ERD Commander 2005 User's Guide Winternals Software LP 3101 Bee Caves Road, Suite 150 Austin, Texas 78746 (512) 330-9130 (512) 330-9131 Fax www.winternals.com Copyright © 2005 Winternals Software LP ERD Commander 2005 User's Guide Table of Contents 1 2 Welcome to ERD Commander 2005.............................................1 Introduction ...................................................................................3 2.1 2.2 2.3 Capabilities...................................................................................... 3 Sample Screen................................................................................ 8 System Requirements..................................................................... 9 3 The Boot CD-ROM Wizard ..........................................................12 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 Introduction ................................................................................... 12 Welcome ....................................................................................... 14 License Agreement ....................................................................... 15 License Information....................................................................... 16 Extracting Files.............................................................................. 17 Select Target Functionality............................................................ 18 Select Remote Recover Port......................................................... 19 Remote Recover Security ............................................................. 20 Selecting the Included Utilities ...................................................... 21 Adding the Debugging Tools for Windows .................................... 22 Password Protection ..................................................................... 23 Adding OEM Storage Controller Drivers ....................................... 24 Adding OEM Network Controller Drivers....................................... 25 Adding Files to the CD-ROM Image.............................................. 26 Image Location.............................................................................. 27 Burning the CD-ROM .................................................................... 28 4 Using ERD Commander 2005.....................................................29 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10 4.11 4.12 4.13 4.14 4.15 Introduction ................................................................................... 29 Network Initialization ..................................................................... 32 Role Selection ............................................................................... 33 Logon ............................................................................................ 34 Windowing Shell............................................................................ 36 System Information ....................................................................... 37 Explorer......................................................................................... 38 File Search .................................................................................... 41 FileRestoreTM ................................................................................ 42 Command Prompt ......................................................................... 44 Notepad......................................................................................... 59 Regedit.......................................................................................... 60 Service and Driver Manager ......................................................... 62 Event Log Viewer .......................................................................... 63 TCP/IP Configuration .................................................................... 64 Winternals Software Page i ERD Commander 2005 User's Guide 4.16 4.17 4.18 4.19 4.20 4.21 4.22 4.23 4.24 4.25 4.26 4.27 4.28 4.29 Disk Management ......................................................................... 65 Locksmith ...................................................................................... 66 File Sharing ................................................................................... 67 Map Network Drive........................................................................ 68 System Restore............................................................................. 69 System Compare .......................................................................... 70 Disk Commander .......................................................................... 71 System File Repair Wizard............................................................ 77 Crash Analyzer Wizard ................................................................. 78 Hotfix Uninstall Wizard .................................................................. 79 Mozilla Web Browser .................................................................... 80 DiskWipe ....................................................................................... 81 Autoruns........................................................................................ 82 Running External Commands ....................................................... 83 5 6 Troubleshooting ..........................................................................84 5.1 Frequently Asked Questions ......................................................... 