scanstate fails at reading a registry entry from the offline image

Question

My win 8 got boot loop and when I want to "Refresh" it, mandates logging in but doesn't show any of the user profiles!

I'm trying to migrate some EFS certificates from it using USMT(Yes, I know I must backup my certificates., and I did, but now, none of the passwords I regularly use can open it!).

So we got an offline win 8 image build 6.2.9200.16384.

I installed another 8.1 on another drive and downloaded ADK and installed USMT and built a WinPE iso.

I went on WinPE, re-assigned drive-letters as desired using DISKPART, moved the side-by-side win 8.1(hosting USMT) under a folder to stay out of the battle, made some almost empty xml files for the scanstate, and got this exception in "scanstate.log":

2014-07-28 03:14:21, Info                  [0x000000] SCANSTATE.EXE Version 6.3.9600.17029[gle=0x000000b7]
2014-07-28 03:14:21, Info                  [0x000000] USMT Started at 2014/07/28:03:14:21.266
2014-07-28 03:14:21, Info                  [0x000000] Command line: d:\newwin\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\User State Migration Tool\amd64\scanstate.exe e:\usmt\Store /i:migapp.xml /i:migdocs.xml /i:miguser.xml /offline:offline.xml /nocompress /localonly /ue:* /ui:MyUserName
2014-07-28 03:14:23, Info                  [0x000000] Script file specified: E:\USMT\migapp.xml[gle=0x00000002]
2014-07-28 03:14:23, Info                  [0x000000] Script file specified: E:\USMT\migdocs.xml[gle=0x00000002]
2014-07-28 03:14:23, Info                  [0x000000] Script file specified: E:\USMT\miguser.xml[gle=0x00000002]
2014-07-28 03:14:23, Info                  [0x000000] Starting the migration process
2014-07-28 03:14:23, Info                  [0x000000] Offline engine startup from WinDir - C:\Windows
2014-07-28 03:14:26, Error                 [0x000000] MigStartupOffline caught exception: Win32Exception: HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName [ComputerName] does not exist or is not accessible.: The system cannot find the file specified. [0x00000002] class UnBCL::String *__cdecl Mig::COfflineWinNTPlatform::GetMachineName(class Mig::IDataStore *)
2014-07-28 03:14:26, Error                 [0x000000] Error while trying to start the migration process
2014-07-28 03:14:26, Warning               [0x000000] Internal error 4 was translated to a generic error
2014-07-28 03:14:26, Info                  [0x000000] Failed.
2014-07-28 03:14:26, Info                  [0x000000]   Software malfunction or Unknown exception
2014-07-28 03:14:26, Info                  [0x000000] USMT Completed at 2014/07/28:03:14:26.735
2014-07-28 03:14:26, Info                  [0x000000] ----------------------------------- USMT ERROR SUMMARY -----------------------------------
2014-07-28 03:14:26, Info                  [0x000000] * USMT error code 26: 
2014-07-28 03:14:26, Info                  [0x000000] +-----------------------------------------------------------------------------------------
2014-07-28 03:14:26, Info                  [0x000000] | Software malfunction or Unknown exception, please check the following possible solutions:
2014-07-28 03:14:26, Info                  [0x000000] | - Check log for any errors found in loaded migxml files
2014-07-28 03:14:26, Info                  [0x000000] | - Verify config xml file is not loaded using /i
2014-07-28 03:14:26, Info                  [0x000000] | - If duplicate SID exists from temp profile – use environment variable or delete temp profile
2014-07-28 03:14:26, Info                  [0x000000] +-----------------------------------------------------------------------------------------

Then I ran scanstate from the side-by-side win 8.1, used USMT's sample xml files, used /genconfig parameter(to find out: If it can't grab anything, at least can it see anything?!), and I got the exact same exception:

2014-07-29 02:46:19, Info                  [0x000000] SCANSTATE.EXE Version 6.3.9600.17029[gle=0x000000b7]
2014-07-29 02:46:19, Info                  [0x000000] USMT Started at 2014/07/29:02:46:19.872
2014-07-29 02:46:19, Info                  [0x000000] Command line: C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\User State Migration Tool\amd64\scanstate.exe /offline:offline.xml /i:migapp.xml /i:miguser.xml /genconfig:config.xml
2014-07-29 02:46:21, Info                  [0x000000] Script file specified: C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\User State Migration Tool\amd64\migapp.xml[gle=0x00000002]
2014-07-29 02:46:21, Info                  [0x000000] Script file specified: C:\Program Files (x86)\Windows Kits\8.1\Assessment and Deployment Kit\User State Migration Tool\amd64\miguser.xml[gle=0x00000002]
2014-07-29 02:46:21, Info                  [0x000000] Starting the migration process[gle=0x000000cb]
2014-07-29 02:46:21, Info                  [0x000000] Offline engine startup from WinDir - D:\Windows
2014-07-29 02:46:23, Error                 [0x000000] MigStartupOffline caught exception: Win32Exception: HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName [ComputerName] does not exist or is not accessible.: The system cannot find the file specified. [0x00000002] class UnBCL::String *__cdecl Mig::COfflineWinNTPlatform::GetMachineName(class Mig::IDataStore *)
2014-07-29 02:46:23, Error                 [0x000000] Error while trying to start the migration process
2014-07-29 02:46:23, Warning               [0x000000] Internal error 4 was translated to a generic error
2014-07-29 02:46:23, Info                  [0x000000] Failed.
2014-07-29 02:46:23, Info                  [0x000000]   Software malfunction or Unknown exception
2014-07-29 02:46:23, Info                  [0x000000] USMT Completed at 2014/07/29:02:46:23.997
2014-07-29 02:46:23, Info                  [0x000000] ----------------------------------- USMT ERROR SUMMARY -----------------------------------
2014-07-29 02:46:23, Info                  [0x000000] * USMT error code 26: 
2014-07-29 02:46:23, Info                  [0x000000] +-----------------------------------------------------------------------------------------
2014-07-29 02:46:23, Info                  [0x000000] | Software malfunction or Unknown exception, please check the following possible solutions:
2014-07-29 02:46:23, Info                  [0x000000] | - Check log for any errors found in loaded migxml files
2014-07-29 02:46:23, Info                  [0x000000] | - Verify config xml file is not loaded using /i
2014-07-29 02:46:23, Info                  [0x000000] | - If duplicate SID exists from temp profile – use environment variable or delete temp profile
2014-07-29 02:46:23, Info                  [0x000000] +-----------------------------------------------------------------------------------------

Any suggestions(or perhaps any other way to get the certificates!) is highly appreciated.

Answer 1

Answering my own question.

I copied the registry entry it complained about using the instructions described here: How to modify a computer's offline registry from WINPE? and despite I couldn't gather what I wanted using later attempts, scanstate didn't repeat that kind of error or any other errors.

Then I remembered of this lovely tool which had saved my data once before: Elcomsoft Advanced EFS Data Recovery

It can scan windows drives - either online or offline or even deleted - for EFS certificates and check them to match the username and password which you provide as the user who owned them. It then lets you browse through your encrypted files to see if they're decryptable with them.

It worked for me alright, and I'm very pleased with this program. :)