Regedit

[Poor Richard]

I have a need to use regedit on a registry that is on an external disk. Are
there options when starting regedit to direct it to another copy of a
registry file that is not in use on the computer? What are the file names
of the registry?

Richard

 

[philo]

I have a need to use regedit on a registry that is on an external disk. Are
there options when starting regedit to direct it to another copy of a
registry file that is not in use on the computer? What are the file names
of the registry?

Richard

there was one possibly useful answer here

http://www.ntcompatible.com/View_Registry_on_slaved_HDD_t31408.html

 

[Bruce Chambers]

I have a need to use regedit on a registry that is on an external disk. Are
there options when starting regedit to direct it to another copy of a
registry file that is not in use on the computer? What are the file names
of the registry?

Richard

The WinXP registry can be found in C:\Windows\System32\Config\.
It'll be divided into several data files, such as Security, Software,
and System. The user-specific portion of the registry is stored in each
user profile, in a file named NTUser.dat.

Within Regedit, click File > Load Hive, and then point to the
\Windows\System32\Config\ folder on the external drive.


--

Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[Alan Edwards]

You may find this useful.

RegdatXP: http://people.freenet.de/h.ulbrich/

....Alan

 

[VanguardLH]

in message

The WinXP registry can be found in C:\Windows\System32\Config\.
It'll be divided into several data files, such as Security,
Software, and System. The user-specific portion of the registry is
stored in each user profile, in a file named NTUser.dat.

Within Regedit, click File > Load Hive, and then point to the
\Windows\System32\Config\ folder on the external drive.

In addition, the File -> Load Hive menu will not be available until
you select WHICH hive under which you want to open the other
registry's hive. That is, and as an example, you have to select a
hive, like HKLM, and then use the File -> Load Hive menu.

The Load Hive submenu only becomes enable after you have selected
either the HKEY_LOCAL_MACHINE or HKEY_USERS hive in your current
registry.

 

[Poprivet]

The WinXP registry can be found in C:\Windows\System32\Config\.
It'll be divided into several data files, such as Security, Software,
and System. The user-specific portion of the registry is stored in
each user profile, in a file named NTUser.dat.

Within Regedit, click File > Load Hive, and then point to the
\Windows\System32\Config\ folder on the external drive.

Bruce,

Thant's interesting, and new to me, so thanks.
I believe the OP was expecting to find the entire set of Registry files; I
know I was hoping for them<g>.
Might there be other locations for other files, or is the ...\config the
entire contents of anything that is a file format? By process of
elimination I can probably answer that myself, but it you know the answer
it'd sure help.

I assume you're aware that only 2 of the Regedit roots can be loaded, right?
I thought your post sounded like it would open all of them.

My interest is purely curiousity at the moment, but I was pleased to see the
..log files there too, and happy that I could tell by dates which ones had
been modified today; something I've often wondered about.

Thanks for any comments or leads you can offer on this.

TIA,

Pop`

 

[VanguardLH]

in message

Might there be other locations for other files, or is the ...\config
the entire contents of anything that is a file format? By process
of elimination I can probably answer that myself, but it you know
the answer it'd sure help.

I assume you're aware that only 2 of the Regedit roots can be
loaded, right? I thought your post sounded like it would open all of
them.

There are only 2 real hives: local machine and users. All the others
are *copies* (partial) of those root hives; that is, there are 2 root
hives and the others are pseudo-hives. HKCU shows the entries under
the HKU hive but only for the currently logged on user. HKR shows a
mix of entries from HKLM and HKU for the currently logged on user.
The HKCFG hive is a mix of System (used for HKLM) and ntuser.dat info.
There are only 2 real hives. The others are compilations made up from
those 2 real hives.

The SAM, Security, Software, and System registry files are all part of
the HKLM hive. The HKU user hive is taken from the ntuser.dat file
user the currently logged on user's profile path. The HKCFG hive is
compiled from the System and ntuser .dat files.

http://www.bleepingcomputer.com/tutorials/tutorial74.html
http://support.microsoft.com/kb/256986
http://en.wikipedia.org/wiki/Windows_Registry

 

[Poor Richard]

Will this action, Load Hive, replace the current hive? I do not want to
replace the current active hive, just edit the old to find the problem that
caused me to have to do a system restore. I also want to extract some
values for programs that were installed from the internet and are not now
available. I changed hard drives before doing the system restore because
the computer would not boot. If I can edit the old registry and correct the
problem, then I can again switch hard drives without having to reload all my
installed programs.

