HowTo: Fix Corrupted Windows Registry from Ubuntu partition

[bsmith1051]

BY FAR the most common problem on Windows machines is a bad sector developing in one of the registry files. If you don't have a usable backup of same then you're hosed no matter what else you do.

So I would suggest a slight variation on the procedure:

1. mount the drive from Ubuntu (see details above)

2. try to copy all the registry files from "\windows\system\config" to someplace/anyplace else. If one of them fails to copy then you know which file needs to be replaced; if none of them fail then maybe the ntfsfix is all you need.

3. *IF* the Windows machine had System Restore enabled then you'll be able to find a backup of the registry files in one of the "\windows\System Volume Information" sub-folders. Otherwise, you can also try the folder, "\windows\system32\repair", which always has a backup (though by default it's only the initial most-basic version; I run NTBACKUP on every Windows machine I touch so as to update this 'repair' backup)

4. try to rename the damaged file, i.e., leave it in-place but unused.

5. copy the backup of the damaged file to the "\windows\system32\config" folder

6. run 'ntfsfix' (to trigger the built-in Windows Check Disk on next boot)

7. reboot the machine
8. cross fingers

[zah_zaf]

Here is my short story:

When I boot into Ubuntu Live mode through a USB boot and run sudo fdisk -l all I see is the usb device /dev/sdb with the /dev/sdb1 and I dont see /dev/sda ... Also, while its booting into live mode I see some error msgs regarding /dev/sda - disk error.

Is my internal drive hosed ?

Long story:

1. When I boot up directly into Windows (my laptop is a X61 tablet - no CD drive) I can see the Windows logo appear and then the progress bar ... and then before I get the logon option I get the error msg saying sytem32/config/SYSTEM is corrupted, insert Win Xp CD and run repair.

2. Since I dont have a CD drive on my laptop I create a USB bootable ubuntu 9.04 using uSbuntu Live Creator (ofcourse I have another machine to do this) to fix the file corruption problem

3. USB bootable created and I am getting ready to replace all the corrupted files and then I run into missing /dev/sda problem.

I dont think it is an NTFS mounting problem, becuase I tried this on another laptop with Windows running fine and an NTFS partition and this cleanly showed up as an "Internal Drive" in Nautilus

The only silver lining is that, atleast when I try booting directly into Windows it doesnt blow up in my face saying Internal Disk Failure and proceeds until a certain point. What baffles me is that there are /dev/sda error msgs and the /dev/sda doesnt show up during the USB boot. Unable to proceed after this. Anbody with a rescue plan?

Thanks,

zah_zaf

[Cato2]

Drumplayr - Good to hear that it still works well. It would be great if someone turned this into more of a point and click application, though.

Has anybody tried this on Windows 7 registry, by the way? I've been too busy to do much with my beta of Win7.

[Cato2]

Hi bsmith1051, Good point about file/disk corruption, although this isn't always the case so your steps are an add-on if you suspect corruption.

In step 2, I'd suggest you copy the registry files with gddrescue (GNU ddrescue - in the Ubuntu repositories, but avoid the non-GNU version which is not as good). This is great at recovering as much as possible of a corrupted file (or disk), and also isolates which if any parts of the file/disk cannot be read. Unlike a normal cp or dd command, it will not give up on the first error.

Registry files recovered by gddrescue should not be used for normal operations but they might be useful in recovering specific reg keys. Generally it will be quicker and easier to go back to an earlier registry version using System Restore, though.

[Cato2]

Hi zah_zaf,

You need to go into the log files on your Ubuntu live CD. In terminal, type "less /var/log/messages" and read through from the time of boot, looking for any errors to do with /dev/sda, IDE, ATA, SATA, etc. It certainly looks as if your disk has problems.

Try GNU ddrescue as mentioned on my previous posts - "apt-get install gddrescue" should install it for you - as it will give possibly better error messages. If you can connect a big enough USB external drive, you should

1. Copy your entire disk (/dev/sda or whatever) onto the external drive - you can copy it into one huge file if the external drive is big enough.

