Before you start
Objectives: learn which options are available if we are not able to start our system at all.
Prerequisites: no prerequisites.
Key terms: restore, boot, recovery, repair, installation, files, disk, backup, computer, previous
Advanced Boot Menu
If we can’t log on to our system the first thing we should do is to try and boot using some other boot method. During the boot process we can press F8 to get to the Advanced Boot Menu. From there we can try several options. For example we can try Last Known Good Configuration which will use our last good configuration to start the computer. Good configuration is saved every time we successfully log on to our computer, so keep in mind that we can’t use this option if the change occurred previous to our last successful logon. We should use this option if the problem occurred after our last known successful log. If we were able to log on after the problem occurred, then Last Known Good Configuration option will not help us to resolve that problem.
We can also use the Safe Mode option. In Safe Mode we can update or remove drivers or we can use System Restore to restore our computer to a restore point. We have a separate article in which we describe different options in Advanced Boot Menu.
The main question of this article is what can we do if the boot process fails before we get to the point where we can press the F8 key to get to the Advanced Boot Options menu. In that case we will often need the installation disk that came with Windows to boot our computer, and then use utilities available from within the installation disk to try to repair our computer.
Boot Configuration
To assist the boot process, Windows implements a boot loader, a boot configuration and a storage system called Boot Configuration Data or BCD. BCD identifies possible operating systems and their locations on disk. To edit boot options we have a command line tool called BCDEdit.
When a computer with multiple boot entries includes at least one entry for Windows, Windows boot manager will display the boot menu, load the selected specific boot loader, and pass the boot parameters to the boot loader file. In addition, if we’re in hibernation or sleep mode, the winresume.exe file or the Windows Resume Loader is used.
The BCDEdit tool can be used to change boot options and Windows. The boot information is stored in the BCD store. BCD provides a common interface for all computers running Windows, and enables administrators to assign rights for managing boot options. BCD is available at run time, and during all phases of the setup, including resuming after hibernation. We can use the BCDEdit tool to manage BCD remotely and manage BCD when the system boots from media other than the media on which the BCD store resides. This feature is important for debugging and troubleshooting, especially when a BCD store must be restored while running a startup repair from a DVD, USB storeage, or remotely. With BCDEdit we can, for example, force the computer reboot into low resolution mode using the set VGA option. Some of the other more common tasks BCDEdit can perform include, but are not limited to, rebuilding the BCD store, adding, modifying, exporting and deleting entries in the BCD store. We must be a member of the local administrators group to use BCDEdit.
Repair Installation, Startup Repair
When using repair installation feature, we boot our computer from the Windows installation disk and instead of choosing Install Windows we choose to Repair an Existing Installation. From Windows 2000, there is some form of a repair installation available in all versions of Windows. When we start the repair the utilities included will automatically try to detect and repair any problems found within the installation. For example, we can use the repair installation to restore corrupt system files or to automatically detect any system files that have been deleted from our system. It also inspects and repairs the boot sector, verifies that Windows boot files exist and are correctly configured. With Windows Vista and 7, the Startup Repair option performs these checks and repairs automatically.
System Protection and System Restore
System Restore is available starting with Windows XP and up. We can use System Restore to restore our system to a previous time (previous restore point) when things were working properly. This way we can restore broken system files and settings. System protection feature in Windows regularly creates and saves information about system files and settings, as well as previous versions of files that we have modified. All those files are saved in restore points, which are created just before significant system events such as the installation of a program or device driver. They are also created automatically at regular intervals, which is every 24 hours by default. Settings and files that are saved in restore points are registry information, DLL cache folder, user profiles, COM+ and WMI info, IIS metabase and certain monitored system files.
Windows reserves space for restore points. They are saved until the disk space is filled up. As new restore points are created, old ones are deleted as we run out of space. If we turn off system restore, all existing restore points are deleted. System protection is automatically on for the drive that holds the operating system. It can also be enabled for drives are formatted using NTFS file system.
When restoring to a previous restore point, we should restore to a time just before the date and time we started noticing problems. Note that system restore doesn’t alter user files. It only replaces system files, registry keys and important settings. Note that system restore is not the same as a system image restore. System image restores the entire volume and overwrites our data if our computer is not bootable.
If we can’t boot to our computer to run system restore, we can boot from our Windows installation media, then select the “Repair your computer” option, and then select the “Use system restore” option. In some situations system restore will not fix our problem. In that case we must turn to more advanced recovering methods.
Recovery Console
Another tool we can use is the Recovery Console . In Windows Vista and Windows 7 this is simply referred to as the Repair Command Prompt. This tool is available from Windows 2000 and up. The Recovery Console is the command line utility which we can use to diagnose and repair system problems when we are unable to start the computer in any other way. We can use Recovery Console to read boot logs, enable and disable services, read and write data to the hard disk drive, repair a corrupt registry, restore corrupt operating system files, format and partition drives, repair a corrupted master boot record, and rebuild boot.ini files. To get a list of commands that are available we can type in ‘help’ or ‘help / [command]’ at the command prompt. There is no point in remembering all available commands. Instead of that we will typically refer to Help articles which explain how to fix and which commands to use in the Recovery Console in order to resolve some problem. In many cases the functions we can perform in the Recovery Console are automatically performed when we try to do a Repair Install, however the Recovery Console helps us to do specific things.
To run the Recovery Console we can boot from the installation disc and choose the repair option. On Windows 7/Vista, we choose the command prompt option. On Windows 2000/XP we can install the Recovery Console by using the winnt32.exe /cmdcons command from the installation disc. The Recovery Console is then available during boot from the boot menu without using the installation disc.
