Windows 2000 System Recovery via Backup

In Microsoft Windows 2000, automated disaster recovery is executed through the native Backup utility (NTBackup) by combining a System State backup with an Emergency Repair Disk (ERD). While newer versions of Windows introduced a dedicated Automated System Recovery (ASR) wizard, Windows 2000 achieves this level of recovery by capturing critical system architecture, boot configuration files, and registry hives, which can subsequently be invoked during the Windows Setup repair phase to restore an unbootable operating system to a functional state.

1. Generating Recovery Data in NTBackup

The recovery process begins inside the operating system using the Windows 2000 Backup utility (ntbackup.exe). The user initiates the procedure through two critical backup operations:

  • System State Backup: NTBackup captures the core components of the operating system. For a standard workstation or member server, this includes the Registry, the COM+ Class Registration database, and system boot files. For domain controllers, it also captures Active Directory and the SYSVOL directory.
  • Emergency Repair Disk (ERD) Creation: Within NTBackup, the user selects "Emergency Repair Disk." The wizard prompts for a 1.44 MB floppy disk and provides a critical checkbox: "Also backup the registry to the repair directory." Checking this option copies current registry hives directly into the %SystemRoot%\Repair\RegBack folder on the local drive, while the floppy disk is formatted with the system configuration mapping files (setup.log, control.ini).

2. The Mechanics of the ERD

The generated floppy disk does not contain a full bootable image or full registry backups due to capacity constraints. Instead, it holds:

  • setup.log: A catalog of all operating system files installed, along with cyclic redundancy check (CRC) checksums to detect corrupt or missing binaries.
  • autoexec.nt and config.nt: Default subsystem configuration profiles.

The actual registry restoration relies on the registry files copied to the hard disk's %SystemRoot%\Repair directory during the backup step.

3. Executing System Recovery

When the operating system fails to boot, recovery is executed outside the running environment using the Windows 2000 setup media:

  1. Boot from Media: The system is booted using the Windows 2000 installation CD-ROM or the four setup boot floppies.
  2. Access Setup Repair: At the initial setup screen, the administrator presses R to enter the repair options menu.
  3. Select Repair Method: The installer presents two options: Recovery Console or the Emergency Repair Process. Selecting the repair process initiates the automated routine.
  4. Choose Repair Mode:
    • Fast Repair: Automatically attempts to repair registry files, system files, partition boot sectors, and the startup environment without user intervention.
    • Manual Repair: Allows the administrator to explicitly select whether to check system files, inspect boot sectors, or verify startup environments.
  5. Apply the ERD: The setup engine prompts for the floppy disk generated via NTBackup. Setup reads setup.log, checks system files against the installation media, replaces missing or corrupted files, and rebuilds the boot sector.

4. Full Restoration of System State

If the physical storage was wiped or replaced, the ERD process is followed by a baseline installation of Windows 2000. Once the minimal environment is restored, the administrator boots into Safe Mode or Directory Services Restore Mode (for domain controllers), opens NTBackup, and restores the full System State from the primary backup media (tape, external drive, or network share) to return the system to its exact pre-failure configuration.