Will I still be able to restore the registry?

  • Thread starter Thread starter casey.o
  • Start date Start date
| I'm running the "HOME" version of XP. It makes little sense for MS to
| design the Home edition for corporate work stations. But MS never makes
| sense in many ways so I cant expect that here.....
|
| I have XP Pro on my laptop. It came with XP Pro. Honestly, I cant see
| any difference between XP Home and XP Pro.
|

It's all just marketing. Home has a few things removed
or disabled, but it's the same thing.

Microsoft has to
satisfy their corporate customers. SOHo customers lose
in the process. (One of the first bugs in XP was a messenger
service (not Windows Messenger). It ran by default and
served to allow corporate IT people to pop up messages,
like "Don't forget the company picnic this weekend", or
"please shut off all computers on Friday". Spammers were
hijacking the service to pop up ads. The service never
should have even existed, much less run by default.
It's a good example of how Microsoft does virtually nothing
to accomodate SOHo customers. All of the services start
out configured for typical corporate workstation use, which
includes a number of network-related services that are
unsafe and/or irrelevant.

Because of the design you really should familiarize yourself
with services and disable anything you don't need.

The best source of info:
http://www.blackviper.com/

A couple of utilities I made myself for one-stop taming
of XP problems:
http://www.jsware.net/jsware/xpfix.php5

On the bright side, XP still supports current software after
13 years. That's also due to corporate focus. Microsoft
can't afford to break old functionality. If they did then
corporate customers would leave them. By contrast, the
consumer-centric Apple products typically last two cycles.
With an OS update about once per year, that means Apple
hangs you out to dry after you've had a product more than
2 years.

| Either way, when I can no longer access ALL the files on my own
| computer, I wont use that OS. Apparently every OS since XP is like
| that. Even XP made it tough to access some stuff, and that began in
| Win2000 but very slightly. This is the #1 reason I like Win98 the best.
| I can customize it my way.
|
XP has system file protection, but you can remove it if
you don't mind losing the useless Windows help. Just run
this line in the Run window:

rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132
C:\WINDOWS\INF\PCHealth.inf

Then you can delete Media Player, games, and anything
else that Microsoft normally blocks you from controlling.

Windows 7 is worse, though it's reasonably usable with
UAC turned down. And you can log on as the real Admin
if you want to. (After XP an Admin is not really an Admin.)
It's also possible to remove all Win7 restrictions if you really
want to. In my experience with Win7 the bloat and brittleness
is a bigger problem. For instance, there's a backup folder
called winsxs that starts out at 4 GB and grows. It's
basically the whole install DVD, with all the drivers you'll
never use. One can remove the restrictions on that folder
to remove it or trim it down, but then it's likely that Win7
will break. In one test I tried, Win7 still worked after removing
winsxs, but there were no drives in the My Computer window!
There are also more services on Win7. And there are confusing
"virtual" items: Fake paths that don't actually exist but
appear to. Very confusing.

There is an improvement with NT in general, though. XP
is faster and far more "robust" on the same hardware than
Win98, as long as the hardware is up to snuff. (Win98 will
run better on 64MB of RAM.)
 
Mayayana said:
Windows 7 is worse, though it's reasonably usable with
UAC turned down. And you can log on as the real Admin
if you want to. (After XP an Admin is not really an Admin.)
It's also possible to remove all Win7 restrictions if you really
want to. In my experience with Win7 the bloat and brittleness
is a bigger problem. For instance, there's a backup folder
called winsxs that starts out at 4 GB and grows. It's
basically the whole install DVD, with all the drivers you'll
never use. One can remove the restrictions on that folder
to remove it or trim it down, but then it's likely that Win7
will break. In one test I tried, Win7 still worked after removing
winsxs, but there were no drives in the My Computer window!
There are also more services on Win7. And there are confusing
"virtual" items: Fake paths that don't actually exist but
appear to. Very confusing.
Click to expand...

WinSXS is the "store" and contains components.

All five versions of Windows 7 are stored in there (including
Ultimate). If you do an Anytime Upgrade, the files to do the
job are already in WinSXS.

To use a file from it, the file is not copied. Instead,
it is hard linked. One data cluster, has two file pointers.
These two file paths, for example, point to the same set
of data clusters. This is from my Win8 disk, which I can
see from my current WinXP. Windows 7 does something similar.
I used this example, because I have all 135000 files
checksummed, to make it easier to detect the duplicates.