Recovery Partition
A recovery partition is a special partition that exists on our computer that includes all the files necessary to recover or restore Windows. This is a backup that was created by the computer manufacturer. The recovery partition may or may not have a drive letter assigned to it, so we might not even be aware that it exists. However, we might be able to choose the recovery partition option from the Advanced Boot Menu, or boot using a special key combination as instructed by the manufacturer. The recovery partition also assumes that at least a part of our hard drive is still available and accessible. The recovery partition restores the system to the state it was in when shipped. The process typically re-formats the hard drive to perform the recovery. That means that all applications and files added since the system was shipped will be lost, so we should back up any data on the hard disk before performing the recovery, if possible. Performing Recovery Partition is typically faster than installing from scratch.
Parallel Installation
We use parallel installation in situations in which Windows does not work, but our hard disk and files on that disk are still accessible. In this case we take the Windows installation disk and install Windows on the same system, but to some other folder, for example ‘WindowsNew’. Remember that we don’t format the drive during installation. If the hard disk has multiple partitions, we can install Windows onto a different partition. We can also add a second hard disk drive to our system and install Windows on the new disk. We install another OS so that we can boot into new instance of the operating system and access the files that are available on that hard drive.
Instead of performing a parallel installation we could take our disk and insert it into a different computer that is able to boot up into Windows. In that case we can access files that are stored on that hard disk.
All methods up to now assume that our hard drive is accessible. If our hard disk is corrupted to the point where the files are no longer accessible, we will have to use other tools to repair our Windows.
Emergency Repair Disk, Automated System Recovery, Complete PC Restore
Emergency Repair Disk, Automated System Recovery or Complete PC Restore basically do the same thing. ERD is used with Windows 2000, ASR with Windows XP and the Complete PC Restore is used with Windows Vista and Windows 7. If we are unable to repair the existing installation, we can restore our system using those tools. In each cases we use our backup files that are accessible on some type of a media. With those tools we restore the entire PC. The restore process erases hard drives, destroying all existing data. If our hard disks have previously failed, we have to replace them before the restore process. During the restore process, hard disks are partitioned and formatted with the volumes that existed when we created the backup, which could result in a loss of data on all disks in the system. After that, the files are restored from the backup to new volumes. For ESD/ASR we also need the ERD/ASR diskette that was created for that system. We cannot use a diskette that was created for a different system. We insert the diskette when instructed by the recovery process.
Complete PC restore, also called system image restore, overwrites the entire content of our system volume. We can restore from a previously-created system image, by booting from the Windows installation media and loading system recovery tools or by pressing F8 during the boot process. Restoring from a system image backup enables us to quickly get the computer up and running after a disaster. The restoration includes the operating system, installed programs, drivers, and user data files. This method of restoration is also known as complete recovery.
Windows Recovery Options
So, we can boot from the Windows installation media and choose “Repair your computer”, or boot the computer to the advanced boot menu by pressing F8, or we can use the system recovery disc that can be created in the Backup and Recovery console in the Control Panel. All of these methods load the Windows Recovery Environment or Windows RE. Windows RE enables us to perform certain repair functions in Windows, like:
- Startup Repair – tries to automatically fix problems that prevent Windows from starting
- System Restore – performs a system restore to a previous restore point
- System Image Recovery – can be used to do a system image restore
- Windows Memory Diagnostic – can be used to analyze the computer memory (RAM) for hardware problems
- Command Prompt – provides full access to the file system and volumes
Before booting into the Windows Recovery Environment we should ensure that the backup media is connected to our computer.
ERD/ASR only restores the operating system. Complete PC Restore in Windows Vista and 7 restores all volumes in the backup, including all user data on those volumes. We can’t restore individual files from a complete PC backup.
To start ERD we choose the repair option and select the emergency repair process. To start ASR we press F2 when prompted during the initialization process to start the recovery process.
Previous Versions and Backup
If we are able to boot into Windows we can use Previous Versions feature, which is available from Windows XP and up. The only task we perform here is roll back to a previous version of the file. To restore a file to a previous version we can go to the file properties and use the Previous Versions tab to select the version we want to restore. To restore a deleted file we can view the properties of the folder containing the file. On the Previous Versions tab we open a previous version of the folder to view its contents at that time. We can restore the original file overwriting the existing file, or restore it to a different location.
If we don’t have access to previous versions or if the entire hard drive has failed, then we will need to restore files from a backup. To do that we can use the appropriate utility based on our operating system. We have NTBackup in Windows XP and 2000 or Backup Status and Configuration tool in Windows Vista and 7. When we restore files from a backup, we restore the file as it existed when the backup was taken. During the restore process we can often choose the files that we want to restore. We can choose to restore the file to its exact location, or we can restore a copy of the file to some other location.
Examples
Remember
Before using recovery tools we should try to boot our PC using the Last Known Good Configuration option (if the problem is keeping us from logging on), or try to boot into Safe Mode to disable devices or roll back drivers. If that doesn’t work we should try to restore our system to a previous restore point. We can also try to repair our Windows installation. Recovery Console can be used to perform specific repair actions. ERD, ASR and Complete PC Restore tools are used to restore our system from the backup set. Recovery partition can be used to restore the system to the state it was in when shipped. We can use Parallel installation to access user files still accessible on the disk. User files can also be restored from the backup or using Previous Versions feature.