中国DOS联盟

### Windows Recovery Console

>>1. <<
The moon has its cloudy and sunny phases, and people have good and bad fortunes. Every system can crash. What do you do when Win2000 crashes? Maybe you have bluecon, ERD Commander, Winresume, etc. But in extreme environments, we often use the built-in Windows 2000 Recovery Console. When it comes to the Recovery Console, most people use its emergency automatic repair process. This function is good for simple failures such as damaged system programs or lost boot partitions. But for more complex problems, system administrators may need to solve them manually. In the absence of other auxiliary tools, we try to explore the potential of the Recovery Console built into the Windows 2000 installation disc.

The simplest way to use the Recovery Console is to boot the system using a Windows installation disc (Windows 2000/XP/2003).
The steps are as follows:
1. Insert the Windows 2000 boot disk into the floppy drive, or insert the Windows 2000 CD-ROM into the CD-ROM drive, then restart the computer;
2. Follow the prompts and click to select any options required to boot the computer from the CD-ROM drive;
3. When the "Welcome to Setup" screen appears, press the "R" key to start the Recovery Console;
4. If you are using a dual-boot or multi-boot computer, select the system path that you need to access from the Recovery Console;
5. Type the administrator password; if the administrator password is empty, press the ENTER key.
6. Enter the Recovery Console command line interface.

Then you will enter a restricted command line interface. In this command line interface, you can use the Recovery Console to enable and disable services, format drives, read and write data on local drives, and perform many other management tasks. You can use the Recovery Console to copy files from a disk or CD-ROM to the hard disk to repair the computer, or reconfigure services that prevent the computer from starting normally. The reason it is restricted is that it does not provide the functions of a complete cmd.exe and additional command line programs, but only provides limited functions for operating system core services. Especially for security reasons, by default, it is not allowed to modify, replace, overwrite, and reference files. It is for this reason that many people are extremely disgusted and troubled by this seemingly useless console. How to open these restrictions will be explained later.

After entering the Recovery Console, you can enter recovery console commands or help to view all commands and help; for information about specific commands, you can use help commandname to view detailed information and command parameters.
To exit the Recovery Console and restart the computer, type exit at the command prompt and press the ENTER key.

All commands supported in the Recovery Console:
attrib delete fixboot md type
cd dir fixmbr mkdir systemroot
chdir disable format more
chkdsk diskpart help rd
cls enable listsvc ren
copy exit logon rename
del expand map rmdir


>>2. <<
The detailed command functions and parameters are as follows:


* ATTRIB
You can use the attrib command and any of the following parameters to change the attributes of a file or folder:
-r: Set the read-only file attribute
+r: Reset the read-only file attribute
-s: Set the system file attribute
+s: Reset the system file attribute
-h: Set the hidden file attribute
+h: Reset the hidden file attribute
Note: At least one attribute must be set or cleared. To view attributes, use the dir command.



* BATCH
batch inputfile
You can use this command to run the commands specified in the text file. In the command syntax, inputfile specifies the text file containing the list of commands to be run, and outputfile specifies the file containing the output of the specified commands. If no output file is specified, the output will be displayed on the screen.



* CD and CHDIR
You can use the cd and chdir commands to change folders. Type cd .. to indicate that you want to go to the parent folder. Type cd drive: to display the current folder in the specified drive. Type the command without parameters to display the current drive and folder.
The chdir command treats spaces as delimiters. Therefore, the subfolder name containing spaces must be enclosed in quotes, for example:
cd "\winnt\profiles\username\programs\start menu"

The scope of operation of the chdir command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.



* CHKDSK
chkdsk drive /p /r

This command (where drive specifies the drive to be checked) checks the drive and repairs or recovers it if necessary. This command also marks bad sectors and recovers readable information.

The /p switch instructs the Chkdsk tool to perform an exhaustive check of the drive (even if the drive is not marked as problematic) and correct any errors found. The /r switch finds bad sectors and recovers readable information. Note that if the /r switch is specified, the /p switch is implied. You can specify the chkdsk command without parameters, in which case the current drive is implied without any switches. The switches listed do not need to be accepted in order. The chkdsk command requires the Autochk.exe file. Chkdsk automatically looks for this file in the startup folder. Usually, if the command console is pre-installed, this folder is the Cmdcons folder. If this folder is not found in the startup folder, Chkdsk will try to find the Windows CD-ROM installation media. If the installation media is not found, Chkdsk will prompt you for the location of the Autochk.exe file.



* CLS
You can use this command to clear the screen content.



* COPY
copy source destination

You can use this command (where source specifies the file to be copied and destination specifies the folder or filename of the new file) to copy the file. Wildcards are not allowed and folder copying is not allowed. When copying a compressed file from a Windows CD-ROM, the file will be automatically uncompressed.

