Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 33 guests and 1 member online
You are here:
Home
Ethical Hacking Discussions and Related Certifications
Hardware
Looking for the registry in XP
EH-Net
May 24, 2013, 05:15:59 AM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Ethical Hacking Discussions and Related Certifications
>
Hardware
(Moderator:
don
) >
Looking for the registry in XP
Pages: [
1
]
Go Down
« previous
next »
Print
Author
Topic: Looking for the registry in XP (Read 11805 times)
0 Members and 1 Guest are viewing this topic.
ejbragg
Newbie
Offline
Posts: 6
Looking for the registry in XP
«
on:
July 21, 2010, 11:25:23 AM »
Is there any way for me to find the registry of a sick hard drive to edit or delete it without running Windows on it? I'd like to use a working version of windows on hard drive A to fix the OS of a non-working hard drive B. This might be a software question, but the location of the registry files is what I'm looking for. Can those files be accessed?
Thanks,
Eric
Logged
sil
Hero Member
Offline
Posts: 549
Re: Looking for the registry in XP
«
Reply #1 on:
July 21, 2010, 11:33:42 AM »
Your best/safest bet:
http://support.microsoft.com/kb/307545
... To answer the location specific question though, its in %
systemroot
%/system32/config so .. Usually C:\
Windows
\ C:\
WINNT
\ ... Whichever is your environment variable
«
Last Edit: July 21, 2010, 11:36:39 AM by sil
»
Logged
http://www.infiltrated.net/mgz/puppylecter.jpg
Ketchup
Hero Member
Offline
Posts: 1021
Re: Looking for the registry in XP
«
Reply #2 on:
July 21, 2010, 11:42:02 AM »
WARNING: Use at your own risk. If you screw up the registry, you will break your computer and will have to reinstall. This is not recommended.
There are a few files that make up the Windows registry. The following are located in %systemroot%\system32\config:
SYSTEM - HKEY_LOCAL_MACHINE \SYSTEM
sam - HKEY_LOCAL_MACHINE \SAM
security - HKEY_LOCAL_MACHINE \SECURITY
SOFTWARE - HKEY_LOCAL_MACHINE \SOFTWARE
default - HKEY_USERS.DEFAULT
The following is located under each user profile and maps to the HKEY_CURRENT_USER when the user is logged, and the HKEY_USERS.<SID>
ntuser.dat
If you want to view and edit these files from another machine, you must copy them offline. Windows will lock these files at all times. You can them load them into the Regedit command as follows:
1. Make a temporary folder underneath your profile (HKEY_CURRENT_USER). For example, you can call it, "DEADMACHINE_SOFTWARE".
2. Select this folder. This is important, otherwise you will override data.
3. File / Load Hive...
Logged
~~~~~~~~~~~~~~
Ketchup
ejbragg
Newbie
Offline
Posts: 6
Re: Looking for the registry in XP
«
Reply #3 on:
July 21, 2010, 03:39:45 PM »
Thanks, guys. I can tell already, by the information I've received, I'm going to have to fess up on something else...
I installed a legit copy of XP SP3 on my drive about 3 weeks ago. I completed the installation on a Friday night in an attempt to overcome a hardware conflict concerning the use of MIDI. (I bought a control surface that will use MIDI, but it crashed my computer.) We also recently moved, and I can't find my old XP disk, so I just bought this one, which is an OEM version, XP Pro SP3, full blown.
I had it set up, as I just mentioned and up pops the authentication request window. I don't have internet access with this computer, because it is a DAW for my recording studio - I've no intentions of connecting it to the internet - I shy away from virus protection to keep my overhead clear (I run up to 48 channels of 32 bit audio at a time, plus processing on every channel).
So I did something .... sorta stupid. I wanted it up and running and I did not want to have to call Microsoft, simply because I figured it was Friday, and I didn't think anyone would answer all weekend, anyway... I'm actually 6 weeks behind in taking care of recorded clients, so I decided to download info on a windows crack. I updated my registry on the timer key. Well, it SEEMED to work - the activation window disappeared, but after the time ran out, it locked up on me anyway. And of course, I'm worse off now than I was, because if I press "Yes" to activate Windows, the response is, "Windows is already activated", after which I am returned to the previous box. There's no way to get into windows at all!
