Registry Ruckus

by Rick Watkins

September 16, 2004

Windows XP Pro and my IBM R32 ThinkPad have been uneasy partners from the beginning. Many applications that were rock-solid under Win98-SE developed strange, unexplained twitches under XP. Twitches that IBM support was never able to explain - let alone resolve.

On the morning of Sept. 11th, memory leaks had reduced free RAM with no apps running to a mere 112 Meg (out of 512 Meg total). The 2 GHz processor had slowed to a crawl. Time to shut the machine down and start afresh.

One source of annoyance with XP was that when shutting Windows down, power was no longer automatically shut off. This problem began six months, or more, ago. Caution dictated that I wait until the disk access light quit flickering - and then wait a bit more before manually shutting power off.

Well, this fine morning, when I turned power back on, XP struggled to life with the initial screen and its blue bullets rotating through the progress bar. XP was never a fast-boot, but this was getting ridiculous. Finally the screen went blank, but rather than seeing the cursor, the screen went blue with a cryptic message which quickly disappeared from view. It said something about not being able to open (or read, or something) a file.

I was greeted with the choice of booting in one of 3 Safe Modes, or try to boot normally, or roll back to the prior good configuration. I selected the roll back option, but XP, again, failed and I was soon greeted with the same choices. I tried them all. Safe Mode spewed a long stream of device drivers being loaded, hung for a long time, then rebooted.

Along the way, I was able to make more sense of the "blue" screen message. The errant file was SystemRoot/System32/Config/SOFTWARE? or the associated .LOG file (whatever that was)? or an alternate (unnamed) file. One or more of these must be corrupted - probably due to my somewhat premature shut down of XP. But, how to get at the file?

Part of the agony of transferring my work from a prior Win98-SE ThinkPad had prompted me to use PartitionMagic 8.0 to provide 3 boot options: XP, 98-SE, or the hidden recovery partition (no recovery CD came with the machine). Booting into Win98 allowed me to use PartitionMagic to browse the XP NTFS volume. After much exploration, I found that SystemRoot was C:\Windows. There was, in fact, a file called SOFTWARE. And it was accompanied by SOFTWARE.LOG and SOFTWARE.SAV. Okay, I'd found them. Now what?

Partition Magic doesn't provide a way to view the contents of files. But, you can view the date info and rename and delete files. Perhaps XP would regenerate needed files if it found them missing. I tried to boot XP after naming each file in turn. No joy. I restored the names and began searching for alternatives.

I asked PartitionMagic to provide info about the XP partition. As it scanned the partition, it presented me with several error messages. The first was #1516. Searching Help revealed that the partition was improperly dismounted. The solution suggested was to simply run CHKDSK on the volume. Unfortunately, the XP volume is in a NTFS partition and Win98 can't do anything with NTFS. But PartitionMagic can copy partitions and change them. If I could copy the XP partition and convert it to FAT32, I could run CHKDSK on it. Then convert it back to NTFS, and finally copy it back to the original partition.

Well the XP partition is 20Gig with 3Gig free. In fact, I only have 6Gig free on the entire 40Gig drive. Fearing potential data loss, I was unwilling to convert the actual partition. A quick trip to MicroCenter got me a 60Gig hard disk and a Suse Linux 9.1 that included a Live-CD, which my friend Ed suggested might be used to access the NTFS volume if all else failed. I don't have enough Internet bandwidth to download Knoppix in a reasonable time. I'm now 1 day and $200 into solving the problem.

The ThinkPad has a CD/DVD drive mounted in the Ultrabay. Adapters permit replacing this with a Floppy, 2nd Hard Disk, a ZIP drive, or a 2nd Battery. With the 2nd hard disk installed, I asked PartitionMagic to copy the XP partition to the 2nd drive. Everything seemed in order until PartitionMagic executed the request. It failed because the XP partition was improperly dismounted. Catch 22.

Okay, maybe Suse would work. I reinstalled the CD drive and booted from the Suse Live-CD. No go. It threw a fatal error trying to access the ThinkPad PCI bus.

Well, if I could get XP running on the 2nd hard disk I could use that to CHKDSK the old XP partition. I used PartitionMagic from Win98 to copy the Recover partition to the new hard disk and made it bootable. Then I swapped the internal hard disk with the Ultrabay disk and rebooted. Recover ran - but did not install XP Pro on the disk. Sleep is now long overdue. Time for bed.

A new day dawns. Time for another trip to MicroCenter. Alas, my car's battery is dead. At last, a problem I CAN deal with!

At MicroCenter I checked out RedHat Linux. The sales people called IBM and affirmed that it would work "out of the box" with ThinkPads. Seemed logical since IBM bought a share of RedHat. Perhaps that's why it costs $100 vs. Suse at $30. Out of morbid curiosity I asked what XP Home cost. $200. XP Pro was over $300. I decided to talk with the tech support folks to see if they had some other solution. It was there I learned that if I bought any PC peripheral, I could get XP for half price. The nice lady offered to un-sell me the hard disk I bought the day before and re-sell it to me with XP Home Edition. I installed XP Home on the 2nd hard disk - and PartitionMagic. That let me hide the Win98 partition and unhide the old XP partition. I did a copy-n-paste of all data from the 20Gig XP volume to a new directory on the XP Home drive. Windows reported that it would take several hours! Plenty of time to eat and play a game or two of Crazy 8's with mother.

When I returned I found that XP had aborted the copy soon after I left to eat. Okay, time for CHKDSK. It ran and ran and ran - and reported fixing numerous errors. I again reversed the hard disks and tried to re-boot XP Pro. No soap.

On day 1, I'd discovered the System Volume Information directory and the _restore{long hash code} subdirectory. Within that were a slew of RPxxx sub directories. Within each of those were 48 files and a Snapshot subdirectory. Within that directory were 17 files and yet another subdirectory - repository. And, yes, yet another subdirectory under that. The 17 files all had names like _REGISTRY_MACHINE_whatever. One was named _SOFTWARE and was about the same size as the SOFTWARE file XP was complaining about. Hmmm.

I deleted ?\System32\config\SOFTWARE and replaced it with the _REGISTRY_ file after renaming it to SOFTWARE. I swapped the disks again and rebooted.

Walla! Nearly 3 days and $350 later the problem was solved. Along the way, I called IBM tech support who researched the problem and assured me that reformatting the disk and reinstalling XP Pro was the only answer. When I observed that my machine never came with a Recovery CD, they offered to sell me one for $42 because my machine was 6 months out of warranty. Had I asked for one earlier, it would have been free. When I said that the documentation with the PC never even hinted that a CD was available, he chuckled and replied that "it's in the REALLY small print."

I've been writing this during a 3.5 hour download of a trial version of Dantz backup software. The 24 kb/s download aborted after 3 hours. And life goes on.