how i saved my windows xp installation with knoppix

so its true. the difference between a 'digital native' and a 'digital immigrant' is the amount of information that they contribute to the world. I absolutely hate having to wade through google searches to find an answer to my problems, so I try to post here about some of my tech adventures (even though it might be nerdy) hoping that one day a spider would come and crawl/index it and provide answers to people for the same questions I couldn't find answers to!

So I tried to upgrade the ATI Radeon drivers on my Windows machine for my old video card (thinking it would improve performance! hah! no.) but I could not get Direct3d to work for my ol' Radeon 9500. After the 26 or so re-boots fiddling with the hardware, the hardware connections and the hardware drivers, something finally happened to my Windows XP OS partition. It got fried.

I tried to boot up, but after the BIOS loaded I would get the error: Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM You can try to repair this file by starting the Windows Setup program from original floppies or boot from CD-ROM. Select 'r' at first screen to repair

I did searches all over the internets to fix my problem, that of a corrupt WindowsXP SYSTEM registry, which caused my XP installation to not boot. Microsoft has a whole knowledge base article about this exact issue! Well, thats fine... just load up your version of XP from a CD (or floppy) and hit 'r' to repair, just like it says. Wait, except I have a SATA drive... and there is no native SATA drivers for those on the Windows XP CD! So Windows XP install CD does not see a valid drive with Windows on it to repair!

Damn.

I love this install of Windows, this drive has been with me since pre-Service Pack 1 days. Lots of tweaks (which caused the problem?) and lots of customization has made it unlike any other windows install I've used over the years. I wasn't about to just re-image the drive after backing up the data.

So I gave Knoppix a try. For those that don't know what it is, it is a Linux Live CD (meaning you run Linux from RAM and swap space) and supposedly contains lots of windows repair utilities. Booting it up, it had no problem seeing the SATA drives, booted into the OS and everything was fine. I was using the newest version, version 5.1.

I found the backup system registry 'hive' files at /System Volume Information/_restore/[Text String] and copied them to the desktop. Renamed them to be the operational one, but the Knoppix disk would not let me write back to the hard drive!

There is a problem with NTFS. The NTFS file system is a Microsoft proprietary OS whose protocols have been reverse engineered by the open source community. There are a couple different ways to make the NTFS formatted hard disk available.

mount -t ntfs /dev/hda1 /mnt/c

Which is the approximate default command in the /etc/fstabBut this command only allows the NTFS disk to be read, since the mount command (even with the -rw option) doesn't allow NTFS partitions to be written to. Everywhere on the internets talks about this, that there could be problems with corruption if users were allowed to write directly to the file system using the mount command. So I couldn't fix the registry hive this way.

So I went into alternate mounting techniques to allow the partition to be written to. Supposedly there is a program called CaptiveNFS (captive-ntfs) that is available on older versions of Knoppix, but wasn't availiable on 5.1. So I downloaded Knoppix 3.6, only to find out that CaptiveNFS wasn't supported any longer and did not work with Windows XP SP2. Shucks, again.

The problem, of course, was information overload.

Of course, Knoppix 5.1 came with utilities to write to an NTFS partition, it is noted as being the distro that allows users to recover windows partitions! There are two utilities: ntfschdsk, ntfsmount that do what I need: check the disk for corruption (and auto-correct things if it can) and mount the NTFS partition to write.

Running ntfschdsk I received:

CHKDSK is verifying indexes (stage 2 of 3) Deleting index entry .DEFAULT in index $I30 od file 30. 73 percent completed.

So at least one entry was corrupt on the disk. Not a problem though, remount the partition with ntfsmount command. Then went into the previous registry save state and copied the following files DEFAULT, SAM, SECURITY, SOFTWARE, SYSTEM from /System Volume Information/_restore/[Text String] (where Text String is some naming auto-archiving naming convention) to the /windows/system32/config directory, overwriting the corrupted hive files.

Reboot the machine, the machine reads in the non-corrupted backup Registry Hives. Instant (instant being over the course of 3 days) success!

Hopefully, someone finds this post on the 5th page of google searches and finds what they need.

Originally written 12/10/2007 - finally posted 03/10/2008!

Comments

Anonymous said…
thanks for the above explanation....Im sure it benefited someone as it did to me....thanks again!
9/13/2008 11:41 AM
Anonymous said…
nice write up.
12/18/2008 1:37 AM
Post a Comment

Popular posts from this blog

My Yahoo! Answers Science Post

I am my dad's personal Yahoo! answers person when it comes to things science and physics. So when I received a question on the dual nature of light and matter, I wrote him back a nice long (LFP!) email in answer. I thought I'd share. Question: Sound travels in waves and needs an "ether" for transmission. Light is also a wave but doesn't need an ether. Is light in space "wave" or "particle"? because when light bends do particles bend or this this one of the examples of light as wave? Answer: Sound is a pressure wave. It is the compressing of molecules. It is the compression that is the sound. Light is a wave of electromagnetic fields, fields in this case being force representations. The light wave is a constant of nature in which a electric force changing will produce a magnetic force which will cause an electric force in a stable, repeating way traveling forward. There are other places where electricity creates magnetic forces and v...
Read more

Tailgates

Image
So, The University of Arizona basketball team is coming to Los Angeles this weekend to play USC and UCLA. Its been a tradition of our little AZ clique to go to the games for the last 5 years. However, UofA was a pretty good basketball team the majority of those years. Now with Rodgers gone, out of the top 25 rankings for the first time in 7-8 years, and Lute giving the kibosh on 3 point attempts (he should just tell Radenovich to stop shooting) things are swinging back into the LA team's favor. Which brings me to the issue of tailgates. It would be nice to actually have a truck to go to the basketball games and put the tailgate down and sit and have a few beers and kick back. Well, I used to be able to do that. Alas, as bad luck would have it (with the help of a few boys from a local chop shop ) my tailgate on my pickup truck was stolen clean. In the place where I park my truck at night. I mean, I see CLKs, H2s, m3's and all sort of $$$ MB cars next to mine. And they have...
Read more

Blog Code Formatting

Note (2012): This post was about a previous webdesign, and no longer applicable. I finally added code formatting to my blog. I used a completely 'client side' javascript library called syntaxhighlighter , hosted on Google Code . Note that I'm currently linking javascript directly from their web facing SVN repository, so I'm not sure how stable it is (but hosting it on googlepages didn't seem to work (they disallow js linking I believe)). Although it is a technology blog, I thought I posted more code about stuff. I only seem to have two posts where I actually put up any code (But maybe that's because it was horribly formatted?), and they now both have pretty Java and XML formatting: http://tmarthal.blogspot.com/2008/02/spring-framework-sample-main-method.html http://tmarthal.blogspot.com/2007/03/my-foray-into-xmlrpc-calling-perl-from.html Maybe one of these days, I'll find use for a blog again. The whole concept of blogging seems so dead.
Read more