Rebuilding Hive in Windows XP Pro.

Joemt
Joemt used Ask the Experts™
on
Hello all, so I have been attempting to follow the steps listed here:
https://support.microsoft.com/en-us/kb/307545
to help me rebuild this BSoD I've been getting about a missing System File.

When I run the command "copy c:\windows\system32\config\system c:\windows\tmp\system.bak"
I get a message saying File not Found. This is fairly normal since this file is most likely missing and therefor causing my problem.
I run all the other commands listed in that link with no issues. When I get to the bottom and run "copy c:\windows\repair\system c:\windows\system32\config\system" it tells me that the File specified cannot be found. I've double checked and triple checked for no typos. I reviewed several other sites with that set of commands to run.

Obviously, I am missing the "System" file. I thought the purpose of the last section was to copy a good version of the System file into the System32 directory. How can it be that the recovery directory does not have this System file?

Can I simply copy and paste this file from a different Xp Pro machine? Is there something I am missing here?

My shop is only open Mon-Fri so I wont be able to check this thread nor try anything till Monday morning. However, I will be checking back here and responding at that time. Thanks again.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Assuming that System Restore was on, there should be multiple older copies of the System file along with the other registry files.  In my experience you have to replace them all together.

Microsoft has a bulletin on the process:
https://support.microsoft.com/en-us/kb/307545

My preferred method is to boot BartPE (CD with bootable Windows XP) and save some steps:

Boot BartPE
Go to a command prompt
Go to the drive letter of your hard drive (probably C:)
cd \windows\system32\config
md regbu
move system regbu
move security regbu
move default regbu
move sam regbu
move software regbu

Then you use the explorer to find the System Volume Information folder on the boot drive
Look in the _Restore..... folder.  You'll see a number of snapshots.  Go into the most recent and you'll see a folder named Snapshot.  You can copy the five registry files from there to \windows\system32\config.  Then you'll rename each to get rid of the REGISTRY_.... stuff at the beginning.
I should mention that with BartPE I've often found that I can only do one thing with the explorer then it seems to hang.  For example, if you rename the _Registry_machine_system to system it will not let you rename another file.  If so, just open another explorer and do the next file.  Otherwise you can do the rename at the command line.
OK... I should have paid closer attention to your post.  You're on the same link.

The copy that isn't working is just so that you can save what you have (your old registry).  It's a good habit to be in even though you think the registry is bad or is missing a file.  You can skip any of those copies that tell you the file doesn't exist.

If you don't already use BartPE I'd highly recommend looking into it (if you will be working on more XP machines).  It makes this job a lot easier.

As far as copying from a different computer, no, you don't want to.  These files are very hardware- and user-specific.
Amazon Web Services

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

Top Expert 2014

Commented:
The registry files are only backed up to c:\windows\repair when you run a system state backup.  You can do a directory listing to see all the files that are present in a folder/directory using the "dir" command.

If you have access to another machine where you can pull the drive from the non-functioning machine and connect it to the functioning one as a secondary drive, the steps can be made a bit easier as you could operate in a GUI environment if you're not used to working at the command prompt.

You can proceed on to part 2 in the link.  But really, the important part is to grab the registry files from a snapshot in SystemVolumeInformation, and copy them (while also renaming them) into c:\windows\system32\config.  And by the way, sometimes it is also necessary to delete the .LOG files in that location.  If I recall correctly, these contain pending changes to the registry, and sometimes they will write a change that makes the machine unbootable again, forcing you to redo all the steps of copying the registry files again.
Top Expert 2013

Commented:
>>  Can I simply copy and paste this file from a different Xp Pro machine  <<  NO - you would have a backup of that system
when in doubt if the system file exist - use the command dir in the folder where it resides - to show all files in there

but if the file does not exist - you can't use this method
>>> ... this BSoD I've been getting about a missing System File ... Obviously, I am missing the "System" file. <<<

What exactly does the blue screen show?
You refer to "a missing system file".  Is it possible that this is some file other than the file named "system"?

Author

Commented:
When running the dir command I do not see the file "\config\system" in the repair directory. Again, just for clarity, shouldn't this file be found in the repair directory? It is, after all the original file the computer was asking for when it failed to boot. If you guys think I'm clear to move to step too in my listed article then I will do so.

Sorry for the delayed response, I'm not working over the weekend. I have a different service call this morning but I will be checking back in soon. Thanks again.
Top Expert 2013

Commented:
the link shows where the files are :  c:\windows\system32\config\system

is your system set to show hidden files and folders?

Author

Commented:
I can not boot in so I'm not sure if it is or not. This is from the command prompt when booting from the XP Pro Disk. The file is missing, but I want to copy it from the repair directory. It doesn't exist in the repair directory apparently so where might I find it?
Top Expert 2013
Commented:
it resides only there
if it does not show, and YOU KNOW for certain that system restore was on, use GDB for recovering it : http://www.runtime.org/

Author

Commented:
I'm not sure if system restore was enabled or not. This is a customer's machine with no service record. The customer themselves I'm afraid is unhelpful in this regard. Due to the time invested they will have to decide for themselves if it's worth trouble shooting further. Thanks again for your help.
If System Restore was on (which is generally likely) then the Microsoft link you found would have done the trick.  Did you ever look to see if those files existed in System Volume Information?  It is fairly quick to identify and to resolve.

Author

Commented:
The machine will not boot. How would I access the System Volume Information in that case?

It is only missing the one file. The last line of the command prompt in the link should copy that file into the correct directory but it tells me that this file is missing. When I took into the repair directory myself that file is not there.
The preferred method that I mentioned was to use BartPE, a copy of Windows XP that is bootable from a CD (or USB stick).  You may be able to do this from the Recovery Console, but you may have issues with permissions.

BartPE (or alternatives such as UBCD) is VERY useful for XP repairs and well worth the effort to create it.  I realize that they are getting rarer.
Top Expert 2013

Commented:
>>  The machine will not boot. How would I access the System Volume Information in that case?    << you can hook the drive to a working system, to see, or copy what you need
also you have a couple more options with darts : https://technet.microsoft.com/en-us/windows/hh826071.aspx?f=255&MSPPError=-2147217396

but as usual with MS it is not free..lol
To be clear.....   if you have done this before, it's about a 10-minute process to resolve (boot BartPE, save whatever there is of the old registry, copy last registry from System Restore/System Volume Information, rename registry files, reboot).
Just as a follow-up, and to serve as clarification for anybody else trying to list system files using the DIR command, you usually need to use the   DIR /AS   switch to show system files, and   DIR /AHS   to  show hidden system files (although just the /A switch usually also works).

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial