Erd 2005 User Manual

ERD Commander version 1.03

User’s Guide

Winternals Software LP 3101 Bee Caves Road, Suite 150

Austin, Texas 78746 (512) 330-9130

(512) 330-9131 Fax www.winternals.com

Copyright © 1999 Winternals Software LP

http://www.winternals.com/

ERD Commander Version 1.03

Winternals Software LP Page i

Table of Contents 1 Introduction................................................................................... 1

1.1 ERD Commander Functionality......................................................1 1.2 Upgrading to ERD Commander Professional .................................1 1.3 Overview of Use.............................................................................2

2 ERD Commander Setup ............................................................... 4

2.1 Requirements ................................................................................4 2.2 Creating the Boot Diskettes ...........................................................4 2.3 ERD Commander for the DEC Alpha Edition .................................5 2.4 Adding Third-Party Drivers.............................................................5

3 Starting ERD Commander ........................................................... 7

3.1 Booting Up.....................................................................................7 3.2 Sample Screen ..............................................................................7

4 The Command-line Environment ................................................ 8

4.1 Overview........................................................................................8 4.2 Command-line Editing....................................................................9

5 The Command Set ...................................................................... 10 5.1 ACCESS......................................................................................12 5.2 ATTRIB........................................................................................13 5.3 CD/CHDIR ...................................................................................13 5.4 CLS..............................................................................................13 5.5 COPY ..........................................................................................14 5.6 DEL/ERASE.................................................................................14 5.7 DIR ..............................................................................................15 5.8 EXIT/QUIT ...................................................................................16 5.9 HELP ...........................................................................................16 5.10 MAP.............................................................................................17 5.11 MKDIR/MD...................................................................................18 5.12 MORE/TYPE................................................................................18 5.13 MOVE ..........................................................................................18 5.14 RENAME/REN.............................................................................19 5.15 RMDIR/RD...................................................................................19 5.16 VERSION/VER ............................................................................19 5.17 XCOPY........................................................................................20

6 Troubleshooting ......................................................................... 21

7 Technical Support ...................................................................... 24


Winternals Software LP Page 1

1 Introduction Welcome to ERD Commander, the advanced system utility that finally brings

boot-floppy functionality to Windows NT. When problems arise in Windows

3.1 or Windows 95 that render a system unbootable, there is always the

possibility of booting off of a DOS floppy disk so that the drives of the

machine can be accessed for repair and salvage. In the past, Windows NT

administrators have gone without this recovery option.

1.1 ERD Commander Functionality

ERD Commander enables you to boot NT off of a floppy disk in order to

access and repair a dead NT installation. It is a command-line shell that runs

off of a set of NT boot disks giving you full access to non-bootable NT

systems with a robust set of familiar command-line file manipulation tools.

Because ERD Commander relies on a standard set of NT boot floppies, any

NT system is accessible, and because ERD Commander runs on top of NT,

all NT file systems, including FAT, NTFS, and CDFS are visible. ERD

Commander has no reliance on data located on a system’s hard disk for it to

boot and run – NT is actually booted on the floppies. Windows NT does not

even have to be present on the computer in order to use ERD Commander to

access the computer’s drives.

1.2 Upgrading to ERD Commander Professional

ERD Commander Professional Edition augments the basic set of ERD

Commander functions with advanced features and additional commands.

These include:

♦ = Support for fault-tolerant drives (striped sets, volume sets, and mirrors)

♦ = Allows replacement of lost administrative passwords with the PASSWORD command

♦ = Supports the CHKDSK command for repairing corrupted drives



♦ = Allows Device and Service startup options to be reconfigured in the registry (Boot, System, Automatic, Manual, or Disabled) in order to enable/disable defective drivers

♦ = Built in FAT32 support

♦ = Built in EXPAND functionality for decompressing and copying files from the NT Installation CD-ROM, or restoring backup registry hives created by RDISK

An upgrade is available for registered users of ERD Commander to ERD

Commander Professional.

1.3 Overview of Use

ERD Commander can be used as a tool in solving problems such as:

Removing or Replacing Buggy Drivers You can use ERD Commander to delete the image files of drivers or services

that, because of a bug or misconfiguration, prevent NT from booting.

Updating Out-of-Date System Files Incorrectly applying service packs or system software updates can cause

system DLLs to become out of sync with each other, preventing NT from

booting successfully. ERD Commander can copy up-to-date versions of old

files from floppy disks or CD-ROMs onto a system.

Correcting Misconfigured NTFS Security If security attributes that are too restrictive are applied to certain system files

or directories on NTFS boot drives, NT will become unbootable. ERD

Commander includes a special command, ACCESS, which unlocks otherwise

inaccessible files or directories.

Updating Locked Files Once NT is up-and-running many system files cannot be replaced because

the system keeps them locked. ERD Commander makes it possible to update

such files because it runs when NT is off-line.



Correcting Registry Problems A number of NT boot problems are the result of misconfigured Registry

values. With ERD Commander you can copy Registry hives (located under

<winnt>\system32\config) off the system to a floppy disk or other writeable

removable media for modification on another NT machine (using Regedt32’s

Hive loading capability). Modified hives can then be copied back.

Copying Important Files off of a Dead System ERD Commander enables you to access files on an NT system that fails to

boot. Important files can be salvaged onto a floppy disk or other removable

media.

Note that ERD Commander is not intended to resolve disk corruption errors,

and that only drives that are consistent enough to be recognized by Windows

NT file systems will be accessible with ERD Commander.



2 ERD Commander Setup

2.1 Requirements

ERD Commander requires the Microsoft Windows NT© 4.0 installation CD-

ROM to create a set of boot diskettes. The disks can be used to access both

NT 4.0 and 3.51 systems.

You will need three blank floppy diskettes. Optionally, you can supply an

existing set of Windows NT Setup diskettes, which ERD Commander will

modify. Please note that such modification is permanent; you will not be able

to reinstall NT from those disks in the future.

Additionally, you must have local administrator access to the machine on

which you are installing ERD Commander.

2.2 Creating the Boot Diskettes

When the ERD Commander Setup program is executed, it will allow you to

create a set of Windows NT boot floppies configured with ERD Commander.

You will be prompted for the Microsoft Windows NT© 4.0 Installation CD-ROM

and for the three floppy diskettes.

The Setup program will install two versions of the boot floppy creator onto

your hard drive. The 32–bit version is the program that is run during the initial

Setup. The 16–bit version allows you to configure boot floppies with ERD

Commander from a DOS boot floppy or from Windows 3.1. This is necessary

in cases where your Windows NT installation is non–bootable and you do not

have access to a second NT machine or to Windows 95.



2.3 ERD Commander for the DEC Alpha Edition

The ERD Commander Setup program will allow you to create a set of Alpha

NT boot floppies that are configured with ERD Commander. The Setup

program will also allow you to install the ERD Commander boot files into a

directory on a hard drive or removable media. Follow your ARC OS loader

instructions to initiate a boot of ERD Commander, specifying “SETUPLDR” as

the boot file. Most ARC OS loaders accept the command “A:SETUPLDR” for

booting off a floppy.

After the installation has completed you can run the Setup program from the

ERD Commander program group to create additional sets of diskette sets.

Portions of Alpha NT boot disk creation copyright BEI, makers of UltraBac

backup software for Windows NT (http://www.ultrabac.com).

2.4 Adding Third-Party Drivers

Some systems have non-standard SCSI disk drives that require third-party

drivers to function under Windows NT. A set of ERD Commander boot

diskettes will not prompt you to specify such drivers like the standard

Windows NT boot diskettes do. However, it is possible to add third-party

SCSI device drivers to ERD Commander boot diskettes by following the

procedure outlined below. Note that this is not a supported option, but

presented here for your convenience.

