Windows XP / Vista / 7 restore a defective registry (corrupt system32\config\system)

Windows starts with a blue screen: (eg SYSTEM32 \ CONFIG \ SYSTEM) how to restore the registry to a previous state

Sprache ändernEnglish (United Kingdom) German (DE)



if your PC starts with one of the following Bluescreen, you maybe can recover the registry and repair your PC:

Error
- Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM
- Windows XP could not start because the following file is missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE
- STOP: c0000218 {Registry File Failure} The registry can not load the hive (file): \SystemRoot\System32\Config\SOFTWARE or its log or alternate load.
- the computer continous reboots on startup

to restore the registry
Conditions for restoring the registry:
System Restore is turned on, because with each recovery point the computer makes a backup of the registry.
First of all: if you copy this backup to the original destination the chances are good to get the computer running.

To recover the registry we need to access the harddrive in an offline state. That means that we attach the disk to another operation system. One way to do so is, to boot the pc with a boot able CD.
If you don't now how to do, we recommend to use
a BartPE CD.
Bart PE to get at: www.nu2.nu/pebuilder

(You can also recover the registry, by accessing the disk with the original Windows Setup CD and the recovery console, but this procedure is more complicated, because you have to know command line commands. Article about this: http://support.microsoft.com/kb/307545/DE/)

so let's go on with the recovery: boot the BartPE Cd and select "GO", "Programs", "A43 File Management Utility" start.
the faulty registry is located in "Windows/system32/config" (presented by the following files: "Software" "system" "sam" "default" and "security") It is recommended to copy (backup) these files to another folder.

the actual recovery:
Backups of your registry are located in :
"System Volume Information/_restore {???}/" that's the home of the various System Restore Points)

It is not relevant, which folder to chose for the recovery
(maybe the one with the latest date);
so, we go on and move to the folder where the registry is located: "? System Volume Information/_restore {???}/RP/ snapshot /"
the following files are a backup copy of the registry:
_REGISTRY_USER_.DEFAULT
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_MACHINE_SAM

copy the files to the original location: "Windows/system32/config/

rename or delete the original files: "software" "system"  "sam" "default "and" "security"

and then rename the copied files to the original filenames:
"_REGISTRY_MACHINE_SOFTWARE" To "SOFTWARE"
"_REGISTRY_MACHINE_SYSTEM" To "SYSTEM"
"_REGISTRY_USER_.DEFAULT" To "DEFAULT"
"_REGISTRY_MACHINE_SECURITY To" SECURITY "
"_REGISTRY_MACHINE_SAM" To "SAM"

then reboot the computer and in Start, Programs, Accessories, System Tools, System Restore you can "restore computer to an earlier date" to restore the last restore point (newest date)!

Details about Windows Registry for offline edit: more information about the structure of the registry