Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Searching in the Windows registry can be ve------ry------ lo----ng.

Is there some tool available that can index the contents of the whole registry, or contents of a single hive, such that fast lookups are available? (for example generating some SQLite database with FTS3 or FTS4 enabled for full text search)

Thank you.

PS. I don't want RegScanner or tools that perform a new, linear search every time. I want an indexer, with which then a search can be instantaneous. See question comments.

share|improve this question

closed as off-topic by Moses, Tog, Shekhar, ncdownpat, Simon Sheehan Jan 19 at 17:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they become outdated quickly and attract opinion-based answers. Instead, describe your situation and the specific problem you're trying to solve. Share your research. Here are a few suggestions on how to properly ask this type of question." – Moses, Tog, Shekhar, ncdownpat, Simon Sheehan
If this question can be reworded to fit the rules in the help center, please edit the question.

    
possible duplicate of Registry Search & Replace Tool –  Mehper C. Palavuzlar Feb 26 '11 at 11:45
    
have a look here: majorgeeks.com/downloads15.html –  bubu Feb 26 '11 at 12:43
2  
@Benoit: This bothers me a lot, I'm going to try to write such application today. –  Tom Wijsman Mar 17 '11 at 8:24
1  
@TomWij: Will it be commercial? Open-source? Could I beta-test it please :-) ? This is a great project, and I back it. –  Benoit Mar 17 '11 at 8:27
1  
@TomWij: I'm not sure what you meant by the "it works fine", but notice that you've actually opened the key ControlSet001 (or maybe ControlSet002 or some other one), not CurrentControlSet. CurrentControlSet is actually a link to those keys, and it's not possible to view the link itself using the regular .NET functions; you need a function like NtOpenKey to open the actual symbolic link instead of the target. Take a look here and here. –  Mehrdad Mar 21 '11 at 22:51

3 Answers 3

up vote 10 down vote accepted
+50

Introduction

I've written an application that indexes the registry and another application that searches this index.

This results in near instant results while you type, this allows you to quickly search several things.

See this video demonstration, shows how quick results are, three different searches and two registry jumps.

The Index

enter image description here

For indexing purposes, I'm using Lucene.net, doesn't that sound familiar?

This allows me to index data straight out of the registry, without using a SQL database to store the data in. Furthermore, Lucene.net has a lot of indexing options and search related features which come in handy!

This index will be stored in %LOCALAPPDATA%\RegistryIndex, and has a size of around 160 MB.

Application 1: RegistryIndex.exe

This will dump the whole registry to the above mentioned index folder,
please note that HKEY_CLASSES_ROOT and HKEY_CURRENT_USER are shortcut hives and thus not indexed.

Although it does work without you might want to configure it to automatically run as administrator.

Once the application shows that it is done, you can close the window and thus the index has been made.

Application 2: RegistrySearch.exe

This one is simple, type something to search in the text box above and results will flow in.

Typing incorrect syntax will result in a yellow text box and the error in the status bar at the bottom.

Special search features like wildcard and boolean operations are supported, see Query Syntax for more information. Please note that specifying fields will not work in the current setting, the system searches in a concatenation of tokenized path and value. So A\B\C with value D E F becomes A B C D E F.

Example of searching an exact path: "HKEY_LOCAL_MACHINE SOFTWARE"

The search is limited to 1000 results.

Double click an entry to jump to it in the registry, this uses regjump.exe from SysInternals.
You need to run the search program as an administrator for the jump to work, accept EULA the first time.

Future features

See the current version as a Technical Preview, it does work but could use refactoring and make-up.

  • Application icon & version
  • Configuration
  • Highlighting results
  • Installer package
  • Monitor service (Tracks registry changes using a hook and update the index)

Changes

  • 21/03: Now stores in %LOCALAPPDATA%, asks for Administrators permission.

Download

Click here to download, unzip all files to a preferred location, create shortcuts to RegistryIndex/Search.exe.

Source

It's non-obfuscated, so to inspect the IL you can use Reflector if you want to.

I might release source when it is refactored with a bit more features, perhaps I can put it on CodePlex.

share|improve this answer
2  
Would be better if your app used %LOCALAPPDATA% not %APPDATA%. –  edusysadmin Mar 21 '11 at 18:42
1  
@edusysadmin: Adjusted, now saves to %LOCALAPPDATA% and asks administrator permissions. –  Tom Wijsman Mar 21 '11 at 18:59
1  
Thank you. I have downloaded the package, using Win Vista in French language, and even running RegistryIndex.exe as administrator fails. (Keeps saying “please run as an administrator”). Do you have an idea why this could fail? –  Benoit Mar 21 '11 at 19:12
    
@Benoit: I'm using code from the Microsoft site for the administrator part, but it seems to be non-international code. All other code looks things up international. The problem is that it looks up the "Administrators" group to look for the permissions, as this group is called different on your computer it thus fails. This has been resolved now using new System.Security.Principal.SecurityIdentifier(WellKnownSidType.BuiltinAdministrat‌​orsSid, null).Translate(typeof(System.Security.Principal.NTAccount)).ToString().Split('\\‌​').Last() to get the group name. –  Tom Wijsman Mar 21 '11 at 21:02
    
I might come back to this software in a month, got deadlines and exams now... –  Tom Wijsman May 24 '11 at 16:32

Look at NirSoft's RegScanner. Not an indexer, but it way out-searches RegEdit and it will open RegEdit for you to a selected hit, among other cool features. Definitely try it before you start a development project (unless you want to do the project for the sake of doing it) - you may find you don't really need more.

share|improve this answer
    
As already told in a comment: it is a good tool, but it won't index anything. –  Benoit Mar 21 '11 at 13:15
    
And as I also said. But your question, in the very first sentence, addresses RegEdit's slow speed, not its technique, and as such, RegScanner addresses that rather well. I'll leave the suggestion up for whomever it might help in the future. –  JRobert Mar 21 '11 at 14:45
    
Very nice tool! +1 –  Piotr Dobrogost Sep 1 '11 at 6:20

You could export the registry to a .reg text file and use your favourite editor to search it.

share|improve this answer
    
This is actually a nice idea but probably suboptimal because there is no indexation. –  Benoit Mar 20 '11 at 6:09
    
Note that of course, then inserting all reg file in some way into SQLite with FTS3 or FTS4 enabled is probably a way of doing it. –  Benoit Mar 21 '11 at 13:18
    
@Benoit: Actually, I started with just enumerating the whole registry to a plain-text file at first and searching with Notepad++ actually is fast by itself. I'm using Lucene.Net to do the indexing as it is specially written for that task and doesn't require me to create a SQL solution, it also supports highlighting features (it's meant for search engines, btw, SE uses Lucene.net for the search engine here) which I'll try to include, perhaps on a later version. I guess that indexing/FTS results in search results while you type, but haven't tried it yet... –  Tom Wijsman Mar 21 '11 at 14:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.