I have an unbootable Windows XP install. I can open the registry (offline). How do I figure out what folders were shared on the network?

Question

I have an Acronis disk image of a PC that had Windows XP Pro on it. The hard drive is dying and the Acronis image is incomplete (some missing sectors, blah blah). I did my best to get the computer to boot, but after days of screwing with it I'm just trying to rebuild from scratch in a VM.

I need to match the hard drive layout exactly (fairly easy from the Acronis image) and then share the same folders on to the network. Here's the problem... how do I determine whether a folder was shared on the network on Windows XP Pro without booting the machine? I don't even know if it was part of a domain.

Is it stored on the partition as part of the metadata for that folder? Or is it in the registry somewhere? Or is it both?

FWIW, one partition (the one with Windows) is FAT32 (don't ask me...) and the rest are NTFS.

Answer 1

From MS KB Article 125996 Saving and restoring existing Windows shares:

From the HKEY_LOCAL_MACHINE subtree, go to the following key: SYSTEM\CurrentControlSet\Services\LanmanServer\Shares