Blue Screen (BSOD) After System Image Restore - *** STOP 0x000000F4...

[miketh2005]

try running this command and let me know the output

reg query \\\HKLM\SYSTEM\CurrentControlSet\Control\CrashControl

then try using this for ex.

wmic recoveros set MiniDumpDirectory = D:\Minidump ( or whichever drive you have)

then try

wmic recoveros set DebugInfoType = 3

I did reg query \\\HKLM\SYSTEM\CurrentControlSet\Control\CrashControl exactly and it says:

ERROR: Invalid key name.
Type "REG QUERY /?" for usage.

I then proceeded to do your other commands. They both said successful, but it never dumped to file and the DebugInfoType got reset back to 0.:shock:

 

[centaur78]

oh crap....

sorry try this...

REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\CrashControl

 

[miketh2005]

oh crap....

sorry try this...

REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\CrashControl

It says:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
AutoReboot REG_DWORD 0x0
CrashDumpEnabled REG_DWORD 0x0
Overwrite REG_DWORD 0x1
DumpFilters REG_MULTI_SZ dumpfve.sys

Thank you.

 

[centaur78]

Okie good

Follow the next steps one after another... Each time you type Yes when asked to overwrite......

First set the crash dump to minidump... thats why its 0x3

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v CrashDumpEnabled /t REG_DWORD /d 0x3

Next set the log event

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v LogEvent /t REG_DWORD /d 0x1

Then the Minidump counts

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpsCount /t REG_DWORD /d 0x32

Then the Dump file

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d ^%SystemRoot%\MEMORY.DMP

Then the Minidump location

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d ^%SystemRoot%\Minidump

Once finished... do the reg query to see of everything is enabled.

REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\CrashControl

The resulting query should look like this.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
AutoReboot REG_DWORD 0x1
CrashDumpEnabled REG_DWORD 0x3
Overwrite REG_DWORD 0x1
LogEvent REG_DWORD 0x1
MinidumpsCount REG_DWORD 0x32
DumpFile REG_EXPAND_SZ %SystemRoot%\MEMORY.DMP
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
DumpFilters REG_MULTI_SZ dumpfve.sys

 

[miketh2005]

Okie good

Follow the next steps one after another... Each time you type Yes when asked to overwrite......

First set the crash dump to minidump... thats why its 0x3

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v CrashDumpEnabled /t REG_DWORD /d 0x3

Next set the log event

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v LogEvent /t REG_DWORD /d 0x1

Then the Minidump counts

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpsCount /t REG_DWORD /d 0x32

Then the Dump file

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d ^%SystemRoot%\MEMORY.DMP

Then the Minidump location

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d ^%SystemRoot%\Minidump

Once finished... do the reg query to see of everything is enabled.

REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\CrashControl

The resulting query should look like this.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
AutoReboot REG_DWORD 0x1
CrashDumpEnabled REG_DWORD 0x3
Overwrite REG_DWORD 0x1
LogEvent REG_DWORD 0x1
MinidumpsCount REG_DWORD 0x32
DumpFile REG_EXPAND_SZ %SystemRoot%\MEMORY.DMP
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
DumpFilters REG_MULTI_SZ dumpfve.sys

I just released you could use the right directional key to copy from the previous command by chance when doing these command. Never knew that before and saved me some time.

Results:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
AutoReboot REG_DWORD 0x0
CrashDumpEnabled REG_DWORD 0x3
Overwrite REG_DWORD 0x1
DumpFilters REG_MULTI_SZ dumpfve.sys
LogEvent REG_DWORD 0x1
MinidumpsCount REG_DWORD 0x32
DumpFile REG_EXPAND_SZ X:\%SystemRoot%\MEMORY.DMP
MinidumpDir REG_EXPAND_SZ X:\%SystemRoot%\Minidump

I don't think the autoreboot is significant, but what about the drive saying X:\ instead of my drive which is C:\?

 

[centaur78]

Aha

Thats the problem... it should never be X or C.... as %SystemRoot% tells windows whatever is drive where windows in installed.

ok repeat only the last two steps again ...

Then the Dump file

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d ^%SystemRoot%\MEMORY.DMP

Then the Minidump location

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d ^%SystemRoot%\Minidump

Remember there is a carat ^ .. after the /d.. its important to add this


One question... how are you doing this command i mean is it from the DVD or is it from the command line through F8... sorry i should have asked this before ???

