Restore the Windows XP registry using the "recovery console"

Damage windows registry   XP is a serious problem due to which the system starts to work unstably or completely stops starting. You can fix the error by rolling back to an earlier state, but sometimes this method does not work, and you have to find other methods to restore the registry.

System update

To restore the Windows XP registry, use the system reinstall in update mode. When performing this operation, the installation program replaces all system filesbut does not touch applications installed by the user. Reinstalling in update mode is one of the most effective ways   XP recovery.

If the system boots:

If the update cannot be launched from the Windows environment, do it through the recovery console:



The installation program will begin to overwrite system files. After rebooting, Windows XP will begin updating. As a result, user data and programs will remain untouched, and the registry will be restored.

Manual recovery

If the system update did not yield a positive result, try performing a manual recovery with the ERD Commander boot disk. This program is written to a USB flash drive or disc, and then used as a Live CD.



After performing the above steps, go to C: \\ Windows \\ System32 \\ Config and rename the data copied here. Remove the prefix “REGISTRY_MACHINE” from the file name, giving them the appearance of standard copies of the Windows XP registry.

The second way to manually transfer is to use registry copies, which are stored in C: \\ Windows \\ repair. The disadvantage of this method is that the system is restored to the form in which it was immediately after installation, that is, some programs will not work:



If manual file transfer seems too complicated for you, use the system recovery function, which is also available in ERD Commander.



After the rollback, Windows XP should work correctly, since the registry files will be restored to the state in which they were before the errors appeared.

Never delete or change information in the registry unless you are sure that this is exactly what you need. Otherwise, incorrect data changes can lead to failures in windows operation, and in the best case, information will have to be restored from a backup.

After reading this warning, it is difficult to disagree with the fact that incorrect registry data changes can indeed lead to serious system failures. But wait ... but what about the experiment that underlies the evolution of an ordinary user into an advanced one - who likes, following the dry average rules and laws, dutifully start work with the Start button? .. Is that Aunt Claud’s “super admin”, sitting at the post office and muttering very seriously “turn on the light”, implying a monitor under the light;) ...

As you already know, the registry is a huge database of settings stored in folders at% SystemRoot% \\ System32 \\ Config and the user profile folder Ntuser.dat. Indeed, already proceeding from the capabilities of the bush, it is clear how the thoughtless change of parameters or, worse, the removal of entire branches can end ... Based on the foregoing, it will be more than reasonable to give some of the recovery methods.

Method number 1

Backing up registry files. The following files are copied to removable media: SYSTEM.DAT and USER.DAT (for Windows 95/98), which are located in the directory where it was installed operating system, and have read-only and hidden attributes. For Windows XP, these are (it is better to copy the entire folder) files at% SystemRoot% \\ System32 \\ Config, as well as Ntuser.dat, which is located at C: \\ Documents and Settings \\ User. In the event of a failure due to registry damage, we boot under another OS (DOS, Linux ...) and copy the files to the place.

Method number 2

In order to create backup   registry, you can use the backup and restore wizard - Start / Programs / Accessories / Utilities / Data backup - or simply Run: ntbackup. The archiving program allows you to back up copies of important system components - such as the registry, boot files   (Ntldr and Ntdetect.com) and the Active Directory directory service database. To back up the Windows XP registry step by step instructions   the following:

  1. We go into the system with the required rights - for example, the administrator.
  2. We start NTbackup - Data archiving.
  3. From the wizard mode, go to Advanced mode.
  4. Select the Archiving tab.
  5. In the left window we find the System State icon (line) and mark it with a “bird”:
  6. Click on the Archive button, and then select Advanced.
  7. Check the box Check data after archiving; remove from the item Automatically archive protected system files along with the state of the system (the procedure will take much less time):
  8. The type of archive is set to Normal.
  9. OK and Archive button. If necessary, after archiving, you can view the report located at the address in the folder C: \\ Documents and Settings \\% User% \\ Local Settings \\ Application Data \\ Microsoft \\ Windows NT \\ NTBackup \\ data \\ in the files backup01.log, back up02.log ...

Step-by-step instructions for full recovery   registry through NTbackup are as follows:

  1. We log in with administrator rights.
  2. We start NTbackup
  3. Go to the "Recovery and media management" tab.
  4. In the Select check boxes for all objects that you want to restore check box for the System Status object. Next, follow the intuitive OK.

