Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I accidently deleted the keys of my loaded NTUSER.dat file instead of unloading it.

The file is still about 15mb big, even though all the keys are gone.

Is there any way I can recover the keys?

share|improve this question
1  
The only way I know is to use the built in ability for Windows to roll back to a recovery point. This is the reason people who don't know what they are doing should not modify the registry by hand. – Ramhound Sep 13 '12 at 10:30
since it was a loaded external registry hive, no recovery is possible, unless it was backed up by you somewhere else. – Moab Sep 13 '12 at 19:08

2 Answers

up vote 0 down vote

Perhaps with some registry forensic tool, but AFAICS the chances are rather slim.

share|improve this answer
up vote 0 down vote accepted

Looks like it isn't possible. If anyone has other ideas, feel free to post them!

share|improve this answer
what would be interesting to know, is how windows store key/value pairs in registry. if registry is doing similar to what most file systems do when they delete stuff (removing entries in a TOC instead of removing the values themselves), there is a chance to recover the deleted keys. one possibility is that NTUSER.DAT grows over the time but don't shrink immediately (the extra space would contain deleted values). one way to quick check that is to open NTUSER.DAT in a hex editor and search for a particular string or hex string that was in the deleted keys. – tigrou Sep 15 '12 at 12:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.