HowTo: Fix Corrupted Windows Registry from Ubuntu partition

[kerrnoPanic]

I run a dual boot on my work laptop because there are some work related apps that do not run so well
on my ubuntu partition. Anyhow I ran into the dreaded

Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM

error message. I tried to follow the solution that Microsoft has available on their tech support site, but
was not able to get to the recovery console, not even through the boot cd!!

The steps below are how I fixed the problem!

• Install NTFS-3G
  
  This package allows you to perform I/O on an NTFS filesystem.
• Install NTFSProgs
  
  This package contains some useful admin tools to use on NTFS filesystems
• Mount NTFS filesystem
  
  You will need to mount your Windows partition to backup your corrupted registry files. To do this run the following commands
  

  sudo mkdir /media/windows
  sudo ntfs-3g -o rw /dev/<device-name> /media/windows
  

  if you get a message regarding Windows not being shutdown properly, then run the following command to force the mount

  sudo ntfs-3g -o force,rw /dev/<device-name> /media/windows
  
  Both of the above commands will mount the device as read-write.
  
• Replace these files
  
  You might want to back up the files in /media/windows/WINDOWS/system32/config/ before replacing them just in case this is not a registry problem
  Now copy the following files from the file /media/windows/System Volume Information/_restore{xxx}/RPxxx/snapeshot/ dir:
  

  
  _REGISTRY_USER_.DEFAULT
  _REGISTRY_MACHINE_SECURITY
  _REGISTRY_MACHINE_SOFTWARE
  _REGISTRY_MACHINE_SYSTEM
  _REGISTRY_MACHINE_SAM

  to the /media/windows/WINDOWS/system32/config/ dir and name them as follows:
  

  
  _REGISTRY_USER_.DEFAULT => default
  _REGISTRY_MACHINE_SECURITY => security
  _REGISTRY_MACHINE_SOFTWARE => software
  _REGISTRY_MACHINE_SYSTEM => system
  _REGISTRY_MACHINE_SAM => sam
• Schedule a consistency check
  
  Run this command to schedule a NTFS consistency check for the first boot into Windows
  

  sudo ntfsfix /dev/<device-name>
• Reboot into Windows twice
  
  The first reboot you should get a blue screen telling you that you should run a filesystem consistency check. Let the check run and then the second reboot should bring you back into a bootable Windows

Hope this helps!!

[shs123]

THANK YOU!

This worked GREAT to get my other partition back!! I was not sure which device had my Windows partition on it, but (after some trial and error) I discovered that it was SDA1. It is nice having that NTFS disk right there on my Ubuntu desk top! I had not used this utility before. I received some kind of "unable to *something*" when I attempted to run the consistency check. I think that my whole issue was a real live corrupt \WINDOWS\SYSTEM32\CONFIG\SYSTEM file since I received an I/O error when attempting to back it up.

I am not sure how to tip your "Thank You" counter on your profile, but please note.. THANK YOU kerrnoPanic!!!

Best Regards,
Sam

[Cato2]

This looks really useful - there seem to be some typos in a few commands that are missing the 'mount' part:

sudo mount ntfs-3g -o rw /dev/<device-name> /media/windows
sudo mount ntfs-3g -o force,rw /dev/<device-name> /media/windows

Also the pathname including 'snapeshot' should be checked as this is a typo.

Now copy the following files from the file /media/windows/System Volume Information/_restore{xxx}/RPxxx/snapeshot/ dir:

[Glaxed]

#!/usr/bin/env python
# Try to fix Windows from a Live CD.
import os
os.system("sudo apt-get install ntfs-3g ntfsprogs")
os.system("sudo mkdir /media/windows")
df = os.popen("df -type=ntfs | grep /dev/")
# Rename dev to something safer if you wish (e.g. "/dev/hda1" or "/dev/sda1")
dev = df[1:8]
os.system("sudo ntfs-3g -o rw, force %s /media/windows" % dev)
os.system("cp -r /media/windows/WINDOWS/system32/config/ ~/Desktop")
# I am fuzzy on what /_restore{xxx}/RPxxx/snapeshot/ means.
# If anyone wants to finish or GUI this, you can still use cp to rename files.
# Good luck to all you windows/linux friends out there. :)
os.system("sudo ntfsfix %s" % dev)
print """Hopefully, your Windows disk was mounted and restored.
Will now reboot.
"""
raw_input("Hit any key to continue, or close the terminal to not continue. . . ")
os.system("sudo reboot")

Would it even work?

[Cato2]

Interesting script, and it could be very useful if enhanced and completed.

However, I recommend it is not actually used yet - it doesn't do any error checking and it's missing the part where you restore the registry from a snapshot (this is the Windows 'System Restore' feature, only implemented under Linux through copying registry files).

Also it assumes first drive in output from 'df' is the NTFS boot drive (the one with \WINDOWS directory, not one with the MBR boot sector and NTLDR.EXE - Microsoft terminology...) - so it would fail on the Windows PC I'm using where \WINDOWS is on drive D.

It's a lot better, for now, to simply copy and paste the commands into a terminal window.

[Glaxed]

Yeah, it's kinda pointless.
Sorry for bumping, I guess, but this is a great howto.

[Stefanie]

thanks to this howto i fixed my friend's computer yesterday. windows xp didn't boot anymore and the windows xp cd refused to repair his installation, so I used an Ubuntu live cd to restore the files in system32/config . His ntfs partition was detected automatically so i could skip the first three steps. worked like a charm.
great howto!

[tuffguy45]

Thanks for the howto, my dad killed our windows computer this morning with a registry "cleaner" program. It wouldn't even boot. Just curious, can you access these files in windows normall? I'm wondering if you could just copy the files from the snapshot dir into the other directory, rename them, and then delete the other files from the command prompt? Having the gui version was a LOT easier but like I said I'm just curious.

[Cato2]

I think you can copy the relevant snapshot files around from within Windows, but the problem is that the registry is locked when in use (file locking) in Windows. So it's best to use a Live CD - if you prefer a GUI, just use the Ubuntu Live CD and use the Nautilus explorer tool to copy files around.

As always, you REALLY need to back up registry files onto a USB stick or similar before you start deleting or overwriting them...

[Drumplayr]

Still works great. I used Ubuntu 8.1 live CD and didn't have to install anything. I just had to mount the Windows partition manually.
Also, before running ntfsfix, I had to unmount the Windows partition.

Thanks,

Drumplayr