{"id":785,"date":"2008-11-27T16:09:20","date_gmt":"2008-11-27T10:39:20","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=785"},"modified":"2021-12-29T18:33:22","modified_gmt":"2021-12-29T13:03:22","slug":"restore-registry-hives-system-restore-snapshot-xp","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/restore-registry-hives-system-restore-snapshot-xp\/","title":{"rendered":"How to Restore the Registry Hives from a System Restore Snapshot in Windows XP"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/xp-icon.gif\" width=\"45\" height=\"32\" \/>This article describes how to restore the registry hives from a recent System Restore snapshot in Windows XP, in the event of registry corruption that prevents your Windows XP computer from starting. If the registry hives become corrupted, the following errors are displayed when starting up.<!--more--><\/p>\n<pre class=\"err\">Windows XP could not start because the following file is missing or corrupt: \\WINDOWS\\SYSTEM32\\CONFIG\\SYSTEM\r\n\r\nWindows XP could not start because the following file is missing or corrupt: \\WINDOWS\\SYSTEM32\\CONFIG\\SOFTWARE<\/pre>\n<p>Here are the methods that you can use to fix this problem, short of reinstalling Windows:<\/p>\n<h2>Method 1: Perform a System Restore Rollback Offline<\/h2>\n<p>You can perform a System Restore rollback offline using ERD Commander&#8217;s System Restore Wizard. For more information, see our article <a href=\"https:\/\/www.winhelponline.com\/blog\/perform-system-restore-rollback-on-non-bootable-xp-computer\/\">Perform a System Restore rollback on a non-bootable Windows XP Computer<\/a>. This is probably the easiest method. If you need to restore the registry hives manually for some reason, use <b>Method 2<\/b>.<\/p>\n<h2>Method 2: Restore registry hives from the System Restore store folder<\/h2>\n<p>The System Restore snapshots are stored in a folder named <b>System Volume Information<\/b>. Each snapshot folder stores the registry hives, system files and other data. Microsoft Knowledgebase article <a href=\"http:\/\/support.microsoft.com\/?kbid=307545\" target=\"_blank\" rel=\"noopener noreferrer\">307545<\/a> tells you how to restore the registry from the Windows\\Repair directory, and then restore the most recent registry hives from the <b>System Volume Information<\/b> folder. A brief synopsis of that article follows:<\/p>\n<p><b>Part I<\/b><\/p>\n<ul>\n<li>Start Windows XP Recovery Console.<\/li>\n<li>Copy the five registry hives (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) from C:\\Windows\\System32\\Config to C:\\Windows\\Tmp, adding the <b>.bak<\/b> extension.<\/li>\n<li>Delete the five registry hives from C:\\Windows\\System32\\Config<\/li>\n<li>Copy the five registry hives from C:\\Windows\\Repair folder to C:\\Windows\\System32\\Config<\/li>\n<\/ul>\n<p>With this done, you should be able to start Windows XP using the registry that was created during the initial setup of Windows XP. As a result, any changes and settings that occurred after the Setup program was finished are lost.<\/p>\n<p><b>Part II<\/b><\/p>\n<ul>\n<li>Start Windows XP in Safe mode<\/li>\n<li>Explore the <b>System Volume Information<\/b> folder in the drive where Windows XP is installed. If you&#8217;re denied access to the folder, read <a href=\"http:\/\/support.microsoft.com\/kb\/309531\/\" target=\"_blank\" rel=\"noopener nofollow noreferrer\">this article<\/a> to know how to gain access to the System Volume Information folder.<\/li>\n<li>Double-click the <b>_Restore&#8230;<\/b> folder, and locate the recent restore point, identified by the Restore Point Sequence ID (RP1, RP2, RP3, and so forth&#8230;). <i>Because you used the registry file that the Setup program created, this registry does not know that these restore points exist and are available. A new folder is created with a new GUID under System Volume Information and a restore point is created that includes a copy of the registry files that were copied during part one. Therefore, it is important not to use the most current folder, especially if the time stamp on the folder is the same as the current time.<\/i><\/li>\n<li>Double-click the folder named <b>snapshot<\/b><\/li>\n<li>Copy the five registry hives to C:\\Windows\\Tmp<\/li>\n<\/ul>\n<p><b>Part III<\/b><\/p>\n<ul>\n<li>Start Windows XP Recovery Console<\/li>\n<li>Copy the five registry hives from C:\\Windows\\Tmp to C:\\Windows\\System32\\Config<\/li>\n<li>Start Windows XP<\/li>\n<li>Perform a System Restore rollback.<\/li>\n<\/ul>\n<h2>Easier Method<\/h2>\n<p>If you find the steps in KB307545 tedious, you can accomplish the task using a bootable live Windows CD like BartPE or ERD Commander Boot CD. Here are the instructions for ERD Commander Boot CD.