WinSxS\amd64_microsoft-windows-network-datausage_31bf3856a
d364e35_6.3.9600.16384_none_5839dc11fcec2fae/datusage.dll--
\___32,256
/ bytes
Windows\System32\datusage.dll ----------------------------/

The overhead of this system, is about 500MB worth of file points.
Many irrelevant versions of things are contained in WinSXS,
purportedly for an old application you might install, with
a dependency on it. There will be files in there you will
not be using, or ever even reference. But if they're linked
somewhere else, they're in use.

Now, since these are hard links, how do you delete a file ?
By removing all hard links to it. In my example, there are
two file pointers. I would have to delete both pointers,
to remove the reference to those 32,256 bytes.

The file space also gets double-counted. If you measure the
size of System32, you get a number X. If you measure the
size of WinSXS, you get a number X. You mistakenly assume
the space used is 2X. When in fact, it's around X + 500MB.
The 500MB is an estimate of the amount of file pointers
used to make the two (or more) references to the same file.
That's my estimate of what the hard links for all the files
might cost.

I originally studied this from Linux. Using Linux, if you
use the "ls" program option to display inode information,
the multiple file pointers in Windows, all have the same
inode number in Linux. Linux inode numbers on NTFS are
"fake", and exist to provide compatibility with the software
there. (So system software will be less aware of the
differences between an EXT2 file tree, and an NTFS file tree.)
So the inode numbers do not imply NTFS uses inodes. Some
property of Windows is used to assemble inode equivalence.
If I was in Linux, seeing the same inode for the two files
in my example above, would be an indication of the usage of
hard linking. My using my md5sum checksum file to create
that example above, isn't really the right way to do it.
To do it properly, I'd have to boot Linux and check they
both show the same inode number. In Windows, if I use
"nfi.exe", which gives the LBA addresses of clusters,
that's how I'd figure it out purely in Windows. (Two
files with the same clusters in usage, must be hard linked.)

If you delete the WinSXS folder in my above example, you save
500MB of space for the pointers. For those files that exist
for the purpose of supporting Ultimate, if you had Home Premium,
all the Ultimate files would be deleted (so you could not
do an Anytime Upgrade to Ultimate then). For files that have
two pointers, such as the datusage.dll file in System32,
the clusters are not freed up, as there is still a pointer
to the clusters, and System32 continues to work properly.

By deleting WinSXS then:

1) You save 500MB of file pointers.
2) References to currently unused files, are completely
removed. Old versions of DLLs, or the files needed for
an Anytime Upgrade to another OS version, are lost.
3) The OS continues to work, because the remaining file
pointers prevent the data clusters from being removed
for them.
4) System maintenance operations are going to be blindsided.
There should be a series of system utilities, that
simply won't know what to do. Because they act on the
WinSXS file set, and not on System32. That could be
things like "dism" or System Update Readiness Check (SURcheck).

The only real way to get file usage data on a WinSXS
based OS, is to examine the entire partition properties.
My Windows 8 uses 26GB for the entire partition. If
I went from folder to folder, totaling up the numbers,
I would double count anything with hard links, and I might
get a number like 40GB. Do not conclude that "14GB is
being wasted", when in fact it might all be done with
hard link sleigh-of-hand. And the penalty for the sleigh-of-hand
might be 25.5GB of real files plus 0.5GB of multiple file
pointers to make things appear in two (or more) places
at the same time.

When hard links were latched onto, as a mechanism, the
File Explorer should have been modified to display two
numbers for a folder. "Unique file size" and "Shared file
size". This would give the user some idea, of the risks of
double counting, without attempting to name what other
folder might be sharing the same data clusters.

HTH,
Paul
 
Ken said:
Oh, yea, if you don't have room for 20 restore points, or whatever the
default is, you're not going to have them. But if you've got a few
spare GB of space, you'll have the default number.

Effing MS!!!! Just did a quick search on this, a webpage at MS was
listed, and the snipped of text clearly says Windows XP. But MS has
redirected you to the Windows 7 page. A$$holes.

Maybe you've got the time to do more searching than I did.
Click to expand...

Note that, even some reference pages for Windows 7 have been
removed, making Windows 8 the only OS with complete
documentation (if you want to call it that) still intact.
Even though numerically, Windows 7 has the lions share of
user buy-in. More web pages will have been damaged for the
older OSes. There's really no way to predict what pages they'll
screw over and which they will leave alone.

And you then need to find references to the old pages (URLs), then
look them up on archive.org, to read them. If we didn't
have archive.org, we'd be screwed.

