System Restore from Recovery Console

Sometimes we screwed up our machine so bad, that it could not boot into windows anymore, not even safe mode. So i looked around for ages and eventually found out how to do it in the recovery console. For anyone who is new to windows, the recovery console can be found by booting up your machine with the XP CD in the drive, and booting off of that CD. Then it will ask you if you want to go to the recovery console, and select that option. The recovery console is basically a MS DOS command prompt, with a little more functionality.

That being said, if you need to run System Restore to revert the system to an earlier version of the SYSTEM or SOFTWARE Registry hive, because of a corrupted Registry, it is possible to do this manually. This method is far from perfect and doesn’t take into account any of the other changes that System Restore might track (such as changed .DLLs or other system components), but it will allow you to recover copies of the Registry in the event of a failure—provided they’ve been saved with System Restore and are available. Follow the below steps

Step 1: Boot the Recovery Console from the Windows XP installation CD.

Step 2: When you’re at the Recovery Console command prompt, change into the root directory of the system drive with the cd command (i.e., cd \).

Step 3: Change into the System Volume Information directory by typing cd system~1 on most machines, or cd “System Volume Information.”

Step 4: The System Volume Information directory contains a folder name _restore followed by a GUID in curly braces. Change into it by typing cd _resto~1; if that doesn’t work you’ll have to type cd “_restore{GUID_STRING}”, with the full GUID string in place of GUID_STRING.

Step 5: In the _restore directory are a group of subdirectories starting with the letters RP and followed by a number. These are the different restore points available for that volume.

Step 6: Check the date on each directory and look for one that corresponds to a date before you began experiencing problems.

Step 7: Change into the appropriate directory. If the directory is named RP74, for instance, change into it by typing RP74.

Step 8: Inside that directory will be a subdirectory named snapshot; change into that directory as well (cd snapshot)

Step 9: The snapshot directory holds backup copies of the SOFTWARE and SYSTEM Registry hives, named _REGISTRY_MACHINE_SOFTWARE and _REGISTRY_MACHINE_SYSTEM, respectively.

Step 10: The target directory for these files is \Windows\System32\Config, and the hives there are named SOFTWARE and SYSTEM. Rather than overwrite those files entirely, you can rename them to something else. Typing ren \windows\system32\config\software \windows\system32\config\software.bak and ren \windows\system32\config\system \windows\system32\config\system.bak will rename them to software.bak and system.bak, respectively.

Step 11: Copy in the backup hives: copy _REGISTRY_MACHINE_SOFTWARE \windows\system32\config\software and copy _REGISTRY_MACHINE_SYSTEM \windows\system32\config\system.

Step 12: Type exit to leave the Recovery Console and restart the computer.

~ by ramanathan on December 21, 2007.