Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 47 guests and 1 member online
 
Free Business and Tech Magazines and eBooks

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Hardwarearrow Looking for the registry in XP
EH-Net
May 21, 2013, 06:31:23 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Looking for the registry in XP  (Read 11791 times)
0 Members and 1 Guest are viewing this topic.
ejbragg
Newbie
*
Offline Offline

Posts: 6


View Profile
« on: July 21, 2010, 11:25:23 AM »

Is there any way for me to find the registry of a sick hard drive to edit or delete it without running Windows on it?  I'd like to use a working version of windows on hard drive A to fix the OS of a non-working hard drive B.  This might be a software question, but the location of the registry files is what I'm looking for.  Can those files be accessed?

Thanks,
Eric
Logged
sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #1 on: July 21, 2010, 11:33:42 AM »

Your best/safest bet:

http://support.microsoft.com/kb/307545

... To answer the location specific question though, its in %systemroot%/system32/config so .. Usually C:\Windows\ C:\WINNT\ ... Whichever is your environment variable
« Last Edit: July 21, 2010, 11:36:39 AM by sil » Logged

Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #2 on: July 21, 2010, 11:42:02 AM »

WARNING:  Use at your own risk.  If you screw up the registry, you will break your computer and will have to reinstall.  This is not recommended.


There are a few files that make up the Windows registry.   The following are located in %systemroot%\system32\config:

SYSTEM - HKEY_LOCAL_MACHINE \SYSTEM
sam - HKEY_LOCAL_MACHINE \SAM
security - HKEY_LOCAL_MACHINE \SECURITY
SOFTWARE - HKEY_LOCAL_MACHINE \SOFTWARE
default - HKEY_USERS.DEFAULT

The following is located under each user profile and maps to the HKEY_CURRENT_USER when the user is logged, and the HKEY_USERS.<SID>

ntuser.dat

If you want to view and edit these files from another machine, you must copy them offline.   Windows will lock these files at all times.   You can them load them into the Regedit command as follows:

1.  Make a temporary folder underneath your profile (HKEY_CURRENT_USER).   For example, you can call it, "DEADMACHINE_SOFTWARE".   