On occasion, it appears Microsoft has issued a takedown from
archive.org . For example, one file I used to point people
to, it was removed from archive.org. But the neat part was,
archive.org was doing maintenance a year later, and that
file was put back :-) Made my day. I think the file is still
there, but I'm not naming the file in question. I learned
my lesson from the first time.

Paul
 
| WinSXS is the "store" and contains components.
|
| All five versions of Windows 7 are stored in there (including
| Ultimate). If you do an Anytime Upgrade, the files to do the
| job are already in WinSXS.
|

That's interesting. I knew there were irrelevant
versions in there. I didn't know they were imposing
all of that mess.

I still don't understand the hard linking scenario, and
since I only use Win7 for testing I haven't tried very
hard. But the idea that the used space is not "real"
doesn't make sense to me. If Windows things it's 40
GB it's 40 GB. When it installs winsxs is something like
4 GB and the whole OS install is 7-9 GB. If I make a
disk image, compressed, it's over 4GB. There's nothing
"unreal" about that bloat.

The Microsofties don't even seem to know how it
works:

http://blogs.msdn.com/b/e7/archive/2008/11/19/disk-space.aspx

Steve Sinofsky: ...nearly every file in the WinSxS directory is a "hard
link" to the physical files elsewhere on the system-meaning that the files
are not actually in this directory. ...The actual amount of storage consumed
varies, but on a typical system it is about 400MB.

http://blogs.technet.com/b/askcore/...and-windows-vista-and-why-is-it-so-large.aspx

The "Windows Server Core Team": All of the components in the operating
system are found in the WinSxS folder - in fact we call this location the
component store. ...The WinSxS folder is the only location that the
component is found on the system, all other instances of the files that you
see on the system are "projected" by hard linking from the component store.

Both say the file only exists in one place. Each says
it's in the other place. :) And that also doesn't explain
Windows File Protection.



| To use a file from it, the file is not copied. Instead,
| it is hard linked. One data cluster, has two file pointers.
| These two file paths, for example, point to the same set
| of data clusters. This is from my Win8 disk, which I can
| see from my current WinXP. Windows 7 does something similar.
| I used this example, because I have all 135000 files
| checksummed, to make it easier to detect the duplicates.
|
| WinSxS\amd64_microsoft-windows-network-datausage_31bf3856a
| d364e35_6.3.9600.16384_none_5839dc11fcec2fae/datusage.dll--
| \___32,256
| / bytes
| Windows\System32\datusage.dll ----------------------------/
|
| The overhead of this system, is about 500MB worth of file points.
| Many irrelevant versions of things are contained in WinSXS,
| purportedly for an old application you might install, with
| a dependency on it. There will be files in there you will
| not be using, or ever even reference. But if they're linked
| somewhere else, they're in use.
|
| Now, since these are hard links, how do you delete a file ?
| By removing all hard links to it. In my example, there are
| two file pointers. I would have to delete both pointers,
| to remove the reference to those 32,256 bytes.
|
| The file space also gets double-counted. If you measure the
| size of System32, you get a number X. If you measure the
| size of WinSXS, you get a number X. You mistakenly assume
| the space used is 2X. When in fact, it's around X + 500MB.
| The 500MB is an estimate of the amount of file pointers
| used to make the two (or more) references to the same file.
| That's my estimate of what the hard links for all the files
| might cost.
|
| I originally studied this from Linux. Using Linux, if you
| use the "ls" program option to display inode information,
| the multiple file pointers in Windows, all have the same
| inode number in Linux. Linux inode numbers on NTFS are
| "fake", and exist to provide compatibility with the software
| there. (So system software will be less aware of the
| differences between an EXT2 file tree, and an NTFS file tree.)
| So the inode numbers do not imply NTFS uses inodes. Some
| property of Windows is used to assemble inode equivalence.
| If I was in Linux, seeing the same inode for the two files
| in my example above, would be an indication of the usage of
| hard linking. My using my md5sum checksum file to create
| that example above, isn't really the right way to do it.
| To do it properly, I'd have to boot Linux and check they
| both show the same inode number. In Windows, if I use
| "nfi.exe", which gives the LBA addresses of clusters,
| that's how I'd figure it out purely in Windows. (Two
| files with the same clusters in usage, must be hard linked.)
|
| If you delete the WinSXS folder in my above example, you save
| 500MB of space for the pointers. For those files that exist
| for the purpose of supporting Ultimate, if you had Home Premium,
| all the Ultimate files would be deleted (so you could not
| do an Anytime Upgrade to Ultimate then). For files that have
| two pointers, such as the datusage.dll file in System32,
| the clusters are not freed up, as there is still a pointer
| to the clusters, and System32 continues to work properly.
|
| By deleting WinSXS then:
|
| 1) You save 500MB of file pointers.
| 2) References to currently unused files, are completely
| removed. Old versions of DLLs, or the files needed for
| an Anytime Upgrade to another OS version, are lost.
| 3) The OS continues to work, because the remaining file
| pointers prevent the data clusters from being removed
| for them.
| 4) System maintenance operations are going to be blindsided.
| There should be a series of system utilities, that
| simply won't know what to do. Because they act on the
| WinSXS file set, and not on System32. That could be
| things like "dism" or System Update Readiness Check (SURcheck).
|
| The only real way to get file usage data on a WinSXS
| based OS, is to examine the entire partition properties.
| My Windows 8 uses 26GB for the entire partition. If
| I went from folder to folder, totaling up the numbers,
| I would double count anything with hard links, and I might
| get a number like 40GB. Do not conclude that "14GB is
| being wasted", when in fact it might all be done with
| hard link sleigh-of-hand. And the penalty for the sleigh-of-hand
| might be 25.5GB of real files plus 0.5GB of multiple file
| pointers to make things appear in two (or more) places
| at the same time.
|
| When hard links were latched onto, as a mechanism, the
| File Explorer should have been modified to display two
| numbers for a folder. "Unique file size" and "Shared file
| size". This would give the user some idea, of the risks of
| double counting, without attempting to name what other
| folder might be sharing the same data clusters.
|
| HTH,
| Paul
 
