Page 15

2.10 Burning the ERD Commander 2003 CD-ROM
Most popular CD-ROM burning applications offer the option to write a CDROM from a CD-ROM ISO file. Check with your softwares documentation for information on how to do this. For additional tips, please check the Winternals Product Knowledge Base: http://www.winternals.com/support/kbfiles/ISOtoCD.pdf

Page 16

Using ERD Commander 2003
Once ERD Commander 2003 boots, a stripped-down version of Windows XP will start and run the ERD Commander 2003 windowing environment. Its important to keep in mind that, although this graphical environment looks like Windows and even has similar utilities, it is not Windows code and therefore behaves slightly differently. Also note that your end-user license agreement prohibits use of ERD Commander 2003 as a general-purpose operating system, and the environment is designed to reboot automatically 24 hours after starting. NOTE: it is important that you do not remove the ERD Commander 2003 CDROM from the system while ERD Commander 2003 is running. Doing so could result in a lock-up of ERD Commander 2003, requiring a reboot. The ERD Commander 2003 environment provides a number of powerful utilities that help you identify and repair problems that are preventing a system from booting. These include:
Logon Windowing Shell System Information Explorer File Search FileRestore Command Prompt Chkdsk Regsvr32 Notepad Regedit

Page 17

Service and Driver Manager Event Log Viewer TCP/IP Configuration Disk Management Locksmith File Sharing System Restore System Compare Disk Commander (available if ERD Commander 2003 is purchased as part of the Administrators Pak)
This section describes the functionality and use of each of these tools. In addition, you can execute Win32 applications other than those that are part of the ERD Commander 2003 environment.

Page 18

When ERD Commander 2003 boots it executes the Winternals Logon application. The first step performed by the Logon application is to start the networking services. These services assume that a DHCP server is present on your network and attempt to obtain an IP address. If your network uses static IP addresses rather than DHCP you can use the TCP/IP Configuration utility after logging in to specify a static IP address. If the ERD Commander 2003 CD was generated by the Boot CD-ROM Wizard, the Logon application next displays the licensing information entered during execution of the wizard. Otherwise it will prompt you to enter ERD Commander 2003 license text or specify a file containing an ERD Commander 2003 license. Next, the Logon application scans the systems hard-disk volumes for Windows NT, 2000, XP, and Server 2003 installations. It displays the system root directory of located installations, the type of operating system installed, and service pack information. It also allows you to specify the language layout of your keyboard. The default language selection is the one specified by the operating system installation entered in the edit box of the Logon application.

Page 19

If the system you wish to repair is not in the list or the operating system is displayed as "unknown", then some or all of the Registry hives for that installation are damaged, missing, or have restrictive permissions that do not allow the System account access. Registry hives are the Registrys on-disk storage files and are stored under \SystemRoot\System32\Config (where SystemRoot is the system root directory of a Windows NT, 2000, XP, or Server 2003 installation). Choose the installation you wish to repair from the list, by manually entering the system root path, or by browsing to the system root directory. When you make a selection the Logon application validates the SYSTEM, SOFTWARE, SAM and SECURITY Registry hives and notifies you if any of them are corrupt or missing. Note that in this event the corresponding portions of the Registry will be inaccessible by the Winternals Registry editor and other ERD Commander 2003 utilities also have limited functionality.

Page 20

The Logon application allows you to choose a keyboard layout and time zone using the drop down controls. The default selections for keyboard layout and time zone are taken from the installation you have currently entered into the installation selection field if the Registry of that installation is accessible. Clicking the OK button selects the specified installation and starts the ERD Commander 2003 Windowing Shell, described in the next section. After you have completed work on an installation and log off the Windowing Shell you return to this Logon dialog. Clicking the Reboot button performs a clean shutdown and reboot of the computer.

Page 21

Windowing Shell
The ERD Commander 2003 Windowing Shell closely resembles Microsoft's Explorer shell. It has a task bar, Start menu, and desktop shortcuts. However, you cannot move the Windowing Shells task bar, edit the items on the Start Menu, move or modify existing desktop shortcuts, or create new desktop shortcuts. The Windowing Shell provides the familiar desktop motif and allows you to easily access ERD Commander 2003 applications and manage multiple running applications with taskbar buttons. NOTE: a limitation in the ERD Commander 2003 operating environment prevents concurrent execution of more than approximately 4 applications. ERD Commander 2003 will inform you when starting another application might exceed the limit.

Page 22

System Information
The ERD Commander 2003 System Information utility is accessed via the Administrative Tools folder of the Start menu. The utility reports extensive information about the system you are repairing, including the operating system version, service pack, hotfixes, registered owner and organization and more. It also displays the installations computer name as well as the computer name (listed as the "Real computer name") that ERD Commander 2003 randomly assigns while it is running. The value of the System root, which represents the root folder of the installation, can be useful to determine where key system files, such as service and driver files and Registry hives, reside.

