May the source be with you, but remember the KISS principle ;-)
Contents Bulletin Scripting in shell and Perl Network troubleshooting History Humor

Windows Recovery Console


See also

Reinstallation of Windows XP Recommended Links Norton Ghost Alternatives to Norton Ghost Windows XP Slow Startup and Shutdown


You can use Recovery Console to perform many tasks without starting Windows XP, including: starting and stopping services, reading and writing information on a local disk drive, and formatting drives. However, you must install Recovery Console while your computer is still functioning. The Recovery Console feature should be used only by advanced users. Before using Recovery Console, it is recommended that you back up your information on a tape drive, because your local hard disks might be reformatted—thus erased—as part of the recovery. You can also run Recovery Console from the Windows XP CD.

If it does not help you can try Reinstallation of Windows XP

To install Recovery Console as a Startup option

1.Log on to Windows XP Professional as an administrator or as a user with administrator rights.

If your computer is connected to a network, network policy settings may prevent you from completing this procedure. Contact your network administrator for assistance.

2.Insert the Windows XP Professional CD into your CD ROM drive. If you're prompted to upgrade to Windows XP, click No.

3. From the command prompt—or from the Run command in the Start menu–type the path to the appropriate Winnt32.exe file (on your Windows XP Professional CD), followed by a space and /cmdcons to reference this switch. For example:

Follow the instructions that appear

To run Recovery Console on a computer if Windows XP Professional does not start

1. Restart your computer, and then choose Windows Recovery Console from the list of operating systems.
2. Follow the instructions that appear.

Recovery Console displays a command prompt.

3. Make the required changes to your system.

To learn more about using Recovery Console, see Help and Support Center.


Old News ;-)

[Apr 28, 2006] Port25 Recovering remote NT-W2K-XP desktops with a network boot CD-DVD 

In the comment below it's unclear why just don't let create students to use Norton Ghost and create thier own images ?  Also only amateurs use one partition (C: for all the drive) on modern laptop, and if University wants to train idiots this is definitely a way to go ;-). It's very easy to link major user directories to the second drive.

re: Recovering remote NT/W2K/XP desktops with a network boot CD/DVD

Friday, April 28, 2006 12:58 PM by fluke g4u is a very interesting project.  I have been using Novell's ZEN Image which boots a light (less than 12MB) version of SuSE to do imaging.  And just like g4u, it supports be started via CD boot or PXE network boot.

However, you did not answer the question about *RECOVERY* of an existing installation at all.

At the University, we have several students that are getting hit with the "Blackworm."  Several of these Dell laptop users don't even have a Windows install CD, but rather a Ghost boot CD that puts the drive back to OEM default (in some cases also without SP2).  It would be nice to have a "Live CD" based on the XP kernel.  This way, even if the user has hardware not supported by alternative OSes, a recovery enviroment could be booted that is ensured not automatically start any rootkits from the hard drive.  We could then use network access to the "Live CD" enviroment to try to remove the infection or at least remotely back up critical data files.

But the problem is one of license terms instead of any technical issue.  While several people claim that Windows is simply a victim of it's own popularity and if Mac OS or Linux became the popular desktop then it would also be the target of malware.  To some extent that might be true but the people that make this claim do not seem to take into account what methods of recovery could be made available to the different personal desktop users.

If a Mac OS port of Blackworm came out, we could create a bootable recovery CD based on Darwin that uses Apple's offical HFS+ file system code and is able to support all the same hardware drivers as the hard drive installed OS.  Once such a recovery CD is created, we could then redistribute it to the students under the licensing terms of Darwin.

If a GNU/Linux port of Blackworm came out, we could create a bootable recovery CD based on the GNU/Linux distribution that uses the distribution's offical file system code and is able to support all the same hardware drivers as the hard drive installed OS.  Once such a recovery CD is created, we could then redistribute it to the students under the licensing terms of the GNU/Linux distribution.

But now that XP version of Blackworm is out, we have tried creating a bootable BartPE CD that uses the offical MS kernel, NTFS driver and other XP drivers.  But, then the terms of redistribution on any work derived using the XP kernel and other resources prohibits us from redistributing it to the students.

We don't want to cheat Microsoft but we don't want to cheat our students either.  Ultimately, copyright law wins out and our ability to help the students is greatly hindered.  Our Microsoft sales rep will only confirm that we don't have any reasonable method of redistributing BartPE CDs regardless of what our intentions are.

Much like you, Dell and Microsoft's answer involves re-imaging the laptop which does not address keeping any of the data they need to pass their classes.

"and went for coffee (anytime is a good time for coffee J )"

Well... if you can recommend any good coffee, it might at least make our students feel better about loosing to the Blackworm their end of semester papers that are due today.