If destination is not specified, this command defaults to the current folder. If the file already exists, the system will prompt you to overwrite it.



* DEL and DELETE
del drive:path filename

delete drive:path filename

You can use this command (where drive:path filename specifies the file to be deleted) to delete the file.

The scope of operation of the delete command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source. The delete command does not accept wildcards (*).



* DIR
dir drive:path filename

You can use this command (where drive:path filename specifies the drive, folder, and file to be listed) to display a list of files and subfolders in the folder. The dir command lists all files, including hidden files and system files. Files may have the following attributes:

D - Directory R - Read-only file
H - Hidden file A - Files ready for archiving
S - System file C - Compressed
E - Encrypted P - Reparse Point


The scope of operation of the dir command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.



** DISABLE
disable servicename

You can use this command (where servicename specifies the name of the service or driver to be disabled) to disable a Windows system service or driver.

You can use the listsvc command to display all appropriate services or drivers to be disabled. The disable command prints the old start type of the service before resetting the service to SERVICE_DISABLED. Therefore, you should record the old start type so that you can re-enable the service when necessary.

The following start type values can be displayed using the disable command:
SERVICE_DISABLED
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START


** DISKPART
diskpart /add /delete device_name drive_name partition_name size

You can use this command to manage partitions on a hard disk volume.
/add: You can use this parameter to create a new partition.
/delete: You can use this parameter to delete an existing partition.
device_name: You can use this parameter to specify the device name used to create a new partition. You can find this name from the output of the map command, for example: \Device\HardDisk0.
drive_name: You can use this parameter to specify the drive letter-based name used to delete an existing partition, for example D:
partition_name: You can use this parameter to specify the partition-based name used to delete an existing partition. You can use this parameter instead of the drive name parameter, for example: \Device\HardDisk0\Partition1.
size: You can use this parameter to specify the size (MB) of the new partition.
Note: If no parameters are used, the user interface for managing partitions is displayed.

Warning: If the disk has been upgraded to a dynamic disk configuration, this command may damage the partition table. Do not modify the structure of a dynamic disk unless you use a disk management tool.



** ENABLE
enable servicename start_type

You can use the enable command (where servicename specifies the name of the service or driver to be enabled) to enable a Windows system service or driver.

You can use the listsvc command to display all appropriate services or drivers to be enabled. The enable command prints the old start type of the service before resetting the service to the new value. You should record the old value so that you can restore the start type of the service when necessary. The following start types are valid:
SERVICE_BOOT_START
SERVICE_SYSTEM_START
SERVICE_AUTO_START
SERVICE_DEMAND_START


Note: If the new start type is not specified, the enable command prints the old start type.



* EXIT
You can use the exit command to exit the command console and restart the computer.



** EXPAND
expand source

expand source /d

You can use this command (where source specifies the name of the file to be expanded and destination specifies the folder of the new file) to expand the file.

Note: Wildcards cannot be included.
If destination is not specified, the command defaults to the current folder.

This command can use the following parameters:
/y: Use this parameter if you do not want the system to prompt you before overwriting an existing file.
/f:filespec: Use this parameter if the source contains multiple files. You need to use this parameter to specify the specific file to be expanded. Wildcards can be included.
/d: Use this parameter if you do not want to expand the folder; it only displays the folder of the files contained in the source.
The destination can be any folder in the system folder of the current Windows installation, the root of the drive, the local installation source, or the Cmdcons folder. The destination cannot be removable media. The destination file cannot be a read-only file. You can use the attrib command to remove the read-only attribute.

If you use the expand command and the destination file already exists, the system will prompt you unless /y is used.



** FIXBOOT
fixboot drive name:

You can use this command (where drive name is the drive letter in which the boot sector is written) to write new Windows boot sector code on the boot sector. This command fixes the problem that caused the Windows boot sector to be damaged. The emergency repair process can also repair the boot sector. This command overwrites the write default of the system boot partition.



** FIXMBR
fixmbr device name

You can use this command (where device name is an optional device name used to specify the device that needs a new MBR) to repair the master boot record (MBR) of the system partition. If the virus damages the MBR and Windows cannot start, you can use this command.

Warning: This command may damage the partition table if there is a virus or hardware problem. This command may cause the partition to be inaccessible. Microsoft recommends that you run antivirus software before using this command.

You can find this name from the output of the map command. If there is no this name, repair the MBR of the boot device, for example:
fixmbr \device\harddisk2

If Fixmbr detects an invalid or non-standard partition table signature, it prompts you whether to agree to rewrite before rewriting the MBR.



