MalwareTeks: How To Install the Windows Recovery Console (Windows 2000/XP/Server 2003)

Table of Contents

1 What is the Recovery Console?
2 Installing the Recovery Console
4 Using the Recovery Console
3 The Recovery Console Command Prompt
5 Deleting the Recovery Console
6 Install Recovery Console during an unattended installation

What is the Windows Recovery Console?

The Windows Recovery Console, will allow limited access to the NTFS file system, FAT, and FAT32 volumes without starting the Windows graphical user interface (GUI). In the Windows Recovery Console, you can perform the following actions:

Use, copy, rename, or replace operating system files and folders
Enable or disable service or device startup the next time that you start your computer
Repair the file system boot sector or the master boot record (MBR)
Create and format partitions on drives

INFORMATION

To use the recovery console, you need the local Administrator password. For Domain Controllers, you need the Administrator password that is used in the Directory Service Restore mode.

Installing the Windows Recovery Console

You can install the Recovery Console on your computer to make it available if you cannot restart Windows. You can then select the Recovery Console option from the list of available operating systems during startup. This article describes how to install the Recovery Console to computers running Microsoft Windows 2000, Windows XP or Windows Server 2003. To install the Recovery Console, you must be logged on as an administrator.

Although you can run the Recovery Console by starting directly from the Windows XP CD, it is generally more convenient to set it up as a startup option on your startup menu.

To install the Recovery Console, follow these steps:

Insert the Windows CD into the CD-ROM drive.
Click Start, and then click Run.
In the Open box, type CD-ROM drive letter:\i386\winnt32.exe /cmdcons where CD-ROM drive letter is the drive letter assigned to your CD-ROM drive. In the case of 'Microsoft Windows XP Professional x64 Edition', type CD-ROM drive letter:\amd64\winnt32.exe /cmdcons where CD-ROM drive letter is the drive letter assigned to your CD-ROM drive.
A Windows Setup Dialog Box appears, which describes the Recovery Console option.
The system prompts you to confirm installation. Click Yes to start the installation procedure.
Restart the computer. The next time you start your computer, you will see a "Microsoft Windows Recovery Console" entry on the boot menu.

Using the Recovery Console

From the Windows Recovery Console, you can enable, disable, and list services; format drives; create, delete and rename folders; copy, delete, and rename files; read and write data on a local drive, and perform many other administrative tasks. The Recovery Console is particularly useful when you have to repair the operating system by copying a file from a disk or CD-ROM to your hard disk, or if you have to reconfigure a service that is preventing your computer from starting correctly.

During Startup, select Recovery Console from the startup options menu. If you have a dual-boot or multiple-boot system, choose the installation that you need to access from the Recovery Console. When prompted, type the Administrator password. At the system prompt, type Recovery Console commands; type help for a list of commands, or help commandname for help on a specific command. To exit the Recovery Console and restart the computer, type exit.

CAUTION

Because the Windows Recovery Console is very powerful, and inexperienced users could render the Operating Sytem unusable; it is recommended for use only by advanced users or administrators.

The Recovery Console Command Prompt

When you use the Recovery Console, you are working at a special command prompt instead of the ordinary Windows command prompt. At the command prompt for %SystemRoot% (generally C:\Windows), you can start using the available commands for the Recovery Console.

