WinXP software disaster recovery

Installed and uninstalled a lot of programs the other day. I also needed to clean up some of that notorious Windows Registry. I did it by hand and also used one registry cleaner program to eliminate all erranous records (I think it was Eusing Free Registry Cleaner). That all led (zeppelin) to a disaster - I could log into Win, but it logged me right out again. So I was stuck logging in and out in the evening at work - it was my work PC. So not to mention I went home frustrated, I also thought is this the time that an it-person is supposed to go and get drunk in the nearest bar?

Of course I didn't get drunk (yet). I did what every respecable engineer would do - research. I made a "disaster recovery plan", that simply stated that I need to do a backup of useful data before I try some recovery measures.


Backup with Knoppix

Fortunately I didn't have any hardware problems. I had a disk with faulty (towers) OS. So the data was still there, I only needed to extract it.

So I downloaded the latest live DVD of Knoppix because
1) it's OS You can run in Your DVD drive without installing it and
2) it has all the neccessary drivers and software already working on the disc.

I don't remember the exact place where I got it, because I had it downloaded months before just in case for these kind of events. And I must warn You that I didn't get it the first time - the DVD image was broken. But I got it nonetheless, via Torrent I think.

So my first memo - always look up the images MD5 hash and compare it to the image's hash that You just downloaded. On Linux You would probably do something like "md5sum 'imagefile'", but on Windows You'd probably have to download some additional software.
I suggest MD5Deep (a simple commandline tool), MD5summer (a GUI) and digestIT (a GUI with integration into Windows Explorer).

MD5 checksum is usually comes in pairs with Linux distro images (e.g. http://ftp.ux0.de/pub/linux/knoppix/DVD/) so You can be sure, that corrupted download doesn't leave You with freshly burned 4,7GB of random bits.

So now let's get to Knoppix, which comes with native Windows filesystem read capability (FAT*, NTFS). So I could access my files and burn then with the K3b (excellent disc burning tool on Linux) on to a DVD - that's the backup.

I did it with two DVD drives, but I hear it can be done also with only one - You load the K3b, mount the Windows partition (click on the harddrive icons on the desktop) and then You can do:

sudo umount -l /cdrom
sudo eject /dev/cdrom

And later You can do "mount /dev/cdrom" again, if needed. This unmounts and ejects the disc and You can place the new dvd into tray, which You intend to write on.

Still, I suggest You do it with two drives (I had external USB DVD writer, but You can copy onto USB thumbsticks or external harddrives also).


Changing the Windows XP (or any other NT based Win password)

Now that the backup was complete I could start experimenting.

First I thought maybe the registry is actually intact and I just have problems logging in. So I decided to change my local user password (usually there is at least "Administrator"). And as it turn out, it's not that hard at all.

NB! You cannot change a domain user password unless You're a domain administrator.

There are couple of bootable CD-s and tools available.

1. Offline NT Password & Registry Editor - it could fit even onto a floppy disk, but I made a 3MB bootable CD. What a waste now isn't it. It has a really simple interface with a "wizardy" questions to guide You through the process so it's quite self explanatory.
2. Emergency Boot CD - includes the above mentioned software and more. If You only need to change the password, then there is no point to download this.
   

I'm sure there are more options available (like commercial ERD Commander 2005 from Winternals), but I didn't get around to those as the above mentioned worked quite satisfactory. Only problem is that it didn't provide a solution to my problem.


Windows Repair install

So the last option I had, was to perform a repair install with Windows XP install CD. I fortunately had SP2 installed on the CD, so I didn't need to do the slipstream thingy and I just installed the Windows binaries over.
Read the howto from here for example. The process is really simple, but it's quite useful and literally colourful reading. (I especially like the big warning about Sasser and Blaster and things and stuff.)


The result

As I made quite a few changes before the failed restart, I really don't have a clue what broke my system. But if You think it might have been the manual tampering with the Windows registry, then I might add, that I have done it in the past successfully about 2-3 times.

Anyways, the repair install repaired my system completely. Even all my installed programs were intact. So I'm glad that the repair option was available on the CD and actually worked; also I'm glad that I now have a complete backup of my data. Only thing I'm not satisfied is the lost time, but I guess this experience was worth it.