Announcement

Collapse
No announcement yet.

Needed -- Offline Registry Viewer

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Needed -- Offline Registry Viewer

    Can anyone please recommend a good offline registry viewer, preferably free/shareware? If possible, it should work with Win9x as well as 2K/XP registry files. I need it urgently for some forensic work.

    Short on time, so haven't done my usual googling

    TIA
    Tom
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    PhD, MSc, FIAP, MIITT
    IT Trainer / Consultant
    Ossian Ltd
    Scotland

    ** Remember to give credit where credit is due and leave reputation points where appropriate **

  • #2
    Re: Needed -- Offline Registry Viewer

    Windows Registry Analyzer, originaly written by Michal Mutl http://www.mitec.cz/
    It was free ware untill he sold it to http://www.paraben-forensics.com/cat...roducts_id=310

    but one of the free old versions is still for download in this repository;
    http://www.stahuj.centrum.cz/utility...stry-analyzer/


    \Rems

    This posting is provided "AS IS" with no warranties, and confers no rights.

    __________________

    ** Remember to give credit where credit's due **
    and leave Reputation Points for meaningful posts

    Comment


    • #3
      Re: Needed -- Offline Registry Viewer

      Hey, Tom.
      I had to do this not long ago. I took the relevant file (in my case, the NTUSER.DAT) from that computer to mine, and used the method described here: http://www.petri.com/edit_registry_s...han_myself.htm .
      I don't know exactly how much info you need, but this was enough for me at that point.

      Just a thought

      Sorin Solomon


      In order to succeed, your desire for success should be greater than your fear of failure.
      -

      Comment


      • #4
        Re: Needed -- Offline Registry Viewer

        Thanks, Rems, I will look at those

        I know the link you mentioned, Sorinso, but find that as soon as I say I'm going to look at it in Regedit, there is the possibility that I am changing the file -- I need completely off line!

        Tom
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment


        • #5
          Re: Needed -- Offline Registry Viewer

          This guy Michal still has a Registry Reader utility on his site which will open non-active registry files and allow you to export.
          http://www.mitec.cz/Downloads/RegView.zip
          It can read files from the 'System Volume Information' folder (Unhide system folders first, and some times you have to enable sharing (?) to , before you could access the System Volume Information).
          There are also old backup files *.bak/*sav in windows\repair and windows\system\config

          An alternative for RegView is:
          http://www.computer-help.net/FTP-Files/RFV.exe

          WRA (Windows Registry Analyzer), has an option to export only the selected key.

          \Rems

          This posting is provided "AS IS" with no warranties, and confers no rights.

          __________________

          ** Remember to give credit where credit's due **
          and leave Reputation Points for meaningful posts

          Comment

          Working...
          X