<\/p>\n<p><b>Using the ERD Commander Boot CD<\/b><\/p>\n<p><i>ERD Commander is part of the Microsoft Diagnostics and Recovery Toolset (DaRT) whose 30 day evaluation is available here (MSDaRT50Eval.msi &#8211; 64.2 MB). We\u2019ve covered MS DaRT earlier in article <a href=\"https:\/\/www.winhelponline.com\/blog\/perform-system-restore-rollback-on-non-bootable-xp-computer\/\">Perform a System Restore rollback on a non-bootable Windows XP computer<\/a>. Follow steps 1-7 in that article to create a ERD Commander Boot CD.<\/i><\/p>\n<p>1. Insert the ERD Commander Boot CD into the drive and restart the system<\/p>\n<p>2. Boot the computer using ERD Commander Boot CD. You may have to set the boot order in the BIOS first.<\/p>\n<p>3. Select your Windows XP installation and click OK.<\/p>\n<p>4. Double-click the My Computer icon on the Desktop<\/p>\n<p>5. Open the <b>C:\\Windows\\System32\\Config<\/b> folder<\/p>\n<p>6. Rename the five registry hives (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) by adding .bak extension to them.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/srp-hives1.png\" width=\"257\" height=\"229\" \/><\/p>\n<p>5. Double-click the drive-letter where Windows is installed.<\/p>\n<p>6. Open the <b>System Volume Information<\/b> folder, and double-click the <b>_restore{&#8230;}<\/b> folder.<\/p>\n<p>7. Locate the recent snapshot, identified by the Restore Point Sequence ID (RP1, RP2, RP3 and so forth&#8230;). The highest number indicates the most recent snapshot, and the lowest number indicates the oldest snapshot. Choose the one that you want to restore. Alternately, you can also sort the System Restore snapshots using the Date column.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/srp-hives2.png\" width=\"280\" height=\"320\" \/><\/p>\n<p>8. Double-click the appropriate folder (say, <i>RP20<\/i>) and double-click the folder named <b>snapshot<\/b><\/p>\n<p>9. Select the following files (Use the CTRL key to select multiple files.)<\/p>\n<ul>\n<li>_REGISTRY_MACHINE_SAM<\/li>\n<li>_REGISTRY_MACHINE_SECURITY<\/li>\n<li>_REGISTRY_MACHINE_SYSTEM<\/li>\n<li>_REGISTRY_MACHINE_SOFTWARE<\/li>\n<li>_REGISTRY_USER_.DEFAULT<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/srp-hives3.png\" width=\"356\" height=\"296\" \/><\/p>\n<p>10. Right-click the selection and choose <b>Copy to&#8230;<\/b><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/srp-hives4.png\" width=\"230\" height=\"209\" \/><\/p>\n<p>11. Select <b>C:\\Windows\\System32\\Config<\/b> as the destination path, and click OK.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/srp-hives5.png\" width=\"410\" height=\"350\" \/><\/p>\n<p>The items will be copied now.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/srp-hives6.png\" width=\"336\" height=\"169\" \/><\/p>\n<p>12. Open <b>C:\\Windows\\System32\\Config<\/b> and rename the hives, as follows:<\/p>\n<ul>\n<li>Rename _REGISTRY_MACHINE_SAM to <b>SAM<\/b><\/li>\n<li>Rename _REGISTRY_MACHINE_SECURITY to <b>SECURITY<\/b><\/li>\n<li>Rename _REGISTRY_MACHINE_SOFTWARE to <b>SOFTWARE<\/b><\/li>\n<li>Rename _REGISTRY_MACHINE_SYSTEM to <b>SYSTEM<\/b><\/li>\n<li>Rename _REGISTRY_USER_.DEFAULT to <b>DEFAULT<\/b><\/li>\n<\/ul>\n<p>13. Remove the ERD Commander Boot CD and restart Windows XP. Now that you&#8217;ve only done a registry rollback. To complete the procedure, click Start, and then click All Programs. Click Accessories, and then click System Tools. Click System Restore, and then click <b>Restore to a previous RestorePoint<\/b>. Complete the System Restore process.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This article describes how to restore the registry hives from a recent System Restore snapshot in Windows XP, in the event of registry corruption that prevents your Windows XP computer from starting. If the registry hives become corrupted, the following errors are displayed when starting up.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[12],"tags":[],"class_list":["post-785","post","type-post","status-publish","format-standard","hentry","category-windows-xp"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":5506,"url":"https:\/\/www.winhelponline.com\/blog\/recover-registry-keys-restore-point-shadow-copy-windows\/","url_meta":{"origin":785,"position":0},"title":"Recover Registry Keys from a System Restore Point in Windows","author":"Ramesh","date":"October 14, 2017","format":false,"excerpt":"System Restore snapshots or volume shadow copies contain registry hives as well as critical system files. Sometimes you may need to extract individual registry keys from an earlier restore point but don't want to do a complete System Restore rollback. Previously we saw how to open the registry hives from\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"registrychangesview options","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/recover-registry-restore-point-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/recover-registry-restore-point-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/recover-registry-restore-point-1.