browsing ghost image to find the registry

  • Thread starter Thread starter dado.bendavid
  • Start date Start date
D

dado.bendavid

All,
i have backed up my system using norton ghost 9.0
i am now trying to find out what was the value of a specific registry
key and i don't know if this is posible to do using ghost image
browser.

is this possible?

Dado
 
First restore the hive you're interested in from the image location
%systemroot%\system32\config\ (do not attempt restore to the same location!)

Then run regedt32, then from the Local Machine Hive, choose Registry|Load
Hive. Then navigate to the location of the hive you want to edit/read. Give
it some tempname (doesn't matter what). Then when your done, move the cursor
back to tempname, then Registry|Unload Hive, Registry|Exit

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
 
Dave,

thanks for the reply
what to you mean by "Then navigate to the location of the hive"
as you said, i restored the image (only the system32\config folder) to
a temp location.
then i opened regedit and selected File\Load Hive, however, i do not
know how to find the hive i want. i need to look at HKEY_LOCAL_MACHINE.
i see many files and sub dirs in the temp dir that i created, but i
don't know which one i need to load.

Regards,

Dado
 
If;
HKEY_LOCAL_MACHINE\SYSTEM
then load the hive file \system32\config\system

If;
HKEY_LOCAL_MACHINE\SOFTWARE
then load the hive file \system32\config\software

from your temp location.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
 
Back
Top