The quick answer, you're pretty much there. Check value of Current
in the key HKEY_LOCAL_MACHINE\SYSTEM\Select
. This will tell you which of the CurrentControlSet00X
's you need to make your change in.
For example, if Current
is set to 2
, you need to edit HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet002
with your changes.
The way it works is this:
Windows always keeps a few copies of this key, suffixed 001 to 003 (only 2 in Windows 7 I think?). CurrentControlSet001, CurrentControlSet002 and CurrentControlSet003. Think of them as the master keys that are persistent while the computer is switched off.
When you log into Windows, it picks the last used key, using the value of Current
in the HKEY_LOCAL_MACHINE\SYSTEM\Select
key. The content is copied into a key called HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
. This key is what Windows plays with while you are logged on.
When you log off of Windows, changes are written back to the key that was original copied from when you first logged on. CurrentControlSet002
for example. CurrentControlSet
vanishes, so to speak. This is why you are unable to see it while you are logged off, working from the recovery console :-)
Probably a bit over the top with my answer (I blame the Red Bull), but I figured I'd answer a detailed question with a detailed answer.
It goes without saying that you should back up all your user data first and anything important on the broken machine. As you should be aware, there are risks in doing this, and really the easiest thing would be a full install - and to not mess with the registry. But, that of course is up to you. However, you may see latent issues if/when you get Windows back up...
Here is a pretty good guide, I used it once when I was in IT (though that was a while ago).
You should be able to load the other drive's Hive file and restore that way:
EHOW Run-Through
- Login to your other Windows drive
- Type "regedit.exe" into the search box
- Expand "HKEY_LOCAL_MACHINE", click "FILE" > "Load Hive", navigate to your broken drive.
- Browse to "Windows\System32\Config", select a Hive file from the list (SAM/Security = User Rights / Passwords, System = OS,
Software = third party)
- Click "Open" and name it, click OK
- Modify away, though this will be pretty manual.
- Left click Hive, "File" > "Unload Hive"
Best Answer
MiTeC's Windows Registry Recovery can read the files and even export them into REGEDIT4 format like a normal registry backup.
Windows Registry Recovery is freeware.