I tried re-installing windows, but it doesn't fix the registry problem. So I was hoping I could go in from another computer and possibly remove that particular key (and try re-installing windows). If I could get it back to a "normal" state, I could merely call Windows and activate it over the phone.
I'm trying very hard NOT to have to wipe the drive because I JUST got through installing a new drive and setting up all my DAW software, hardware, and an array of plug-ins from different vendors, each with their own, time consuming method of security verification / activation. Most of them run on some sort of .dll license or dongle, so I'm hoping that a mild, localized registry deletion should help me get back in the swing quickly.
«
Last Edit: July 22, 2010, 01:00:36 PM by ejbragg
»
Logged
ejbragg
Newbie
Offline
Posts: 6
Re: Looking for the registry in XP
«
Reply #4 on:
July 22, 2010, 01:07:19 PM »
Quote from: sil on July 21, 2010, 11:33:42 AM
Your best/safest bet:
http://support.microsoft.com/kb/307545
...
This particular link, I found, warned against trying the method due to the fact that I DO have an OEM version of the OS. Microsoft specifically states that when registry files are deleted, the hive will not recover the files, but will rather create new user profiles. If I'm understanding it correctly, it means I cannot actually mess with the registry from somewhere else (?)
I haven't yet tried anything - it will be Friday evening before I am able to actually sit down and work on this issue.
Thanks for the assistance, guys. I'll let you know how it goes. ... if it goes!
Logged
ejbragg
Newbie
Offline
Posts: 6
Re: Looking for the registry in XP
«
Reply #5 on:
July 26, 2010, 09:49:18 AM »
Report, as promised...
Outcome, not good.
My approach was to load XP on another hard drive and attempt to open the registry of my home drive and edit out some entries. However, regedit doesn't open external registers, and I didn't have any other editor on hand. My time in the office is extremely limited, so I wound up just removing the config files altogether - I had no other way of being sure I removed the offending entry.
Obviously, this created a problem with the operating system and because of the nature of the OEM configuration, when windows was reinstalled, it created new users.
In total frustration, I merely wiped the drive and started over.
The good news is that the OS is now authenticated - I didn't realize the authentication process was automated (available 24/7). So that much is done.
The bad news is I have to download drivers and jump through authentication processes of all kinds for about a dozen hardware appendages, all over again. Even now, I'm dealing with an audio (ASIO) driver (RME Hammerfall 9652) that crashes my computer each time I attempt to load it: apparently, the driver consumes 64 MB, whereas the BIOS only allows room for 32 MB.
Presumably, I'll be back up in another week or two.
Logged
Synquell
Full Member
Offline
Posts: 169
Re: Looking for the registry in XP
«
Reply #6 on:
July 26, 2010, 10:30:17 AM »
Sorry to hear you're still having problems :-/
Probably very obvious advice, but for the record: once you have it all up and running, be sure to make a perfect mirror image of the drive. I did this with my W7 installation, making the job of formatting and restoring all your apps and preferences a breeze.
Now I can basicly format whenever I think my drive is getting too messy.
Logged
Twitter:
https://twitter.com/dietervds
Blog:
https://synquell.wordpress.com
(not much there yet)
The beginning of knowledge is the discovery of something we do not understand.
ejbragg
Newbie
Offline
Posts: 6
Re: Looking for the registry in XP
«
Reply #7 on:
July 28, 2010, 01:26:33 PM »
Thanks for the advice, Anquilas.
By the way, is there any newer technology that allows for mirroring a drive that is not exactly the same? I just completed the new drive, and am now actually creating a back-up .... the long way. This is because my backup drive is actually a little larger.
Logged
famfu786
Newbie
Offline
Posts: 3
Re: Looking for the registry in XP
«
Reply #8 on:
July 29, 2010, 12:08:37 AM »
Quote from: Ketchup on July 21, 2010, 11:42:02 AM
WARNING: Use at your own risk. If you screw up the registry, you will break your computer and will have to reinstall. This is not recommended.
