Fixing pagefile.sys from recovery console???

On Sep 26, 6:08*am, Andy <1...@2.3> wrote:
> On Fri, 25 Sep 2009 15:32:27 -0700 (PDT), surface9 <da...@neto.com>
> wrote:
>
>
>
> >I was able to create the hive for the backup and load it into regedt32
> >and to my suprise all the entites mentioned above are exactly
> >identical to the primary system. *(I am sure I was viewing the backup
> >because I gave it an unusual name XXXX) *The only thing that makes me
> >wonder is under dosdevices, each of the letters has a series of two
> >digit numbers behind them - if that designates a serial number for the
> >H/D, then that might be a problem because the one for DosDevices\C
> >would be to the primary h/d and NOT the backup - but, I don't even
> >know what those numbers mean. *The pagefile.sys was exactly the same,
> >so, unless there is something else to check, it looks like I'll need
> >to just go ahead and use ROBOCOPY, which will overwrite my current
> >backup that I can't seem to get past the pagefile.sys problem anyway.
>
> The first four pairs of hex numbers is the disk signature. In order
> for the clone to work correctly, the disk signature in MountedDevices
> has to be identical to the disk signature that is located in the MBR
> of the clone disk.http://www.geocities.com/thestarman3...r/Win2kmbr.htm
>
> The easiest way to make this happen is to boot from a Windows 98
> emergency boot disk, and run the fdisk /mbr command, which will zero
> the existing disk signature. Then when Windows 2000 is booted, the
> loader will see that the disk signature in the MBR is zero, change it
> so it's not zero, and modify the disk signature fields in the registry
> so they're identical to the MBR disk signature.
>
> Another way is to use a program such as MBRWizard to change the disk
> signature in the MBR so it agrees with the registry. This will make
> the disk signature identical to the parent disk's, and if you connect
> both disks to the computer, the disk signature in the MBR of one of
> the disks will be changed when Windows is booted.
>
> A third way is to modify the disk signature field in MountedDevices in
> the registry of the clone so it matches the disk signature in its MBR.
>
>
>
> >One other thought *- could it be that the system under which you are
> >performing the copy must be DIFFERENT from the system you are
> >copying? *When I backup my XP system, I am using windows 2000 as my
> >auxillary boot, so the xcopy command is being run under Win2000 but
> >against XP as both the source and target. *Maybe that is why it works,
> >and, for me to be able to use win2000 as a source and target, I might
> >need to create an auxillary bootable h/d with XP (just to make it a
> >different system while performing the xcopy).
>
> >So much confusion - I really wish there was something I could do from
> >the repair console to fix the problem, but, alas, it seems to be well-
> >hidden.

Hallelujah!

FIxing the disk signature in the MBR of my backup solved the problem,
and, I am now booted up on my backup (primary being disconnected)
replying to this post on my backup. It turns out that the 4 digit
value in the MBR for the disk signature of the backup was not the same
as in the registry for Drive C, but was correct for Drive F (the
target when the xcopy was performed). So, I just used the disk editor
program (from starman, using your web refernce), DE (booted from DOS),
to write over this disk signature in the backup to match what is
already in the registry for drive C:, and, bingo!, it worked like a
champ. So, now, I am confident that I can xcopy this backup back onto
the primary (should the primary pick up a virus), and the registry
will already be correct so it should boot right up.

The only thing I still wonder about is why I had to run FIXMBR and
FIXBOOT (using the recovery console from booting with the win2k CD),
before the backup will boot. If I just run the xcopy from the source
to the backup and try to boot to the backup, it says it is a non-
bootable disk. Booting to the win2k CD and entering the repair
console and running fixmbr and fixboot solves that problem. Just
curious about it.

So, anyway, I can now put the backup on the shelf and be ready to
restore it anytime my primary gets infected. Thanks for the pointers.