When trying to restore an image I recently got the error “Failed to load registry hive - 1009" (see attached picture) after which the system would not boot anymore (BSOD). I am curious what this error means, what Macrium tries to do when trying to update the registry and why it occurred.

This installation is a multi-boot installation using BootIt BareMetal, but I do not think that is the cause for this error. Let me explain.

This system has 3 MBR drives connected (see attached picture). Disk 0 is the data drive which also includes the so-called EMBR partition (hidden and 8 MB large at the end of disk 0), that contains the information for the multi-boot. Disk 1 contains a VM partition as well as 3 other system partitions that are hidden, because these should no be used. Disk 2 contains the current system partition, a Windows 10 test upgrade from my Windows 7 system.

Last year I extensively tested whether Macrium Reflect was compatible with BootIt Bare Metal (BIBM). I found out that Reflect can be used with a disk on which BIBM is installed, but only if the disk on which the system partition is located is smaller than 1 TB. I have no clue why 1 TB is the limit, but if I restore a partition to a disk that is 1 TB large after restoring and rebooting I get the BIBM error “EMBR missing - System Halted!”. This also happens when I choose to not replace the MBR when restoring an image and also when there is only one system installed (single boot, but with BIBM installed). I assume it has something to do with the fact that Reflect always writes the partition table after a restore, which, unfortunately, cannot be disabled. Why that is no problem with disks smaller than 1 TB is a mystery to me. If someone can enlighten me about that difference I would be very interested.

Fact is that for about a year I have been using the combination of BIBM and Reflect without any issues on this system with just disk 0 & 1 installed. When I started my test upgrade on June 22nd from my Windows 7 system to Windows 10 I copied the Windows 7 partition to a third drive connected via eSATAp and set BIBM accordingly. Note that all installations only use 1 partition, there are no recovery or system reserved partitions.

After upgrading and doing some initial steps I then made a full image (1), installed Image for Windows and the made an incremental image (2) with Reflect. Image for Windows (IFW) is an imaging program from the same developers as BIBM with the advantage that it is developed with BIBM in mind and can see, image and restore all partitions, where Reflect can only see, image and restore visible partitions. BIBM has the option of completely making partitions invisible for the selected system and thus allows to have many more than 4 primary partitions on an MBR drive. That is however not the setup that I am using here, where all partitions are visible. I prefer to use Reflect over Image for Windows, because it is faster and simpler to use.

The registry error mentioned above occurred when trying to restore the incremental image I made after installing IFW. Restoring the full image (1) went without hiccup. Luckily I also made an IFW image directly after making Reflect image (2), which was able to restore the last situation from Jun 22nd.

There is however more to this story. Because I wanted to try what drivers Windows downloads when upgrading Windows 7 to Windows 10 when selecting to also install updates, drivers and optional features I did an upgrade with and without that option enabled. In both cases I made the full (1) and incremental (2) Reflect images at the same points, i.e. before and after installing IFW. Remarkably in both cases the registry error occurs only with image (2). But if I now (September) start with restoring image (1) then install the same IFW version again and make an incremental image (parking the previous incremental image in another folder), that error does not occur again when restoring the incremental image. I thus cannot replicate the error.


Yesterday I started working on the test upgrade again, installed the latest Windows updates, updated Norton 360 and made another incremental (3). I then changed the registry key to move my C:\Users\Public folder to D:\Users\Public. I had already moved those folders to D:\Users\Public on my Windows 7 installation, but during an upgrade Windows resets the registry key, so I had to correct that. I also deleted the newly created C:\Users\Public folder and made a junction pointing C:\Users\Public to D:\Users\Public. I then made another incremental image (4). This time another error occurred. Both images could be restored without problem, but after restoring image (4) (I tried both a delta and a full restore) there was no audio and when hovering over the audio icon in the system tray the message “The audio service is not running” was displayed. I was not able to start the service and the troubleshooter could not be started. Fortunately, I had also made an IFW image which could be restored without problem. I then made a differential with Reflect which could then also be restored without problem.

The main concern I have from these experiences is that two Reflect images could not be restored and one only finds out about that fact when the restoring that image. Even though these images were made from a multi-boot system I do not see how the errors can be caused by that fact, especially because I have been using Reflect with no issue whatsoever with the two systems (Win7 and a fresh Win10 installation) on disk 2 and the other images restore without problem. Moreover, I do not see how the non-starting audio service could be caused by the multi-boot setup, where Windows works well in other aspects (I have not done an extensive check).