There are a few files that make up the Windows registry. The following are located in %systemroot%\system32\config:
SYSTEM - HKEY_LOCAL_MACHINE \SYSTEM
sam - HKEY_LOCAL_MACHINE \SAM
security - HKEY_LOCAL_MACHINE \SECURITY
SOFTWARE - HKEY_LOCAL_MACHINE \SOFTWARE
default - HKEY_USERS.DEFAULT
The following is located under each user profile and maps to the HKEY_CURRENT_USER when the user is logged, and the HKEY_USERS.<SID>
ntuser.dat
If you want to view and edit these files from another machine, you must copy them offline. Windows will lock these files at all times. You can them load them into the Regedit command as follows:
1. Make a temporary folder underneath your profile (HKEY_CURRENT_USER). For example, you can call it, "DEADMACHINE_SOFTWARE".
2. Select this folder. This is important, otherwise you will override data.
3. File / Load Hive...
great information.... thanks for sharing
Logged
new movies on dvd
Synquell
Full Member
Offline
Posts: 169
Re: Looking for the registry in XP
«
Reply #9 on:
July 29, 2010, 02:50:03 AM »
Quote from: ejbragg on July 28, 2010, 01:26:33 PM
By the way, is there any newer technology that allows for mirroring a drive that is not exactly the same? I just completed the new drive, and am now actually creating a back-up .... the long way. This is because my backup drive is actually a little larger.
I'm not sure I understand what you mean here m8. Are you talking about RAID configurations or something like that? Since as far as I know, mirroring software doesn't require the drives to be the same?
Logged
Twitter:
https://twitter.com/dietervds
Blog:
https://synquell.wordpress.com
(not much there yet)
The beginning of knowledge is the discovery of something we do not understand.
ejbragg
Newbie
Offline
Posts: 6
Re: Looking for the registry in XP
«
Reply #10 on:
July 30, 2010, 03:52:19 PM »
My motherboard info said it required the drives to be identical. Maybe I have an old version of RAID?
Logged
Synquell
Full Member
Offline
Posts: 169
Re: Looking for the registry in XP
«
Reply #11 on:
August 02, 2010, 02:13:56 AM »
If you got RAID, I suppose it's possible, but I don't have enough knowledge on the subject for that
For normal backup/mirror software, the drives don't matter afaik.
Logged
Twitter:
https://twitter.com/dietervds
Blog:
https://synquell.wordpress.com
(not much there yet)
The beginning of knowledge is the discovery of something we do not understand.
Ketchup
Hero Member
Offline
Posts: 1021
Re: Looking for the registry in XP
«
Reply #12 on:
August 02, 2010, 10:49:20 AM »
You actually don't really want to mix drives when you are doing RAID. It's not so much the driver sizes, but the timings on the drives. If they are not identical in RPM, seek times, etc, you will end up with one drive that wears out faster than the other. At least, that's from my experience.
Logged
~~~~~~~~~~~~~~
Ketchup
vekarman
Newbie
Offline
Posts: 28
Re: Looking for the registry in XP
«
Reply #13 on:
August 03, 2010, 01:56:26 AM »
Quote
My motherboard info said it required the drives to be identical.
It is meant only for the hardware level RAID which is faster than a Software based RAID implementation. Later is slower because of operating at Layer 7.
Quote
You actually don't really want to mix drives when you are doing RAID. It's not so much the driver sizes, but the timings on the drives. If they are not identical in RPM, seek times, etc, you will end up with one drive that wears out faster than the other. At least, that's from my experience.
In hardware based RAID implementation, you need to have similar capacity, RPM etc. Software based implementation does not need them because it operates at block level of a file system, block of an NTFS from one drive to another drive. So, it does not tax drive electronics leading to a failure. Failure could be because of other reasons, not because of software RAID implementation.
My 2 cents.
Logged
CISSP
Pages: [
1
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
News Items and General Discussion About EH-Net
: ÌÀÃÀÇÈÍ ÌÎÄÍÎÉ ÎÄÅÆÄÛ APPLE-FASHION!
(0) by
Infabeemace
News Items and General Discussion About EH-Net
: When your benjamin will be to your own car and truck clean up
(0) by
areluctes
Network Pen Testing
: Want a challenge? Want a GXPN practice exam?
(0) by
ajohnson
GCIH - GIAC Certified Incident Handler
: Passed my GCIH
(8) by
ajohnson
News Items and General Discussion About EH-Net
: Change is Coming to EH-Net!!
(29) by
ajohnson
GCIH - GIAC Certified Incident Handler
: GCIH Free Practice test attempt
(1) by
prats84
Greetings
: Hi from the UK
(4) by
MrTuxracer
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.