Windows 10 recovery from damaged registry hive files (2023)

04 Apr 2021 - tsp
Last update 04 Apr 2021
Windows 10 recovery from damaged registry hive files (1) 9 mins

Disclaimer: The steps described in this article do not reflect how Microsofthas thought on should use their operating system. You should make a backup - really.One usually does such stuff only in case the alternative would be total loss of thegiven machine or in case on wants to play around a little. So as usual: Make backups.And if you haven’t had some up until now learn your lesson. And in the best casejust switch to a more user friendly and robust system such as FreeBSDor Linux.

Disclaimer 2: This article might be loaded with a decent amount of sarcasm since itemerged late at night after many hours of getting a single machine back up runningby an author that already had a somewhat negative bias towards this operating system.

What’s this article about?

So we all know this situation - you have a Windows machine that makes troubles - again.And as usual there is no easy way to recover from an error so the usual suggestionis just reinstall it or move back to a system restore point. But what specificproblem is this blog post about?

In case you have a damaged registry hive file (in my case it has been the SOFTWAREhive) the machine might crash during boot just raising an BAD_SYSTEM_CONFIG_INFOerror. This is in many cases caused by a damaged hive file in the systemconfiguration contained in \Windows\system32\config\. Currently there are

  • ELAM
  • Different NTUSER.dat files (HKEY_USERS sub hierarchies)

These correspond to the different registry subkeys as mentions above. Back in thedays up to early Windows 10 versions Windows made a periodic backup of the registryinto the RegBack folder to allow easy recovery - I have to say I wouldn’t reallycall this recovery since copying an old version might lead to data loss but it wasan easy solution - from such errors. This has been disabled to reduce the disk footprintof Windows even morebut can be re-enabled by setting a registry key at HKLM\System\CurrentControlSet\Control\Session Manager\Configuration Manager\EnablePeriodicBackupto DWORD:1 anyways but as usual you discover such changes when it’s toolate. The currently encouraged method to restore the system is to use a system restorepoint and roll back the configuration of the machine to a previous known state.Unfortunately there was no such point present on the machine I had the problemon. Also utilities such as dism do not work when they’re unable to gainaccess to the registry.

So I had to use another approach:

  • Boot from a recovery disk
  • Copy the hive file to another machine
  • Use a forensic tool to dump all readable content of the hive file (as it turnedout there was nothing unreadable) into a reg file
  • Copy that dump back to the damaged machine
  • Create an empty hive file using a simple hack
  • Import the reg file from within the Windows RE environment

Just took about a day to get to this solution - on any other decent operatingsystem one could’ve just copied a set of the base executable over the existingsystem and continue running in a few minutes or rewrite the few damaged configurationfiles - but not so for windows, but that’s what one’s used to on user friendly windows.

(Video) How to Recover Windows 10 Registry From a Backup Copy ♻️📝💻

How to gain access

First one has to gain access to the current machine. Since there is no way to getsomething like a boot loader prompt or a shell in case the system configuration storeisn’t readable one has to use the installation medium. Since this is not shippedcurrently on has to download the Windows 10 ISO,burn it on a double layer DVD and finally boot from this disk.

Then one can simply select computer repair options on the installation menu andis ready to go. It’s a good idea to let auto repair try to repair the currentWindows installation though since sometimes there are some really basic problemslike a damaged BCD or some invalid references inside the boot configuration - ora simple chkdsk that’s required to get the system up and running.

If nothing works it’s a good idea to first try the usual sfc and dismcommands that one knows might help (adjust the c: - which is my bootpartition - and d: - which is my system partition - paths according toyour system):

sfc /offbootdir=c:\ /offwindir=d:\ /scannow

One might also try to fix the MBR, the bootsector and the BCD. In this case Iassume that the EFI partition has been assigned the drive letter F by usingthe usual diskpart commands (list vol, sel vol N, assign letter=F)

bootrec /fixmbrbootrec /fixbootbootrec /scanosbcdboot d:\windows /f ALL /s F:

Now one might also use dism to restore system files. This utility usuallyshould be used with active internet connectivity since it tries to fetch componentsfrom the windows update site. One might also add a different source but that’sway more cumbersome than simply specifying the path of the installation disk (oneusually has to have a wim or esd file such as the one contained oncustom created recovery disks - if one has done this instead of using a genericinstallation medium one can supply the location using the /Source:x:\sources\install.wimparameter). I personally don’t know how to get a wim file at a later stagefor a system one hasn’t built a recovery disk for.

