By pimjoosten - 19 September 2023 3:49 PM
When trying to restore an image I recently got the error “Failed to load registry hive - 1009" (see attached picture) after which the system would not boot anymore (BSOD). I am curious what this error means, what Macrium tries to do when trying to update the registry and why it occurred.
This installation is a multi-boot installation using BootIt BareMetal, but I do not think that is the cause for this error. Let me explain.
This system has 3 MBR drives connected (see attached picture). Disk 0 is the data drive which also includes the so-called EMBR partition (hidden and 8 MB large at the end of disk 0), that contains the information for the multi-boot. Disk 1 contains a VM partition as well as 3 other system partitions that are hidden, because these should no be used. Disk 2 contains the current system partition, a Windows 10 test upgrade from my Windows 7 system.
Last year I extensively tested whether Macrium Reflect was compatible with BootIt Bare Metal (BIBM). I found out that Reflect can be used with a disk on which BIBM is installed, but only if the disk on which the system partition is located is smaller than 1 TB. I have no clue why 1 TB is the limit, but if I restore a partition to a disk that is 1 TB large after restoring and rebooting I get the BIBM error “EMBR missing - System Halted!”. This also happens when I choose to not replace the MBR when restoring an image and also when there is only one system installed (single boot, but with BIBM installed). I assume it has something to do with the fact that Reflect always writes the partition table after a restore, which, unfortunately, cannot be disabled. Why that is no problem with disks smaller than 1 TB is a mystery to me. If someone can enlighten me about that difference I would be very interested.
Fact is that for about a year I have been using the combination of BIBM and Reflect without any issues on this system with just disk 0 & 1 installed. When I started my test upgrade on June 22nd from my Windows 7 system to Windows 10 I copied the Windows 7 partition to a third drive connected via eSATAp and set BIBM accordingly. Note that all installations only use 1 partition, there are no recovery or system reserved partitions.
After upgrading and doing some initial steps I then made a full image (1), installed Image for Windows and the made an incremental image (2) with Reflect. Image for Windows (IFW) is an imaging program from the same developers as BIBM with the advantage that it is developed with BIBM in mind and can see, image and restore all partitions, where Reflect can only see, image and restore visible partitions. BIBM has the option of completely making partitions invisible for the selected system and thus allows to have many more than 4 primary partitions on an MBR drive. That is however not the setup that I am using here, where all partitions are visible. I prefer to use Reflect over Image for Windows, because it is faster and simpler to use.
The registry error mentioned above occurred when trying to restore the incremental image I made after installing IFW. Restoring the full image (1) went without hiccup. Luckily I also made an IFW image directly after making Reflect image (2), which was able to restore the last situation from Jun 22nd.
There is however more to this story. Because I wanted to try what drivers Windows downloads when upgrading Windows 7 to Windows 10 when selecting to also install updates, drivers and optional features I did an upgrade with and without that option enabled. In both cases I made the full (1) and incremental (2) Reflect images at the same points, i.e. before and after installing IFW. Remarkably in both cases the registry error occurs only with image (2). But if I now (September) start with restoring image (1) then install the same IFW version again and make an incremental image (parking the previous incremental image in another folder), that error does not occur again when restoring the incremental image. I thus cannot replicate the error.
Yesterday I started working on the test upgrade again, installed the latest Windows updates, updated Norton 360 and made another incremental (3). I then changed the registry key to move my C:\Users\Public folder to D:\Users\Public. I had already moved those folders to D:\Users\Public on my Windows 7 installation, but during an upgrade Windows resets the registry key, so I had to correct that. I also deleted the newly created C:\Users\Public folder and made a junction pointing C:\Users\Public to D:\Users\Public. I then made another incremental image (4). This time another error occurred. Both images could be restored without problem, but after restoring image (4) (I tried both a delta and a full restore) there was no audio and when hovering over the audio icon in the system tray the message “The audio service is not running” was displayed. I was not able to start the service and the troubleshooter could not be started. Fortunately, I had also made an IFW image which could be restored without problem. I then made a differential with Reflect which could then also be restored without problem.
The main concern I have from these experiences is that two Reflect images could not be restored and one only finds out about that fact when the restoring that image. Even though these images were made from a multi-boot system I do not see how the errors can be caused by that fact, especially because I have been using Reflect with no issue whatsoever with the two systems (Win7 and a fresh Win10 installation) on disk 2 and the other images restore without problem. Moreover, I do not see how the non-starting audio service could be caused by the multi-boot setup, where Windows works well in other aspects (I have not done an extensive check).