Mayayana said:
| WinSXS is the "store" and contains components.
|
| All five versions of Windows 7 are stored in there (including
| Ultimate). If you do an Anytime Upgrade, the files to do the
| job are already in WinSXS.
|

That's interesting. I knew there were irrelevant
versions in there. I didn't know they were imposing
all of that mess.

I still don't understand the hard linking scenario, and
since I only use Win7 for testing I haven't tried very
hard. But the idea that the used space is not "real"
doesn't make sense to me. If Windows things it's 40
GB it's 40 GB. When it installs winsxs is something like
4 GB and the whole OS install is 7-9 GB. If I make a
disk image, compressed, it's over 4GB. There's nothing
"unreal" about that bloat.

The Microsofties don't even seem to know how it
works:

http://blogs.msdn.com/b/e7/archive/2008/11/19/disk-space.aspx

Steve Sinofsky: ...nearly every file in the WinSxS directory is a "hard
link" to the physical files elsewhere on the system-meaning that the files
are not actually in this directory. ...The actual amount of storage consumed
varies, but on a typical system it is about 400MB.

http://blogs.technet.com/b/askcore/...and-windows-vista-and-why-is-it-so-large.aspx

The "Windows Server Core Team": All of the components in the operating
system are found in the WinSxS folder - in fact we call this location the
component store. ...The WinSxS folder is the only location that the
component is found on the system, all other instances of the files that you
see on the system are "projected" by hard linking from the component store.

Both say the file only exists in one place. Each says
it's in the other place. :) And that also doesn't explain
Windows File Protection.
Click to expand...

When you do the partition properties and get the "pie chart",
that display is accurate. In many other cases, it's possible
to be double counting the space, and ending up with the
wrong estimate. If you use File Explorer to do space estimates,
without understanding what you've just measured, you could be
double counting. In the first example below, if I open WinSXS\ and
I open Windows\, if I get 4GB+9GB=13GB that would be an
over-estimate, as the 32256 bytes is counted twice, when
it should not be. The data clusters only exist once.

The file utilities themselves, have to be aware of what
a hard link is, and what to do with it. You cannot
naively copy both file pointers, without ending up at
the destination, taking up twice the space.

And the files don't really have a "prime" instance and
others being "projected". In a way, once the second link
is formed, there's no way to tell which one was there first.

WinSxS\amd64_microsoft-windows-network-datausage_31bf3856a
d364e35_6.3.9600.16384_none_5839dc11fcec2fae/datusage.dll--
\___32,256
/ bytes
Windows\System32\datusage.dll ----------------------------/

No bias was intended there. The copies are equal, in that if
their partner is erased, only they remain and would
then be the only file pointer to the 32256 bytes of data.
Only when the last of the hard links is deleted, do the
data clusters go away.

It's the same problem as when a soft link is used, and
it causes a circular reference. I ran into that problem
not that long ago, where a file utility I was using,
complained "path too long", when what had happened, is it
ran into a soft link that "pointed to itself". (And that
technique is used, to actually prevent folder deletion - its
not an accident when you find one of those cases. They're
intended to function as "land mines".) Unix utilities
have some protection against that, and have loop detection
for the trivial case.

