Posts Tagged as ‘registry’

October 28, 2009

libhivex: Windows Registry hive extractor library

Several people managing Windows virtual machines have told me that libguestfs/virt-cat isn’t enough for them. They’d like to be able to get at Windows Registry entries in the guest.
A typical example is the imaginary [as of now] virt-win-reg command that lets you interrogate the Registry in a guest:

$ virt-win-reg MyWinGuest ‘\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion’
“ProductName”=”Microsoft Windows Server [...]

June 8, 2009

Explore the Windows registry with libguestfs

Using libguestfs we can dump out the Windows registry as plain files. Here’s how.
You will need Petter Nordahl-Hagen’s Windows registry tools (Fedora package chntpw).
On NT-derived versions of Windows, the registry is stored in several binary files under the path /WINDOWS/system32/config. This document explains what’s in what file and Wikipedia explains how the registry [...]