I do not need to get this installation working again, because I have succeeded in that using IFW, but I am left with three main questions, partly because I want to assess my risks.
(1) - What does the “Failed to load registry hive - 1009" error mean? What can be the cause of this error and why does Reflect need to update the registry after a restore?
(2) - What could explain the fact that the Audio service is not running when restoring an image with Reflect when IFW has no problem?
(3) - What could be different when restoring an image to a 1 TB drive or a smaller drive that causes BIBM to not work anymore when restoring an image to disks larger than 1 TB, while restoring to a disk smaller than 1 TB works well?
 
|
By jimrf97 - 19 September 2023 7:46 PM
Do a hardware check, memory, hard drive, etc.
Restore should have nothing to do with the registry, it should just restore the drive in the state it was in, unless it has a write problem.
And if you have to repair a disk with a /r then it's time to replace that disk.
|
By pimjoosten - 20 September 2023 6:48 AM
+xDo a hardware check, memory, hard drive, etc. Restore should have nothing to do with the registry, it should just restore the drive in the state it was in, unless it has a write problem. And if you have to repair a disk with a /r then it's time to replace that disk.
Thank you for your reply, but I don't think hardware is the issue here, because all other images of the 2 systems, as well as the other images of this 3rd system can be restored without problem. I have never had this issue before and I have done quite a lot of restores on this machine. Also, if you look at the 1st screenshot you can see that Reflect actually does do something with the registry when restoring an image. Among my questions are what exactly and why does Reflect update the registry when restoring?
|
By DanDanz - 20 September 2023 12:46 PM
. If it didn't restore the registry files, then your Registry files would be out of sync with the rest of the drive.
|
By pimjoosten - 20 September 2023 5:17 PM
+x. If it didn't restore the registry files, then your Registry files would be out of sync with the rest of the drive.
I always assumed that a sector based restore of a system partition also restores the registry because it is contained in those sectors. That is why I wonder why the registry has to be updated separately. Am I wrong?
|
By DanDanz - 20 September 2023 5:21 PM
+x+x. If it didn't restore the registry files, then your Registry files would be out of sync with the rest of the drive. I always assumed that a sector based restore of a system partition also restores the registry because it is contained in those sectors. That is why I wonder why the registry has to be updated separately. Am I wrong?
I don't know. Perhaps something in that hive can't be updated until the restore has finished. We'll both find out if we can get a support rep to answer why.
|
By Seekforever - 20 September 2023 6:57 PM
Certainly a reasonable question. The only thing I can guess is that there are a lot of references in the registry of my active Windows installation that are C:\"some folder and file names" so I wonder if the restore is to a different partition letter the "C" gets changed. This guess is a bit shaky because I think Windows now on bootup automatically assigns the partition letter to C but this may not be the case in multiple boot installations or other reasons.
|
By pimjoosten - 21 September 2023 10:18 AM
+xCertainly a reasonable question. The only thing I can guess is that there are a lot of references in the registry of my active Windows installation that are C:\"some folder and file names" so I wonder if the restore is to a different partition letter the "C" gets changed. This guess is a bit shaky because I think Windows now on bootup automatically assigns the partition letter to C but this may not be the case in multiple boot installations or other reasons.
I assume that Reflect does not recognise the other system partitions as system partitions because they are hidden in this situation, but I may be wrong. Also, even when restoring a single boot system does Reflect's log includes a line Registry Update Success. I have included two examples. I have only found one example with the RegSetValueEx Success and it may be related to the fact that the restore is done to a different disk if I look at the BCD Update line. I do no know what RegSetValueEx means.
 
|
By Seekforever - 21 September 2023 1:16 PM
RegSetValueEx is an API that allows information to be placed, and I presume changed, in the registry. If one looks at your result above it could be assumed only 4 values were set/altered but that return could be from a routine that set numerous values so it isn't definitive without knowing the program internals. Since it is a general API, without knowing what it is referencing there is no way of knowing what it is altering.
|
By pimjoosten - 21 September 2023 1:34 PM
+xRegSetValueEx is an API that allows information to be placed, and I presume changed, in the registry. If one looks at your result above it could be assumed only 4 values were set/altered but that return could be from a routine that set numerous values so it isn't definitive without knowing the program internals. Since it is a general API, without knowing what it is referencing there is no way of knowing what it is altering.