Page 27

Resetting Permissions
A system can become unbootable if permissions are set on NTFS folders or directories that prevent the operating system from accessing the files required for the boot process. The Reset Permissions button on a volume or folder Properties dialog changes the permissions on the volume folder, and optionally on child folders, to a security descriptor that gives the Everyone group (all users) full access.
NOTE: Because resetting permissions makes folders and directories fully accessible
to any user, you should lock down the appropriate folders and directories after the system is booted normally to close potential security holes.

Page 28

Mapping Network Drives
ERD Commander 2003 Explorer provides a Network Neighborhood folder for you to navigate to file shares. However, in some cases it is more convenient to access a file share through a mapped drive letter. To map a share to a drive letter use the Map Network Drive menu item in the Tools menu or the Map Network Drive button on a file shares Properties dialog. This method allows you to map shares on networks without NetBIOS and thus not visible in Network Neighborhood. The Map Network Drives dialog requires that you specify a free local drive letter, the path to the network file share that you want to map, and optionally the username and password information that Explorer should use to connect to the share. The network share path can consist of DNS (e.g. \\system.mydomain.com), NetBIOS (\\System) or TCP/IP (\\192.168.3.101) computer addresses. Disconnect a mapped drive either by selecting the drive you wish to disconnect and selecting Disconnect from its context menu, or by selecting the drive in the Disconnect Network Drive dialog, accessed from the Tools menu.

Page 29

Adding a Domain
If a domain is not visible within ERD Commander 2003's Network Neighborhood you can add it with the Add Domain dialog, which you activate from the Tools menu of ERD Commander 2003 Explorer.

Page 30

3.10 Using File Search
You can search for files on the hard disks of the system that you are repairing using ERD Commander 2003 File Search. ERD Commander 2003 File Search has an interface nearly identical to that of the Windows 2000 File Search utility, and is accessible via the Start menu and from the context menu of folders within ERD Commander 2003 Explorer. As with Windows 2000 File Search, the search pattern you enter can contain any subset of the file or path names for which you wish to search, and can include the asterisk (*) wild-card character. You can also optionally modify your search to include only results with modifications within a certain time period, or of a particular size. File Search displays the result of a search as a list in its right pane. After selecting one or more entries in the list you can perform the following operations, all of which are accessible via menu items in the File menu, the context menu (display the context menu by right clicking), and the toolbar:

3.12.1 The Command Set ATTRIB BUFFER CALL CD CHDIR CHKDSK CLS COPY DATE Displays or changes file attributes. Sets console screen buffer information. Calls one batch program from another. Displays the name of or changes the current directory. Displays the name of or changes the current directory. Checks a disk and displays a status report. Clears the screen. Copies one or more files to another location. Displays the current date.

Page 35

DEL DIR DISKPART ECHO ERASE EXIT HELP MAP MD MKDIR MOVE RD REGSVR32 RMDIR SCREEN SET START TIME TYPE VER VERSION XCOPY
Deletes one or more files. Displays a list of files and subdirectories in a directory. Partitions disks. Displays messages, or turns command echoing on or off. Deletes one or more files. Exits the command prompt. Provides Help information for ERD Commander 2003 commands. Displays drive letter to partition mapping. Creates a directory. Creates a directory. Moves or renames a file or directory. Removes a directory. Registers COM/DCOM DLLs. Removes a directory. Sets console screen information. Sets, displays, or removes environment variables. Starts a program in a new command prompt window. Displays the current time. Displays the contents of a file. Displays ERD Commander 2003 version number. Displays ERD Commander 2003 version number. Copies files and directory trees.

Page 36

3.12.2 Attrib Displays or changes file attributes.
ATTRIB [+R | -R] [+A | -A] [+S | -S] [+H | -H] [[drive:][path]filename] [/S] + R A S H /S Sets an attribute. Clears an attribute. Read-only file attribute. Archive file attribute. System file attribute. Hidden file attribute. Processes files in all directories in the specified path.
3.12.3 Buffer Sets console screen buffer information.
BUFFER [width height] width height Specifies width of the console buffer. Specifies height of the console buffer.
3.12.4 Call Calls one batch program from another.
CALL [drive:][path]filename [batch-parameters] batch-parameters Specifies any command-line information required by the batch program.
3.12.5 Cd/Chdir Displays the name of or changes the current directory.
CHDIR [drive:][path] CHDIR[.] CD [drive:][path] CD[.] "." specifies that you want to change to the parent directory. Type CD drive: to display the current directory in the specified drive. Type CD without parameters to display the current drive and directory.

Page 37

3.12.6 Cls Clears the screen.
3.12.7 Copy Copies one or more files to another location.
COPY source [destination] source destination Specifies the file or files to be copied. Specifies the directory and/or filename for the new file(s).
Wildcards can be used in both the source and destination file name specifications.
3.12.8 Date Displays the current date.
3.12.9 Del/Erase Deletes one or more files.
DEL [/P] [/F] [/S] [/Q] [/A[[:]attributes]] [[drive:][path]filename ERASE [/P] [/F] [/S] [/Q] [/A[[:]attributes]] [[drive:][path]filename [drive:][path]filename Specifies the file(s) to delete. Specify multiple files by using wildcards. /P Prompts for confirmation before deleting each file. /F Force deleting of read-only files. /S Delete specified files from all subdirectories. /Q Quiet mode, do not ask if ok to delete on global wildcard /A Selects files to delete based on attributes attributes R Read-only files S System files H Hidden files A Files ready for archiving - Prefix meaning not

Page 43

3.13 Chkdsk
ERD Commander 2003 includes a clone of the Windows 2000/XP Chkdsk utility for analyzing and correcting file system corruption. Run Chkdsk, which is located in the system32 directory of the ERD Commander 2003 CD-ROM, from a command prompt window. The ERD Commander 2003 Chkdsk supports a subset of the Windows Chkdsk command-line options:
Usage: chkdsk [/F] [/X] [/R] [drive:] /F Fixes errors on the disk. /X Forces the volume to dismount first if necessary. /R Locates bad sectors and recovers readable information (implies /f)
If you specify a drive that has open files, for instance because you are running an application from the drive, you must use the /X switch. However, the /X switch does not work on the system drive of an installation you are repairing if you are running any utilities that access the Registry of that installation. The ERD Commander 2003 utilities that access the Registry include Regedit, Explorer, Service and Driver Manager, System Information, and Event Log Viewer. Make sure that you close these applications before running Chkdsk against the system drive.

Page 44

3.14 Diskpart
Diskpart, Microsofts command-line disk partitioning utility, ships with ERD Commander 2003. The ERD Commander 2003 Disk Management snap-in that you access with the Computer Management utility provides a graphical interface to Diskparts functionality, but Diskpart has interactive as well as script-driven modes. For help on Diskparts commands, run it and enter the Help command. Microsofts web site also has information on using Diskpart.

Page 45

3.15 Regsvr32
ERD Commander 2003 Regsvr32 has an interface identical to that of the Windows Regsvr32 utility. The Windows Regsvr32 utility does not function properly in the ERD Commander 2003 environment because it cannot register DLLs into an installation you are repairing, so use ERD Commander 2003 Regsvr32 to register COM/DCOM server DLLs.
Usage: regsvr32 [/u] [/s] [/n] [/i[:cmdline]] dllname /U Unregister server /S Silent; display no message boxes /L Call DllInstall passing it an optional [cmdline]; when used with /u calls dll uninstall /N Do not call DllRegisterServer; this option must be used with /l

Page 46

3.16 Notepad
ERD Commander 2003 Notepad is essentially a clone of the Windows Notepad application, allowing you to edit existing text files and create new ones.

Page 47

3.17 Regedit
ERD Commander 2003 Regedit is similar to the Windows XP Regedit utility, but enables you to edit the Registry of the system you are repairing. Unlike with Windows Regedit, you will only see two top-level keys in ERD Commander 2003 Regedit: HKEY_CLASSES_ROOT and HKEY_LOCAL_MACHINE. This is because there are no users actually logged on to the system you are repairing with ERD Commander 2003, obviating the need for the HKEY_USERS and HKEY_CURRENT_USER root keys. Since ERD Commander 2003 (not the system) is booted, there is no current hardware configuration loaded, obviating the need for HKEY_CURRENT_CONFIG (the root key that links to the part of the Registry representing the active hardware profile) and there is no HARDWARE subkey under HKEY_LOCAL_MACHINE, since the system creates the HARDWARE key for an installation when it boots. If any of the Registry hives (the files that store Registry data) of the system that you are repairing are missing or corrupt one or more subkeys under HKEY_LOCAL_MACHINE will not be available. See Chapter 4, Frequently Asked Questions, for a description of the correspondence between Registry hives and the keys that represent them. ERD Commander 2003 Regedit understands the following Registry value types:
String Multi-String Expandable String Binary DWORD
Like the Windows Regedit, ERD Commander 2003 Regedit supports Registry key import and export, allowing you to save Registry key information to a text

Page 48

file and to incorporate Registry key information of the same format into the Registry. The file format used by ERD Commander 2003 Regedit is the same as that used by the Windows 2000, XP, and Server 2003 Registry editors. Use ERD Commander 2003 Regedits permissions reset functionality when a system becomes unbootable because security permissions on keys prevent the system from accessing critical areas of the Registry. Select the key whose permissions you wish to reset and chose the Reset Permissions menu entry. You can reset the permissions on a specific key or a key and all its subkeys. NOTE: Because resetting permissions makes objects fully accessible to any user, you should lock down the appropriate objects after the system is booted normally to close potential security holes.

