How can I view /and extract keys from a backed up registry? (windows xp)

[ty1er]

I copied the registry folder out of a backup from norton ghost.
(%SystemRoot%\System32\Config\)

Now i have an older version of my registry in a folder on my desktop.

I want to extract a couple of software configuration keys from it - but its not in plain text.

Is there anyway i can open these registry files from the backup folder?

Here is the folders contents:
Appevent.evt
default
default.log
default.sav
Sam
Sam.log
Secevet.evt
Securirty.....etc

As you can see there not .reg files. So im wondering if htere is a way to open/view/and extract keys from these files.

thanks
-ty1er//

 

[Smilin]

those are hive files.

See "load hive" in regedit for details, but here is a quick rundown:


open regedit (on XP, regedt32 on anything prior).
Highlight Hkey local machine.
File | Load hive
browse to your config folder, grab either 'system' or 'software' (if you need security or sam keys, rethink your life 😛 ), hit ok.
When prompted give it any name. "test" will do. Hit ok.
Under HKLM you'll now see "test" listed. Drill into it and it will look familiar.
When you are done, highlight "test" and hit File | unload hive. Regedit does NOT do this automatically when you close it.

 

[ty1er]

thanks Smilin!

I have one more question.
Does anyone know where the "HKEY_CURRENT_USER" hive is stored?

thanks again!
-ty1er/

 

[ty1er]

Found it!

NTUSER.DAT and USRCLASS.DAT (Windows XP only) = store the HKEY_CURRENT_USER Hive key,

 

[Smilin]

HKCU isn't actually stored anywhere. That portion of the registry is built on the fly from HKEY users, which is indeed store in ntuser.dat files located in documents and settings.

Hkey current config is another one that doesn't actually have a file. It's built on the fly from ntdetect.com info at boot.


Tyler, you find the key you were after? Out of curiosity, what are you up to?

 

[Smilin]

HKCU isn't actually stored anywhere. That portion of the registry is built on the fly from HKEY users, which is indeed store in ntuser.dat files located in documents and settings.

Hkey current config is another one that doesn't actually have a file. It's built on the fly from ntdetect.com info at boot.


Tyler, you find the key you were after? Out of curiosity, what are you up to?

 

[Smilin]

WTF?

WTF?

 

[bendixG15]

He went home

Shut the lights off and let the cat out.....