ERD Commander 2005 User's Guide Winternals Software LP 3101 Bee Caves Road, Suite 150 Austin, Texas 78746 (512) 330-9130 (512) 330-9131 Fax www.winternals.com Copyright © 2005 Winternals Software LP ERD Commander 2005 User's Guide Table of Contents 1 2 Welcome to ERD Commander 2005.............................................1 Introduction ...................................................................................3 2.1 2.2 2.3 Capabilities...................................................................................... 3 Sample Screen................................................................................ 8 System Requirements..................................................................... 9 3 The Boot CD-ROM Wizard ..........................................................12 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 Introduction ................................................................................... 12 Welcome ....................................................................................... 14 License Agreement ....................................................................... 15 License Information....................................................................... 16 Extracting Files.............................................................................. 17 Select Target Functionality............................................................ 18 Select Remote Recover Port......................................................... 19 Remote Recover Security ............................................................. 20 Selecting the Included Utilities ...................................................... 21 Adding the Debugging Tools for Windows .................................... 22 Password Protection ..................................................................... 23 Adding OEM Storage Controller Drivers ....................................... 24 Adding OEM Network Controller Drivers....................................... 25 Adding Files to the CD-ROM Image.............................................. 26 Image Location.............................................................................. 27 Burning the CD-ROM .................................................................... 28 4 Using ERD Commander 2005.....................................................29 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 Introduction ................................................................................... 29 Network Initialization ..................................................................... 32 Role Selection ............................................................................... 33 Logon ............................................................................................ 34 Windowing Shell............................................................................ 36 System Information ....................................................................... 37 Explorer......................................................................................... 38 File Search .................................................................................... 41 FileRestoreTM ................................................................................ 42 Command Prompt ......................................................................... 44 Notepad......................................................................................... 59 Regedit.......................................................................................... 60 Service and Driver Manager ......................................................... 62 Event Log Viewer .......................................................................... 63 TCP/IP Configuration .................................................................... 64 Winternals Software Page i ERD Commander 2005 User's Guide 4.16 4.17 4.18 4.19 4.20 4.21 4.22 4.23 4.24 4.25 4.26 4.27 4.28 4.29 Disk Management ......................................................................... 65 Locksmith ...................................................................................... 66 File Sharing ................................................................................... 67 Map Network Drive........................................................................ 68 System Restore............................................................................. 69 System Compare .......................................................................... 70 Disk Commander .......................................................................... 71 System File Repair Wizard............................................................ 77 Crash Analyzer Wizard ................................................................. 78 Hotfix Uninstall Wizard .................................................................. 79 Mozilla Web Browser .................................................................... 80 DiskWipe ....................................................................................... 81 Autoruns........................................................................................ 82 Running External Commands ....................................................... 83 5 6 Troubleshooting ..........................................................................84 5.1 Frequently Asked Questions ......................................................... 84 Contacting Winternals Software ................................................86 6.1 6.2 Sales ............................................................................................. 86 Technical Support ......................................................................... 