84 Contacting Winternals Software ................................................86 6.1 6.2 Sales ............................................................................................. 86 Technical Support ......................................................................... 87 Winternals Software Page ii ERD Commander 2005 User's Guide 1 Welcome to ERD Commander 2005 When your Windows NT 4.0®, Windows 2000®, Windows XP®, or Windows Server 2003® system becomes unbootable and you've exhausted the recovery options available with the operating system, you can rely on ERD Commander 2005 to provide full access to your dead system with a familiar Windows-like environment. ERD Commander 2005 also provides a powerful set of tools to help you quickly diagnose and repair the problem that is preventing your system from booting or running properly. Like the Windows Recovery Console provided with Microsoft Windows since Windows 2000, and also like previous versions of ERD Commander, ERD Commander 2005 makes any Windows NT/2000/XP/Server 2003 file system accessible, including FAT, FAT32 and NTFS. Unlike those other utilities, ERD Commander 2005 offers both a graphical windowing environment and a command-line console. ERD Commander 2005 includes numerous utilities such as a service and driver manager, registry editor, Explorer-like file system browser, Notepadlike text editor, Event Viewer, and local password changer so that you can gain access to accounts from which you've been locked out. ERD Commander 2005 also includes tools that allow you to roll back Windows hotfixes or service packs, diagnose the driver responsible for a system crash, find potential malware applications automatically launching with Windows, and securely erase volumes or hard disks. When you need to save files to another system on the network or to copy files from another system as part of the repair process, ERD Commander 2005 gives you full access to network file shares. Additionally, when building an ERD Commander 2005 CD, you may include the Remote RecoverTM 3.0 client, for use with the Administrator's Pak Remote Recover tool. Winternals Software Page 1 ERD Commander 2005 User's Guide ERD Commander 2005 also includes the Mozilla Firefox 1.0 web browser allowing you to download patches, driver updates, or other updates to an offline system - giving you a secure offline environment to download updates in. You can browse for security bulletins and explore Microsoft support newsgroups to find answers to system problems while troubleshooting the system itself. Repairing, debugging, and diagnosing problem systems has never been easier or more intuitive than with ERD Commander 2005. Winternals Software Page 2 ERD Commander 2005 User's Guide 2 2.1 Introduction Capabilities ERD Commander 2005's built-in tools allow you to perform many different types of system diagnosis and repair. A few of the ways that ERD Commander 2005 helps you solve problems include: Diagnosing Windows Crashes The Crash AnalyzerTM allows you to diagnose Windows crashes and pinpoint the driver causing the failure. Once found, you can remove, replace, or disable the problem driver to restore the system. Finding Malware By showing you the applications which are set to run automatically when Windows starts or each user logs on, ERD Commander 2005 allows you to more easily identify applications which may be using system resources and possibly posing a security risk to your system. Removing or Replacing Buggy Drivers and Services You can use ERD Commander 2005 to delete or replace files for drivers or services that, because of a bug or misconfiguration, prevent Windows from booting. Browsing for Solutions - on a Dead System Even when the computer is not booting or running normally, you can use the included Mozilla Firefox 1.0 web browser to find security or support information, download updates, and read newsgroups to find answers to your system problems. Winternals Software Page 3 ERD Commander 2005 User's Guide Updating Out-of-Date System Files Incorrectly applying service packs or system software updates can cause system DLLs to become out of sync with each other, which may prevent Windows from booting successfully. ERD Commander 2005 can copy up-todate versions of old files from USB flash drives or USB or 1394-attached hard disks, floppy disks, or other computers on your network. Verifying System Files Using the DLLCache directory installed by default with Windows, ERD Commander 2005 can be used to ensure critical operating system files have not been tampered with or corrupted. Correcting Misconfigured NTFS or Registry Security If security attributes that are too restrictive are applied to certain system files or directories on NTFS boot drives, or to some registry keys, Windows will become unbootable. Using ERD Commander 2005's Explorer and Regedit you can reset permissions on files, directories and registry keys to regain access. Updating Locked Files Once Windows is up and running many system files cannot be replaced because the system keeps them locked. ERD Commander 2005 makes it possible to update such files because it runs when Windows is not running and the files are not locked open. Correcting Registry Problems A significant number of Windows boot problems are the result of misconfigured Windows registry values. The ERD Commander 2005 Registry Editor has all the capabilities and the same interface as the Windows Winternals Software Page 4 ERD Commander 2005 User's Guide Registry Editor, making it easy for you to inspect and change registry settings. Recovering