Method number 3

Essence this method   lies in the so-called export reg file. The method is especially effective (it does not take much time and allows you to make copies of individual subsections) and is relevant when experimenting with the registry. Equipment:

  1. Run / regedit.
  2. We select the section / subsection we need.
  3. The right button of the "rodent" / export, specify the path to save the copy and file name:

When archiving part of the registry, we exported the data to a reg file. In order to extract them and restore initial condition   registry, you must follow these steps:

  1. Run regedit: Start / Run / regedit.
  2. In the main menu, select File / Import with the path to the imported file or simply run the reg-file, confirming the import into the registry:

Method number 4

In this case, we will archive system registry   Using the Recovery Console. To do this, you must:

  1. Boot into Recovery Console (via boot disk   your Windows XP).
  2. In the appeared command line of Recovery Console, execute the following commands *:
md tmp
copy c: \\ windows \\ system32 \\ config \\ system c: \\ windows \\ tmp \\ system.bak
   copy c: \\ windows \\ system32 \\ config \\ software c: \\ windows \\ tmp \\ software.bak
   copy c: \\ windows \\ system32 \\ config \\ sam c: \\ windows \\ tmp \\ sam.bak
   copy c: \\ windows \\ system32 \\ config \\ security c: \\ windows \\ tmp \\ security.bak
   copy c: \\ windows \\ system32 \\ config \\ default c: \\ windows \\ tmp \\ default.bak

Method number 2 - the registry is restored only under a working Windows-system, but with one caveat: in the mode we choose, this is really so, however (!) There is a so-called wizard mode emergency training system (ASR - creates an archive of a system consisting of two parts: a floppy disk with system parameters and other media that contain an archive of the system partition), in which recovery from scratch is possible using a previously created bootable recovery disk.

Method number 4 - for fans of "scary black windows" ...

A typical situation: after infection with a virus, Windows stops loading in both normal and safe (!) Mode. Reinstalling the system on top of the installed one does not help. Many users in this case practice reinstalling windows   from scratch, but you can still try to save the system using the "recovery console".


Prerequisite - the system recovery option must be enabled on the infected computer (if it is disabled, then there will be no place to get the registry version before infection). We will also need an installation CD for Windows XP.

So, let's start the recovery:

  1. First you need to make sure that the computer will not boot from the main hard drive, but with a CD / DVD drive. To do this, go to the BIOS and in the list of boot (boot) devices, install the CD-DVD drive in first place. Please note that many modern BIOSes allow you to select a boot device when you press F8 or F12.
  2. We boot from the Windows XP installation CD. If the boot device is selected correctly, after the BIOS you will see the inscription: "Press any Key to boot from CD" - press any key, for example, a space, after which the boot from the CD will begin. After a while you will see blue screen   Windows Installer. Wait until the menu appears. Instead windows installation   (F1), select the “recovery console” (R) boot.
  3. Console loading usually takes several minutes. Before you begin, you must select the desired installation of Windows. If only one system is installed on the computer, simply enter the number 1 and press enter. Next, enter the Administrator password. If you don’t know the password, try entering blank (just by pressing enter). As a result, you should get to the command line: C: \\ WINDOWS\u003e
  4. Next, enter the command: cd \\

    Please note that there must be a space between cd and \\.

  5. Then: cd system ~ 1 \\ _resto ~ 1

    If the system generates an Access Denied error, the following commands must be executed sequentially:

    Cd \\ cd windows \\ system32 \\ config ren system system.bak exit

    After the exit command, the computer will restart. You should again go into the recovery console and repeat steps 4 and 5. This time, there should be no “Access Denied” error!

  6. Enter the command: dir

    This command displays a list of folders of the form RP1, RP2, etc. These folders correspond to recovery points. It is advisable to find a folder with the creation date before the computer is infected with a virus (1-3 days before infection). Remember the name of this folder, for example RP822 and enter the following command:

    Cd snapshot

    hint command line   should look something like this:
      c: \\ system ~ 1 \\ _resto ~ 1 \\ rp822 \\ snapshot\u003e

  7. Now proceed to restore the registry. We execute the commands: copy _registry_machine_system c: \\ windows \\ system32 \\ config \\ system

    Copy _registry_machine_software c: \\ windows \\ system32 \\ config \\ software

    In the end we introduce:

    We reboot and load the system as usual from the hard drive. The download problem should be resolved (of course, if the reason was in the damaged registry).