Page 49

3.18 Using Service and Driver Manager
The ERD Commander 2003 Service and Driver Manager, accessible in the Administrative Tools folder of the Start menu, is an ERD Commander 2003 Computer Management utility snap-in. The Service and Driver Manager is actually an interface to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services part of the Registry where service and driver configuration subkeys are located for the system you are repairing. Every service and driver has a subkey that includes values that specify its start type, and an optional description and display name. The Service and Driver Manager shows this information and allows you to edit the start type when you view the properties of a selected service or driver. You can access the Properties dialog by selecting the service or driver and double-clicking, or by choosing Properties from the Action menu or from the context menu that appears when you right-click. Typical repair operations involve disabling a service or driver that is preventing a system from booting, or replacing a corrupt service or driver file. To disable a service or driver, display its properties and change the startup type to Disabled. The Properties dialog also reports the path to the service or drivers executable image.

Wizard does not corrupt the systems state, ERD Commander 2003 System Restore Wizard deletes the restore point that you apply and any that follow it chronologically from the Windows XP System Restore database.

Page 61

Page 62

3.26 System Compare

If you have an unbootable system that was configured similarly to another installation on your network or to an on-disk image (such as an installation CD), use the ERD Commander 2003 System Compare utility to identify file, service and driver differences between the system and a reference image to help guide the repair process. The ERD Commander 2003 System Compare utility starts by asking you to select the local installation directory. By default, this is the system directory of the installation that you logged into. However, if corruption or other issues prevent ERD Commander 2003 from finding the installation directory you can also specify a directory. You can specify the reference installation in one of two ways: either as a computer name or as a path to an installation directory or Windows installation media root directory. You must enter computer names with a \\ prefix e.g. \\ref-comp. If you designate a computer or a remote path the wizard requires you to enter an account name and password with which to access the remote location. You should enter a computer name if you want to compare both file and service and driver configuration, since only file information is available for comparison if you enter a directory path. After making your selections the ERD Commander 2003 System Compare utility performs the requested comparison and presents the results in a list. If the reference location is a computer then you have the option to see either file or driver and service differences. For files, the Details button or right-click context menu selection displays a dialog box with additional information about the selected file.

Page 63

3.27 Running External Commands
The ERD Commander 2003 operating environment allows you to run Win32 applications other than those included on your product CD. Such External Commands may be found on the volumes of the computer that you wish to repair, or on the network. However, because the ERD Commander 2003 environment is different than that of Windows, many applications launched within it either behave incorrectly or fail to run. It should also be noted that different Windows installations provide different versions of many commands, so a particular External Command found on one system may work, while that found on another system may not. For these reasons Winternals Software does not warrant or support use of commands other than those found on your ERD Commander 2003 product CD, and a warning is displayed whenever you launch an external command from the ERD Commander 2003 Windowing Shell or an ERD Commander 2003 command prompt.

Page 64

If you wish to suppress the external command dialog for commands launched from within the ERD Commander 2003 command prompt (for example, when you execute batch files that spawn them) you can set the AllowExternalCommand environment variable to a value of "yes". If you do not want to allow the execution of any external commands set the AllowExternalCommand environment variable to "no". The default value of the variable is "warn".

Page 65

Disk Commander
Disk Commander is an advanced partition, volume, file and master boot record (MBR) salvage and repair tool that ERD Commander 2003 includes when you purchase it as part of the Winternals Administrators Pak. You can use Disk Commander to:
Salvage files from a volume that your operating system is having trouble accessing. Salvage files from a volume that your operating system does not recognize or provide a drive letter for. Recover deleted files. Repair volumes that have been damaged by a virus or been accidentally deleted by FDISK or the Windows Disk Administrator.
Disk Commander consists of a Wizard that guides you through the recovery process.
Warning: Some features of Disk Commander allow you to modify your disk in ways that can potentially damage or render your volumes inaccessible. Because all volumes on a disk share the same partition table it is possible that changes to one volume can impact other volumes on the disk. It is highly recommended that you use a conventional back up program to preserve as much of your data as possible before using Disk Commander to perform repairs.
Selecting a Drive Letter to Recover
If the data you wish to recover is on a volume that is relatively intact and has a drive letter assigned to it, then you can select that drive letter and go directly to recovering files. If it does not have a drive letter assigned then there are several additional step needed for Disk Commander to locate the partition. The version of Disk Commander you are running impacts which volumes may be recognized, since drive letter assignments are performed by the underlying operating system rather than Disk Commander. Therefore, if you

Page 66

are running the DOS version of Disk Commander, or the Win32 version on a Windows 9x/Me system, you will not be able to directly select NTFS volumes. Similarly a Windows NT 4.0 system will not normally recognize FAT32 volumes.
Warning: The drive letter assignments you see in Disk Commander may be different than what Windows assigns. Please carefully examine the sizes and labels of all of the drives before making a selection.
If you select a drive letter then you will be able to salvage files from the volume, but not make any kinds of repairs (normally if the volume is assigned a drive letter than there are no further repairs that Disk Commander can perform). If you wish to make repairs to the partition then indicate the volume does not have a drive letter.

