Restoring the Registry Hives From a System Restore Snapshot in Windows

we describe you to restore the registry hives from a recent System
Restore snapshot in Windows XP, in the event of registry corruption
that prevents
your Windows XP computer from starting. If the registry hives become
corrupted, the following errors are displayed when starting up:

• Windows XP could not start because the following file is missing
  or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM
• Windows XP could not start because the following file is missing
  or corrupt: \WINDOWS\SYSTEM32\CONFIG\SOFTWARE

Here are the methods that you can use to fix this problem, short of
reinstalling Windows:

Method 1. Perform a System Restore Rollback Offline:

You can perform a System Restore rollback offline using ERD Commander’s
System Restore Wizard. Our
previous post covered how to use this product, see it and follow.
This is probably the easiest method. If you need
to restore the registry hives manually for some reason, use Method 2.

Method 2. Restore registry hives from the System Restore store
folder:

The System Restore snapshots are stored in a folder named System Volume
Information. Each snapshot folder stores the registry hives, system
files and other data. this Microsoft
Knowledgebase article tells you how to restore the registry from
the Windows\Repair directory, and then restore the most recent registry
hives from the System Volume Information folder. A brief synopsis of
that article follows:

Synopsis:

Part 1:

1. Start Windows XP Recovery Console.
2. Copy the five registry hives (SYSTEM, SOFTWARE, SAM, SECURITY,
   DEFAULT) from C:\Windows\System32\Config to C:\Windows\Tmp, adding the
   .bak extension.
3. Delete the five registry hives from C:\Windows\System32\Config.
4. Copy the five registry hives from C:\Windows\Repair folder to
   C:\Windows\System32\Config.

With this done, you should be able to start Windows XP using the
registry that was created during the initial setup of Windows XP. As a
result, any changes and settings that occurred after the Setup program
was finished are lost.

Part 2:

1. Start Windows XP in Safe mode.
2. Explore the System Volume Information folder in the drive where
   Windows XP is installed. If you’re denied access to the folder, read this article  to
   know how to gain access to the System Volume Information folder.
3. Double-click the _Restore… folder, and locate the recent restore
   point, identified by the Restore Point Sequence ID (RP1, RP2, RP3 and
   so forth…). Because you used the registry file that the Setup program
   created, this registry does not know that these restore points exist
   and are available. A new folder is created with a new GUID under System
   Volume Information and a restore point is created that includes a copy
   of the registry files that were copied during part one. Therefore, it
   is important not to use the most current folder, especially if the time
   stamp on the folder is the same as the current time.
4. Double-click the folder named snapshot.
5. Copy the five registry hives to C:\Windows\Tmp.

Part 3:

1. Start Windows XP Recovery Console.
2. Copy the five registry hives from C:\Windows\Tmp to
   C:\Windows\System32\Config and Start Windows XP.
3. Perform a System Restore rollback.

Easier Method :

If you find the steps in this microsoft
support article tedious, you can accomplish the task using a
bootable live Windows CD like BartP  or ERD Commander Boot CD. Here are
the instructions for ERD Commander Boot CD.

Using the ERD Commander Boot CD

ERD Commander is part of the Microsoft Diagnostics and Recovery Toolset
(DaRT) whose 30 day evaluation is available MSDaRT50Eval.msi
64.2 MB). We hav covered MS DaRT earlier in article: Reset Lost Windows XP
Administrator Password Using ERD Commander. 
Follow steps 1-6 in that article to create a ERD Commander Boot CD,
and now head back on to this post!

1. Insert the ERD Commander Boot CD into the drive and restart the
   system.
2. Boot the computer using ERD Commander Boot CD. note: You may need
   to
   set the boot order in the BIOS first if your bios is not set to boot
   from CD.
3. Select your Windows XP installation and click OK.
4. Double-click the My Computer icon on the Desktop and Open the
   C:\Windows\System32\Config folder.
5. Rename the five registry hives (SYSTEM, SOFTWARE, SAM, SECURITY,
   DEFAULT) by adding .bak extension to them.
6. Double-click the drive-letter where Windows is installed.
7. Open the System Volume Information folder, and double-click the
   _restore{…} folder.
8. Locate the recent snapshot, identified by the Restore Point
   Sequence ID
   (RP1, RP2, RP3 and so forth…). The highest number indicates the most
   recent snapshot and the lowest number indicates the oldest snapshot.
   Choose the one that you want to restore. Alternately, you can also sort
   the System Restore snapshot using the Date column.
9. Double-click the appropriate folder (say, RP20) and open the
   folder named snapshot in it.
10. Select the following files (Use the CTRL key to select multiple
    files.).
11. _REGISTRY_MACHINE_SAM,
12. _REGISTRY_MACHINE_SECURITY,
13. _REGISTRY_MACHINE_SYSTEM,
14. _REGISTRY_MACHINE_SOFTWARE and
15. _REGISTRY_USER_.DEFAULT.
16. Right-click the selection and choose Copy to…
17. Select C:\Windows\System32\Config as the destination path, and
    click
    OK, The items will be copied now.
18. Open C:\Windows\System32\Config and rename the hives, as follows:
19. Rename _REGISTRY_MACHINE_SAM to SAM.
20. Rename _REGISTRY_MACHINE_SECURITY to SECURITY.
21. Rename _REGISTRY_MACHINE_SOFTWARE to SOFTWARE.
22. Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM and
23. Rename _REGISTRY_USER_.DEFAULT to DEFAULT.
24. Remove the ERD Commander Boot CD and restart Windows XP..
25. Now that you’ve only done a registry rollback. To complete the
    procedure, click Start, an then click All Programs. Click Accessories,
    and then click System Tools. Click System Restore, and then click
    Restore to a previous RestorePoint. Complete the System Restore process.

Written by Jitendra