Copy the driver(s) to floppy #3 and edit the txtsetup.sif file, which located on

floppy #1. Add a line for each driver in the following three sections:

1. Under the [SourceDisksFiles] heading:

oemdrvr.sys = 1,,,,,,_3,4,1

2. Under the [SCSI.Load] heading

oemdrvr = oemdrvr.sys,4



3. Under the [SCSI] heading

oemdrvr = "HAL 9000 SCSI Host Adapter"

Enter as shown above, replacing ”oemdrvr” with the name of the third-party

driver that you need to add. The format should match that of other entries in

each section.



3 Starting ERD Commander

3.1 Booting Up

After the disks are loaded, a stripped–down version of Windows NT will start,

displaying the familiar boot–time Blue Screen that presents the NT version

number, system memory size, and number of processors present. ERD

Commander then starts automatically and enters a command–line

environment nearly identical to the one NT implements in Command–Prompt.

3.2 Sample Screen

Figure 3-1 is a presentation of what a typical display looks like after ERD

Commander has started. ERD Commander presents information on the disk

drives that are recognized and the drive letters it has assigned for them.

Volume name, file system type, and drive size data should help you identify

particular drives. (Note that this information can be reproduced with the MAP

command while using ERD Commander.)

Figure 3-1

Microsoft (R) Windows NT (TM) Version 4.Ø 1 System Processor [128 MB Memory]

ERD Commander v1.Ø

Copyright (C) 1998 Winternals Software LLC

http://www.winternals.com Drive letter mappings: A: \Device\FloppyØ\ FAT C: \Device\HarddiskØ\Partition1\ WINDOWS FAT 1Ø15744 KB D: \Device\HarddiskØ\Partition2\ WINNT NTFS 2Ø56ØØ KB E: \Device\HarddiskØ\Partition3\ SRC FAT 87Ø64Ø KB F: \Device\HarddiskØ\Partition4\ TEST NTFS 2Ø128 KB G: \Device\CdromØ\ CDFS C:\>



4 The Command-line Environment

4.1 Overview

ERD Commander has a sophisticated command-line processor and it

implements a large subset of NT’s command-line command set, complete

with all standard file-related commands. The environment mirrors the

standard NT command-line environment so that using ERD Commander is

intuitive – if you’re familiar with the commands and command-line editing

capabilities present in NT, then you already know how to use ERD

Commander.

The command-processor’s editing features include:

♦ = Arrow key navigation (e.g. left-arrow to move back, right-arrow to move forward)

♦ = Special key navigation (e.g. Home to go to the start of a line, End to go to the end)

♦ = Insert mode

♦ = Command history

A sample of the commands available in ERD Commander includes:

♦ = RMDIR

♦ = MKDIR

♦ = MOVE

♦ = RENAME

♦ = DELETE

♦ = COPY and XCOPY

Subsequent pages describe the command processor in greater depth.



4.2 Command-line Editing

The command-line editing capabilities of ERD Commander are very similar to

those supported by NT’s command-line processor. Below is a reference of

recognized special keys.

ESC Resets the input line.

HOME Moves the cursor to the start of the input line.

END Moves the cursor to the end of the input line.

LEFT, RIGHT Moves the cursor left or right one character

DEL Deletes the character under the cursor.

BACKSPACE Deletes the character to the left of the cursor.

UP, DOWN Navigates through the command-history buffer,

which is 30 commands deep.

INSERT Toggles between insert and overwrite mode. The

default is overwrite.

Note that the ENTER key that is part of numeric keypads is disabled.



5 The Command Set The command set of ERD Commander, like its command-line editing

features, is similar that of NT. The command set includes all standard file-

related commands, and virtually all support the same options as their NT

counter-parts. This list shows the full set, with each command linked to its

documentation. This list can be obtained inside of ERD Commander by

entering the HELP command, and detailed information on the syntax of a

particular command can listed by typing “command /?” or “HELP command”.

Note that the commands are interpreted in a case-insensitive manner so that

“HELP” is the same as “help”.

ACCESS Gives Everyone full access to a files or directories.

ATTRIB Displays or changes file attributes.

CD Displays the name of or changes the current directory.

CHDIR Displays the name of or changes the current directory.

CLS Clears the screen.

COPY Copies one or more files to another location.

DEL Deletes one or more files.

DIR Displays a list of files and subdirectories in a directory.

