Manual restore registry files from a system backup created before Registry First Aid registry scan

If it is not possible to boot in safe mode and "last known good configuration" is damaged then you can restore the system files from a system backup created before Registry First Aid registry scan. If you remember, you were prompted to create a backup of the system state.

In this case you need either another copy of Windows installed or Recovery Console installed. Read install Recovery Console and how to use it topic.

There may be several variants to boot into another copy of Windows (at least Windows XP is required):
  • a second operating system installed on that machine;
  • or install a new OS into another folder (not C:\Windows originally) or another partition;
  • or connect hard drive to a machine with Windows installed;
  • or make a boot CD or flash drive with Windows or another OS with support of NTFS.
The better and easier choice is using a boot device. There are a lot of bootable images in the Internet especially designed for Windows recovery.
Windows 2000/2003
  • Boot into your parallel installed system and launch the Backup utility from the Programs > Accessories > System Tools menu.
  • Click on the Restore Wizard button and select the backup file created by Registry First Aid. You may be asked for original container of backed up files - select your first Windows folder.
  • Extract registry files from a system backup files.

Windows XP/Vista/7/8

The instructions below will show you how you can replace registry files with backup copies.

  • Boot into your parallel system
  • open in explorer your old Windows drive and find the folder System Volume Information.
    To see this folder you need to make it visible:
    • on the Tools menu, click Folder options,
    • click the View tab,
    • under Hidden files and folders click to select Show hidden files and folders,
    • and then clear the Hide protected operating system files (Recommended) check box.
  • The System Volume Information folder contains one or more folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}". Open a most recent folder but not a folder where time stamp is the same as the current time.
  • Then open a recent restore point folder like "RPx" and then Snapshot folder.
  • From the Snapshot folder, copy the following files to the \Windows\system32\config folder on your problem Windows drive: 
    
    _REGISTRY_USER_.DEFAULT
    _REGISTRY_MACHINE_SECURITY
    _REGISTRY_MACHINE_SOFTWARE
    _REGISTRY_MACHINE_SYSTEM
    _REGISTRY_MACHINE_SAM
  • Rename these files to DEFAULT, SECURITY, SOFTWARE, SYSTEM and SAM. But before this you should rename all existent files in \Windows\system32\config to *.bak - that will be backups in case something will go wrong.
  • Reboot in your problem Windows system and see if it works OK. If no, you can try to copy other registry files from another Restore Point snapshot folder.
Registry files
SYSTEM file is the "HKEY_LOCAL_MACHINE\System" registry hive
DEFAULT is the "HKEY_LOCAL_MACHINE\.Default" hive
SAM is the "HKEY_LOCAL_MACHINE\SAM" hive
SECURITY is the "HKEY_LOCAL_MACHINE\SECURITY" hive
Both last mentioned files contain system security records. Don't modify these files if you don't know what you're doing exactly.
SOFTWARE is the "HKEY_LOCAL_MACHINE\Software" hive
It contains registry keys for installed software. If you replace this file with one old then you probably will have to re-install the most of your programs.