By selecting a drive letter here you advance straight to the Salvaging Files screen.

Page 67

Selecting a Target Disk
If the volume you are interested in was not assigned a drive letter, or you elected not to use the letter assigned, then you must help Disk Commander to locate the volume. Select which physical hard disk that contains the volume you need to recover files from.

Lost Volume Scan

The next page in the wizard gives you the opportunity to scan for lost volumes. Disk Commander will always look at the partitions defined in the partition table for the disk you have selected, but it can also perform an exhaustive scan of your disk attempting to locate volumes that do not appear in your partition table. The exhaustive scan takes a long time to perform and is usually not necessary to recover your data. You may want to skip the scan initially and

Page 68

see if Disk Commander can locate your volume without it. If it cannot then back up and perform the scan. After you perform a scan Disk Commander will save the results in a file so you do not have to perform the scan again, even if you exit and restart the program.

Partition Table Backup

Because Disk Commander allows you to modify your partition table, you may want to create a back up of the information stored there. Disk Commander allows you to back up the partition table entries, as well as the boot sectors of each of your partitions, and save them to a file. The backup file can be stored in the Disk Commander installation directory (if running from a floppy disk it will be stored on the floppy disk) or on a floppy disk you designate.

Page 69

You can use the back up to restore your partition table and boot sectors in the event that your changes cause additional problems with your system.

Volume Recovery

The Recover Volume screen is the main screen for analyzing and modifying your disk. The screen displays information about your disk in several ways. The top most pane shows the layout of partitions on your disk. Every disk starts with a Master Boot Record (MBR) shown in red, followed by one or more partitions and extended partitions. NTFS volumes are shown in blue, while FAT volumes are shown in green. Extended boot records (used to delineate logical volumes) are shown in yellow. The middle pane shows volumes that were discovered by Disk Commander while scanning your disk. (If you elected not to perform a disk scan on the Lost Volume Scan screen then this area will not be shown.) Some of the

Page 70

volumes in this area may overlap your regular volumes; these may be remnants of volumes created and then deleted at some point in the past. You may also see volumes that seem to be identical to existing volumes, but there is a slight difference: these volumes are shown because they can be mounted using an alternate boot sector. If the regular boot sector for a volume has been corrupted you can use this backup version of the partition to repair or salvage data in the original. The bottom pane provides a summary of all the displayed volumes. It first lists the regular volumes, followed by lost volumes. Clicking an entry in the top or middle pane will automatically select the corresponding entry in the bottom pane, and vice versa. You can select a volume and click the Details button to obtain additional information about the volume youve selected.

Page 71

Salvaging Files
Use the Salvage Files option to scan a partition for files that reside on it, and to copy those files to a safe location. Disk Commander allows you to scan for either regular files (including files that have been damaged or rendered inaccessible by disk corruption), or for files that have been accidentally deleted. After you select the type of files you wish Disk Commander to look for it may take several minutes to scan the volume. Once Disk Commander has finished scanning your volume for files it presents an Explorer-like view of the files and directories it has found. In order to copy one or more files off of the corrupt volume:
Click on a file or directory icon. Click the (De)Select button to mark the file/directory. A black check mark on a file or directory icon indicates that it is marked to be salvaged. A gray check mark on a directory icon indicates that some of the files it contains are marked to be salvaged. Mark all files and directories you wish to salvage. You can unmark a marked file/directory by clicking the (De)Select button again. Type the path of a directory on an intact volume to which you wish to copy the marked files/directories, or use the Browse button to select one. If you wish for Disk Commander to preserve the directory structure of the files being copied then ensure that Preserve paths is checked. Otherwise no directories will be created when the files are copied. Click Next to begin copying files.

Page 72

Once you have copied files off the volume you can exit Disk Commander, or return to this screen to copy additional files. Even though a file appears to successfully copy, it does not necessarily mean that its contents are those it originally had. Files that are deleted may have been overwritten with other file data, and corrupt files may contain invalid data. In addition, Disk Commander reports copy errors when the amount of file data it can salvage for a file is smaller than the apparent size of the file. For these reasons you should examine salvaged data carefully to ensure that it is intact and complete.

Page 73

NOTES:
The percentage value shown next to files indicates Disk Commander's estimate as to how much of a deleted file is intact. The value is based on heuristics and is not definitive, however you can use it as guide for selecting the best candidate for a restore when there a number of deleted copies of the same file. After copying files and returning to this screen your selections are not automatically cleared. Select the root folder and pre (De)Select twice to clear all of you selections. Use the Search button to search for files or directories by name. Disk Commander will search for any file or directory whose name contains the text you enter. The use of wild cards in your search is not supported by Disk Commander. If a file is deleted it will be marked with a red X. If a file or directory is found but it cannot be determined which directory it belongs to (possibly because the parent directory is destroyed) then it is placed in a directory labeled <orphan> and marked with X. It is possible for there to be multiple orphan directories, each corresponding to a different directory that no longer exists.

