Contents of NT ERD (Emergency Repair Disk)

  • AUTOEXEC.NT – used to initialize the MS-DOS
    environment. Not registry oriented.
    gotcha! this is a 16-bit environment and
    does not understand long file names. Any file name used must conform to the 8.3
    naming convention.
  • CONFIG.NT – used to initialize the MS-DOS
    environment. Not registry oriented.
  • DEFAULT._ – contains the HKEY_USERS\.Default hive. Default user settings.
  • NTUSER.DA_ – new user profile, NT 4.x file.
  • SAM._ – copy of HKEY_LOCAL_MACHINE\SAM hive. Contains user and domain account
    and password data.
  • SECURITY – copy of HKEY_LOCAL_MACHINE\Security hive. Contains local security and
    user right data. SAM is a subkey of SECURITY.
  • SETUP.LOG – contains setup/configuration
    information used in repairs.
  • software._ – copy of HKEY_LOCAL_MACHINE\Software hive. Subkeys for each installed
  • system._ – copy of HKEY_LOCAL_MACHINE\System hive. Contains system start-up,
    device drivers, services, …
Are the ERD contents same as the repair
directory (\winnt\repair)? YES. Only real difference is that you can have many
copies of the ERD and there is only one repair directory. [excluding situation
where server has so many accounts, that SAM is too large for a floppy disk]

Note: Files with the ._ extension are compressed. System._, Software._,
Security._, SAM._, Default._ and NTUSER.DA_ can all be uncompressed using

ERD Related Tips:

Leave a Comment

Your email address will not be published.

Scroll to Top