If only malware authors where restricted by the same laws that hinder us from fighting their creations.

To run the Recovery Console from the Windows XP startup disks or the Windows XP CD-ROM, follow these steps:
  1. Insert the Windows XP startup disk into the floppy disk drive, or insert the Windows XP CD-ROM into the CD-ROM drive, and then restart the computer.

    Click to select any options that are required to start the computer from the CD-ROM drive if you are prompted.
  2. When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  3. If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console.
  4. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.
  5. At the command prompt, type the appropriate commands to diagnose and repair your Windows XP installation.

    For a list of commands that are available in Recovery Console, type recovery console commands or help at the command prompt, and then press ENTER.

    For information about a specific command, type help commandname at the command prompt, and then press ENTER.
  6. To exit the Recovery Console and restart the computer, type exit at the command prompt, and then press ENTER.


Recommended Papers

Description of the Windows 2000 Recovery Console This article describes the functionality and limitations of the Windows Recovery Console. The Windows Recovery Console is designed to help you recover when your Windows-based computer does not start properly or does not start at all.
Article ID : 229716
Last Review : November 17, 2004
Revision : 3.1
This article was previously published under Q229716

For a Microsoft Windows XP version of this article, see 314058.


When you use the Windows Recovery Console, you can obtain limited access to NTFS, FAT, and FAT32 volumes without starting the Windows graphical interface. In the Windows Recovery Console you can:
Use, copy, rename or replace operating system files and folders.
Enable or disable services or devices from starting when you next start your computer.
Repair the file system boot sector or the Master Boot Record (MBR).
Create and format partitions on drives.

Note that only an administrator can obtain access to the Windows Recovery Console so that unauthorized users cannot use any NTFS volume.

Starting the Windows Recovery Console

To start the Windows Recovery Console, use any of the following methods:

Start your computer with the Windows Setup floppy disks, or with the Windows CD-ROM. At the "Welcome to Setup" screen, press F10, or press R to repair, and then press C (Windows 2000 only) to start the Windows Recovery Console. Select the appropriate number for the Windows installation that you want to repair, and then type the administrator password. If the administrator password does not exist, just press ENTER.
Add the Windows Recovery Console to the Windows Startup folder by using Winnt32.exe with the /cmdcons switch. This procedure requires approximately 7 MB of hard disk space on your system partition to hold the Cmdcons folder and files.

NOTE: If you are using software mirroring, please see the following article in the Microsoft Knowledge Base:

229077 Mirroring Prevents Pre-Installing the Recovery Console

Follow the instructions in the following article in the Microsoft Knowledge Base:

222478 Creating a Template to Run Recovery Console Using a Remote Install Server

Using the Command Console

After you start the Windows Recovery Console, you receive the following message:

Windows NT(TM) Boot Console Command Interpreter.


This is a limited function command prompt intended only as a system recovery utility for advanced users. Using this utility incorrectly can cause serious system-wide problems that may require you to reinstall Windows to correct them.

Type 'exit' to leave the command prompt and reboot the system.


Which Windows installation would you like to logon to (enter to abort)?

After you enter the number for the appropriate Windows installation, enter the Administrator account password. Note that if you use an incorrect password three times, the Windows Recovery Console quits. Also, if the SAM database is missing or damaged, you are not able to use the Windows Recovery Console because you cannot be properly authenticated. After you enter your password and the Windows Recovery Console starts, type exit to restart your computer.

Restrictions and Limitations of the Command Console

From the Windows Recovery Console you can only use the following folders:

The root folder
The %SystemRoot% folder and the subfolders of the Windows installation you are currently logged on to
The Cmdcons folder
Removable media drives such as CD-ROM drives

NOTE: If you try to obtain access to other folders, you receive an "Access Denied" error message. Also, while you are using the Windows Recovery Console, you cannot copy a file from the local hard disk to a floppy disk. You can copy a file from a floppy disk or CD-ROM to a hard disk, and from one hard disk to another hard disk.

Available Commands


Use the help command to list all of the following supported commands:

attrib       delete        fixboot    md        type
cd           dir           fixmbr     mkdir     systemroot
chdir        disable       format     more
chkdsk       diskpart      help       rd
cls          enable        listsvc    ren
copy         exit          logon      rename
del          expand        map        rmdir


Use the attrib command with any of the following parameters to change attributes of a file or folder:


+ Sets an attribute.
- Resets an attribute.
R Read-Only file attribute.
S System file attribute.
H Hidden file attribute.

NOTE: At least one attribute must be set or cleared. To view attributes, use the dir command.