(Video) How to Restore Registry Backup in Windows 10, 8, 7 to Fix Blue Screen Error and Repair Boot Failure

dism /Image:d:\ /Cleanup-Image /CheckHealth /ScratchDir:d:\scratch\dism /Image:d:\ /Cleanup-Image /ScanHealth /ScratchDir:d:\scratch\dism /Image:d:\ /Cleanup-Image /RestoreHealth /ScratchDir:d:\scratch\

So that’s all pretty well known and basic stuff - now what’s this blog post about?Basically it might happen that dism fails with an error 1009 and complaininside it’s log that a registry hive could not be loaded. It’s a good idea to verifythis by trying to import the hive file inside regedit - simply selectyour HKEY_LOCAL_MACHINE node and then execute the Load structurecommand selecting the specific file inside \Windows\system32\config\ andspecifying any name such as TEST. If it gets loaded correctly your problemis a different one. In case the load fails it’s exactly what this short articleis about.

First try to restore a periodic backup

In any case - first check if the RegBack folder only contains 0 byte files.If this is the case you’ve got bad luck. In case files are actually present, havea size larger than zero and are somewhat recent it’s a good idea to simply tryto copy them into the config parent folder and try a reboot. Many times thissolves the problem.

Extracting hive content

In any other case the next step is to get the files of the machine. I personallyused the ftp tool to do this. First one has to disable the firewall:

wpeutil DisableFirewall

Then one can launch ftp

open SOFTWAREquit
(Video) How to Fix Corrupt Registry in Windows 10

This allowed me to upload the current hive file onto a different (FreeBSD)machine.

To extract hive content I used some forensic tools - in this case the RegRipper.On FreeBSD it’s available in the security/regripper package and easilyinstallable using pkg install regripper. This suite is a collection oftools that’s usually used during forensic investigations on Windows machines - itallows to search for information inside copied hive files, allows one to dumpinformation and pretty efficiently look for specific data. Basically all I didwas to use ~/SOFTWARE -r to dump the information fromthe hive into the ASCII registry format. ~/SOFTWARE -r > software.reg

If everything works out this should provide a pretty complete dump of the registrycontent of the given hive - in my case of HKEY_LOCAL_MACHINE\Software.


The next step is re-importing. Again I used the ftp utility to copy databack onto the windows machine

open software.regquit
(Video) How to Repair Corrupted or Damaged Registry in Windows 10 [Tutorial]

The last step was to import the data back into the local registry. Since directaccess is not possible and the hive file is still inaccessible I just copiedthe SOFTWARE hive from the Windows RE environment

copy x:\windows\system32\config\SOFTWARE d:\windows\system32\config\

Then I started regedit and added this as substructure into HKEY_LOCAL_MACHINEdirectly under the Software2 key. Now I deleted all child keys containedinside this substructure. The last step before importing was to edit theASCII dump software.reg and replace all HKEY_LOCAL_MACHINE\Softwareoccurrences with HKEY_LOCAL_MACHINE\Software2. Then I simply ran theimport function from regedit to load the dump again.

After that a final reboot turned out to work somewhat - after the known hourslong black boot screen period that chkdsk triggered anyways (another one ofthe really user friendly status message hiding features since it seems to be waymore intuitive to stare on a black screen for multiple hours than to actually see amessage about the current progress of any error checking and recovery operation …).At least tools like dism now worked as before.

Note: Note that of course this removes any security information attached tothe registry keys.

As it turned out the system required another run of

dism /Image:d: /Cleanup-image /RestoreHealth /ScratchDir:d:\scratch\
(Video) How to Recover Windows Registry Fix Windows 10 Startup Blue Screen error

Which now leads to the end of this blog article but not to the end of the recoveryof the machine (since DISM now complained with the well known 0x800f081f).Just to note that again: Life is really way easier with a solid and well designedUnixoid operating system such as FreeBSD,Linux, Solarisor even Android

This article is tagged:

  • Computer
  • Windows
  • Administration


Can Windows 10 fix broken registry items? ›

Performing system restore is another useful way to fix corrupt registry on Windows 10. System Restore can revert system's registry back to a restore point where the registries were not broken.

How do I fix a broken registry file? ›

Run Command Prompt as administrator, type the command of "sfc /scannow" without the quotes and press Enter to run it. Please be patient while it is scanning and wait for the process to complete. Step 2. Restart your computer to check if the broken registry items error has been repaired.

Can a System Restore fix registry errors? ›

Restoring the Windows registry

The most common methods for fixing corrupt records are: Restoring the Windows registry from Safe Mode. Restoring the registry from the command prompt. Fixing Windows registry errors with System Restore.

Does Windows 10 have a registry cleaner? ›

The Windows Registry Editor in Windows 10 allows you to review, change, and delete registry entries.

Will reinstalling Windows 10 fix registry? ›

The Only Way to Fully Reset the Registry

The process of resetting Windows reinstalls the operating system, which will naturally reset the registry. To reset your Windows PC, open Settings from the Start menu or with Win + I, then go to Update & Security > Recovery and click Get Started under Reset this PC.

