Aller au contenu principal

Where is Registry (Hive) in Windows Whole Partition Backup?

Thread needs solution

I want to be able to examine keys in the whole partition backup archive. I want to extract the whole registry, set it up as a .reg file, and will probably use a .reg file editor/viewer to examine or create. How do I extract it from the TIB file. The System.SAV and System Volume Information trees don't indicate anything obvious.

0 Users found this helpful

mavi:

You will need to Mount the backup archive as read/write in order to gain access to the registry files, which are in C:\Windows\System32\config. Here is a screen shot showing what you'll see (from Windows 7). The different registry hives are visible as BCD, SAM, Software, System, etc., which can then be mounted and explored using Regedit.

Mounting as read/write is needed because in order to gain access to the files you will need to take ownership, so Windows will need to modify the default permissions on the files, and this can only be done if mounted as read/write. TI will create an incremental image file to contain the changes while mounted, which you can later delete.

Fichier attaché Taille
12961-86455.PNG 48.17 Ko