a Flo + a Blog = a Flog my ブログ

Hive corruption Fix Access Restore Point using Recovery Console

A colleague came to me today with an interesting issue.

Windows XP would not start as some system hive was corrupt.

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

Stop: c0000218 {Registry File Failure} The registry cannot load the hive (file): \SystemRoot\System32\Config\SYSTEM or its log or alternate

CAUSE
This issue can occur if the System or Software hive for the Windows XP installation is missing or damaged.

Microsoft does describe the issue very well and it appears quite simple to fix. You want to check this KB for more info.

The fixing process is fairly easy and requires to use the recovery console to make a copy of the current corrupted system files (or not if they are totally missing) and replace them with a backup that windows does.

We are talking about files on c:\windows\system32\config to be replaced by copies.

Everything would have been easy and neat if everything was there as said. Yes, windows is to backup those up into the repair folder. But sometimes it happens.

I was interested in that SYSTEM file, but it was not there. The remaining option would have been to reinstall windows XP offer and have quick and dirty fix.

There had to be another way. Digging into my memory I though about other ways that Windows would have made another copy of those files.  Restore Point snapshot was the answer!

Actually restore point are easily accessibly to the recovery console.

Booting from the XP CD. I started Windows Setup and press R to access the recovery console.
Just using the following command, you can get into the restore point files.

cd c:\
cd  "system volume information\_resto~1"
dir

You'll see a list of restore point folders with names such as RP1, RP2 and so on. Pick the restore point you wish to use, using the folder date stamps to guide you. Enter the commands:

cd RPx (the restore point you chose)
cd snapshot

This takes you into the folder containing the restore point snapshot files. Then I could just copy what I needed to the target.

copy _Registry_machine_system C:\Windows\System32\Config\System

Sometimes, it is not because you don't see or if it is not where it is supposed to be that it is not there!