Page 74

Frequently Asked Questions
Why do I get access denied errors when I try to replace a system's Registry hives? If you are running a utility that accesses the Registry of the system being repaired you will be unable to replace the Registry hives. Utilities that access the Registry include Regedit, Explorer, Service and Driver Manager, System Information, and Event Log Viewer. Why didnt you use the Windows versions of the tools instead of writing your own? ERD Commander 2003 includes special versions of several utilities to comply with Microsoft licensing requirements, and to provide interfaces that are intuitive in its repair environment. For example, the Windows Regedit utility would only allow you to edit the ERD Commander 2003 Registry, whereas ERD Commander 2003 Regedit allows you to edit the Registry of the installation that you wish to repair. Why cant I have more than 4 applications active at the same time? This limit results from the restricted environment in which ERD Commander 2003 executes. Why are some Registry keys empty when I know I should see subkeys? When you use Regedit, ERD Commander 2003 attempts to load the Registry hives (files) that make up the Registry keys that you are familiar with. The Logon application informs you if it cannot load a hive, and those that it cannot load result in empty Registry keys within Regedit and possibly limitations to the functionality of other ERD Commander 2003 applications. Registry hives reside in

Page 75

%systemroot%\system32\config and cannot be loaded if they are either missing or corrupt. The correspondence between hives and their Registry keys is as follows:
Hive Name SAM SECURITY SOFTWARE SYSTEM Registry Key(s) HKLM\SAM HKLM\SECURITY HKLM\SOFTWARE HKLM\SYSTEM, HKCR
Why does ERD Commander 2003 freeze when I eject the ERD Commander 2003 CD-ROM? Individual ERD Commander 2003 applications are loaded into memory on demand. If you remove the ERD Commander 2003 CD the system cannot read any items not already in memory, potentially causing a fatal error within the ERD Commander 2003 environment. In this event the system must be rebooted to continue running ERD Commander 2003. Why does my application behave strangely or fail to execute when I run it inside of ERD Commander 2003? The ERD Commander 2003 environment is a stripped-down version of the standard Windows XP environment and is missing many noncore system files, services, and run-time support.

Page 76

Order Winternals products online at www.winternals.com, or by fax, phone or email: Phone: Fax: Email: (800) 408-8415 (512) 330-9130 (512) 330-9131 sales@winternals.com
Winternals Software LP 3101 Bee Caves Road Suite 150 Austin, TX 78746 USA

Page 77

Technical Support
To view Online Help, press F1 or select Help from the ERD Commander 2003 Start Menu. To access the ERD Commander 2003 Support Knowledge Base, visit our support web site at: www.winternals.com/support You may also request help by email for issues not covered in the Online Help or Support Knowledge Base. Please visit: www.winternals.com/support/getsupport.asp or send email to: support@winternals.com Customers who have purchased Product Assurance may receive phone support by calling 512-330-9861. Before contacting support, please determine if the problem is reproducible, and if so, record the steps necessary to reproduce it. In addition, please have the following information about your system ready:
Windows version (including Service Pack) of the system being repaired, Memory size, disk types, and file system types Version of ERD Commander 2003 The License Number shown on the lower right of your ERD Commander 2003 desktop

SAM, 21, 87 SCREEN command, 40, 48 SCSI adapters, 13 Search, 34, 36, 85 Security attributes, 2 service and driver configuration, 5, 58, 73 service and driver manager, 1 Service and driver manager, 5, 19, 51, 58, 86 Service pack, 2, 20, 24 services, 2, 5, 20, 60, 87 Set Child Attributes, 28 SET command, 40, 48 START command, 40, 49 Start menu, 23, 24, 25, 34, 58, 60, 63, 65, 67, 69, 71 System Compare, 5, 19, 73 system diagnosis, 2 system files, 2, 3, 5, 24, 50, 71, 87 System Information, 18, 24, 51, 86 System Requirements, 8 System Restore, 19, 71, 72 System Restore Wizard, 71, 72 task bar, 23 TCP/IP, 19, 20, 31, 63 TCP/IP Configuration, 19, 20, 63 Text editor, 1 TIME command, 40, 49 Time zone, 22 TYPE command, 40, 49 Unbootable system, 5, 7, 73 updates, 2, 71 username, 31 VER command, 40, 49 VERSION command, 40, 49 Virus, 6, 76 Win32, 19, 74, 77 Windowing, environment, 1, 18 Windowing, shell, 18, 22, 23, 74 Windows 2000, 1, 2, 3, 4, 5, 6, 8, 20, 21, 34, 36, 51, 56 Windows 95, 8 Windows NT, 1, 2, 3, 4, 8, 20, 21, 77 Windows Server 2003, 1, 3, 4, 8, 20, 21, 56 Windows XP, 1, 3, 4, 5, 6, 8, 13, 14, 18, 20, 21, 38, 51, 55, 56, 71, 72, 87 XCOPY command, 40, 50 ZIP drives, 3 ZIP files, 25

Page 80

Winternals Software's ERD Commander 2005 simplifies system repair
Version 1.0 July 14, 2006

By Erik Eckel

Takeaway
ERD Commander 2005 from Winternals Software is not cheap, but with the investment comes a collection of powerful utilities you can use with confidence to repair failed systems. Best of all, its completely legal.