 

[miketh2005]

Aha

Thats the problem... it should never be X or C.... as %SystemRoot% tells windows whatever is drive where windows in installed.

ok repeat only the last two steps again ...

Then the Dump file

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d ^%SystemRoot%\MEMORY.DMP

Then the Minidump location

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d ^%SystemRoot%\Minidump

Remember there is a carat ^ .. after the /d.. its important to add this


One question... how are you doing this command i mean is it from the DVD or is it from the command line through F8... sorry i should have asked this before ???

I was doing it through F8 but I do have the disc in also. I did have the carat after /d. Do I still repeat the last steps?

 

[centaur78]

F8 is fine..

Yes please repeat and then do a REG QUERY again

 

[miketh2005]

F8 is fine..

Yes please repeat and then do a REG QUERY again

I copied the output wrong, it actually says:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
AutoReboot REG_DWORD 0x0
CrashDumpEnabled REG_DWORD 0x3
Overwrite REG_DWORD 0x1
DumpFilters REG_MULTI_SZ dumpfve.sys
LogEvent REG_DWORD 0x1
MinidumpsCount REG_DWORD 0x32
DumpFile REG_EXPAND_SZ X:\windows\MEMORY.DMP
MinidumpDir REG_EXPAND_SZ X:\windows\Minidump

 

[centaur78]

This is weird... The command should set it to %SystemRoot%..... not sure why it still refers to X ??

Could you repeat the last steps again .... but this time... try to make it specific..

Like

For Dump file

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d ^C:\Windows\MEMORY.DMP

Then the Minidump location

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d ^C:\Windows\Minidump


Let me know what the REG QUERY shows after doing this

 

[miketh2005]

This is weird... The command should set it to %SystemRoot%..... not sure why it still refers to X ??

Could you repeat the last steps again .... but this time... try to make it specific..

Like

For Dump file

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v DumpFile /t REG_EXPAND_SZ /d ^C:\Windows\MEMORY.DMP

Then the Minidump location

REG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl /v MinidumpDir /t REG_EXPAND_SZ /d ^C:\Windows\Minidump


Let me know what the REG QUERY shows after doing this

It says C:\ now. For some reason it thinks the %SystemRoot% is X:\, but that's over with now I suppose. Should I restart > go to BSOD and see if it dumps now?

 

[centaur78]

Yes ...

 

[miketh2005]

Yes ...

Aaaaaaaaannnnnddddddddd..... it just reset back.

LOL

Maybe we can change the registry from Ubuntu instead??

Btw, if it means anything to you the title of cmd says:

Administrator: X:\windows\system32\cmd.exe

and the beginning of cmd says:

X:\sources\recovery\Tools>

 

[centaur78]

Alright

Try it now with the Win 7 DVD..

go to the command prompt and go to C:

and do all the commands be did before to set it ...

It should work

 

[miketh2005]

Alright

Try it now with the Win 7 DVD..

go to the command prompt and go to C:

and do all the commands be did before to set it ...

It should work

Ohhhhh.... Win 7 DVD..... I thought I could do it with the repair disc. Guess not.

I don't have the Win 7 DVD.

I guess I will download it.

 

[centaur78]

Any feedback ???

 

[miketh2005]

Any feedback ???

I'm trying to load the Windows 7 disc on an external HDD.

 

[miketh2005]

Any feedback ???

I have the Windows 7 DVD and it still says "X:\Sources>" I cannot navigate to C drive using "cd C:\"....

 

[miketh2005]

Any feedback ???

Can you still help or is it useless?

 

[centaur78]

Any feedback ???

Can you still help or is it useless?

Mike

Your not getting C: because when you are booting from the DVD .. the drive letters are different.

One way to do it is trial and error method.... Try typing D: ... if it goes to D: then type DIR to confirm that you are in partition where Windows Folder is shown... This is the boot partition.

If D: doesnt work try another letter

or

You could try this....

1. Type DISKPART
   
2. then type LIST DISK
   
3. select the First disk ... ex DISK 0 by typing SELECT DISK 0
   
4. then type LIST VOLUME
   
5. this will show you which drive letter is shown as Boot.