ERASE Deletes one or more files.

EXIT Quits ERD Commander and reboots the system.

HELP Provides Help information for ERD Commander commands.

MAP Displays drive letter to partition mapping.

MD Creates a directory.



MKDIR Creates a directory.

MORE Displays the contents of a file

MOVE Moves one or more files from one directory to another directory.

QUIT Quits ERD Commander and reboots the system.

RD Removes a directory.

REN Renames a file or files.

RENAME Renames a file or files.

RMDIR Removes a directory.

SERVICE Displays and modifies service and driver startup settings.

TYPE Displays the contents of a file

VER Displays ERD Commander version number.

VERSION Displays ERD Commander version number.

XCOPY Copies files and directory trees.



5.1 ACCESS

Gives Everyone full access to directories or files.

Syntax ACCESS [[drive][path]filename] [/S]

Switches /S Processes files in all subdirectories in the specified path

This command is a custom ERD Commander command. It is possible to

render a NT system unbootable by inadvertently applying security restrictions

to NTFS files or directories that prevent NT from loading files it requires. The

ACCESS command will add a security entry to the security attributes of

specified files or directories which gives the Everyone group full access. The

Everyone group includes all groups and accounts, so this is the most

permissive security setting possible.

If the file or directory specified is inaccessible because the System account or

Administrators group is denied access, ERD Commander will first take

ownership for the Administrators group. This allows it to then modify the

security settings to give Everyone full access.

The command can even be applied to root directories of drives that have

been totally locked down. Such drives will show up in the drive mapping as

having a file system type of “???”. Simply specify the directory, e.g. “G:\”, as

the parameter to allow Everyone full access to the root directory. Files and

directories within the drive can then be unlocked through subsequent

applications of the ACCESS command.

NOTE: Because this command makes files and directories fully accessible to

any user, which opens potential security holes, you should lock-down files

and directories on which it is used after the system is booted normally.



5.2 ATTRIB

Displays or changes file attributes.

Syntax ATTRIB [+R | -R] [+A | -A] [+S | -S] [+H | -H] [drive:][path]filename] [/S]

Switches + Sets an attribute

- Clears an attribute

R Read-only file attribute

A Archive file attribute

S System file attribute

/S Processes files in all subdirectories in the specified path

5.3 CD/CHDIR

Displays the name of or changes the current directory.

Syntax CHDIR [drive:][path] CHDIR[..] CD [drive:][path] CD[..]

Notes .. Specifies that you want to change to the parent directory

Type CD drive: to display the current directory in the specified drive. Type CD

without parameters to display the current drive and directory.

5.4 CLS

Clears the screen.

Syntax CLS



5.5 COPY

Copies one or more files to another location.

Syntax COPY source [destination]

Notes source Specifies the file or files to be copied

destination Specifies the directory and/or filename for the new file(s)

Wildcards can be used in both the source and destination file name

specifications.

5.6 DEL/ERASE

DEL or ERASE deletes one or more files.

Syntax DEL [/P] [/F] [/S] [/Q] [/A[[:]attributes]] [[drive:][path]filename

ERASE [/P] [/F] [/S] [/Q] [/A[[:]attributes]] [[drive:][path]filename

Notes [drive:][path]filename specifies the file(s) to delete; specify multiple files by using wildcards

Switches /P Prompts for confirmation before deleting each file.

/F Force deleting of read-only files.

/S Delete specified files from all subdirectories.

/Q Quiet mode, do not ask if ok to delete on global wildcard

/A Selects files to delete based on attributes

Attributes R Read-only files

S System files

H Hidden files

A Files ready for archiving

- Prefix meaning not

The display semantics of the /S switch are reversed in that it shows you only

the files that are deleted, not the ones it could not find.



5.7 DIR

DIR displays a list of files and subdirectories in a directory.