ERD Commander 2005

Rescue boot CDs are plentiful. Numerous ISO images populate the Internet. From Hirens BootCD to a BartPE disk, numerous options exist for rescuing failed systems quickly. Not all are legal, and some are outright flaky. If you work within a larger enterprise youd be well served to take a look at Winternals Softwares ERD Commander 2005. A core component of Winternals $1,439 Administrators Pak, ERD Commander 2005 isnt cheap. But with the investment comes a collection of powerful utilities you can use with confidence to repair failed systems. Best of all, its completely legal.

Booting

Figure A
The Winternals ERD Commander 2005 boot process appears similar to that used by Windows XP.
Page 1 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html
Place the ERD Commander 2005 boot CD in an accessible drive, bypass the existing or inoperative operating system by booting from the CD, and the utility will create a miniature Windows XP environment. Though limited in scope, the interface enables troubleshooting a variety of Windows operating systems, including Windows NT 4.0 (Service Pack 4 or later required), Windows 2000, Windows XP and Windows Server 2003. Figure B
ERD Commander 2005 is capable of identifying numerous installed Windows installations; when booting using the ERD Commander 2005 CD, simply select the Windows installation you wish to repair.
Page 2 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html
Once running, ERD Commander 2005 presents a Windows XP-like interface providing access to numerous troubleshooting tools in a graphical environment, including: Administrative Tools Autoruns, Disk Management, Event Log, Reg Edit, Service and Driver Manager and System Information. Networking Tools File Sharing, Map Network Drive and TCP/IP Config. System Tools Crash Analyzer, Disk Commander, Disk Wipe, File Restore, Hotfix Uninstall, Locksmith, System Compare, System File Repair and System Restore. Menu Tools Console, Explorer, Internet Browser (Mozilla Firefox version 1.0), Notepad, Search, Solution Wizard, Help and Run (command line).

Figure C

ERD Commander 2005 creates a Windows XP-like graphical user environment for troubleshooting systems that wont boot.

Administrative tools

Selecting any of the Administrative Tools, which are accessed by clicking the ERD Commander 2005 Start button and clicking Administrative Tools, opens a Windows 2000 Computer Management-like console. Administrators can leverage the console to perform Disk Management functions just as if the technician had booted into Windows and selected Disk Management within the Computer Management console. In addition to formatting partitions, Disk Management can set partitions active and change drive letters, among other tasks. Accessing Winternals Event Log, meanwhile, provides the ability to review Application, Security and System logs as if the technician had booted into Windows and selected Event Viewer from within the Computer Management console. Information found within these event logs can prove critical in identifying and eliminating the issues that are preventing a system from booting or operating properly.

Page 3 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

Figure D

Event Viewer logs, accessible within ERD Communicator 2005, can prove invaluable in tracing the cause of system failures. RegEdit provides the standard registry editing utility for correcting problematic registry entries, while System Information reports on critical system specifications. RegEdit can prove a lifesaver in reversing a registry setting thats prohibiting Windows from booting. System Information, meanwhile, reveals the computers name, OS kernel version, OS product type (such as Windows XP Home versus Professional), current service pack, applied hotfixes and more. Such data helps identify or eliminate potential causes for failure and ensures an administrator can collect as much information as possible about a failed, non-booting system. Wayward services and errant drivers can also prevent systems from starting properly. ERD Commander 2005s Service and Driver Manager offers support professionals a simple interface for resurrecting desktops and servers that are failing due to problematic services and drivers. Using the Service and Driver Manager, technicians can view services and drivers that load by default. Using simple right-click actions, services can be disabled, set to manual, configured to run at boot or set for automatic startup. Drivers can be reviewed and reconfigured, too, as well as updated. Autoruns provides another powerful graphic-based tool. The utility lists programs that run automatically when Windows starts, including those that arent always listed in Windows default Startup folder. Within the ERD Commander 2005 boot environment, administrators can then make any adjustments as needed, thereby enabling the removal of programs or files whose automatic execution is prompting Windows to fail.
Page 4 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

