Hack111.Repair and Recover with the Recovery Console

Hack 111. Repair and Recover with the Recovery Console

If Windows won't start, use the DOS-like Recovery Console to make repairs.

The Recovery Console is one of the last-ditch tools you can use if your Windows installation doesn't start up at all. Before you resort to the Recovery Console, if Windows starts up make sure you've already tried System Restore (especially if you've recently changed your hardware).

To run System Restore, choose Control Panel Performance and Maintenance System Restore.

If it won't start, try running the Windows XP Setup Wizard from the installation CD and choosing its Repair option, or try starting Windows in Safe Mode.

If none of these easier paths works, you're stuck using the DOS-like Recovery Console to figure out what's wrong with Windows, your system or boot partition, or your disk's master boot record (MBR). You can use its DOS-like commands to look at the files and folders that make up Windows, and possibly to repair them. You can also repair the master boot record and boot sector.

You can configure the Recovery Console not to require the administrator password on login. In the Registry Editor [Hack #83], set the value of the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel key to 1.

12.5.1. Starting the Recovery Console

To start the Recovery Console, boot your computer from the Windows XP installation CD and follow the prompts. When it asks which Windows installation you want, type the number of the installation (1, if Windows XP is the only operating system installed) and press Enter. Type the password for the Administrator account. When the Recovery Console is running, you see the prompt D:\WINDOWS>, which tells you the name of the current folder (directory).

If you plan to use the Recovery Console often, add it to your boot menu (the menu that appears if you have a multiboot system). You must be logged in as an administrator. Choose Start Run and type the command d:\i386\winnt32.exe /cmdcons (replace d: with your CD drive's letter if it's not D). The Recovery Console occupies about 7MB of disk space and stores its program files in \Comdcons on your system drive.

Now you can type commands and press Enter, just like in the good old days of DOS! However, not all DOS commands work (see the "Hacking the Hack" section at the end of this hack), and you can't examine files in all folders. You are restricted to the Windows program folder (C:\Windows on most systems), its subfolders, the root folder of the Windows partition (C:\ on most systems), removable drives (including disk, zip, and CD drivesbut these are read-only), and the \Cmdcons folder (which contains the Recovery Console program itself, if you have added it to your boot menu).

If you know DOS, the Recovery Console's commands look familiar, though only a few are available and some work differently. To see a list of all the available commands, type help and press Enter. To find out how a specific command works, type the command, followed by a space and /? (for example, expand /?). When you are done using the Recovery Console, type exit and press Enter to reboot your computer.

12.5.2. Looking Around

Use these commands to examine your system:

cd folder

Changes the current folder to the folder you name. In the folder name, two dots (..) represent the parent folder of the current folder. To move to a different drive, type its drive letter and a colon and press Enter.

dir folder or dir filename

Lists the contents of the folder, including files and subfolders. For the filename, you can use * as a wildcard character (for example, dir *.dll). You see the last modification date and time, attributes, size (in bytes), and filename. The attributes are represented by letters: d (directory or folder), h (hidden), s (system), e (encrypted), r (read-only), a (changed since last backup), and c (compressed).

map

Lists the drive letters with their file format (FAT32 or NTFS), size, and pathname.

type filename

Displays the contents of the file as text. For executable, graphic, and other nontext files, you see garbage.

If a filename or pathname includes spaces, enclose it in double quotes.

12.5.3. Fixing the MBR, Boot Sector, or Boot Menu

If your system can't find a partition from which to boot, try fixing the MBR. Type fixmbr to rewrite the MBR on the boot partition (the drive or partition from which the computer starts up).

If the system finds the boot partition but the Windows boot sector is fouled up on the Windows partition (the drive or partition where Windows is installed), rewrite the Windows boot sector by typing fixboot. To specify which drive is the Windows partition, you can add the drive letter (e.g., fixboot c:).

Windows XP includes a boot menu that allows you to choose which operating system to start up. (It doesn't appear if your system has only one operating system.) To fix the boot menu, use the bootscan command. Type bootcfg /scan to look at all your partitions and drives and scan for Windows installations. Type bootcfg /list to list the entries in boot.ini (the file that contains your boot menu entries).

12.5.4. Fixing Windows

If something is wrong with your Windows installation, use these commands to modify or replace the problematic files:

attrib filename flag

Changes the attribute of a file (filename). The flag is + (adds, or turns on) or - (removes, or turns off), followed by r (read-only), s (system), or h (hidden).

chkdsk drive

Checks and repairs files and folders on drive. Add the /p switch to check the drive even if no problems are marked.

copy sourcepath1 sourcepath2

Copies the file from sourcepath1 and names the new file sourcepath2. The asterisk wildcard (*) doesn't work, so you can copy only one file at a time.

diskpart

Lets you add or delete partitions, though you can't resize or move them. (For that, you need a program like PartitionMagic; go to http://www.partitionmagic.com.)

expand pathname

Decompresses files from a .cab file and puts the result in the current folder. If the .cab file contains more than one file, add /f:* to extract all the files. Or add /f:* /d to list all the files in the .cab, and then use the expand pathname /f:filename command to extract just the one you want.

12.5.5. Hacking the Hack

By default, the Recovery Console doesn't allow you to use wildcards, copy files from local drives to removable media, or use the cd command to list files in subfolders in all folders on all local disks. It also issues a warning message every time you copy files that overwrite existing files.

However, if you have XP Professional Edition, you can change that behavior using the Group Policy Editor. At a command prompt, type gpedit.msc to run the Group Policy Editor. Go to Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. In the list of policies on the right, double-click "Recover console: Allow floppy copy and access to all drives and all folders." Select the Enabled option and click OK.

Doing this won't actually make the changes; at this point, you'll have to use the Recovery Console itself to do that. Open the Recovery Console and use the following commands to customize its behavior:

set allowwildcards = true

This command lets you use the * and ? wildcards with the Recovery Console commands.

set allowallpaths = true

This command lets you use the cd command to list all files and subfolders on all folders on all local disks.

set allowremovablemedia = true

This command lets you copy files from local drives to removable media.

set nocopyprompt = true

This command lets you copy files that overwrite existing files without getting a warning prompt.

Margaret Levine Young