Deleted Files ERD Commander 2005 includes FileRestoreTM, a utility that you can use to find and restore deleted files from any supported Windows file system format, including FAT, FAT32, and NTFS. Copying Important Files off of a Dead System ERD Commander 2005 enables you to access files on a Windows system that fails to boot. You can copy files to removable media such as USB flash drives or USB or 1394-attached hard disks, floppy disks, Zip drives, or Jaz drives, or use ERD Commander 2005 or Remote Recover 3.0's network capabilities to copy them to another system on your network. Regaining Access to a System That You've Been Locked Out Of ERD Commander 2005 allows you to list the local user accounts for a Windows installation and to change their passwords, including the local Administrator account. Viewing Event Logs Many times the Event Logs of a system contain clues that can help you diagnose a boot problem, so ERD Commander 2005 includes an Event Log Viewer with the same interface as the Windows 2000/XP Event Log Viewer MMC snap-in, allowing you to inspect logs for relevant records. Running CHKDSK on Corrupt Drives ERD Commander 2005 will let you check the consistency of hard drives. Winternals Software Page 5 ERD Commander 2005 User's Guide Enabling and Disabling Services and Drivers You can list and modify the start types of a system's drivers and services with ERD Commander 2005's Service and Driver Manager utility. The utility implements an interface similar to the Windows 2000/XP Services MMC snap-in, which makes it easy to identify services and drivers and to disable those that are preventing a system from booting. Restoring Windows XP Restore Points Windows XP's Restore Point feature periodically creates snapshots of a system's state that includes system files and registry data. Overcoming a deficiency of Windows XP's Restore Point functionality, ERD Commander 2005 allows you to restore unbootable systems to a previous Restore Point. Uninstalling Windows Hotfixes and Service Packs Installing a Windows hotfix or service pack can occasionally leave you with an unbootable system. Use this feature to roll back the file changes made by the hotfix to get your system working again. Comparing a Working System with a Dead System ERD Commander 2005's System Compare utility lets you compare service and driver configuration and the system files of a dead system with that of a live system or a Windows installation media at which you direct it. This enables you to identify differences between working systems and one that doesn't boot or does not run normally in order to guide your repair process. Partitioning and Formatting Disks The Disk Management MMC snap-in that ERD Commander 2005 includes in its Computer Management utility has many of the features of the Windows 2000/XP Disk Management MMC snap-in, allowing you to delete, format, and create partitions and volumes. If you prefer a command-line environment you Winternals Software Page 6 ERD Commander 2005 User's Guide can use the corresponding command-line tool, DiskPart, to accomplish the same tasks. Scanning a Dead System for Viruses With ERD Commander 2005 and Remote Recover 3.0 you can share the drives of a system on the network so that you can access them from another computer. This allows you to use tools installed on other systems to aid in the repair or recovery process. For example, if you suspect a virus has attacked a computer you can shut it down, boot into Remote Recover 3.0 or ERD Commander 2005, mount or share its drives, and then run a virus scanner on the drives from a different system. Using Remote Recover 3.0 allows you to run utilities on remote drives as easily as a local drive. Securely Deleting Data The DiskWipe utility allows you to sanitize volumes and drives via secure data deletion. Winternals Software Page 7 ERD Commander 2005 User's Guide 2.2 Sample Screen This screenshot demonstrates a typical session using ERD Commander 2005 to access the Registry and service configuration of an offline system. Winternals Software Page 8 ERD Commander 2005 User's Guide 2.3 System Requirements ERD Commander 2005 requires that the target system have a bootable CDROM drive, and one of the following operating systems: · · · · Windows NT 4 Service Pack 6a Windows 2000 Windows XP (x86 versions) Windows Server 2003 (x86 versions) Note that while many components of ERD Commander 2005 do work properly with 64-bit versions of Windows XP and Windows Server 2003 running on a Extended 64-bit (x64, often referred to as AMD64) system, there are several which are known to not work correctly, including (but not limited to) the Crash Analyzer, Hotfix Uninstall, System Restore, System File Repair utilities. Also note that ERD Commander 2005 also gives you access to the drives of Windows 95®, Windows 98®, and Windows Me® systems, although most of the included utilities, such as the password changer, Registry Editor and Event Log viewer do not function when accessing installations of those operating system versions. Regardless of the operating system it is working with, ERD Commander 2005 requires a minimum of 64MB (128MB recommended) of system RAM and an Intel Pentium (or compatible) 166 MHz or faster processor, as well as a CDROM drive and a computer with BIOS support from booting from that CDROM drive. The ERD Commander 2005 Boot-CD Creation Wizard runs on x86 versions of Windows 2000, Windows XP, and Windows Server 2003. It is not supported for use on earlier versions of Windows, or 64-bit versions of Winternals Software