Available Recovery Console Commands

Command	Action
Attrib	changes attributes on one file or subdirectory.
Batch	executes commands that you specify in the text file, Inputfile. Outputfile holds the output of the commands. If you omit the Outputfile parameter, output appears on the screen.
Bootcfg	modifies the Boot.ini file for boot configuration and recovery.
CD (Chdir)	operates only in the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.
Chkdsk	The /p switch runs Chkdsk even if the drive is not flagged as dirty. The /r switch locates bad sectors and recovers readable information. This switch implies /p. Chkdsk requires Autochk. Chkdsk automatically looks for Autochk.exe in the startup folder. If Chkdsk cannot find the file in the startup folder, it looks for the Windows Setup CD-ROM. If Chkdsk cannot find the installation CD-ROM, Chkdsk prompts the user for the location of Autochk.exe.
Cls	clears the screen.
Copy	copies one file to a target location. By default, the target cannot be removable media, and you cannot use wildcard characters. Copying a compressed file from the Windows Setup CD-ROM automatically decompresses the file.
Del (Delete)	deletes one file. Operates within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. By default, you cannot use wildcard characters.
Dir	displays a list of all files, including hidden and system files.
Disable	disables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to disable. When you use this command to disable a service, the command displays the service's original startup type before it changes the type to SERVICE_DISABLED. Note the original startup type so that you can use the enable command to restart the service.
Diskpart	manages partitions on hard disk volumes. The /add option creates a new partition. The /delete option deletes an existing partition. The variable device is the device name for a new partition (such as \device\harddisk0). The variable drive is the drive letter for a partition that you are deleting (for example, D). Partition is the partition-based name for a partition that you are deleting, (for example: \device\harddisk0\partition1) and can be used instead of the drive variable. The variable size is the size, in megabytes, of a new partition.
Enable	enables a Windows system service or driver. The variable service_or_driver is the name of the service or driver that you want to enable, and start_type is the startup type for an enabled service. The startup type uses one of the following formats: SERVICE_BOOT_START SERVICE_SYSTEM_START SERVICE_AUTO_START SERVICE_DEMAND_START
Exit	quits the Recovery Console, and then restarts the computer.
Expand	expands a compressed file. The variable source is the file that you want to expand. By default, you cannot use wildcard characters. The variable destination is the directory for the new file. By default, the destination cannot be removable media and cannot be read-only. You can use the attrib command to remove the read-only attribute from the destination directory. The option /f:filespec is required if the source contains more than one file. This option permits wildcard characters. The /y switch disables the overwrite confirmation prompt. The /d switch specifies that the files will not be expanded and displays a directory of the files in the source.
Fixboot	writes a new startup sector on the system partition.
Fixmbr	repairs the startup partition's master boot code. The variable device is an optional name that specifies the device that requires a new Master Boot Record. Omit this variable when the target is the startup device.
Format	formats a disk. The /q switch performs a quick format. The /fs switch specifies the file system.
Help	If you do not use the command variable to specify a command, help lists all the commands that the Recovery Console supports.
Listsvc	displays all available services and drivers on the computer.
Logon	displays detected installations of Windows and requests the local Administrator password for those installations. Use this command to move to another installation or subdirectory.
Map	displays currently active device mappings. Include the arc option to specify the use of Advanced RISC Computing (ARC) paths (the format for Boot.ini) instead of Windows device paths.
MD (Mkdir)	operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.
More	displays the specified text file on screen.
Rd (Rmdir)	operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources.
Ren (Rename)	operates only within the system directories of the current Windows installation, removable media, the root directory of any hard disk partition, or the local installation sources. You cannot specify a new drive or path as the target.
Set	displays and sets the Recovery Console environment variables.
Systemroot	sets the current directory to %SystemRoot%.
Type	displays the specified text file on screen.

Recovery Console rules

Several environment rules are in effect while you are working in the Recovery Console. Type set to see the current environment. By default, these are the rules:

AllowAllPaths = FALSE prevents access to directories and subdirectories outside the system installation that you selected when you entered the Recovery Console.
AllowRemovableMedia = FALSE prevents access to removable media as a target for copied files.
AllowWildCards = FALSE prevents wildcard support for commands such as copy and del.
NoCopyPrompt = FALSE means that you are prompted by the Recovery Console for confirmation when overwriting an existing file.

Deleting the Recovery Console

To delete the Recovery Console:

Restart your computer, click Start, click My Computer, and then double-click the hard disk where you installed the Recovery Console.
On the Tools menu, click Folder Options, and then click the View tab.
Click Show hidden files and folders, click to clear the Hide protected operating system files check box, and then click OK.
At the root folder, delete the Cmdcons folder and the Cmldr file.
At the root folder, right-click the Boot.ini file, and then click Properties.
Click to clear the Read-only check box, and then click OK.
Open the Boot.ini file in Microsoft Windows Notepad, and remove the entry for the Recovery Console. It looks similar to this:

C:\cmdcons\bootsect.dat="Microsoft Windows Recovery Console" /cmdcons

CAUTION

Modifying the Boot.ini file incorrectly may prevent your computer from restarting. Make sure that you delete only the entry for the Recovery Console. Also, change the attribute for the Boot.ini file back to a read-only state after you finish this procedure.
Save the file and close it.