How to fix a broken registry using command prompt? ›

Replies (2) 
  1. Open Start and type cmd, right-click on "Command Prompt", and select "Run as administrator".
  2. Run the following commands at the Command Prompt one at a time: dism.exe /online /cleanup-image /scanhealth. dism.exe /online /cleanup-image /restorehealth. ...
  3. Restart the PC and see if the problem is resolved.
Jan 20, 2022

How to restore registry in Windows 10? ›

Restore a manual back up
  1. Select Start , type regedit.exe, and then press Enter. ...
  2. In Registry Editor, click File > Import.
  3. In the Import Registry File dialog box, select the location to which you saved the backup copy, select the backup file, and then click Open.

How does Windows registry get corrupted? ›

There are many reasons why a registry hive may be corrupted. Most likely, the corruption is introduced when the computer is shut down, and you cannot track the cause because the computer is unloading processes and drivers during shutdown. Sometimes, it is difficult to find the cause of registry corruption.

Are Broken registry issues a problem? ›

Consequently, broken registry items clog your PC's storage, slow down your computer, and sometimes result in startup problems.

How do I clean up a broken computer registry? ›

How to Delete Broken Registry Items in Windows?
  1. Perform disk cleanup.
  2. Run SFC scan.
  3. Run DISM scan.
  4. Run startup repair.
  5. Reset Windows.
  6. Use Third-party registry cleaner.

Does DISM repair registry? ›

Fix Registry with the DISM command. If you have tried the SFC method to fix corrupt registry on your Windows 10 PC but it didn't work for you, you may want to give a try to the DISM command which should help you fix the registry on your PC.

Can CCleaner repair registry? ›

Clean your Registry with CCleaner for Windows: In CCleaner, click the Registry icon at left to view the Registry Cleaner menu. You can then select the items under Registry Clean you want CCleaner to scan (they are all checked by default). This is for advanced users.

Will a System Restore undo registry edits? ›

The quick, simple explanation is that System Restore backs up and restores the Registry, important Windows files, and the programs you've installed into Windows. It has no effect whatsoever on documents, photos, and so forth.

What software fixes broken registry? ›

Listed below are the best registry cleaner software for Windows:
  1. iolo System Mechanic.
  2. Restoro.
  3. Outbyte PC Repair.
  4. Advanced SystemCare.
  5. MyCleanPC.
  6. CCleaner.
  7. Auslogics Registry Cleaner.
  8. Wise Registry Cleaner.
Feb 9, 2023

Is it worth using a registry cleaner? ›

One of the popular myths about cleaning the Registry is that it can provide a performance boost to your PC, but the truth is that doing so will have little – if any – tangible benefit. As such, we wouldn't recommend using Registry cleaners – and we'd strongly advise against ever changing things manually.

How do I clean up registry errors in Windows 10? ›

How To Clean Registry in Windows 10 and 11
  1. Press Start and type Disk Cleanup in search bar.
  2. Click on app.
  3. Once the app opens, a window will appear, select the Windows C: drive and then click OK.
  4. After the tool completes its scan, click on Clean up system files.

How to clean registry using cmd? ›

2. Clean registry Using DISM
  1. Open Start and search for cmd.
  2. On the right-hand menu, click on “Run as administrator,”now command prompt will open up with elevated permission.
  3. In the terminal window, type: dism /online /cleanup-image /restorehealth and click.
Aug 23, 2022

Where is Windows 10 registry backup? ›

Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder. If you browse to the \Windows\System32\config\RegBack folder in Windows Explorer, you will still see each registry hive, but each file is 0 kb in size.

Where is System Restore in registry? ›

System Restore Registry Entries
  1. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr.
  2. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService.
  3. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore.

What are the symptoms of corrupted registry Windows 10? ›

Signs of Corrupt Windows Registry

You have error messages on your screen with some of your routine application refusing to start. At times the system refuses to boot or you notice your PC slowing down, amidst a robust processor and rugged versatile memory.

Should you fix registry errors? ›

Don't Waste Time With Registry Cleaners

In the end, running a registry cleaner does not bring any perceptible benefit in performance. There's a good chance that a registry cleaner will break something on your system and cause far more problems than it could fix.

Does DISM fix corrupt files? ›

In short, DISM is not a complete reinstallation of Windows; instead, it finds critical core files required to run and gather information, then upgrades or repairs any files that are corrupted or out-of-date.

How DISM command fix corrupt files? ›

To repair Windows 10 image problems with the DISM command tool, use these steps:
  1. Open Start.
  2. Search for Command Prompt, right-click the top result, and select the Run as administrator option.
  3. Type the following command to repair the Windows 10 image and press Enter: DISM /Online /Cleanup-Image /RestoreHealth.
Mar 2, 2023

When should I use DISM? ›

When the System File Checker (SFC) cannot resolve issues on a computer, the DISM utility is often employed. The DISM tool can repair Component Store Corruption, which is known to hinder SFC Scan from operating correctly on a computer when it is used.

How do I fix registry errors in Windows 10 for free? ›

To run Automatic Repair which will attempt to fix a corrupt registry on your Windows 10 system, follow these steps:
  1. Open the Settings panel.
  2. Go to Update & Security.
  3. At the Recovery tab, click Advanced Startup -> Restart now. ...
  4. At the Choose an option screen, click Troubleshoot.

How long does System Restore take Windows 10 restoring the registry? ›

How long should System Restore is restoring the registry take? Usually, it takes 30-45 minutes and you should wait patiently. If the time is several hours, something goes wrong.

How long does System Restore take to restore the registry? ›

If your System Restore Windows takes a long time to perform, something wrong may happen with it or your PC. But you can wait for some minutes; it usually takes about 30-45 minutes to complete a system restore.

What happens if you delete the entire registry? ›

Registry keys are important to the functionality of your computer and its installed programs. Accidental removal of an essential registry entry may damage the system of your PC. Having a backup allows you to recover accidentally deleted entries.

Are broken registry items a problem? ›

Consequently, broken registry items clog your PC's storage, slow down your computer, and sometimes result in startup problems.

Does CCleaner fix broken registry items? ›

Cleaning the registry to remove any damaged or unnecessary entries will improve performance and increase the computer's speed. CCleaner is a great option for cleaning these damaged registry files. Its streamlined interface allows users to manage their unnecessary files and programs very easily.

Is it OK to delete broken registry items? ›

The broken registry items can be deleted by adopting several methods including, performing a disk cleanup, running a system file checker scan, running the DISM scan, running startup repair, resetting Windows, or using third-party software.

How does Windows Registry get corrupted? ›

There are many reasons why a registry hive may be corrupted. Most likely, the corruption is introduced when the computer is shut down, and you cannot track the cause because the computer is unloading processes and drivers during shutdown. Sometimes, it is difficult to find the cause of registry corruption.

Is it OK to clean registry? ›

The short answer is no - don't attempt to clean the Windows Registry. The Registry is a system file that holds lots of vital information about your PC and how it works. Over time, installing programs, updating software and attaching new peripherals can all add to the Registry.

Is it good to clean registry with CCleaner? ›

Over time, the Registry can become cluttered with missing or broken items when installing, upgrading, and uninstalling software or updates. CCleaner cleans out the Registry to help prevent errors from occurring, which can help it run faster.

How to repair Windows 10 registry from cmd? ›

Replies (2) 
  1. Open Start and type cmd, right-click on "Command Prompt", and select "Run as administrator".
  2. Run the following commands at the Command Prompt one at a time: dism.exe /online /cleanup-image /scanhealth. dism.exe /online /cleanup-image /restorehealth. ...
  3. Restart the PC and see if the problem is resolved.
Jan 20, 2022

Should I clean registry with CCleaner? ›

Please, do not use CCleaner. It has a bad reputation, including being hijacked to spread malware. Microsoft does not recommend that you use any kind of registry optimizer, ever - except for what Microsoft provides officially. If you try anything else, you do so entirely at your own risk.

What happens if you mess up the registry? ›

Problems Caused By a Corrupt Registry

If your registry is corrupted, the computer may not restart. This usually happens when the computer is shut down, and you can't track its cause because it unloads processes and drivers during shut down. Power failure or unexpected shutdown can also corrupt the registry hives.

Does broken registry slow down computer? ›

While some registry keys are absolutely critical to make sure your PC operates correctly, in fact a lot of them are duplicates. Some of your registry keys may actually be invalid, or even corrupt. These useless registry keys can slow down your computer.


1. How to Reset Registry in Windows to Default Settings
2. How to Load Registry Hives
3. Fix-Windows Failed To Load Because The System Registry File Is Missing Or Corrupt Status: 0xc00000e9
(Tech Help Sourav)
4. How to Backup and Restore the Registry in Windows 10?
5. Windows 10/8/7 - Registry Backup, Restore, Import And Export
6. Fix, Clean And Repair Windows 10/8/7 Registry [Tutorial]
Top Articles
Latest Posts
Article information

Author: Rev. Leonie Wyman

Last Updated: 03/28/2023

Views: 6573

Rating: 4.9 / 5 (79 voted)

Reviews: 94% of readers found this page helpful

Author information

Name: Rev. Leonie Wyman

Birthday: 1993-07-01

Address: Suite 763 6272 Lang Bypass, New Xochitlport, VT 72704-3308

Phone: +22014484519944

Job: Banking Officer

Hobby: Sailing, Gaming, Basketball, Calligraphy, Mycology, Astronomy, Juggling

Introduction: My name is Rev. Leonie Wyman, I am a colorful, tasty, splendid, fair, witty, gorgeous, splendid person who loves writing and wants to share my knowledge and understanding with you.