1,105,633 Community Members

Reading External Registry

Member Avatar
brettclavier
Newbie Poster
2 posts since Oct 2011
Reputation Points: 0 [?]
Q&As Helped to Solve: 0 [?]
Skill Endorsements: 0 [?]
 
0
 

I'm working on a tool that can copy the registry files from a designated drive or image onto a local machine.

After doing that, how would I go about reading from those registry keys? I've seen other people use RegOpenKeyEx but that was on their computer and not an external registry file.

Member Avatar
Ancient Dragon
Achieved Level 70
27,637 posts since Aug 2005
Reputation Points: 5,232 [?]
Q&As Helped to Solve: 3,037 [?]
Skill Endorsements: 115 [?]
Team Colleague
Featured
Sponsor
 
0
 

google for "c++ ReadRemoteRegistry" and you will find several threads, like this one

Member Avatar
brettclavier
Newbie Poster
2 posts since Oct 2011
Reputation Points: 0 [?]
Q&As Helped to Solve: 0 [?]
Skill Endorsements: 0 [?]
 
0
 

Thanks. I had actually seen that but as far as I can tell its using the network to connect to a running computer. My approach is for a forensics class where I have an image of the hard drive or the actual hard drive connected to my machine.

I would then copy the registry to my local computer where I would then open them to look for useful information such as previously connected devices. I've gotten the copying down, its just reading the copied files that has me stumped.

Member Avatar
MonsieurPointer
Junior Poster
152 posts since Jun 2011
Reputation Points: 27 [?]
Q&As Helped to Solve: 15 [?]
Skill Endorsements: 0 [?]
 
0
 

Just to clarify: Are you trying to read keys/values in from a registry file (*.reg)?

You
This article has been dead for over three months: Start a new discussion instead
Post:
Start New Discussion
View similar articles that have also been tagged: