Boot log?

[Stubby]

I'm trying to debug a BSOD followed by immediate reboot. Too fast to
see the error code. I used F8 and seletected boot logging, but where is
the log left? I hoped to find it from the Repair Console. TIA

 

[John John]

It should be in ntbtlog.txt in the %systemroot% folder usually C:\WINNT.

John

 

[Stubby]

Can you check that for me? I couldn't find a file of that name in any
of the likely places. (The Repair Console doesn't make searching
easy.) Thanks.

 

[John John]

I kind of thought that you would come back with that question. See if
these can help.

How to Retrieve One Page Text Files in the Recovery Console by Using the
Batch Command
http://support.microsoft.com/?kbid=243067

Ntbtlog.txt File Not Written When Boot Logging Is Enabled
http://support.microsoft.com/?kbid=275735

Also, unless you enabled the SET command before the fact in the Group
Policy options you will not be able to copy the file to removable media
or floppy disks.

I'm almost sure that the Ntbtlog.txt will be bigger than one page so you
might need to do this with a Bart PE disk or by accessing the drive over
a network or slaved in another suitable computer.

John

 

[Stubby]

I was able to get the error number: 0xC0000218 -- corrupt registry.
That's why SMSS crash and thus, the log was not written to disk.
KB 307545 tells how to recover from this.

Unfortunately, I slipped and deleted the contents of WINNT\config .
That was in the repair console... do deleted files land somewhere that i
can retrieve them from ?

 

[John John]

The file(s) is gone to file heaven. I just did a small test and I can
confirm that files deleted while in the Recovery Console are deleted
permanently. With a basic file recovery utility I could however see and
recover the deleted file from the up and running installation.

However, neither the files that you wanted to replace nor the
replacements were in WINNT\config. You have to replace the files in:

C:\WINNT\system32\config

with files from:

C:\WINNT\repair\RegBack

If the C:\WINNT\repair\RegBack directory contains no files then you can
try to use files from C:\WINNT\repair, although these would be the
oldest possible set to use, they are the ones that were created when you
installed Windows.

John