Richard


--

 

[Poprivet]

in message


There are only 2 real hives: local machine and users. All the others
are *copies* (partial) of those root hives; that is, there are 2 root
hives and the others are pseudo-hives. HKCU shows the entries under
the HKU hive but only for the currently logged on user. HKR shows a
mix of entries from HKLM and HKU for the currently logged on user.
The HKCFG hive is a mix of System (used for HKLM) and ntuser.dat info.
There are only 2 real hives. The others are compilations made up from
those 2 real hives.

The SAM, Security, Software, and System registry files are all part of
the HKLM hive. The HKU user hive is taken from the ntuser.dat file
user the currently logged on user's profile path. The HKCFG hive is
compiled from the System and ntuser .dat files.

http://www.bleepingcomputer.com/tutorials/tutorial74.html
http://support.microsoft.com/kb/256986
http://en.wikipedia.org/wiki/Windows_Registry

Thanks much, that helps explain a LOT. And I'm into the links you provided
too. With your information here, they're making a little more sense to me
so far.

One more question if you don't mind.
The "other" hives, partials of the two "real" ones: Are those
created/updated at boot time? e.g. if I make a change in local machine,
does it propogate to the relevant partial hives? Sorry, I'm not useing
names yet because I'd screw them up for sure<g>.

Back to reading now,

Thanks

 

[Bruce Chambers]

Will this action, Load Hive, replace the current hive?

No, it won't affect the hive of the host OS.


--

Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[VanguardLH]

in message

The "other" hives, partials of the two "real" ones: Are those
created/updated at boot time? e.g. if I make a change in local
machine, does it propogate to the relevant partial hives? Sorry,
I'm not useing names yet because I'd screw them up for sure<g>.

There are no registry .dat files to record the values of the
pseudo-hives. There is no need. The values shown in those
pseudo-hives is taken from the HKLM and HKU hives. Those pseudo-hives
are generated when you login.

Obviously HKCU cannot be defined until a user actually logs in since
that pseudo-hive is supposed to contain entries for THAT logged in
user. HKR and HKCFG are also pseudo-hives built when you login.
Those pseudo-hives only exist in the memory copy of the registry (you
and the apps do not use the disk copy of the registry and instead
access is against the memory copy, but updates to the memory copy will
get written back into the .dat disk files).

There are no disk files for the pseudo-hives since there is no need to
duplicate their data that they got from the real hives.

 

[Poprivet]

in message



There are no registry .dat files to record the values of the
pseudo-hives. There is no need. The values shown in those
pseudo-hives is taken from the HKLM and HKU hives. Those pseudo-hives
are generated when you login.

Obviously HKCU cannot be defined until a user actually logs in since
that pseudo-hive is supposed to contain entries for THAT logged in
user. HKR and HKCFG are also pseudo-hives built when you login.
Those pseudo-hives only exist in the memory copy of the registry (you
and the apps do not use the disk copy of the registry and instead
access is against the memory copy, but updates to the memory copy will
get written back into the .dat disk files).

There are no disk files for the pseudo-hives since there is no need to
duplicate their data that they got from the real hives.

Thanks, Vanguard; it makes a lot more sense now. Perhaps the thickness of
my skull is inversely proportional to what I know about a subject, but I'll
be darned if I've ever seen that written anywhere that I'd consider clear or
anywhere near concise. It covers off the sort of "inconsistancies" I've
wondered about for a long, long time w/r to the Registry hives. I'd expect
something like that to be Registry 101 and explicitly described, but if it
is, I've never come across it. Implicity, now that I know about it, yes,
it's there, but - woof!

Regards,

Pop`

 

[Sam Hobbs]

It is my understanding that they are not pseudo-hives, they are
pseudo-names. In other words, there are no separate copies; when
modifications are made to the original data, the pseudo-name copy is
modified at the same time because the data is the same.

It seems strange to me that when we search the registry, portions are
searched twice eventhough the data is the same.