The Recovery Console

The Windows XP Recovery Console is a tool that allows recovery from a number of failures. Previously, all you could do was boot another copy of Windows XP and hack your way around, replacing files, even registry components, in the blind hope that you would somehow fix the problem. With Windows XP, you have two tools to use: the Recovery Console and the Safe Mode feature. The Recovery Console is a powerful, simple (no, that's not an oxymoron!) feature that is supplied with Windows XP, but it is not installed by default. The Windows XP Safe Mode works in the same manner as the Safe Mode found in other versions of Windows. You can modify a number of system settings using Safe Mode (such as video modes). Installing the Recovery Console after the system has failed is quite like locking the barn door after the horse has been stolen it really won't work that well.

Installing the Recovery Console

The Recovery Console must be installed before disaster strikes. It will be difficult (maybe even impossible) to install it after a disaster has reared its ugly head. So, let's install the Recovery Console right now. First, you must use the Windows XP distribution CD (or share containing the appropriate files, if installing from a network device). The Recovery Console is installed using the winnt32.exe program. The winnt32.exe program is the same program that is used to install Windows XP; however, by selecting the correct option, you are able to tell winnt32.exe to not install Windows XP, but to install the Recovery Console instead. Note It is not possible to install the Recovery Console at the same time as Windows XP. You must first install Windows XP, then install the Recovery Console. If you have multiple copies of Windows XP installed, it is only necessary to install the Recovery Console one time the Recovery Console will work with as many copies of Windows XP as are installed. Follow these steps to install the Recovery Console from the Windows XP distribution CD: 1. Insert the distribution CD and change into the i386 directory. 2. Run winnt32.exe using the /cmdcons option. Typically, no other options are needed, though some users may wish to specify source options, especially if installing from a network share rather than a hard drive. 3. The installation program contacts Microsoft to check for updates to this Windows XP component.

4. The winnt32.exe program opens the dialog box. This dialog box allows you to cancel the installation if you need to. Note that multiple installations of the Recovery Console will simply overwrite previous installations; in such cases, no error is generated. 5. If there are no errors, the dialog box is displayed. The Recovery Console is ready for use at this point.

What's in the Recovery Console?

The Recovery Console consists of a minor modification to the boot.ini file, and the addition of a hidden directory on the boot drive. The added directory's name is cmdcons. The change to the boot.ini file is simply the addition of another line providing for a new boot option: C:\cmdcons\bootsect.dat="Microsoft Windows Recovery Console" /cmdcons This option consists of a fully qualified file name (C:\cmdcons\bootsect.dat), a text description (Microsoft Windows Recovery Console), and a boot option (/cmdcons). As everyone should be well aware, the Windows XP Boot Manager is able to boot virtually any operating system (assuming that the operating system is compatible with the currently installed file system).

How Windows XP Supports Booting other Operating Systems

Windows XP can be told to "boot" any directory or file location. For example, the Recovery Console is saved in the cmdcons directory. In the cmdcons directory is a 512-byte file named bootsect.dat. Windows XP will treat a file named bootsect.dat exactly as if it were a hard disk's boot sector. In fact, one could, theoretically, copy the bootsect.dat file to a drive's boot sector location and cause that operating system to be booted directly.

One use for this technology is in a multiple-boot configuration where the other operating system or systems are not compatible with Windows NT (such as Windows 95/98/Me). The Recovery Console does qualify as an operating system, though it is very simple and limited. A major question will always be this: is the Recovery Console secure? In most situations, the Recovery Console is actually quite secure. The user, at startup of the Recovery Console, is prompted for two pieces of information:

• Which Windows XP installation is to be repaired (assuming that there is more than one Windows XP installation!).

• The Administrator's password for that installation. The Recovery Console then uses the installation's SAM to validate this password to ensure the user has the necessary permission to use the system. A situation comes to mind: if the Administrator's password is lost or otherwise compromised, not only may it be impossible to use the Recovery Console, but anyone with access to the compromised password could modify the system with the Recovery Console. This is not really an issue, though. If the Administrator's password is lost, that's life. It will be difficult, if not impossible, to recover the password. If the security of the Administrator's password is compromised, then it will be necessary to repair the damage changing the password is mandatory in this case. In either case, the Recovery Console is no less secure than Windows XP is. The cmdcons directory holds over 100 files. Most of these files are compressed and are uncompressed by the Recovery Console when needed. Here's a list of the uncompressed files found in this directory:

   C:\cmdcons\autochk.exe
   C:\cmdcons\autofmt.exe
   C:\cmdcons\biosinfo.inf
   C:\cmdcons\bootsect.dat
   C:\cmdcons\disk101
   C:\cmdcons\disk102
   C:\cmdcons\disk103
   C:\cmdcons\disk104
   C:\cmdcons\drvmain.sdb
   C:\cmdcons\KBDAL.dll
   C:\cmdcons\KBDBE.dll
   C:\cmdcons\KBDBLR.dll
   C:\cmdcons\KBDBR.dll
   C:\cmdcons\KBDBU.dll
   C:\cmdcons\KBDCA.dll
   C:\cmdcons\KBDCR.dll
   C:\cmdcons\KBDCZ.dll
   C:\cmdcons\KBDCZ1.dll
   C:\cmdcons\KBDDA.dll
   C:\cmdcons\KBDDV.dll
   C:\cmdcons\KBDES.dll
   C:\cmdcons\KBDEST.dll
   C:\cmdcons\KBDFC.dll   C:\cmdcons\KBDFI.dll   C:\cmdcons\KBDFR.dll   C:\cmdcons\KBDGKL.dll   C:\cmdcons\KBDGR.dll   C:\cmdcons\KBDGR1.dll   C:\cmdcons\KBDHE.dll   C:\cmdcons\KBDHE220.dll   C:\cmdcons\KBDHE319.dll   C:\cmdcons\KBDHELA2.dll   C:\cmdcons\KBDHELA3.dll   C:\cmdcons\KBDHU.dll   C:\cmdcons\KBDHU1.dll   C:\cmdcons\KBDIC.dll   C:\cmdcons\KBDIR.dll   C:\cmdcons\KBDIT.dll   C:\cmdcons\KBDIT142.dll   C:\cmdcons\KBDLA.dll   C:\cmdcons\KBDLT.dll   C:\cmdcons\KBDLV.dll   C:\cmdcons\KBDLV1.dll   C:\cmdcons\KBDNE.dll   C:\cmdcons\KBDNO.dll   C:\cmdcons\KBDPL.dll   C:\cmdcons\KBDPL1.dll   C:\cmdcons\KBDPO.dll   C:\cmdcons\KBDRO.dll   C:\cmdcons\KBDRU.dll   C:\cmdcons\KBDRU1.dll   C:\cmdcons\KBDSF.dll   C:\cmdcons\KBDSG.dll   C:\cmdcons\KBDSL.dll   C:\cmdcons\KBDSL1.dll   C:\cmdcons\KBDSP.dll   C:\cmdcons\KBDSW.dll   C:\cmdcons\KBDTUF.dll   C:\cmdcons\KBDTUQ.dll   C:\cmdcons\KBDUK.dll   C:\cmdcons\KBDUR.dll   C:\cmdcons\kbdus.dll   C:\cmdcons\KBDUSL.dll   C:\cmdcons\KBDUSR.dll   C:\cmdcons\KBDUSX.dll   C:\cmdcons\KBDYCC.dll   C:\cmdcons\KBDYCL.dll   C:\cmdcons\ksecdd.sys   C:\cmdcons\migrate.inf   C:\cmdcons\ntdetect.com   C:\cmdcons\ntfs.sys   C:\cmdcons\setupldr.bin   C:\cmdcons\setupreg.hiv   C:\cmdcons\spcmdcon.sys   C:\cmdcons\System32   C:\cmdcons\txtsetup.sif   C:\cmdcons\winnt.sif   C:\cmdcons\System32\ntdll.dll   C:\cmdcons\System32\smss.exe

The files disk101, disk102, disk103, and disk104 are disk image identifier files, and they contain nothing but a single space and a carriage return/line feed. The bootsect.dat file is the bootable boot sector image file. The migrate.inf file contains information used to update the registry if needed. The setupreg.hiv file is used to update the registry; however, this file is in a special format usable only with certain applications. The cmdcons directory also contains the subdirectory System32. This subdirectory contains two files, ntdll.dll and smss.exe (the Windows XP session manager).

Using the Recovery Console

Once the Recovery Console is installed, it appears in the Start menu as the last item in the list, named "Microsoft Windows Recovery Console." Warning It is strongly recommend that the Recovery Console not be invoked unless absolutely necessary! The commands available in the Recovery Console are powerful, and if used improperly, they can destroy a Windows XP installation. To use the Recovery Console, follow these steps: 1. Boot the system. 2. When the startup screen displays, select Microsoft Windows Recovery Console. 3. Select the installation to be repaired if there are multiple Windows XP installations. (The first installation is number 1. Enter 1.) 4. Enter the correct Administrator password for the installation to be repaired. (This password is a local or SAM password and not an Active Directory password.) 5. Use any Recovery Console commands (see the later section "Recovery Console Commands and Options") needed to do the repair. When you're done repairing the installation, simply enter the exit command to restart the computer.

Starting the Recovery Console from the Installation CD-ROM

Follow these steps to start the Recovery Console for computers that either do not have the Recovery Console installed or cannot be booted (perhaps due to errors in the partition table, or MBR): 1. Boot the system, using the CD-ROM (or diskettes) as appropriate. 2. When the initial setup text screen is displayed, select Repair by pressing the R key. 3. At the prompt, select Recovery Console by pressing C. 4. Select the installation to be repaired if there are multiple Windows XP installations. 5. Enter the correct Administrator password for the installation to be repaired. 6. Use any Recovery Console commands (see the next section) needed to do the repair. When you're done repairing the installation, enter the exit command to restart the computer. Recovery Console Commands and Options New! When the computer is started in the Recovery Console mode, a prompt similar to a command prompt is the only interface available to the user. The Recovery Console's functionality is limited, and there is only support for the commands listed in Table 2.1 (Bootcfg and Net Use are new to Windows XP): The Recovery Console may be installed permanently so that whenever the system is booted, there is an option to select the Recovery Console. This works well for installations that will still boot to the Start menu (where one selects the installation or operating system to be booted). The Recovery Console is placed into the cmdcons directory, located on the boot drive.

Note The cmdcons directory is always located on the boot drive, not on the system drive, unless the boot drive is also the system drive.

Other Backup and Restore Programs

There are other registry backup and restoration programs. One excellent source for them is the Windows XP Resource Kit's REG program, which has backup and restore functionality. Take a look at tutorial 4 for a listing of the registry tools found in the Windows XP Resource Kit.