Question
92835 views

How to view NTUSER.DAT file like in registry without using it?

Leonnis.16 asked on
How to view NTUSER.DAT file like in registry without using it?
The file is from another Windows instalation!!!!

I have Win 7 but the file is from my old Windows xp.
15 people had this question

Abuse history


The answered status icon Answer
PauloBreim replied on

Hi Leonnis,

There are many ways to read the registry file without using regedit.

Some ways:
RegLookup: The RegLookup project is devoted to direct analysis of Windows NT-based registry files. RegLookup is released under the GNU GPL, and is implemented in ANSI C. RegLookup provides command line tools, a C API, and a Python module for accessing registry data structures.  
Get here: http://projects.sentinelchicken.org/reglookup/

RegViewer: Is GTK 2.2 based GUI Windows registry file navigator. It is platform independent allowing for examination of Windows registry files from any platform. Particularly useful when conducting forensics of Windows files from *nix systems.
Get here: http://regviewer.sourceforge.net

RegRipper: 
RegRipper is an open source forensic software application developed by Harlan Carvey. RegRipper, written in Perl, is a Windows Registry data extraction tool.
Get here: http://regviewer.sourceforge.net


KRegedit: 
kregedit was a KDE utility for viewing native Windows registry files. It is similar to the regedt32 utility that can be found on most Windows platforms. Only the NT registry format (NT4/2000/XP) is supported.

Paulo Breim
Centro Brasileiro de Perícia

Please help!!!!

12 people found this helpful

Abuse history


progress