Thanks for the explanation. I hope somebody from Macrium will chime in and shed some light on this and perhaps also the other questions. My main concern is that some restores may fail which one would only find out after the fact. If it is only a hiccup I can live with that, because I also keep a log and could the restore an earlier image and set the steps again to the same point in time. It would also be very interesting to know why there apparently is a limit of 1 TB for successfully restoring an image. Something must be different between a disk smaller than 1 TB (I only had a 750 GB disk to test, so I do not know where the threshold is exactly) and equal to or larger than 1 TB. Other imaging programs (I tred True Image 2014 and Paragon) do not suffer from this, they can restore an image to a BIBM disk irrespective of its size. It would be nice if I could do the same with Reflect, because it is by far my favourite imaging program.
|
By Seekforever - 21 September 2023 2:34 PM
The link below says Reflect will handle an image of up to 16 TB and I doubt if they would use that as a limit if it couldn't normally restore that size. This points to some issue with how BIBM has done something that is different from regular MS Windows possibly having to do with the EMBR that appears to be a Terabyte corporation construct (it isn't the same as the EBR) which you probably already knew.
Let the finger-pointing begin!
You could try to raise this in a ticket to Reflect support which is pretty accommodating for problems even if you are out of support time; be sure to reference this thread. You also might try Terabyte.
https://tecnobits.com/en/What-image-size-does-Macrium-Reflect-Free-support%3F/#:~:text=Image%20sizes%20%E2%80%8Csupported%20by%E2%80%8D%20Macrium%20Reflect%20%E2%81%A3Free%201,offers%20several%20compression%20%E2%81%A2options%20for%20disk%20images.%20
|
By DanDanz - 21 September 2023 5:46 PM
@pimjoosten If the Ex on the end of RegSetValue is what puzzles you, that's a common MS way of differentiating two versions of the RegSetValue (used to Set a new value in the Registry), with the Ex meaning Extended version (with more or different arguments, perhaps).
As for the other thing you asked: why does it show up sometimes? I note that the operation performed in the second picture of your examples shows a modified Disk ID.
And that's explained in this UserGuide/KnowledgeBase article:
... as part of a clone or restore process, Macrium Reflect will recalculate the signature according to the table below. If the signature is recalculated, the boot configuration data (BCD) store is located and updated and the drive mappings in HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\ are also updated if necessary.
The whole article has more about why the disk id must be different.
|
By Seekforever - 21 September 2023 8:19 PM
@DanDanz, good info and I think explains his questions about why it changes the registry.
|
By pimjoosten - 26 October 2023 7:35 PM
@Seekforever @DanDanz Thank you both for your replies. I was unexpectedly not able to respond to you for about a month, please accept my apologies for that. Your replies are much valued.
+xLet the finger-pointing begin! You could try to raise this in a ticket to Reflect support which is pretty accommodating for problems even if you are out of support time; be sure to reference this thread. You also might try Terabyte.
Yes, that is what I fear will happen in this case and why I am reluctant to contact the support of both companies. I have my doubts whether Terabyte Unlimited would be willing to help in this case, because they already have a strict policy of not allowing to mention a competing product on their forum. They will very likely refer to their own Image for Windows product. As far as Macrium is concerned, they have no knowledge about what BIBM actually does to the disk, and I do not feel that I am in a position to ask them to look at that. But maybe I will try to get some answers to my questions.
+x@pimjoosten If the Ex on the end of RegSetValue is what puzzles you, that's a common MS way of differentiating two versions of the RegSetValue (used to Set a new value in the Registry), with the Ex meaning Extended version (with more or different arguments, perhaps). As for the other thing you asked: why does it show up sometimes? I note that the operation performed in the second picture of your examples shows a modified Disk ID. And that's explained in this UserGuide/KnowledgeBase article: ... as part of a clone or restore process, Macrium Reflect will recalculate the signature according to the table below. If the signature is recalculated, the boot configuration data (BCD) store is located and updated and the drive mappings in HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\ are also updated if necessary. The whole article has more about why the disk id must be different.
Thanks Dan. I understand what that article says and it explains possible registry updates when there is a signature collision. Unfortunately it does not explain why even when restoring to the same drive as the image was made from also needs registry updates. I am still hoping somebody from Macrium can chime in why the registry is always updated during a restore and perhaps also the other questions in my opening post.
|
|