87 Winternals Software Page ii ERD Commander 2005 User's Guide 1 Welcome to ERD Commander 2005 When your Windows NT 4.0®, Windows 2000®, Windows XP®, or Windows Server 2003® system becomes unbootable and you've exhausted the recovery options available with the operating system, you can rely on ERD Commander 2005 to provide full access to your dead system with a familiar Windows-like environment. ERD Commander 2005 also provides a powerful set of tools to help you quickly diagnose and repair the problem that is preventing your system from booting or running properly. Like the Windows Recovery Console provided with Microsoft Windows since Windows 2000, and also like previous versions of ERD Commander, ERD Commander 2005 makes any Windows NT/2000/XP/Server 2003 file system accessible, including FAT, FAT32 and NTFS. Unlike those other utilities, ERD Commander 2005 offers both a graphical windowing environment and a command-line console. ERD Commander 2005 includes numerous utilities such as a service and driver manager, registry editor, Explorer-like file system browser, Notepadlike text editor, Event Viewer, and local password changer so that you can gain access to accounts from which you've been locked out. ERD Commander 2005 also includes tools that allow you to roll back Windows hotfixes or service packs, diagnose the driver responsible for a system crash, find potential malware applications automatically launching with Windows, and securely erase volumes or hard disks. When you need to save files to another system on the network or to copy files from another system as part of the repair process, ERD Commander 2005 gives you full access to network file shares. Additionally, when building an ERD Commander 2005 CD, you may include the Remote RecoverTM 3.0 client, for use with the Administrator's Pak Remote Recover tool. Winternals Software Page 1 ERD Commander 2005 User's Guide ERD Commander 2005 also includes the Mozilla Firefox 1.0 web browser allowing you to download patches, driver updates, or other updates to an offline system - giving you a secure offline environment to download updates in. You can browse for security bulletins and explore Microsoft support newsgroups to find answers to system problems while troubleshooting the system itself. Repairing, debugging, and diagnosing problem systems has never been easier or more intuitive than with ERD Commander 2005. Winternals Software Page 2 ERD Commander 2005 User's Guide 2 2.1 Introduction Capabilities ERD Commander 2005's built-in tools allow you to perform many different types of system diagnosis and repair. A few of the ways that ERD Commander 2005 helps you solve problems include: Diagnosing Windows Crashes The Crash AnalyzerTM allows you to diagnose Windows crashes and pinpoint the driver causing the failure. Once found, you can remove, replace, or disable the problem driver to restore the system. Finding Malware By showing you the applications which are set to run automatically when Windows starts or each user logs on, ERD Commander 2005 allows you to more easily identify applications which may be using system resources and possibly posing a security risk to your system. Removing or Replacing Buggy Drivers and Services You can use ERD Commander 2005 to delete or replace files for drivers or services that, because of a bug or misconfiguration, prevent Windows from booting. Browsing for Solutions - on a Dead System Even when the computer is not booting or running normally, you can use the included Mozilla Firefox 1.0 web browser to find security or support information, download updates, and read newsgroups to find answers to your system problems. Winternals Software Page 3 ERD Commander 2005 User's Guide Updating Out-of-Date System Files Incorrectly applying service packs or system software updates can cause system DLLs to become out of sync with each other, which may prevent Windows from booting successfully. ERD Commander 2005 can copy up-todate versions of old files from USB flash drives or USB or 1394-attached hard disks, floppy disks, or other computers on your network. Verifying System Files Using the DLLCache directory installed by default with Windows, ERD Commander 2005 can be used to ensure critical operating system files have not been tampered with or corrupted. Correcting Misconfigured NTFS or Registry Security If security attributes that are too restrictive are applied to certain system files or directories on NTFS boot drives, or to some registry keys, Windows will become unbootable. Using ERD Commander 2005's Explorer and Regedit you can reset permissions on files, directories and registry keys to regain access. Updating Locked Files Once Windows is up and running many system files cannot be replaced because the system keeps them locked. ERD Commander 2005 makes it possible to update such files because it runs when Windows is not running and the files are not locked open. Correcting Registry Problems A significant number of Windows boot problems are the result of misconfigured Windows registry values. The ERD Commander 2005 Registry Editor has all the capabilities and the same interface as the Windows Winternals Software Page 4 ERD Commander 2005 User's Guide Registry Editor, making it easy for you to inspect and change registry settings. Recovering Deleted Files ERD Commander 2005 includes FileRestoreTM, a utility that you can use to find and restore deleted files from any supported Windows file system format, including FAT, FAT32, and NTFS. Copying Important Files off of a Dead System ERD Commander 2005 enables you to access files on a Windows system that fails to boot. You can copy files to removable media such as USB flash drives or USB or 1394-attached hard disks, floppy disks, Zip drives, or Jaz drives, or use ERD Commander 2005 or Remote Recover 3.0's network capabilities to copy them to another system on your network. Regaining Access to a System That You've Been Locked Out Of ERD Commander 2005 allows you to list the local user accounts for a Windows installation and to change their passwords, including the local Administrator account. Viewing Event Logs Many times the Event Logs of a system contain clues that can help you diagnose a boot problem, so ERD Commander 2005 includes an Event Log Viewer with the same interface as the Windows 2000/XP Event Log Viewer MMC snap-in, allowing you to inspect logs for relevant records. Running CHKDSK on Corrupt Drives ERD Commander 2005 will let you check the consistency of hard drives. Winternals Software Page 5 ERD Commander 2005 User's Guide Enabling and Disabling Services and Drivers You can list and modify the start types of a system's drivers and services with ERD Commander 2005's Service and Driver Manager utility. The utility implements an interface similar to the Windows 2000/XP Services MMC snap-in, which makes it easy to identify services and drivers and to disable those that are preventing a system from booting. Restoring Windows XP Restore Points Windows XP's Restore Point feature periodically creates snapshots of a system's state tha ...