I do not need to get this installation working again, because I have succeeded in that using IFW, but I am left with three main questions, partly because I want to assess my risks.
(1) - What does the “Failed to load registry hive - 1009" error mean? What can be the cause of this error and why does Reflect need to update the registry after a restore?
(2) - What could explain the fact that the Audio service is not running when restoring an image with Reflect when IFW has no problem?
(3) - What could be different when restoring an image to a 1 TB drive or a smaller drive that causes BIBM to not work anymore when restoring an image to disks larger than 1 TB, while restoring to a disk smaller than 1 TB works well?

Do a hardware check, memory, hard drive, etc.
Restore should have nothing to do with the registry, it should just restore the drive in the state it was in, unless it has a write problem.
And if you have to repair a disk with a  /r  then it's time to replace that disk.

+x

 

jimrf97 - 19 September 2023 7:46 PM

Do a hardware check, memory, hard drive, etc.
Restore should have nothing to do with the registry, it should just restore the drive in the state it was in, unless it has a write problem.
And if you have to repair a disk with a  /r  then it's time to replace that disk.

Thank you for your reply, but I don't think hardware is the issue here, because all other images of the 2 systems, as well as the other images of this 3rd system can be restored without problem. I have never had this issue before and I have done quite a lot of restores on this machine. Also, if you look at the 1st screenshot you can see that Reflect actually does do something with the registry when restoring an image. Among my questions are what exactly and why does Reflect update the registry when restoring?

.  If it didn't restore  the registry files, then your Registry files would be out of sync with the rest of the drive.


L.W. (Dan) Danz, Overland Park KS

+x

 

Dan Danz - 20 September 2023 12:46 PM

.  If it didn't restore  the registry files, then your Registry files would be out of sync with the rest of the drive.

I always assumed that a sector based restore of a system partition also restores the registry because it is contained in those sectors. That is why I wonder why the registry has to be updated separately. Am I wrong?

+x

 

Pim - 20 September 2023 5:17 PM

+x

 

Dan Danz - 20 September 2023 12:46 PM

.  If it didn't restore  the registry files, then your Registry files would be out of sync with the rest of the drive.

I always assumed that a sector based restore of a system partition also restores the registry because it is contained in those sectors. That is why I wonder why the registry has to be updated separately. Am I wrong?

I don't know. Perhaps something in that hive can't be updated until the restore has finished. We'll both find out if we can get a support rep to answer why. 

L.W. (Dan) Danz, Overland Park KS

Certainly a reasonable question. The only thing I can guess is that there are a lot of references in the registry of my active Windows installation that are C:\"some folder and file names" so I wonder if the restore is to a different partition letter the "C" gets changed. This guess is a bit shaky because I think Windows now on bootup automatically assigns the partition letter to C but this may not be the case in multiple boot installations or other reasons.

+x

 

Seekforever - 20 September 2023 6:57 PM

Certainly a reasonable question. The only thing I can guess is that there are a lot of references in the registry of my active Windows installation that are C:\"some folder and file names" so I wonder if the restore is to a different partition letter the "C" gets changed. This guess is a bit shaky because I think Windows now on bootup automatically assigns the partition letter to C but this may not be the case in multiple boot installations or other reasons.

I assume that Reflect does not recognise the other system partitions as system partitions because they are hidden in this situation, but I may be wrong. Also, even when restoring a single boot system does Reflect's log includes a line Registry Update Success. I have included two examples. I have only found one example with the RegSetValueEx Success and it may be related to the fact that the restore is done to a different disk if I look at the BCD Update line. I do no know what RegSetValueEx means.

RegSetValueEx is an API that allows information to be placed, and I presume changed, in the registry. If one looks at your result above it could be assumed only 4 values were set/altered but that return could be from a routine that set numerous values so it isn't definitive without knowing the program internals. Since it is a general API, without knowing what it is referencing there is no way of knowing what it is altering.

+x

 

Seekforever - 21 September 2023 1:16 PM

RegSetValueEx is an API that allows information to be placed, and I presume changed, in the registry. If one looks at your result above it could be assumed only 4 values were set/altered but that return could be from a routine that set numerous values so it isn't definitive without knowing the program internals. Since it is a general API, without knowing what it is referencing there is no way of knowing what it is altering.

Thanks for the explanation. I hope somebody from Macrium will chime in and shed some light on this and perhaps also the other questions. My main concern is that some restores may fail which one would only find out after the fact. If it is only a hiccup I can live with that, because I also keep a log and could the restore an earlier image and set the steps again to the same point in time. It would also be very interesting to know why there apparently is a limit of 1 TB for successfully restoring an image. Something must be different between a disk smaller than 1 TB (I only had a 750 GB disk to test, so I do not know where the threshold is exactly) and equal to or larger than 1 TB. Other imaging programs (I tred True Image 2014 and Paragon) do not suffer from this, they can restore an image to a BIBM disk irrespective of its size. It would be nice if I could do the same with Reflect, because it is by far my favourite imaging program.