** FORMAT
format drive:/q /fs:file_system

You can use this command (where drive is the drive letter of the partition to be formatted and file_system specifies the type of file system to be used ) to format the specified drive to the specified file system. You can use this command and the /q parameter to perform a quick format on the drive.

If the file system is not specified, the existing file system format (if any) is used.



** LISTSVC
The listsvc command lists all available services, drivers, and their current start types of the Windows installation. You may need to use this command when using the disable and enable commands.

Note: This information is extracted from the %SystemRoot%\System32\Config\SYSTEM hive. If the SYSTEM hive is damaged or lost, unexpected consequences may occur.



* LOGON
logon

When using the logon command, a list of all detected Windows installations is displayed, and you are prompted to enter the local administrator password of the copy of Windows you want to log on to. If the logon fails more than three times, the console will exit and restart the computer.



* MAP
map arc

You can use this command (where the arc parameter tells the map command to use the ARC path instead of the Windows device path) to list the mapping of drive letters, file system types, partition sizes, and physical drives.



* MD and MKDIR
You can use the md or mkdir command to create a new folder. Wildcards are not supported. The scope of operation of the mkdir command is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.



* MORE
more filename
You can use this command to display the text file on the screen.



* RD and RMDIR
You can use the rd and rmdir commands to delete folders. The scope of operation of these commands is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.



* REN and RENAME
You can use the ren and rename commands to rename files. Note that you cannot specify a new drive or path for the target file. The scope of operation of these commands is limited to the system folder of the current Windows installation, removable media, the root folders of all hard disk partitions, or the local installation source.



** SET
You can use the set command to display or modify 4 environment options.
AllowWildCards = FALSE
AllowAllPaths = FALSE
AllowRemovableMedia = FALSE
NoCopyPrompt = FALSE


** SYSTEMROOT
You can use the systemroot command to set the current working folder to the %SystemRoot% folder of the Windows installation you are currently logged on to.



* TYPE
type filename
You can use the type command to display the text file.



>>3. << Basic Tasks
In the previous section, all the commands of the Win2000 Recovery Console are listed. The ones marked are all commands closely related to system failures. The possible failures and solutions related to them are as follows.

1. After installing Linux or other operating systems, Windows 2000 cannot boot...
# The reason may be that the master boot record (MBR) or the Windows partition boot record is modified. You can use the FIXBOOT and FIXMBR commands to repair the MBR and boot sector. The function of FIXMBR is equivalent to fdisk /mbr in DOS. FIXBOOT may need to specify the system installation partition path of Win2000, in the format like \Device\HardDisk0\Partition1.
Another possibility is that the system partition has changed, resulting in an incorrect system file path recorded in c:\boot.ini, so the system cannot boot. In this case, you need to modify the boot.ini file. Since there is no available text editor in the Recovery Console... so you may only be able to copy it to a removable media, edit it correctly in another system, and then copy it back. Note that this file has system implicit read-only attributes, and you need to first use attrib -s -r -h c:\boot.ini to be able to modify and replace it. For the method and problem of modification, see points 4 and 5.
If you use a powerful tool like Bluecon or WinPE, you can directly modify this file, and the work is simpler.


2. I added a new hard disk, how to partition and format it?
# Many people complain that there is no fdisk in the Win20 system, which is natural because it has been replaced by another command DISKPART. The command line parameters of DISKPART are as described in the previous section, and the device name is also in the format described above. It can run in both character control interface and command line operation modes. As for formatting, the format command is not much different from before, and the parameter format is very simple. The more useful parameters mainly include /FS:, which can specify the partition type for formatting. Tip: You can use the MAP command to view all currently recognized device paths.


3. I turned off the RPC/DCOM service according to some documents on the Internet to prevent the Slammer virus, so...
# So you encountered misfortune, didn't you? I said you shouldn't turn it off...
You can use the following command to turn it on: ENABLE Remote Procedure Call (RPC) SERVICE_SYSTEM_START. If you accidentally turned off other services, you can also use LISTSVC to view service information, and then use ENABLE to turn it on. LISTSVC will list all system services, including implicit services and driver services, which is much more powerful than Services.msc... Similarly, for failures caused by the failure of the system service to start, for example, if you don't like the Norton antivirus engine, you can also use DISABLE to disable it here. The last parameter of ENABLE and DISABLE is the start type, which is respectively defined as the stage and type of service startup. For details, see the key values in the registry and other materials.


