Reading External Registry

[brettclavier]

I'm working on a tool that can copy the registry files from a designated drive or image onto a local machine.

After doing that, how would I go about reading from those registry keys? I've seen other people use RegOpenKeyEx but that was on their computer and not an external registry file.

[Ancient Dragon]

google for "c++ ReadRemoteRegistry" and you will find several threads, like this one

[brettclavier]

Thanks. I had actually seen that but as far as I can tell its using the network to connect to a running computer. My approach is for a forensics class where I have an image of the hard drive or the actual hard drive connected to my machine.

I would then copy the registry to my local computer where I would then open them to look for useful information such as previously connected devices. I've gotten the copying down, its just reading the copied files that has me stumped.

[MonsieurPointer]

Just to clarify: Are you trying to read keys/values in from a registry file (*.reg)?