I am trying to view registry items in a saved copy of NTUSER.DAT; how can I do so?

I want to do this because I had a crashed hard drive and want to get all my programs running again. I reinstalled Win10 and all programs from a USB drive backup, but now some programs refuse to run because they can't find their registry settings; I have a pre-crash backup of NTUSER.DAT and want to view it so I can find the missing items.

7

3 Answers

Registry hives, such as NTUSER.DAT, are a bespoke file format, with a number of ways of viewing them:

• Perhaps the cleanest is to use a third-party application such as:
  1. Ease of use: MiTeC's Windows Registry Recovery
  2. Forensic analysis: Eric Zimmerman's Regisrty Explorer
• If you don't want third-party tools, you can mount a registry hive using regedit:
  (You probably don't want to do this and requires local Administrator privileges)
  1. From Start Menu, find Registry Explorer/regedit
  2. In the left-hand tree pane select HKEY_USERS
  3. From the File menu, select Load hive...
  4. Select the file you want to mount [NTUSER.DAT]
  5. Give it a name [OLD] and you will now see the mounted hive under HKEY_USERS
  6. To unmount it, select the name you gave it [OLD], and from the File menu, select Unload hive
• Google search results

4

To load the NTUSER.DAT hive:

• GUI:
  1. +R → RegEdit → OK
  2. Highlight HKEY_USERS → File: Load Hive... → Select NTUSER.DAT
  3. Arbitrarily name it → OK → Browse as normal
• CLI:
  1. Load hive:

     Reg Load HKU\temp "C:\Path\to\NTUSER.dat"

  2. Export key:

     Reg Export HKU\temp\Path\to\Key "C:\Path\to\Save\Exported.reg"

  3. Unload hive:

     Reg Unload HKU\temp

5

I appreciate the suggestions but I couldn't get any to work as I wanted. However, I did find a work-around: I created a shortcut to the troublesome EXE and changed its Properties (Compatibility Mode) to Windows 7. I also set Shortcut->Advanced->Run as Administrator. This did not actually answer my question as originally asked, but it did solve my problem.

4

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy