Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I accidently deleted the keys of my loaded NTUSER.dat file instead of unloading it.

The file is still about 15mb big, even though all the keys are gone.

Is there any way I can recover the keys?

share|improve this question
1  
The only way I know is to use the built in ability for Windows to roll back to a recovery point. This is the reason people who don't know what they are doing should not modify the registry by hand. –  Ramhound Sep 13 '12 at 10:30
    
since it was a loaded external registry hive, no recovery is possible, unless it was backed up by you somewhere else. –  Moab Sep 13 '12 at 19:08

3 Answers 3

Perhaps with some registry forensic tool, but AFAICS the chances are rather slim.

share|improve this answer
up vote 0 down vote accepted

Looks like it isn't possible. If anyone has other ideas, feel free to post them!

share|improve this answer
    
what would be interesting to know, is how windows store key/value pairs in registry. if registry is doing similar to what most file systems do when they delete stuff (removing entries in a TOC instead of removing the values themselves), there is a chance to recover the deleted keys. one possibility is that NTUSER.DAT grows over the time but don't shrink immediately (the extra space would contain deleted values). one way to quick check that is to open NTUSER.DAT in a hex editor and search for a particular string or hex string that was in the deleted keys. –  tigrou Sep 15 '12 at 12:15

Its a little late for this one but you could image the box/drive or do a memory dump from a running box. If you don't have the memory dump, you could just grab the hiberfil.sys file (convert it to raw image via imagecopy from volatility) from the image via FTK imager or sleutkit or SIFT 3.0. Use volatility to extract the hives from memory, specifically NTUSER.dat and then recursively print out all the keys/values ( using PRINTKEY) and compare them against the ones that are currently missing. This may help in finding out specifically what was deleted.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.