FTP Bookmarks lost

[docfxit]

I just found out that all my FTP Bookmarks are not showing in ver. 2.52

Is there any way I could recover them?

Thank you,

Docfxit

[Jan Rysavy]

Please check Registry key HKEY_CURRENT_USER\Software\Altap and look for older versions of Salamander.

Bookmarks are placed (for example) in HKEY_CURRENT_USER\Software\Altap\Altap Salamander 2.51\Plugins Configuration\FTP\Bookmarks

Do you have your lost bookmarks there?

[docfxit]

Thank you for the reply.

Under Altap all I have is:

Altap Salamander 2.52
Applications
Servant Salamander 2.0

Would I be able to recover the bookmarks from someplace else?

Thank you,

Docfxit

[Jan Rysavy]

It doesn't look good.

Do you have some backups of registry or Windows Restore Points? Unfortunately I don't know if is it possible to extract Registry hives from restore points? Does anybody know? Is HKEY_CURRENT_USER key part of restore points?

[SelfMan]

It doesn't look good.

Do you have some backups of registry or Windows Restore Points? Unfortunately I don't know if is it possible to extract Registry hives from restore points? Does anybody know? Is HKEY_CURRENT_USER key part of restore points?

Yes, the HKCU is a part of system restore point.
Solution depends on windows version.
1) Change access right on C:\System Volume Information so you can read it
2) find the latest restore point entry where your FTP bookmarks worked (sort by date)
3) locate the subfolder Snapshot where the registry backups are
4) Locate your user hive _REGISTRY_USER_NTUSER_S-<long user id> and copy the file to a temporary location i.e. C:\temp
5) rename the file in C:\temp to myreghive or something similar
6) start regedit
7) go to HKEY_LOCAL_MACHINE, click File -> Load hive
give the hive a name ie test
9) open HKEY_LOCAL_MACHINE > test > software > Altap > Plugins Configuration > FTP > Bookmarks
10) let the Bookmarks be highlighted and go File > Export
11) name the exported file myregfile.reg
12) go to HKEY_LOCAL_MACHINE > test and then File > Unload hive
13) close regedit
14) open the exported registry file in notepad
15) replace all occurences of "HKEY_LOCAL_MACHINE\test" by "HKEY_CURRENT_USER" so the path looks like this "[HKEY_CURRENT_USER\Software\Altap\Altap Salamander 2.52\Plugins Configuration\FTP\Bookmarks]" and save the reg file.
16) Now make a restore point in case something goes wrong (start %SystemRoot%\system32\restore\rstrui.exe)
17) Close SALAMANDER and import the entries in to the registry by hitting enter on the modified file.
18) start Salamander and check your bookmarks

This is the "hard" way...
The easy way is to restore the system state with a older restore point using systenm restore (%SystemRoot%\system32\restore\rstrui.exe).

[Jan Rysavy]

SelfMan, looks good, thank you!

7) go to HKEY_LOCAL_MACHINE, click File -> Load hive

I didn't know about option to mount offline Registry hive until recently.

[Ether]

Yes, the HKCU is a part of system restore point.

Nice.

Steps 10, 11, 14, 15 can be replaced by using Salamander's Registry Plugin (navigate to both registry keys and copy), but you have to ensure that Salamander won't rewrite its configuration upon exit (using the option in the Configuration dialog, or by terminating the process).

And of course, in any case, you shouldn't forget to set the System Volume Information's permissions back to how it was before.

[SelfMan]

SelfMan, looks good, thank you!

7) go to HKEY_LOCAL_MACHINE, click File -> Load hive

I didn't know about option to mount offline Registry hive until recently.

Its been there alon time . The only problem was you had to be in HKLM to load it.
@ether
I made the list on purpose without salamander. It's not healthy at all to mess with the programs own registry while its running.

[Ether]

The only problem was you had to be in HKLM to load it.

Not really, you can mount registry hives under HKU, too.

[SelfMan]

The only problem was you had to be in HKLM to load it.

Not really, you can mount registry hives under HKU, too.

Ah true... mea culpa... I've never used this key for loading offline hives.

[therube]

Since this thread was just mentioned ...

1) Change access right on C:\System Volume Information so you can read it

Accessing the System Volume Information Folder

(I always use the cacls method myself.)

