Recovering a Copied Registry

A registry that has been backed up using copy or xcopy is restored in the opposite manner from which it was backed up. For example, if you have the NTFS file system, then you have to restart the system using your backup copy of Windows XP.

FAT and NTFS

When restoring a registry on a FAT-based file system running Windows XP, it's necessary to boot DOS, Windows 95/98/Me, or a second copy of Windows XP. If you have a dual-boot installed (either DOS or Windows 95/98/Me), you can use the dual-boot to get to the other operating system. If you are restoring the registry on an NTFS system, then dual-boot into the backup copy of Windows XP that you installed to back up the registry. Avoid dual-booting into a previous version of Windows, as there may be incompatibilities in NTFS support offered by earlier versions of Windows. Warning Once running the alternate operating system, find your latest working copy of the registry before you lose it in the restore process, and back up the current registry to another, safe, location. Take this precaution just in case the current registry is not the problem (it happens), and the backup copy is actually not quite as good as you thought it was. You can follow these steps to restore your registry from a backup you have created: 1. Boot to another operating system: Windows XP/NT, DOS, or Windows 95/98/Me for FAT; use Windows XP/NT for NTFS. 2. Save the current registry to a safe location just in case the registry is not the problem after all. 3. Copy your saved registry (from wherever it was stored) to the correct registry location. 4. Boot the problematic version of Windows XP and test to see if the restore worked. If it didn't, keep reading; more golden tips are coming up soon.

The ASR Disk Strikes Again: Using Setup to Recover

If you have no other acceptable backup copies of the original registry, then you'll have to fall back on the ASR disk and the copy of the registry that is saved in the Repair directory. This technique is fraught with peril, including the fact that the registry saved with ASR may not have all the necessary information or be up-to-date. Properly restoring the system registry from the Repair directory and the ASR disk requires running the Windows XP Setup program. When it first starts, Setup examines the hard drive and looks for already-installed copies of Windows XP and their Repair directories. Once the examination is complete, Setup gives you some choices, including Press F2 to Run Automated System Recovery (ASR). Warning Running ASR with Setup will, repeat, will cause Setup to reformat the system hard drive, without further warning! If your backup is on the system drive or a networked drive, be aware that you will either lose the backup or you will probably be unable to access it! This will result in having to do a complete reinstall of the system, and the loss of all user data on the drive. Don't ask how I found this small issue... At a later point, if you didn't run ASR, the Windows XP's Setup program gives you three choices:

• To set up Windows XP now, press Enter.

• To repair a Windows XP installation using Recovery Console, press R.

• To quit Setup without installing Windows XP, press F3. Now, you know that you are in trouble at this point the only choice is whether it might be possible to recover from your problems without doing a complete reinstallation of Windows XP. Let's say that you are going to try to repair. First, select the repair option by pressing R. At this stage, the Setup program switches to repair mode and continues. The next screen displays four choices. You may choose any combination or all of them: Inspect registry files. This choice allows the repair program to check and repair the registry files. This is the option that most of us will select. The repair program will need either an ASR disk or the files stored in the %SystemRoot%\Repair directory. Inspect startup environment. The startup environment is the Boot Manager, which is called by the program contained in the boot sector. There are also other supporting files including boot.ini, ntdetect.com, and others that must be validated. The repair program repairs or replaces these files as best as it can, but be prepared for some items to be restored to the state they were in when you installed Windows XP. Verify Windows XP system files. Verifying the system files is a process where the repair program will go through the root directory and all the system directories (such as the Windows and System directories) and verify that each and every file is valid. This process is used when a hard disk error (especially on an NTFS volume) has made one or more system files invalid. Careful! You will lose all service packs installed to this repair process. Reinstall your service packs immediately after choosing this option.

Inspect boot sector. There are several reasons to inspect (and repair) the boot sector. For example, if you inadvertently install another operating system with boot sector virus infections, this could damage the boot sector, especially with the FAT file system. All four of these selections are selected by default. You can use the selector bar (use the arrow keys) to highlight and deselect any option that is not desired; use the Enter key to select or clear an option. Once you have elected to continue, Setup does a device check. This is the same check that is done prior to an installation of Windows XP. The next stage is to determine where the registry repair information will be coming from. Remember, you can use either the ASR disk or the copy stored in the Repair directory. If you have multiple installations of Windows XP, be sure to choose the correct Repair directory to repair from. Tip The ASR disk tells Setup which copy of Windows XP you are attempting to repair. You cannot use the ASR disk from one installation of Windows XP to repair another installation of Windows XP. It just won't work. If you don't have an ASR disk (or you don't want to use it), then Setup searches your drive for Windows XP. You may have multiple installations of Windows XP; this is common, considering how many times I've recommended installing at least two copies. If this is the case, Setup lists each installation of the operating system that it finds. Select the version of Windows XP you want to repair and press Enter to repair the selected installation. Warning Careful! Make sure you repair the right Windows XP installation if you have more than one copy of the operating system installed. Nothing is worse than successfully repairing a copy of Windows XP that wasn't broken in the first place; that'll break it for sure. Next, Setup does a drive check. The message indicates that drives are being checked, and the status indicator at the bottom of the screen shows the progress. Actually, Setup only checks the boot (C:) drive, but that's probably all that is needed right now. The next prompt, which is displayed when you have elected to have the registry repaired, is to determine which key or keys are to be repaired:

• System

• Software

• Default

• ntuser.dat

• Security

• SAM

Replacing some hives and not others might result in some problems if items in the registry have been updated since the registry was last saved. Typically, it is best to replace all files if possible to avoid any problems with different versions.

Once the registry has been updated, the Setup program prompts you to remove any diskettes from the drives and reboot the computer. If all went well, the computer will reboot and run.

Loading a .reg file

Any .reg file created by RegEdit (discussed earlier) is usually loaded by simply doubleclicking the .reg file in Windows Explorer or on the Desktop. You can also go into RegEdit to load the .reg file. From the RegEdit main menu, select Registry → Import Registry File. Actually, when you double-click a .reg file, Windows XP starts RegEdit to do the registry file load. The main advantage of loading a registry file from the RegEdit menu is that you're able to see the effect of the registry load in RegEdit. A .reg file, being a text file, may be carefully edited. Did I emphasize carefully enough? Realize you are making a registry change if you modify the .reg file and then reload it. And make certain that the editor you use understands Unicode. Notepad works fine, just remember not to use Notepad's default .txt file extension when saving the file. Realize that you will not be able to use this technique if you are unable to boot or run Windows. This is another good reason to have multiple backups of the registry in different formats. Note When restoring the registry, several errors may be displayed. Some errors will state "System Process - Licensing Violation" and advise the user that the system has detected tampering with the product registration component of the registry. Click OK when these messages appear and also when another error stating that it was not possible to write to the registry shows up. This final error is actually an artifact of the licensing violation errors and does not indicate a failure of the entire process.

Using the Restored Registry

To make the restored registry active, you must restart Windows XP. (Windows XP caches most of the registry while it is running.) There is no prompt to restart. However, some changes to the registry will not be reloaded until the system is restarted. Select Shut Down from the Start menu and then select Restart the Computer in the Shutdown dialog box. Note It is not uncommon for applications to update the registry using a .reg file during program installation time. This is one method used by software developers. Why? One simple reason is that this allows the registry to be repaired, restoring the application's default values without having to reinstall the entire program.