Use the cd and chdir commands to change the folder. If you type cd .., you specify that you want to change to the parent folder. Type cd drive: to display the current folder in the specified drive. Type cd without parameters to display the current drive and folder. The chdir command treats spaces as delimiters. Because of this, you must enclose a subfolder name that contains a space with quotation marks, for example:

cd "\winnt\profiles\username\programs\start menu"

The chdir command only operates within the system folders of the current installation of Windows, removable media, the root folder of any hard disk partition, or the local installation sources.


chkdsk drive /p /r

This command (where drive specifies the drive to check) checks the drive, and if needed, repairs or recovers the drive. It also marks bad sectors and recovers readable information.

The /p switch instructs CHKDSK to do an exhaustive check of the drive even if the drive is not marked with problems, and then corrects any errors that are found. The /r switch locates bad sectors and recovers readable information. Note that if you specify the /r switch, the /p switch is implied. The chkdsk command may be specified without arguments, in which case the current drive is implied with no switches. Optionally, the listed switches are accepted. The chkdsk command requires the Autochk.exe file. Chkdsk automatically locates this file in the bootup folder. Typically, this folder is the Cmdcons folder if the Command Console was pre-installed. If the folder cannot be found in the bootup folder, Chkdsk tries to locate the Windows CD-ROM installation media. If the installation media cannot be found, Chkdsk prompts you to provide the location of the Autochk.exe file.


Use this command to clear the screen.


copy source destination

Use this command (where source specifies the file to be copied and destination specifies the folder or file name for the new file) to copy a file. Wildcards or folder copies are not permitted. A compressed file from the Windows CD-ROM is automatically decompressed as it is copied.

If destination is not specified, it defaults to the current folder. If the file already exists, you are prompted to overwrite it.


del drive: path filename

delete drive: path filename

Use this commmand (where drive: path filename specifies the file to delete) to delete a file. The delete command only operates within the system folders of the current Windows installation, removable media, the root folder of any hard disk partition, or the local installation sources. The delete command does not accept wild card (*) characters.


dir drive: path filename

Use this command (where drive: path filename specifies drive, folder, and files to list) to display a list of files and subfolders in a folder. The dir command lists all files including hidden and system files. Files may have the following attributes:

D - Directory       R - Read-only file
H - Hidden file     A - Files ready for archiving
S - System file     C - Compressed
E - Encrypted       P - Reparse Point

The dir command only operates within the system folders of the current Windows installation, removable media, the root folder of any hard disk partition, or the local installation sources.


disable servicename

Use this command (where servicename specifies the name of the service or driver to be disabled) to disable a Windows system service or driver.

Use the listsvc command to display all eligible services or drivers to disable. The disable command prints the old start type of the service before resetting it to SERVICE_DISABLED. Because of this, you should record the old start type in case it is necessary to re-enable the service.

The start_type values that the disable command displays are:



diskpart /add /delete device_name drive_name partition_name size

Use this command to manage the partitions on your hard disk volumes.

/add: Creates a new partition.
/delete: Deletes an existing partition.
device_name: The device name for creating a new partition. The name can be obtained from the output of the MAP command, for example: \Device\HardDisk0.
drive_name: A drive-letter based name for deleting an existing partition, for example D:
partition_name: The partition-based name for deleting an existing partition and can be used in place of the drive name argument, for example: \Device\HardDisk0\Partition1.
size: The size of the new partition in megabytes.

NOTE: If no arguments are used, a user interface for managing your partitions is displayed.

WARNING: This command can damage your partition table if the disk has been upgraded to a dynamic disk configuration. Do not modify the structure of dynamic disks unless you are using the Disk Management tool.


enable servicename start_type

You can use the enable command (where servicename is the name of the service or driver to be enabled) to enable a Windows system service or driver.

Use the listsvc command to display all eligible services or drivers to enable. The enable command prints the old start type of the service before resetting it to the new value. You should note the old value, in case it is necessary to restore the start type of the service.

Valid start_type are:


NOTE: If you do not specify a new start type, the enable command prints the old start type for you.


Use the exit command to quit the Command Console and restart your computer.


expand source [/F:filespec] [destination] [/y]

expand source [/F:filespec] /D

Use this command (where source specifies the name of the file to be expanded and destination specifies the directory for the new file) to expand a file.

NOTE: You may not include wildcards.
If destination is not specified, the command defaults to the current folder.


/y: Do not prompt before overwriting an existing file.
/f:filespec: If the source contains more than one file, this parameter is required to identify the specific files to be expanded. You may include wildcards.
/d: Do not expand; only display a directory of the files which are contained in the source.