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":5289,"url":"https:\/\/www.winhelponline.com\/blog\/system-restore-rollback-windows-10-recovery-options\/","url_meta":{"origin":785,"position":1},"title":"Perform System Restore Rollback Offline via Windows RE","author":"Ramesh","date":"January 29, 2017","format":false,"excerpt":"System Restore is an excellent tool that can rescue the system from catastrophe. But, when you cannot revert the system configuration from normal mode, you can perform System Restore rollback offline via Windows Recovery Environment (WinRE), or from Safe Mode. This post tells you how to revert the system configuration\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"perform system restore rollback offline in windows 10","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/system-restore-offline-0.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/system-restore-offline-0.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/system-restore-offline-0.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/system-restore-offline-0.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":9898,"url":"https:\/\/www.winhelponline.com\/blog\/automatically-backup-registry-hives-windows-10\/","url_meta":{"origin":785,"position":2},"title":"How to Automatically Backup the Entire Registry in Windows","author":"Ramesh","date":"June 22, 2019","format":false,"excerpt":"Every System Restore point or shadow copy maintains a complete backup of the registry hives. However, Windows 10\/11 doesn't automatically create System Restore points every day. Restore Points are created only when installing important updates or drivers. Notwithstanding the System Restore's excellent capabilities, relying upon System Restore as a file\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"backup registry daily or weekly - regidlebackup task","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/06\/registry-backup-task-regidlebackup.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":26688,"url":"https:\/\/www.winhelponline.com\/blog\/restore-path-environment-variable-deleted\/","url_meta":{"origin":785,"position":3},"title":"How to Recover PATH Variable After Deleting it Accidentally","author":"Ramesh","date":"May 18, 2022","format":false,"excerpt":"The PATH is a variable that Windows uses to locate needed executables, especially from the command line. Unfortunately, there are situations where users accidentally delete the PATH variable. This can happen when users inadvertently overwrite the PATH data rather than appending them. There are also cases where some buggy applications\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"recover path environment variable - shadow copy hive","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/05\/recover-path-variable-shadowcopy.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":80597,"url":"https:\/\/www.winhelponline.com\/blog\/recover-registry-files-shadow-copy\/","url_meta":{"origin":785,"position":4},"title":"Recover Registry Hives from a System Restore Point or Shadow Copy","author":"Ramesh","date":"March 30, 2026","format":false,"excerpt":"This article explains how to restore registry hives or files from shadow copies. This can be helpful if the current registry hives are damaged and cannot be loaded. Shadow copy, or Volume Shadow Copy Service (VSS), is a Windows feature that creates snapshots or backup copies of files and volumes,\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"list system restore points","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/list-system-restore-points.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/list-system-restore-points.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/list-system-restore-points.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":823,"url":"https:\/\/www.winhelponline.com\/blog\/scan-for-affected-programs-system-restore-feature-windows-7\/","url_meta":{"origin":785,"position":5},"title":"Scan for affected programs &#8211; New System Restore Feature in Windows 7","author":"Ramesh","date":"January 13, 2009","format":false,"excerpt":"When you perform a System Restore rollback in earlier versions of Windows, you'll see the list of changes in the file system\/registry that had occurred after restoring to an earlier System Restore point. Windows 7 introduces a new System Restore feature wherein you can know beforehand the list of programs\u2026","rel":"","context":"In &quot;Windows 7&quot;","block_context":{"text":"Windows 7","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-7\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/w7-icon.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=785"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/785\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}