Windows NT has some built-in methods for protecting system hive
files. First, in the NT system32\config directory, several files have no
extension (the hive files) and an equal number have the same prefix and a . log
extension. Open a .log file with Notepad, and you see garbage. What is it?
This "garbage" is Windows NT's way of protecting itself from
failed updates to hive files. When a hive file is being changed (for example,
when you edit the Registry), the . log files ensure an unfinished write
operation does not corrupt the hive. Such corruption can occur when the system
fails. Here's how the fault-tolerance process works:
- Changes to the hive are written to the hive's . log file with information
about where in the hive the changes will occur, and these changes are flushed
(i.e., immediately sent, not cached) to the disk.
- The system marks the hive file to signal that the file is in transition.
- NT enters the new data into the hive file.
- The hive file is marked to show that the change is complete.
If the system fails between steps 2 and 4, the information in the . log file
is sufficient to restore the hive file to its previous condition. Thus, the .
log file isn't a complete backupit's a recovery tool in case of accidents.
. log files aren't the only fault-tolerance measure NT provides. The
preceding procedure applies to all hive files except for system, which is
required to boot the computer. For system, NT uses a . log file and, each time
the system is booted, also backs up system to system.alt. You can't delete,
move, or rename the system or system.alt files in system32\config. If the
original system hive file is unavailable or doesn't work, NT can still boot the
system. The .alt file becomes the system hive file, and a backup of it becomes
system.alt.
NT's automatic fault-tolerance features work well most of the time. But
when these protection measures can't help, (such as after reinstallation or when
you make a change to the Registry that disables your system), you must rely on
your own hive backups to restore system information.
Register
nlouis4 December 18, 2003