a Vista/Win7 Disk
A Vista RE disk can be downloaded from one of these links:
Vista Recovery Environment CD 64 bit Vista 32 bit Vista
Windows 7 RE from here:
Recovery Environment CD - Boot with the Vista/Win7 DVD, or Vista/Win7 RE CD.
- Select your Language, click Next
- Click Repair your Computer
It will search for Vista/Win7 installations, just wait for it to finish.
If using Win7 Disk, select Use recovery tools that can help fix problems starting Windows. at the top. - Click Next
- Click Command Prompt.
- Type Notepad and press Enter.
- Click File | Open
- On the left, click Computer
This will let you verify the drive letter, as they may be different when booted to the CD/DVD - Click Cancel and close Notepad.
For the rest, I'll use C: for the drive letter, change it as needed.
We will also use a little trick called Auto Completion so we don't have to type the full folder names for the next part. - Type the following, then press TAB:
attrib -H -S c:\system
This should change to this:
attrib -H -S "c:\System Volume Information"
Press Enter - Type the following, then press TAB:
CD /D c:\system
This should change to this:
CD /D "c:\System Volume Information"
Press Enter - Type Dir /oD then press Enter
You should see one folder named like this:
_restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}"
A, B, C, D, and E will be Hexadecimal numbers (0-9, A-F), different on each system.
If there is more than one, we'll need to determine which to use, see the steps after the end of this procedure. - Type the following, then press TAB:
attrib -H -S \_res
The line should now read something like this:
attrib -H -S _restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}
Press Enter - Type Notepad
Notepad should open - Press Alt+Tab to switch back to the Command Prompt
- Press the Up Arrow, then Enter. This will open a 2nd instance of Notepad.
- Click File | Open
Change the Files of type: box to All Files - Press Alt+Tab to switch to the other Notepad window
- Click File | Open
Change the Files of type: box to All Files - Position the two Open dialogs so you can easily switch between the two, and widen them if needed.
Depending on your Screen Resolution, they may overlap.
I position one top left, and one bottom right. - In one of the Open dialogs, let's call this the First one, double click Computer on the left
- Double click the C: Drive.
- Double click the System Volume Information folder.
- Double click the _restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE} folder
- Click on the View Menu (right most icon to the right of the Look in: box
Select Details
You should see a list of folders named RPX, where X is a number. - Click twice on the Date Modified column heading.
This will sort the folders by date with the newest one at the top.
Check the dates of the folders, and find one with a date BEFORE the problem occurred. - Double click on the RPX folder selected above
- Double click on the snapshot folder.
- Switch to the other Open dialog, let's call this the Second
- Double click the C: Drive.
- Double click the Windows folder.
- Double click the System32 folder.
- Double click the Config folder.
- Copy the following files to the Config folder by dragging each one from the First open dialog window to the Second
This has to be done one at a time.
Hold the CTRL key down while doing this, and make sure a plus sign is displayed to indicate copying:- _REGISTRY_USER_.DEFAULT
- _REGISTRY_MACHINE_SAM
- _REGISTRY_MACHINE_SECURITY
- _REGISTRY_MACHINE_SOFTWARE
- _REGISTRY_MACHINE_SYSTEM
- Now, switch back to the Second open dialog window.
- Rename the following files (highlight each file and press F2, then edit the name, then press Enter):
- Rename DEFAULT to DEFAULT.bak
- Rename SAM to SAM.bak
- Rename SECURITY to SECURITY.bak
- Rename SOFTWARE to SOFTWARE.bak
- Rename SYSTEM to SYSTEM.bak
None of these will have extensions. If one is missing, just skip it.
If there already are files with the .bak extension, just add a number to the end, .bakX - Now rename these files:
- Rename _REGISTRY_USER_.DEFAULT to DEFAULT
- Rename _REGISTRY_USER_SAM to SAM
- Rename _REGISTRY_USER_SECURITY to SECURITY
- Rename _REGISTRY_USER_SOFTWARE to SOFTWARE
- Rename _REGISTRY_USER_SYSTEM to SYSTEM
- Click Cancel on both Notepad Open dialogs to close them, then close both Notepad windows.
- Last step is to restore the hidden and system properties on the two folders. Easier to do it now, as you won't have permission to do so in XP.
- Switch to the Command Prompt
- Press the up arrow until this command is displayed:
- attrib -H -S _restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}
- Press HOME, then arrow right to change the - signs to +
(Place the cursor on the -, press Delete, type +)
The line should now read:
attrib +H +S _restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}
Press Enter. - Press the up arrow to select this line:
]attrib -H -S "c:\System Volume Information"
and repeat the above steps so it reads
attrib +H +S "c:\System Volume Information"
Press Enter. - Close the Command Prompt, and click Restart.
Hopefully the system will boot successfully.
Try to do a System Restore to the same date you picked above for the
RPXXX folder.
This procedure only replaces the registry hives, not any system files, so there is a chance that previous restore points will no longer work, as System Restore may detect inconsistencies if there were any major changes.
If System Restore fails, try booting to Safe Mode, then running restore
Once you are satisfied that the system is working correctly, you can delete the
*.bak files from
C:\Windows\system32\config Determine the folder to use on a Dual boot system
If you have a dual boot system you may have more than one
_restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE} folder, here's how to find the one you need to use.
In the Command Prompt type
regedit and press
Enter:
In the left pane, click on
HKEY_LOCAL_MACHINE to highlight it
Click
File | Load Hive...
Browse to
C:\Windows\system32\config
Double click on
SOFTWARE (the one with no extension)
In the
Key Name: box type
@Software
navigate to here:
Code:
HKEY_LOCAL_MACHINE\@SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg
Note the value of the item named
MachineGuid
If you can't load the
SOFTWARE hive, load the
SYSTEM hive, name it
@SYSTEM, and look for the
System Restore item here:
Code:
HKEY_LOCAL_MACHINE\@SYSTEM\ControlSet001\Control\BackupRestore\FilesNotToBackup
If you can't load either hive, you'll have to load the
_REGISTRY_USER_SOFTWARE hive from one of the Restore Points
snapshot folders, and we'll have to find something else to look for. (name it
@SOFTWARE)
If a dual boot with different versions of Windows check the
ProductName here:
Code:
HKEY_LOCAL_MACHINE\@SOFTWARE\Microsoft\Windows NT\CurrentVersion
This won't differentiate between Home or Pro though.
If the Computer Name is different, you can check that in a
_REGISTRY_USER_SYSTEM hive(name it
@SYSTEM):
Code:
HKEY_LOCAL_MACHINE\@SYSTEM\ControlSet001\Control\ComputerName\ComputerName
If no ControlSet001, use ControlSet00X, what ever is present.
You'll have to use the
attrib -H -S command on each of the
_restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE} folders so you can browse to them in the Registry Editor
If System Restore has been disabled, there won't be a
_restore{AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE}" folder under the
System Volume Information folder.
In that case, check the
C:\Windows\Repair folder.
This should have the following files:
- DEFAULT
- SAM
- SECURITY
- SOFTWARE
- SYSTEM
You'll have to first rename the files in
C:\Windows\System32\Config, then copy these over.
These files are created when the system is first installed, so any software or hardware installed since then will have to be re-installed. You may have only the Built-in Administrator account as well, which usually has a blank password, but could be anything, hence the warning from MS.
It may be worth trying to move just the damaged hive, the one listed in the error message. I would first make copies of the originals, as they do get modified. To copy them, right click the file, click
Copy, then right click in the window
on a blank spot and click
Paste.
HTH
Jerry