Page 9 ERD Commander 2005 User's Guide Windows XP or Windows Server 2003 running on Intel Itanium or 64-bit Extended systems. The use of the Internet Browser and the Crash Analyzer Wizard require a writable volume formatted with NTFS or FAT. The use of DiskWipe requires at least one working hard disk or floppy diskette. ERD Commander 2005 provides more diagnostic and repair functionality than any other version of ERD Commander before. Most of the utilities provided are compatible with several versions of Windows. The table below lists the utilities provided in ERD Commander 2005 and which versions of Windows you can expect to work with each. You should never attempt to use ERD Commander 2005 with versions of Windows NT earlier than Windows NT 4.0 Service Pack 6. Windows Server 2003* Autoruns Chkdsk Console Crash Analyzer Wizard Disk Commander Disk Management DiskWipe EventLog Viewer Explorer FileRestore File Search File Sharing Hotfix Uninstall Wizard Internet Browser Locksmith Logon Map Network Drive Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Windows XP* Windows 2000 Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Windows NT 4 SP6 Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Windows ME or earlier Not Compatible Compatible Not Compatible Not Compatible Not Compatible Not Compatible Compatible Not Compatible Compatible Not Compatible Not Compatible Compatible Not Compatible Not Compatible Compatible Compatible Compatible Compatible Compatible Not Compatible Not Compatible Compatible Winternals Software Page 10 ERD Commander 2005 User's Guide Regedit Compatible Compatible Compatible Compatible Compatible Compatible Compatible Not Compatible Not Compatible Service and Driver Manager Compatible Solution Wizard System Compare System File Repair Wizard System Information System Restore See individual tool Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Compatible Not Compatible Not Compatible Not Compatible Compatible Not Compatible Not Compatible Compatible Not Compatible Not Compatible Not Compatible * x86 versions only Winternals Software Page 11 ERD Commander 2005 User's Guide 3 3.1 The Boot CD-ROM Wizard Introduction There are two delivery methods for ERD Commander 2005: as a Boot-CD Creation Wizard and as a bootable CD-ROM on physical media. The BootCD Creation Wizard is what is received when you download ERD Commander 2005 after an online purchase; the version of ERD Commander 2005 that ships as physical media is a bootable image that also includes an installer for the Boot-CD Creation Wizard. The Boot-CD Creation Wizard is used to create a bootable CD ISO image, which is a file that represents the raw contents of a CD, ready to be written to recordable CD media. When the wizard has created your ISO image, if it detects that a supported CD recordable drive exists on your system, it will offer to burn the ISO image to blank CD recordable media. If your system does not contain a drive supported by the wizard, you can burn the ISO image onto CD recordable media with most popular CD-ROM burning software (note that you cannot use the CD burning software built in with Windows XP for this task). You will need several items in addition to successfully create a bootable CD-ROM from the ISO image the Boot-CD Creation Wizard creates: · · · CD recordable drive CD recordable media (as supported by your recordable drive) CD burning software that supports your recordable drive and supports burning an ISO image directly to CD Note that you can utilize whatever recordable media type (CD-R/+R/RW/+RW, etc.) that your recordable drive supports, but you should test the resulting media on all systems you intend to support with it, as some systems are not cable of booting from all types of CD recordable media. Depending on Winternals Software Page 12 ERD Commander 2005 User's Guide the tools you decide to include in it via the wizard, ERD Commander 2005 can range in size from 130 to 230 MB, so also insure that you are using media large enough to contain the resulting ISO image (i.e. if you intend to use CD recordable 3" media). This section guides you through the Boot-CD Creation Wizard. Winternals Software Page 13 ERD Commander 2005 User's Guide 3.2 Welcome After you start the Boot-CD Creation Wizard you will be presented with a welcome page briefly informing you of the functionality the wizard performs. Winternals Software Page 14 ERD Commander 2005 User's Guide 3.3 License Agreement Next you will be presented with a page containing the Licensing Agreement containing the licensing terms for the resulting product created from the wizard. You must select Yes, I accept the terms in the License Agreement before you can click Next. Winternals Software Page 15 ERD Commander 2005 User's Guide 3.4 License Information Next you will be presented with a page that requests your licensing information (or will contain your existing information if you already have a licensed copy of the Administrator's Pak 5.0 installed). Online purchasers receive the licensing information as an email attachment that can be imported into the wizard. The Boot-CD Creation Wizard verifies the license information and embeds it into the ISO image so that after you create a bootable CD from the image and start ERD Commander 2005 the licensing information exists when it starts. Winternals Software Page 16 ERD Commander 2005 User's Guide 3.5 Extracting Files The next page will begin the process of extracting the files from the wizard to begin the process of creating the ISO image. Winternals Software Page 17