- browsing ghost image to find the registry
- Posted by dado.bendavid@gmail.com on October 25th, 2005
All,
i have backed up my system using norton ghost 9.0
i am now trying to find out what was the value of a specific registry
key and i don't know if this is posible to do using ghost image
browser.
is this possible?
Dado
- Posted by Dave Patrick on October 25th, 2005
First restore the hive you're interested in from the image location
%systemroot%\system32\config\ (do not attempt restore to the same location!)
Then run regedt32, then from the Local Machine Hive, choose Registry|Load
Hive. Then navigate to the location of the hive you want to edit/read. Give
it some tempname (doesn't matter what). Then when your done, move the cursor
back to tempname, then Registry|Unload Hive, Registry|Exit
--
Regards,
Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
<dado.bendavid@gmail.com> wrote:
> All,
> i have backed up my system using norton ghost 9.0
> i am now trying to find out what was the value of a specific registry
> key and i don't know if this is posible to do using ghost image
> browser.
>
> is this possible?
>
> Dado
>
- Posted by dado.bendavid@gmail.com on October 26th, 2005
Dave,
thanks for the reply
what to you mean by "Then navigate to the location of the hive"
as you said, i restored the image (only the system32\config folder) to
a temp location.
then i opened regedit and selected File\Load Hive, however, i do not
know how to find the hive i want. i need to look at HKEY_LOCAL_MACHINE.
i see many files and sub dirs in the temp dir that i created, but i
don't know which one i need to load.
Regards,
Dado
- Posted by Dave Patrick on October 26th, 2005
If;
HKEY_LOCAL_MACHINE\SYSTEM
then load the hive file \system32\config\system
If;
HKEY_LOCAL_MACHINE\SOFTWARE
then load the hive file \system32\config\software
from your temp location.
--
Regards,
Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
<dado.bendavid@gmail.com> wrote:
> Dave,
>
> thanks for the reply
> what to you mean by "Then navigate to the location of the hive"
> as you said, i restored the image (only the system32\config folder) to
> a temp location.
> then i opened regedit and selected File\Load Hive, however, i do not
> know how to find the hive i want. i need to look at HKEY_LOCAL_MACHINE.
> i see many files and sub dirs in the temp dir that i created, but i
> don't know which one i need to load.
>
> Regards,
>
> Dado
>
- Posted by dado.bendavid@gmail.com on October 26th, 2005
Dave,
it works
thanks
Dado
- Posted by Dave Patrick on October 26th, 2005
Glad to hear it. You're welcome.
--
Regards,
Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
<dado.bendavid@gmail.com> wrote:
> Dave,
>
> it works
>
> thanks
>
> Dado
>