Networking tools

The ERD Commander 2005 Networking Tools are accessed by clicking Start, selecting Networking Tools and clicking the desired utility. Selecting the File Sharing option opens the Start Network File Sharing dialog box, which enables securely sharing a troubled systems files on the network. Using File Sharing, an administrator can recover a failed systems data over a network. Security comes into play by virtue of the technicians ability to require a username and password, set by the administrator, to access the troubled systems data. The Map Network Drive feature supports mapping network drives within the ERD Commander 2005 environment. Mapping network drives proves helpful when opening supported console sessions requiring access to files on a network drive and when using the default My Computer and Explorer applications to access network shares holding recovery software, drivers, service packs or antivirus signatures. TCP/IP settings also can be configured when using ERD Commander 2005. Select TCP/IP Configuration to open an applet enabling IP, DNS, subnet mask, and default gateway addressing information. Figure E

ERD Commander 2005 supports configuring or changing TCP/IP information, which can make the difference between having to reinstall Windows or connecting a failed system to the network where additional troubleshooting tools can be accessed to recover the existing installation.
Page 5 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

System tools

A host of system tools are available, too, many with wizards that walk technicians through troubleshooting inoperative PCs and servers. Crash Analyzer works with Microsofts Debugging Tools for Windows (which must be downloaded from Microsofts Web site) to analyze system crash dumps. The resulting information helps isolate the cause of crashes, thereby guiding administrators recovery efforts. Disk Commander helps recover files that have been lost as a result of everything from file system errors to inadvertent partitioning and formatting. File Restore is similar, except it works to recover files that were deleted and emptied from the Recycle Bin. Incidentally, Disk Commander, too, can be used to recover files that have been inadvertently deleted. In larger organizations, where users often discard important documents and empty the Windows Recycle Bin, such file recovery tools are a necessity. Most everyones familiar, now, with horror stories of discarded PCs and servers leaking confidential information. Remembering to properly delete sensitive data before discarding used equipment can be tough, but ERD Commander 2005s Disk Wipe makes easy work of actually wiping hard disks. Administrators can elect to complete a simple pass overwrite or opt for a four-pass deletion that meets US Department of Defense 5220.22M security requirements. Other features ERD Commander 2005 offers include a console for command line administration, the ability to uninstall hotfixes selectively, a Locksmith feature enabling Administrator passwords to be reset (helpful when users forget their system passwords or an administrator leaves without divulging passwords to his or her replacement), File System Repair (for automatically discovering and repairing corrupted Windows system files) and System Restore, which provides access to the Restore Point Wizard. ERD Commander 2005 includes Mozilla Firefox (version 1.0) for Internet browsing from within the limited Winternals operating environment (which comes in handy when needing to search the Web for specific drivers or updates), along with Notepad, Search and a Solution Wizard designed to help guide support professionals through a myriad number of solutions that can be used to recover a failed system.

Creating the ERD Commander boot CD
Creating the ERD Commander Boot CD itself is a relatively simple proposition. Using the Winternals Administrators Pak, select the ERD Commander 2005 Boot CD Wizard (accessed by clicking Start | Programs | Winternals Administrators Pak on the system where the Administrators Pak is installed). The wizard walks technicians through the process of creating the CD image. Technicians must specify the location of any required mass storage drivers to be included. They must also note which tools should be included on the CD image the wizard creates. In addition, whichever staff member builds the CD must specify whether the CD should support Remote Recover, which enables accessing an ERD Commander 2005 CD-equipped system over a network for remote troubleshooting and repair. When using Remote Recover, ensure firewalls are set to pass port 18002 traffic, as this is the default UDP port ERD Commander 2005 uses to communicate over a network.
Page 6 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

Figure F

Winternals ERD Commander 2005 also supports accessing the tools recovery utilities remotely. When the Winternals environment boots, select Run Remote Recover Client on the target system to provide an administrator with access to the ERD Commander 2005 toolset over a network. Here the default setting is selected enabling a technician or support professional to interact with a system locally. Once the wizard completes it creates an ISO image in the location the technician specifies. The wizard can burn the ISO image to a CD, or you can elect to burn the CD yourself using your own preferred CD creation software. In the event a server or PC encounters trouble before you have an opportunity to create a bootable CD for it, you can also use the Administrators Pak OEM CD to boot ERD Commander 2005. Note that, should you do so, you may not have access to mass storage drivers required to access a systems hard drives.

Page 7 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html

Additional resources

TechRepublic's Downloads RSS Feed Sign up for TechRepublic's Downloads Weekly Update newsletter Sign up for TechRepublic's Network Administration NetNote newsletter Check out all of TechRepublic's free newsletters Winternals Administrator's Pak collects multiple enterprise-class utilities in single toolkit

Version history

Version: 1.0 Published: July 14, 2006

Tell us what you think

TechRepublic downloads are designed to help you get your job done as painlessly and effectively as possible. Because we're continually looking for ways to improve the usefulness of these tools, we need your feedback. Please take a minute to drop us a line and tell us how well this download worked for you and offer your suggestions for improvement. Thanks! The TechRepublic Downloads Team
Page 8 Copyright 2006 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html