4. I accidentally replaced a certain system service program/driver, and the system can't start...
# There are two methods. One relatively clean method is to extract the original driver file from the driver installation package in the system installation disc: expand d:\i386\driver.cab /f:filename
In this command, replace d: with the CD-ROM drive letter, replace filename with the name of the file to be expanded, and replace path with the folder where the driver program file is to be copied. Usually, the driver (.sys) file is stored in the %SystemRoot%\System32\Drivers folder. For example, to replace the Atimpab.sys driver file, you can type:
expand d:\i386\driver.cab /f:atimpab.sys %systemroot%\System32\Drivers\
Note that in this command, you must use the /f switch because the Driver.cab compressed file contains multiple files.
The installation files are stored in the compressed folder (called CAB (.cab) file) of the Windows 2000 installation CD-ROM. The driver files are stored in the Driver.cab file.
In addition, you can also use the copy command to copy a clean backup from another machine using a removable media (mainly a floppy disk). copy source filename target filename
Example: copy a:\atimpab.sys c:\winnt\system32\drivers\atimpab.sys. It should be noted that the "copy" command in the Recovery Console does not support wildcards. Therefore, you can only copy one file at a time. If you must replace multiple files, use multiple "copy" commands.



5. Wuwuwu, you lied... I used the copy command, but it said I don't have enough permissions and the copy failed...
# Well, this... I already knew it (actually, I was like this back then). Remember that it was mentioned earlier that this is a "limited console"? Well, in the Win2000 Recovery Console, for security reasons, it is not allowed to directly modify the files in the system. These are determined by several environment variables in the system, which can be viewed with the set command.

By default, the following rules are used:
AllowAllPaths = FALSE: This rule prohibits access to folders and subfolders other than the system installation you selected when entering the Recovery Console.
AllowRemovableMedia = FALSE: This rule prohibits access to removable media as the target of copying files.
AllowWildCards = FALSE: This rule prohibits wildcard support for commands, such as copy and del.
NoCopyPrompt = FALSE: This rule means that when you overwrite an existing file, the Recovery Console will prompt you for confirmation.

We only need to execute set allowremovablemedia = true, and then we can use the removable media to copy files.
Similarly, set AllowAllPaths = true, and then we can access files in all paths. You can take a look at other environment variables, maybe there are unexpected surprises. Now, don't you think this useless console is much more powerful?

Note: You must retype the set command every time you enter the Recovery Console.


6. It's annoying to have to boot with the disc every time...
# Well, actually, this can also be installed on the hard disk... Hehe.
To install the Recovery Console, please:
& Insert the Windows 2000 disc into the CD-ROM drive;
& Click the <Start menu>, then click "Run";
& In the open box, type drive:\i386\winnt32.exe /cmdcons, where drive is the drive letter of the CD-ROM drive.
& Start the installation process, then restart the computer. The next time you start the computer, there will be an additional item on the boot menu "Microsoft Windows Recovery Console".


7. My machine is an AD domain controller, and your method can't repair it...
# If the computer is a domain controller using Active Directory, then you should use the "Directory Services Restore Mode" in the boot mode menu, and enter the "Directory Services Restore Mode" password you selected when promoting the server to a domain controller.


8. I boot with the installation disc, but it can't recognize my hard disk, what should I do?
# Actually, you must have encountered this problem when installing the operating system. Because the Windows system does not have the driver for your hardware, so you need to provide your own third-party driver program. Before the Recovery Console starts, you can press the F6 key to install a third-party SCSI or RAID driver program, and then pray to God. If the RP is not too bad, then you can access your hard disk.


9. Finally, remind one point. The most important thing in system recovery work is to back up in time... back up the registry, back up the driver,
# Back up system files... and so on; the most basic work is to create an emergency repair disk of the current system. Otherwise, there may be a phenomenon that the emergency repair console cannot find the system installation... then you will want to cry.. right. Method:
My Computer -> Right-click on C: -> Tools -> Backup -> Emergency Repair Disk.


10. There are still too few commands for this thing, nothing at all...
# This... that... it's over... You still use O&O BlueCon, its functions are much more powerful;
http://www.freedemon.org/download/bluecon.iso
Or you can use WindowsPE or ERD Commander, which also have graphical interfaces and network support, equivalent to a mini Windows running from a disc. But that's a later story, and I won't mention it here.

There's a lot of content, it's dizzying to look at!

Tips:

You can use 2k's cmdcons to manage XP/2003 systems!! But the permissions are relatively low~~

Are diskpart and fdisk used in the same way?

　　I've always heard about this Fault Recovery Console, but I've never gotten in to play with it, sweat a bit first.

　　Good post, bookmarked for study～～

Thank you very much, I really learned a lot. I saved this post.

Never used it, really want to try it. Thanks

Originally posted by shatong at 2006-5-4 09:42 AM:
Study hard

Different

Just about to start learning this kind of knowledge, and now everything is here. Thanks.