📎 AI Summary:
The thread discusses how to access specific Registry values from an offline Windows 7 image mounted as a drive, since standard Registry editors only work with the active OS. The proposed solution involves using regedit to load the offline hive files (located in \Windows\System32\config for system hives and \Users\Username\NTUSER.DAT for user hives) via "Load Hive," allowing users to inspect and export desired registry data. Overall, the responses provide a clear method to retrieve Registry information from an inactive Windows 7 image, with the original poster expressing gratitude for the helpful guidance.
P

pstein

Extraordinary Member
Member details
Joined
Mar 20, 2010
Messages
454
Thread Author #1
​
​
Assume I have mounted a Windows 7 image file (ISO or Aomei Backupper or TrueImage) to drive letter T:
This Windows 7 is NOT the active, currently running one but an old backup archive file.

Now I want to get a certain Registry value from this image resp. old Win 7.

How can I achieve this?
All Registry editors I know so far allow only peeking into currently active, local Win 7 but not an offline, inactive Windows?

Or did I miss something?

Which files exactly contain the Registry data?

Peter

 

Solution
Neemobeer
You can do that with regedit
  • Open regedit and select either HKEY_LOCAL_MACHINE or HKEY_USERS
  • Click File > Load Hive
  • Select the hive you want to open and click Open
  • Enter a keyname (I usually just enter something like AAAAA)
  • Expand the AAAAA key, locate and export what you need
  • Click on the AAAAA key and click File > Unload hive

In relation to the root of a mounted Windows operating system partition common hives are located at
\Windows\System32\config for system hives
and \Users\<username>\NTUSER.DAT is the user hive location minus the classes which is actually a separate hive file at...
Sort by date Sort by votes
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
#2
You can do that with regedit
  • Open regedit and select either HKEY_LOCAL_MACHINE or HKEY_USERS
  • Click File > Load Hive
  • Select the hive you want to open and click Open
  • Enter a keyname (I usually just enter something like AAAAA)
  • Expand the AAAAA key, locate and export what you need
  • Click on the AAAAA key and click File > Unload hive

In relation to the root of a mounted Windows operating system partition common hives are located at
\Windows\System32\config for system hives
and \Users\<username>\NTUSER.DAT is the user hive location minus the classes which is actually a separate hive file at \Users\<username>\Appdata\Local\Microsoft\Windows\UsrClass.dat
 

Upvote 1 Downvote
Solution
L

luciahenry

New Member
Member details
Joined
Mar 4, 2020
Messages
1
#3
Neemobeer said:
You can do that with regedit
  • Open regedit and select either HKEY_LOCAL_MACHINE or HKEY_USERS
  • Click File > Load Hive
  • Select the hive you want to open and click Open
  • Enter a keyname (I usually just enter something like AAAAA)
  • Expand the AAAAA key, locate and export what you need
  • Click on the AAAAA key and click File > Unload hive

In relation to the root of a mounted Windows operating system partition common hives are located at
\Windows\System32\config for system hives
and \Users\<username>\NTUSER.DAT is the user hive location minus the classes which is actually a separate hive file at \Users\<username>\Appdata\Local\Microsoft\Windows\UsrClass.dat
Click to expand...
Thanks very much. It was very helpful.
 

Upvote 0 Downvote
You must log in or register to reply here.