Syntax DIR [drive:][path][filename] [/P] [/W] [/A[[:]attributes]][/O[[:]sortorder]] [/S] [/X]

Notes [drive:][path]filename specifies drive, directory, and/or files to list

Switches /P Pauses after each screenful of information

/A Displays files with specified attributes

Attributes R Read-only files

S System files

H Hidden files

A Files ready for archiving

- Prefix meaning not

/O List by files in sorted order

Sort order N By name (alphabetical)

S By size (smallest first)

D By date and time (earliest first)

- Prefix to reverse order

/S Displays files in specified directory and all sub directories

/X This displays the short names generated for non-8dot3 file names. If no short name is present, blanks are displayed in it’s place

Use the /P switch to cause DIR to pause after each screen of information.

Use CTRL-C to exit from DIR output back to the command prompt. If you

inadvertently omit this switch you can pause DIR’s output with CTRL-S or

terminate it with CTRL-C.



5.8 EXIT/QUIT

Exits ERD Commander and reboots the system.

Syntax EXIT

QUIT

Be sure to remove the boot floppy from the floppy disk drive before the

system reboots.

5.9 HELP

Provides Help information for ERD Commander commands.

Syntax HELP [command]

Notes Command Displays specific information on the specified command



5.10 MAP

Displays drive letter to partition mappings.

Syntax MAP

This command’s purpose is to help you determine the drive letter

assignments ERD Commander has made. ERD Commander does not rely on

Disk Administrator drive letter mappings because there may be multiple NT

installations on the hard disks, each with their own mappings. For each drive

you’ll see the device name, volume label, file system type and drive size.

If the System account or Administrators group is denied access to a NTFS

drive because of the security settings applied to the drive’s root directory, the

file system type will be <?>. Use the ACCESS command to unlock the drive.

Figure 5-1 is an example mapping.

Figure 5-1

Drive letter mappings: A: \Device\FloppyØ\ FAT C: \Device\HarddiskØ\Partition1\ WINDOWS FAT 1Ø15744 KB D: \Device\HarddiskØ\Partition2\ WINNT NTFS 2Ø56ØØ KB E: \Device\HarddiskØ\Partition3\ SRC FAT 87Ø64Ø KB F: \Device\HarddiskØ\Partition4\ TEST NTFS 2Ø128 KB G: \Device\CdromØ\ CDFS C:\>



5.11 MKDIR/MD

Creates a directory.

Syntax MKDIR [drive:]path

MD [drive:]path

MKDIR creates any intermediate directories in the path, if needed. For

example, assume \a does not exist then:

Syntax MKDIR a\b\c is the same as MKDIR \a mkdir \a\b mkdir \a\b\c

5.12 MORE/TYPE

Displays the ASCII contents of a file.

Syntax MORE filename

TYPE filename

The MORE/TYPE command automatically pauses after each screen of data.

If you wish to terminate a MORE/TYPE output before the entire contents of a

file are displayed, enter CTRL-C at the pause prompt.

5.13 MOVE

Moves one or more files from one directory to another directory.

Syntax MOVE Source [Target]

Notes Source Specifies the path and name of the file(s) to be moved

Target Specifies the path and name to move file(s) to



5.14 RENAME/REN

Renames a file/directory or files/directories.

Syntax RENAME [drive:][path][directoryname1 | filename1] [path][directoryname2 | filename2]

REN [drive:][path][directoryname1 | filename1] [path][directoryname2 | filename2]

Note that you cannot specify a new drive for your destination.

5.15 RMDIR/RD

Removes (deletes) a directory.

Syntax RMDIR [/S] [/Q] [drive:]path

RD [/S] [/Q] [drive:]path

Switches /S Removes all directories and files in the specified in addition to the directory itself. Used to remove a directory tree.

/Q Quiet mode, do not ask if ok to remove a directory tree with /S

5.16 VERSION/VER

Displays ERD Commander's version number.

Syntax VERSION

VER



5.17 XCOPY

Copies files and directory trees.

Syntax XCOPY source [destination] [/A | /M] [/P] [/S] [/W] [/C] [/I] [/Q] [/F] [/H] [/R] [/T] [/U] [/K]

Notes source Specifies the file(s) to copy

destination Specifies the location and/or name of the new files

Switches /P Pauses after each screenful of information

/A Copies files with the archive attribute set, doesn't change the

attribute.