The destination may be any directory within the system directories of the current Windows installation, the root of the drive, the local installation sources, or the Cmdcons folder. The destination cannot be removable media. The destination file cannot be read-only. Use the attrib command to remove the read-only attribute.

expand prompts you if the destination file already exists unless you use /y.


fixboot drive name:

Use this command (where drive name is the drive letter where the boot sector will be written) to write the new Windows boot sector code on the boot partition. This command fixes problems where the Windows boot sector is corrupted. The Emergency Repair process also fixes the boot sector. This command overrides the default of writing to the system boot partition.


fixmbr device name

Use this command (where device name is an optional device name that specifies the device that needs a new MBR) to repair the master boot record (MBR) of the system partition. This command is used in scenarios where a virus has damaged the MBR and Windows cannot start.

WARNING: This command has the potential to damage your partition tables if a virus is present or a hardware problem exists. This command may lead to inaccessible partitions. Microsoft suggests running antivirus software before using this command.

The name can be obtained from the output of the map command. If this is left blank, the boot device's MBR is fixed, for example:

fixmbr \device\harddisk2

If Fixmbr detects an invalid or non-standard partition table signature, it prompts you for permission before rewriting the MBR.


format drive: /Q /FS:file-system

Use this command (where /Q performs a quick format of the drive, drive is the drive letter of the partition to format /FS:file-system specifies the type of file system to use [FAT, FAT32, or NTFS]) to format the specified drive to the specified file system.

If a file system is not specified, the existing file system format is used, when available.


The listsvc command lists all available services, drivers, and their start types for the current Windows installation. This command may be useful when using the disable and enable commands.

NOTE: These are extracted from the %SystemRoot%\System32\Config\SYSTEM hive. If the SYSTEM hive become damaged or missing, unpredictable results may occur.



The logon command lists all detected installations of Windows, and then requests the local administrator password for the copy of Windows you chose to log on to. If more than three attempts to logon do not succeed, the console quits and your computer restarts.


map arc

Use this command (where the arc parameter tells the map command to use ARC paths instead of Windows Device paths) to list drive letters, file system types, partition sizes and mappings to physical devices.


The md or mkdir commands create new folders. Wildcard characters are not supported. The mkdir command only operates within the system folders of the current installation of Windows, removable media, the root folder of any hard disk partition, or the local installation sources.


more filename

Use this command to display a text file to the screen.


The rd and rmdir commands delete a folder. These commands only operate within the system folders of the current Windows installation, removable media, the root folder of any hard disk partition, or the local installation sources.


The ren and rename commands can rename a file. Note that you cannot specify a new drive or path for your destination file. These commands only operate within the system folders of the current Windows installation, removable media, the root folder of any hard disk partition, or the local installation sources.


The set command allows you to display or modify four environment options.

AllowWildCards = FALSE AllowAllPaths = FALSE AllowRemovableMedia = FALSE NoCopyPrompt = FALSE


The systemroot command sets the current working folder to the %SystemRoot% folder of the Windows installation you are currently logged on to.


type filename

The type command displays a text file.

Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Professional Edition
Microsoft Windows 2000 Datacenter Server
kbinfo KB229716


FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available in our efforts to advance understanding of environmental, political, human rights, economic, democracy, scientific, and social justice issues, etc. We believe this constitutes a 'fair use' of any such copyrighted material as provided for in section 107 of the US Copyright Law. In accordance with Title 17 U.S.C. Section 107, the material on this site is distributed without profit exclusivly for research and educational purposes.   If you wish to use copyrighted material from this site for purposes of your own that go beyond 'fair use', you must obtain permission from the copyright owner. 

ABUSE: IPs or network segments from which we detect a stream of probes might be blocked for no less then 90 days. Multiple types of probes increase this period.  


Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy


War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotesSomerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose BierceBernard Shaw : Mark Twain Quotes


Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law


Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOSProgramming Languages History : PL/1 : Simula 67 : C : History of GCC developmentScripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-MonthHow to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least

Copyright © 1996-2016 by Dr. Nikolai Bezroukov. was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. This document is an industrial compilation designed and created exclusively for educational use and is distributed under the Softpanorama Content License.

The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.

FAIR USE NOTICE This site contains copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to advance understanding of computer science, IT technology, economic, scientific, and social issues. We believe this constitutes a 'fair use' of any such copyrighted material as provided by section 107 of the US Copyright Law according to which such material can be distributed without profit exclusively for research and educational purposes.

This is a Spartan WHYFF (We Help You For Free) site written by people for whom English is not a native language. Grammar and spelling errors should be expected. The site contain some broken links as it develops like a living tree...

You can use PayPal to make a contribution, supporting development of this site and speed up access. In case is down you can use the at


The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.

Last modified: February 19, 2014