2. Recover this disk on another system (or use this system if necessary, with a live CD). Google for Linux disk recovery, SystemRescueCD, and hard disk recovery - there are a lot of resources out there.

Good luck.

[bcboybuzz]

First up, thank you OP and all contributors, you really saved my bacon there! I was all smiles and 'I am a Genius! I can fix a Windows crash in Ubuntu!' when I was finished...

Couple small tidbits I'd like to add.

First, I'm running Vista Premium 64 [and Ubuntu 9.04 64] on a homebuilt gamer's wet dream. I'm not trying to brag, and since they don't matter, forget the specs. The point is, some files are not in the same place.

As I read point #3 in bsmith1051's post, I came to realize that getting rid of my shadow copies and restore points to free up space wasn't such a great idea after all... To make matters worse, "\windows\system32\repair" didn't exist. After a few moments of cold-sweats, and then some poking around, I found them tucked away in '/Windows/System32/config/RegBack' Dunno if its a Vista thing or a x64 thing, but that's where they were on mine.

Point two: ddrescue needs some batch process ability. I suppose I could write a script for that, but I haven't got that far into the Linux-for-ex-Windows-users book... I suppose it's no more complicated than the old .BAT files from the good ol' DOS days...

In the end, since I had tried to copy the /config folder out as a first step [failed, file SYSTEM was about 4 megs smaller than the original, not to mention some missing .LOG files, which I assume were after SYSTEM in the copy queue], I just renamed the corrupt file and copied in the backup, ran ntfsfix [ps you gotta umount before you can ntfsfix: sudo umount /dev/sda1 && sudo ntfsfix /dev/sda1 is the command if it's still mounted from ntfs-3g; can't use Gnome to do it], restarted and started celebrating.

Thanks again. A gamer's computer is just not the same with Linux. Though I actually spend more time in my Linux environment than I do the Windows one now. Too bad COD and Fallout 3 and GRID and all the rest weren't Linux-compatible...No money in a free OS, I guess...

[macbraughton]

I just purchased a 1005HA Eee PC with XP pre-installed. I tried a copy of Ubuntu Netbook Remix first and then put in Linux Mint which is what is currently installed in a dual-boot set-up.

I've been waiting to buy a netbook for a long time, hoping that the ARM platform ones coming with Linux pre-installed would finally get here but it seems to be drawing on longer and longer.

Anyway, the only reason I got this one is because I have a single program that I can't live without that only runs in Windows and I figured that if I was going to have to pay MS $100 just to run a virtual version, I might as well spend $400 and get a whole computer (think also, of course, I can dual-boot with my favorite Linux distro).

My wife booted XP Home Edition up earlier today and it gave the:

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

error.

I found this page by typing "fix windows registry from linux" in google, and this was the first hit.

I was able to mount the Windows partition following the instructions in this post without having to install anything.

I was able to move and rename the files as well.

The only problem I had was executing the command for the consistency check because of some permissions issue (which the computer ran automatically after the second reboot anyway).

This is one of the simplest and most useful fixes I have ever found, and I am extremely grateful to kerrnoPanic for posting it.

In my initial research the other ways of fixing this problem inevitably involved using Windows software on a computer with Windows installed on it already (which I am unable to do because I own no other computers with Windows), and I find it ironic that it appears to be much easier to fix these sorts of problems in Windows using Linux than it does within Windows itself.

Again, thanks, and I just want to point out that I was also able to mount the Windows partition of the HDD from the live version of Linux Mint on a USB stick. I hadn't found this post yet so I didn't know that all I had to do was move a few files. That being said, I think it would be entirely feasible for somebody to fix a Windows computer with a live version of Linux regardless of whether or not Linux was already on it or not. Pretty cool!

[chris.flesher]

Thank you so much! This saved my *** today big time.

[tturrisi]

Bear in mind that this solution only works IF System Restore is enabled in Windows, else the restore points do not exist here:
System Volume Information/_restore{xxx}/RPxxx/snapeshot/
nor do they exist anywhere else.

[kevinguillorytraining]

THANK YOU for nice tutorial.