/M Copies files with the archive attribute set, turns off the archive

attribute.

/P Prompts you before creating each destination file.

/S Copies directories and subdirectories except empty ones.

/W Prompts you to press a key before copying.

/C Continues copying even if errors occur.

/I If destination does not exist and copying more than one file,

assumes that destination must be a directory.

/Q Does not display file names while copying.

/F Displays full source and destination file names while copying.

/H Copies hidden and system files also.

/R Overwrites read-only files.

/T Creates directory structure, but does not copy files. Includes

empty directories or subdirectories.

/U Copies only files that already exist in destination.

/K Copies attributes. Normal XCOPY will reset read-only

attributes.



6 Troubleshooting When ERD Commander is booting I get an error that a file is corrupt, or that

the boot cannot continue for some reason. What is the problem?

Errors during ERD Commander’s boot process are almost always due to

defective floppy disk media. (This damage will only be detected by

running a low-level sector scan of the disk.) Try creating the boot

diskettes using a new set of floppy diskettes.

Can I run external programs or commands once I've booted with ERD

Commander?

Because ERD Commander runs before the Win32 subsystem begins

executing, it is not possible to run any programs other than those built

into ERD Commander .

How do I install a new driver for hardware ERD Commander doesn't

recognize?

If you have a SCSI disk device that you'd like to access from within ERD

Commander that is not being recognized with the default setup, you can

add a new driver to the boot diskette set as follows:

Copy the new driver to floppy #3. Edit TXTSETUP.SIF from floppy #1,

and add a reference to the driver in the following three sections, copying

the format for existing drivers:

Under the [SourceDisksFiles] heading: oemdrvr.sys = 1,,,,,,_3,4,1

Under the [SCSI.Load] heading: oemdrvr = oemdrvr.sys,4

Under the [SCSI] heading: oemdrvr = "HAL 9000 SCSI Host Adapter"



At the end of the boot sequence ERD Commander blue-screens with an

"INACCESSIBLE BOOT DEVICE" error.

This occurs when a driver necessary to access your floppy disk is not

installed and when using PCMCIA-based floppy drives for laptops. To

correct this, manually install the PCMCIA driver on the ERD Commander

diskettes.

XCOPY doesn't seem to work correctly for me.

You must specify the /H switch to copy system and hidden files, and the

/R switch if you wish to overwrite read-only files.

How can I edit files on the machine after I've booted with ERD Commander?

ERD Commander does not contain a text editor. However, you can copy

files to a floppy disk, edit them on a second machine, and then copy

them back.

I own ERD Commander but I need to change



Does ERD Commander work with the NTFS 5 enhancements that come with

Service Pack 4/5 and Windows 2000?

The SP4 enhancements to the NTFS driver do not modify the file

system, and do not interfere with ERD Commander .

If you wish to use ERD Commander with a volume that has been

upgraded to NTFS 5 (which occurs automatically when you install

Windows 2000 on a system) you must replace several files on the ERD

Commander boot diskettes with new versions from a Service Pack 4/5

CD-ROM:

♦ = Copy NTKRNLMP.EXE to Disk 1.

♦ = Copy NTDLL.DLL to the SYSTEM32 folder on Disk 2.

♦ = Copy NTFS.SYS to Disk 3.

How do I create a bootable CD-ROM containing ERD Commander ?

Instructions for creating a bootable ERD Commander CD-ROM can be

found in the Windows NT FAQ at:

http://www.ntfaq.com/ntfaq/recovery21.html

http://www.ntfaq.com/ntfaq/recovery21.html



7 Technical Support ♦ = If you encounter a problem that isn’t resolved by the suggestions

listed above and wish to receive technical support, please e-mail us at:

[email protected]

♦ = You can also view our Frequently Asked Questions and download free updates from our web site at:

http://www.winternals.com

♦ = For urgent matters, please call the following number and request Technical Support:

512-330-9861

mailto:[email protected]

http://www.winternals.com/

Erd 2005 User Manual

Documents

Transcript of Erd 2005 User Manual