2.  Select this folder.  This is important, otherwise you will override data.

3.  File / Load Hive...
Logged

~~~~~~~~~~~~~~
Ketchup
ejbragg
Newbie
*
Offline Offline

Posts: 6


View Profile
« Reply #3 on: July 21, 2010, 03:39:45 PM »

Thanks, guys.  I can tell already, by the information I've received, I'm going to have to fess up on something else...

I installed a legit copy of XP SP3 on my drive about 3 weeks ago.  I completed the installation on a Friday night in an attempt to overcome a hardware conflict concerning the use of MIDI.  (I bought a control surface that will use MIDI, but it crashed my computer.)  We also recently moved, and I can't find my old XP disk, so I just bought this one, which is an OEM version, XP Pro SP3, full blown.

I had it set up, as I just mentioned and up pops the authentication request window.  I don't have internet access with this computer, because it is a DAW for my recording studio - I've no intentions of connecting it to the internet - I shy away from virus protection to keep my overhead clear (I run up to 48 channels of 32 bit audio at a time, plus processing on every channel).

So I did something  .... sorta stupid.  I wanted it up and running and I did not want to have to call Microsoft, simply because I figured it was Friday, and I didn't think anyone would answer all weekend, anyway... I'm actually 6 weeks behind in taking care of recorded clients, so I decided to download info on a windows crack.  I updated my registry on the timer key.  Well, it SEEMED to work - the activation window disappeared, but after the time ran out, it locked up on me anyway. And of course, I'm worse off now than I was, because if I press "Yes" to activate Windows, the response is, "Windows is already activated", after which I am returned to the previous box.  There's no way to get into windows at all!

I tried re-installing windows, but it doesn't fix the registry problem.  So I was hoping I could go in from another computer and possibly remove that particular key (and try re-installing windows).  If I could get it back to a "normal" state, I could merely call Windows and activate it over the phone.

I'm trying very hard NOT to have to wipe the drive because I JUST got through installing a new drive and setting up all my DAW software, hardware, and an array of plug-ins from different vendors, each with their own, time consuming method of security verification / activation.  Most of them run on some sort of .dll license or dongle, so I'm hoping that a mild, localized registry deletion should help me get back in the swing quickly.
« Last Edit: July 22, 2010, 01:00:36 PM by ejbragg » Logged
ejbragg
Newbie
*
Offline Offline

Posts: 6


View Profile
« Reply #4 on: July 22, 2010, 01:07:19 PM »


This particular link, I found, warned against trying the method due to the fact that I DO have an OEM version of the OS.  Microsoft specifically states that when registry files are deleted, the hive will not recover the files, but will rather create new user profiles.  If I'm understanding it correctly, it means I cannot actually mess with the registry from somewhere else (?)

I haven't yet tried anything - it will be Friday evening before I am able to actually sit down and work on this issue.

Thanks for the assistance, guys.  I'll let you know how it goes. ... if it goes!
Logged
ejbragg
Newbie
*
Offline Offline

Posts: 6


View Profile
« Reply #5 on: July 26, 2010, 09:49:18 AM »

Report, as promised...
Outcome, not good. Sad

My approach was to load XP on another hard drive and attempt to open the registry of my home drive and edit out some entries.  However, regedit doesn't open external registers, and I didn't have any other editor on hand.  My time in the office is extremely limited, so I wound up just removing the config files altogether - I had no other way of being sure I removed the offending entry.

Obviously, this created a problem with the operating system and because of the nature of the OEM configuration, when windows was reinstalled, it created new users.

In total frustration, I merely wiped the drive and started over.

The good news is that the OS is now authenticated - I didn't realize the authentication process was automated (available 24/7).  So that much is done.

The bad news is I have to download drivers and jump through authentication processes of all kinds for about a dozen hardware appendages, all over again.  Even now, I'm dealing with an audio (ASIO) driver (RME Hammerfall 9652) that crashes my computer each time I attempt to load it: apparently, the driver consumes 64 MB, whereas the BIOS only allows room for 32 MB.

Presumably, I'll be back up in another week or two.
Logged
Synquell
Full Member
***
Offline Offline

Posts: 169



View Profile
« Reply #6 on: July 26, 2010, 10:30:17 AM »

Sorry to hear you're still having problems :-/

Probably very obvious advice, but for the record: once you have it all up and running, be sure to make a perfect mirror image of the drive. I did this with my W7 installation, making the job of formatting and restoring all your apps and preferences a breeze.
Now I can basicly format whenever I think my drive is getting too messy.
Logged

Twitter: https://twitter.com/dietervds
Blog: https://synquell.wordpress.com (not much there yet)

The beginning of knowledge is the discovery of something we do not understand.
ejbragg
Newbie
*
Offline Offline

Posts: 6


View Profile
« Reply #7 on: July 28, 2010, 01:26:33 PM »

Thanks for the advice, Anquilas.

By the way, is there any newer technology that allows for mirroring a drive that is not exactly the same?  I just completed the new drive, and am now actually creating a back-up .... the long way.  This is because my backup drive is actually a little larger.
Logged
famfu786
Newbie
*
Offline Offline

Posts: 3


View Profile
« Reply #8 on: July 29, 2010, 12:08:37 AM »

WARNING:  Use at your own risk.  If you screw up the registry, you will break your computer and will have to reinstall.  This is not recommended.


There are a few files that make up the Windows registry.   The following are located in %systemroot%\system32\config:

SYSTEM - HKEY_LOCAL_MACHINE \SYSTEM
sam - HKEY_LOCAL_MACHINE \SAM
security - HKEY_LOCAL_MACHINE \SECURITY
SOFTWARE - HKEY_LOCAL_MACHINE \SOFTWARE
default - HKEY_USERS.DEFAULT

The following is located under each user profile and maps to the HKEY_CURRENT_USER when the user is logged, and the HKEY_USERS.<SID>

ntuser.dat

If you want to view and edit these files from another machine, you must copy them offline.   Windows will lock these files at all times.   You can them load them into the Regedit command as follows:

1.  Make a temporary folder underneath your profile (HKEY_CURRENT_USER).   For example, you can call it, "DEADMACHINE_SOFTWARE".   

2.  Select this folder.  This is important, otherwise you will override data.

3.  File / Load Hive...


great information.... thanks for sharing
Logged

Synquell
Full Member
***
Offline Offline

Posts: 169



View Profile
« Reply #9 on: July 29, 2010, 02:50:03 AM »

By the way, is there any newer technology that allows for mirroring a drive that is not exactly the same?  I just completed the new drive, and am now actually creating a back-up .... the long way.  This is because my backup drive is actually a little larger.
I'm not sure I understand what you mean here m8. Are you talking about RAID configurations or something like that? Since as far as I know, mirroring software doesn't require the drives to be the same?
Logged

Twitter: https://twitter.com/dietervds
Blog: https://synquell.wordpress.com (not much there yet)

The beginning of knowledge is the discovery of something we do not understand.
ejbragg
Newbie
*
Offline Offline

Posts: 6


View Profile
« Reply #10 on: July 30, 2010, 03:52:19 PM »

 Huh  My motherboard info said it required the drives to be identical.  Maybe I have an old version of RAID?
Logged
Synquell
Full Member
***
Offline Offline

Posts: 169



View Profile
« Reply #11 on: August 02, 2010, 02:13:56 AM »

If you got RAID, I suppose it's possible, but I don't have enough knowledge on the subject for that Smiley
For normal backup/mirror software, the drives don't matter afaik.
Logged

Twitter: https://twitter.com/dietervds
Blog: https://synquell.wordpress.com (not much there yet)

The beginning of knowledge is the discovery of something we do not understand.
Ketchup
Hero Member
*****
Offline Offline

Posts: 1021



View Profile
« Reply #12 on: August 02, 2010, 10:49:20 AM »

You actually don't really want to mix drives when you are doing RAID.   It's not so much the driver sizes, but the timings on the drives.  If they are not identical in RPM, seek times, etc, you will end up with one drive that wears out faster than the other.  At least, that's from my experience. 
Logged

~~~~~~~~~~~~~~
Ketchup
vekarman
Newbie
*
Offline Offline

Posts: 28



View Profile
« Reply #13 on: August 03, 2010, 01:56:26 AM »

Quote
My motherboard info said it required the drives to be identical.

It is meant only for the hardware level RAID which is faster than a Software based RAID implementation. Later is slower because of operating at Layer 7.

Quote
You actually don't really want to mix drives when you are doing RAID.   It's not so much the driver sizes, but the timings on the drives.  If they are not identical in RPM, seek times, etc, you will end up with one drive that wears out faster than the other.  At least, that's from my experience. 

In hardware based RAID implementation, you need to have similar capacity, RPM etc. Software based implementation does not need them because it operates at block level of a file system, block of an NTFS from one drive to another drive. So, it does not tax drive electronics leading to a failure. Failure could be because of other reasons, not because of software RAID implementation.

My 2 cents.
Logged

CISSP
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.095 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.