[therube]

If I'm understanding correctly (& I certainly may not be) there may be other locations that may contain wanted data.

Like: C:\Documents and Settings\{username}\NTUSER.DAT

That a (shareware) program like RegdatXP may help with?

http://www.regdat.com/ a tool to manage non active NT based registry files.
http://www.regdat.com/rmrxp.htm

[fraktik]

Great - its easy and working!
I do (almoast) whole procedure in AS.

Some notes:
-whole setup is only for Windows XP (W7 havent this simple files and folder structure of System Volume Information folder)
- I changed "System Volume Information" properties by "Ctrl+F2" (in AS) and removing Encrypted (or something like it, in czech "Šifrovaný"), I think you can remove all others too (hidden, system...)
- in point 5) you need to change file name on "enything.reg", and be sure, that this file (and folder - I have "C:/Temp" hidden too) isnt hidden (again "Ctrl+F2" in AS) - for better using this by Explorer later.
- after hive (Czech: "Načíst podregistr") backup file, i used whole "HKEY_CURRENT_USER\Software\Altap" part - it possible to restore anything around AS this way (and that is really great new) => I think AS would have some autobackup algoritm too.

- only one last think stay uncertain: Is necessary to restore properties on System Volume Information folder? Or some other "tweak back" things?

[Ether]

OK, now some notes and reactions from me:

1) Change access right on C:\System Volume Information so you can read it

The Task Scheduler or psexec utility can be used to run an application (presumably the Registry Editor) under the SYSTEM account which has full permissions on the System Volume Information directory, so you don't have to mess with them.

If I'm understanding correctly (& I certainly may not be) there may be other locations that may contain wanted data.

Sure, but it's not likely - you'd have to have a good backup somewhere.

Like: C:\Documents and Settings\{username}\NTUSER.DAT

That's the current (working copy) registry hive, this hive doesn't contain the data we want - that's why we looked for other hives in the first place.

I changed "System Volume Information" properties by "Ctrl+F2" (in AS) and removing Encrypted

That's odd, I don't remember anything about SVI being encrypted, this is probably a change you or some application did.

in point 5) you need to change file name on "enything.reg"

You actually don't want to do that, registry hives (usually without any extension) are stored in a different format than registry export files (.reg) and if you add this extension, you're exposing yourself to the risk of opening the file in a wrong way (which will probably just summon an error message and don't do any damage, but you probably want to be on the safe side when dealing with the registry).

I think AS would have some autobackup algoritm too.

Yeah, it could, but since there's a lot of good backup programs already, I don't see why AS should care about that. (^)

only one last think stay uncertain: Is necessary to restore properties on System Volume Information folder? Or some other "tweak back" things?

It's not necessary, it's just recommended.

^) Although it could get better at recovering the remains of damaged configuration data.

[therube]

"RegFileExport"
http://www.nirsoft.net/utils/registry_f ... xport.html

"RegFileExport is a small console application that allows you to easily extract data from offline Registry file located on another disk drive. RegFileExport read the Registry file, analyze it, and then export the Registry data into a standard .reg file of Windows. You can export the entire Registry file, or only a specific Registry key.

RegFileExport may also be able to export some of the Registry data even when the Registry file is corrupted and cannot be loaded by Windows."


Example (& split onto multiple lines only to aid readability):

Code: Select all

C:\BIN\UTILS\Nirsoft> regfileexport.exe
"C:\System Volume Information\_restore{A3FE4697-A95B-4476-A0D8-DD1DBA7304B7}\RP1792\
snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-1184441913-3557630161-3586670608-1010"
"output_data.txt"
"HKEY_CURRENT_USER\Software\Altap\Altap Salamander 2.54\Plugins Configuration\FTP\Bookmarks"

output_data.txt:

Code: Select all

Windows Registry Editor Version 5.00


[HKEY_CURRENT_USER\Software\Altap\Altap Salamander 2.54\Plugins Configuration\FTP\Bookmarks]

[HKEY_CURRENT_USER\Software\Altap\Altap Salamander 2.54\Plugins Configuration\FTP\Bookmarks\1]
"Name"="ALTAP"
"Address"="ftp.altap.cz"
"Initial Path"="/pub/altap/salamand"
"Anonymous"=dword:00000001