Tech Support > Microsoft Windows > browsing ghost image to find the registry
browsing ghost image to find the registry
Posted by dado.bendavid@gmail.com on October 25th, 2005


All,
i have backed up my system using norton ghost 9.0
i am now trying to find out what was the value of a specific registry
key and i don't know if this is posible to do using ghost image
browser.

is this possible?

Dado

Posted by Dave Patrick on October 25th, 2005


First restore the hive you're interested in from the image location
%systemroot%\system32\config\ (do not attempt restore to the same location!)

Then run regedt32, then from the Local Machine Hive, choose Registry|Load
Hive. Then navigate to the location of the hive you want to edit/read. Give
it some tempname (doesn't matter what). Then when your done, move the cursor
back to tempname, then Registry|Unload Hive, Registry|Exit

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

<dado.bendavid@gmail.com> wrote:
> All,
> i have backed up my system using norton ghost 9.0
> i am now trying to find out what was the value of a specific registry
> key and i don't know if this is posible to do using ghost image
> browser.
>
> is this possible?
>
> Dado
>



Posted by dado.bendavid@gmail.com on October 26th, 2005


Dave,

thanks for the reply
what to you mean by "Then navigate to the location of the hive"
as you said, i restored the image (only the system32\config folder) to
a temp location.
then i opened regedit and selected File\Load Hive, however, i do not
know how to find the hive i want. i need to look at HKEY_LOCAL_MACHINE.
i see many files and sub dirs in the temp dir that i created, but i
don't know which one i need to load.

Regards,

Dado

Posted by Dave Patrick on October 26th, 2005


If;
HKEY_LOCAL_MACHINE\SYSTEM
then load the hive file \system32\config\system

If;
HKEY_LOCAL_MACHINE\SOFTWARE
then load the hive file \system32\config\software

from your temp location.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

<dado.bendavid@gmail.com> wrote:
> Dave,
>
> thanks for the reply
> what to you mean by "Then navigate to the location of the hive"
> as you said, i restored the image (only the system32\config folder) to
> a temp location.
> then i opened regedit and selected File\Load Hive, however, i do not
> know how to find the hive i want. i need to look at HKEY_LOCAL_MACHINE.
> i see many files and sub dirs in the temp dir that i created, but i
> don't know which one i need to load.
>
> Regards,
>
> Dado
>



Posted by dado.bendavid@gmail.com on October 26th, 2005


Dave,

it works

thanks

Dado

Posted by Dave Patrick on October 26th, 2005


Glad to hear it. You're welcome.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

<dado.bendavid@gmail.com> wrote:
> Dave,
>
> it works
>
> thanks
>
> Dado
>




Similar Posts