Remote registry viewer

[spittledip]

Hi all,

I need a registry viewer that I can use to view registries on my other hard drives. I used alien registry viewer until the trial period ran out. 69 dollars to purchase that program... :roll: Anyway, does anyone know of a similar program that is freeware? I tried Registry Viewer 2, but it didn't work.. any suggestion are appreciated

thanks

 

[Smilin]

What's wrong with regedit (ala "load hive")?

Maybe I don't understand what you are trying to do.

 

[spittledip]

I need it to view registries on hard drives that the running OS is not running on.

 

[stash]

Definitely regedit. I didn't even know there were third-party registry editors. Wow.

 

[spittledip]

How do you get regedit to view registries that are not being used on current OS?

 

[Smilin]

so your registry consists of 4 files in system32\config plus the ntuser.dat that sits in your profile folder. These are called registry "hives"..named so because of the files cell structure that allows for very fast editing (it's not laid out in the "tree" form you are familiar with in the file)

hkey_local_machine\sam = system32\config\sam
hkey_local_machine\system = system32\config\system
hkey_local_machine\software = systme32\config\software
hkey_local_machine\security = system32\config\security
hkey_users = ntusuer.dat files

There are some other portions of the registry that are built on the fly.
Hkey_current_config is built each boot.
hkey_current_user is copied from hkey_users when someone logs on.

frankly I've not done a lot of crap with hkey_classes_root so I can't tell you much.


All you have to do to view these is:
1. open regedit
2. highlight the top key (say HKLM)
3. From the file menu select "load hive"
4. navigate to the file in question (say system32\config\system)
5. provide a temporary name (say test)

You'll now find a new tree in your registry called hkey_local_machine\test. If you open it you'll find everything you would expect to find in hkey_local_machine\system if you had opened regedit on a system that had booted with that registry.

important: when you are done, highlight the hive you've loaded (say test) and select "unload hive" from the menu. Merely closing regedit does not unload the hive.



Yeah don't pay any $$$ for a utility that does this. That would be like buying ice in Antarctica. I can't believe jerks would sell people such a thing.

 

[spittledip]

Thank you very much. That was what I needed. I also feel that it is criminal for people to try to sell software like that...