The overall summary would be, naive usage of copy, xcopy,
file listing utilities, robocopy, could all subtly do the
wrong thing, and give wrong results. The only way I know
to copy something now, on these OSes, with any assurance
of a quality copy, is to use VSS based cloning software.
That stands a good chance of getting it right. Using other
methods, could cause the destination to be larger than
the source, in terms of occupied space.

Here, I copied the contents of the partition, to another
partition. The utility didn't check for hard links, and
now my two files are using up 64,512 bytes total. On the
source partition, the space used was 32,256 plus the space
to hold the file pointers themselves.

WinSxS\amd64_microsoft-windows-network-datausage_31bf3856a
d364e35_6.3.9600.16384_none_5839dc11fcec2fae/datusage.dll----- 32,256 bytes

Windows\System32\datusage.dll -------------------------------- 32,256 bytes

For the "I'm a DOS guy and I do it this way" person,
there is a distinct disadvantage to the reckless usage
of every available NTFS feature. And that's basically
what they've attempted to do - anything that existed in
the NTFS spec, has been put to usage. No matter how hard
that makes it for someone doing maintenance. Is this
a junction point ? Is this a reparse point ? Is that
a soft link land mine ? Are those files hard linked ?
What utilities (including File Explorer) are prepared
to deal with this in an intelligent way ? How does
Windows equip me to detect hard links (nfi.exe, an old
utility, gives the LBA addresses of the data clusters,
which is the only way I know of right now.) Each file
pointer is given its own "file number", so file numbers
don't work to sort that out. Only knowing the address
of the data clusters, gives away the fact a hard link is
present. The developers of course, will have some
sort of IsThisAHardLink() function, but us users don't
have that available in the form of a utility.

HTH,
Paul
 
In message <[email protected]>,
I just discovered what was going on with these folders, when I copied
one gig of files to the new HDD, just to bne sure the drive was working,
then I deleted them. That left me 1 gig of usage on a drive that was
supposed to be empty. I went to linux, and peered inside adn discovered
all those deleted files were in there.
Click to expand...
[]
Did this happen even if you shift-deleted?
 
In message <[email protected]>,
If you know of any software that can automatically save a copy of the
registry files, please post it.
Click to expand...
[]
As several (I think it was the Bills) have mentioned, Lars Hederer's
ERUNT is pretty good. I use it because ERU/ERD got me out of a hole
several times in 98 days, and Lars seems to have tried to make something
similar. If your Windows will boot at all, then it seems ERUNT will
restore, over the damaged version, though I haven't used it enough to
say it _always_ will. If your Windows _won't_ boot, the ERUNT executable
will still restore things, but you need a way to get as far as being
able to run it: I _think_ it will run from DOS if you have a FAT system,
but since by default XP uses an NTFS system (though will run on FAT), if
you have an NTFS system you need something to boot into; when I asked
Lars himself, he recommended BartPE. I've used that, to make sure I was
able to restore from an ERUNT save. (With held breath!)

Unlike System Restore points, ERUNT saves endure until _you_ decide to
delete them, rather than being overwritten/deleted when the allocated
space is full and a new one is needed. (I. e. ERUNT doesn't _have_ an
"allocated space" - it just keeps adding new saves.)
 
Note that, even some reference pages for Windows 7 have been
removed, making Windows 8 the only OS with complete
documentation (if you want to call it that) still intact.
Even though numerically, Windows 7 has the lions share of
user buy-in. More web pages will have been damaged for the
older OSes. There's really no way to predict what pages they'll
screw over and which they will leave alone.

And you then need to find references to the old pages (URLs), then
look them up on archive.org, to read them. If we didn't
have archive.org, we'd be screwed.

On occasion, it appears Microsoft has issued a takedown from
archive.org . For example, one file I used to point people
to, it was removed from archive.org. But the neat part was,
archive.org was doing maintenance a year later, and that
file was put back :-) Made my day. I think the file is still
there, but I'm not naming the file in question. I learned
my lesson from the first time.
Click to expand...

If a car company, appliance mfgr., etc., behaved this way, there'd
probably be a pretty good hue and cry over it. But no one seems to care
if it's MS.

Just another reason I don't want to go back to Windows.


--
Ken
Mac OS X 10.8.5
Firefox 25.0
Thunderbird 24.3.0
"My brain is like lightning, a quick flash
and it's gone!"
 
Back
Top