Tuesday, November 6, 2012

System Restore on XP using Linux

I was given a laptop to try and fix: it wouldn't boot into Last Known Good or Safe Mode. What to try? A Blue Screen Of Death flashed up for a half second before the computer rebooted: fortunately one of the boot options was to disable automatic reboot so I could read the error message: the registry cannot load the hive.

A web search told me the registry files were corrupted, and I needed the system disks to repair an OEM install, but the laptop owner didn't have them.

I booted the laptop with a CrunchBang live USB, and with Google's help, found the location of the registry files. I wondered whether it would be possible to manually move over some working registry files from a System Restore point, but couldn't work out which ones I'd need. I had a hunch that somebody might know how to do it, and Google told me they did.

ICompute has a description of how to do it. Basically by taking _REGISTRY_MACHINE_SYSTEM and _REGISTRY_MACHINE_SOFTWARE from one of the _restore*** folders in System Volume Information and replacing the system and software files in the windows\system32\config folder.

The Ubunti forum has a post on this too, detailing some other registry files that can be restored in this way, but the method above worked for me.

The computer booted telling me I should do a file consistency check, which I accepted- after which XP booted normally. I ran Chkdsk and it found bad sectors on the old software registry file- not surprising as the the laptop had a failing power supply.

After that it was just a case of tracking down a virus causing constant hard disk access (thanks DrWeb CureIT!) and a long-overdue, and in fact very long defrag.

Ah, the joys of Windows: System Restore that doesn't work when you need it, BSODs that disappear after a micro second, 30% fragmentation on a half-full disk, and elusive viruses hiding in temp files!


No comments:

Post a Comment