Reading the registry from unbootable drive...

[Ichinisan]

I have access to the files stored on a drive that will no longer boot Windows XP. How can I bring up the registry contents to retrieve important information that will be useful when reinstalling Windows? Is there a way to mount the file so that Regedit can display it?

 

[Markbnj]

It can be done. Winternals and Sysinternals both have freeware/shareware tools that will let you boot into a dead NT/XP box and manipulate the NTFS volumes. Sysinternals has tools that will allow you to use a serial connection (or TCP/IP) to move files on and off a dead NT/XP box.

Lastly, once you have the .dat file in which the registry hive is kept you can use regedt32.exe to load the entire hive into a temporary key and go registry snooping.

All this is pretty complicated, and I suggest you do some googling on the XP registry architecture, file locations, backup and restore before attempting it.

This also assume you know what data you want out of the old registry, and where to find it.

 

[Ichinisan]

I do. I have experience editing the registry. When I try to load a hive, Regedit wants me to select a computer from the network. I assume this means that it's looking for a domain controller or something.

[edit]
Eh, that was the "Connect Network Registry..."

Wrong option...heh. I shied away from "import" because I don't want anything merged with the registry in my good computer. I think that Microsoft botched the terminology here.

 

[Markbnj]

Yeah, I don't think you can use rededt32 to do this if the target computer won't boot NT/XP.

As for the import, the suggestion I saw while searching was to create a temporary key, and import the whole hive under that. Then grab what you want and delete the temp key.

 

[bsobel]

It's not Import you want it's 'Load Registry Hive'

Bill

 

[Ichinisan]

The option is always disabled (greyed-out)

 

[bsobel]

See the help file on load registry hive, basically you need to select hkey_local_machine or hkey_current_user and the other reg will load as a subkey of those two roots...