Contents of NT ERD (Emergency Repair Disk)

• AUTOEXEC.NT – used to initialize the MS-DOS
  environment. Not registry oriented.
  gotcha! this is a 16-bit environment and
  does not understand long file names. Any file name used must conform to the 8.3
  naming convention.
  
• CONFIG.NT – used to initialize the MS-DOS
  environment. Not registry oriented.
  
• DEFAULT._ – contains the HKEY_USERS\.Default hive. Default user settings.
  
• NTUSER.DA_ – new user profile, NT 4.x file.
  
• SAM._ – copy of HKEY_LOCAL_MACHINE\SAM hive. Contains user and domain account
  and password data.
  
• SECURITY – copy of HKEY_LOCAL_MACHINE\Security hive. Contains local security and
  user right data. SAM is a subkey of SECURITY.
  
• SETUP.LOG – contains setup/configuration
  information used in repairs.
  
• software._ – copy of HKEY_LOCAL_MACHINE\Software hive. Subkeys for each installed
  product.
  
• system._ – copy of HKEY_LOCAL_MACHINE\System hive. Contains system start-up,
  device drivers, services, …

Are the ERD contents same as the repair
directory (\winnt\repair)? YES. Only real difference is that you can have many
copies of the ERD and there is only one repair directory. [excluding situation
where server has so many accounts, that SAM is too large for a floppy disk]

Note: Files with the ._ extension are compressed. System._, Software._,
Security._, SAM._, Default._ and NTUSER.DA_ can all be uncompressed using
EXPAND.EXE.

ERD Related Tips:

• NT ERD – never there when you need it
  
• Contents of NT ERD
  
• Steps Performed by the Emergency Repair
  Disk
  
• Disable a Service or Device that Prevents
  Windows NT from Booting
  
• Cracking Windows NT passwords
  
• Using the
  Emergency Repair Disk to Fix Windows NT Problems
  
• Repair Disk
  Secrets Reduce Downtime
  
• Patch
  Available for RDISK Registry Enumeration File” Vulnerability