Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I can find the "Last write Time" of a windows registry key by right-clicking on it in regedit and exporting it to a .txt.

Is there any way to pull this information from a mounted windows hard-drive without booting the system?

share|improve this question
Mount the SAM registry hives in another windows system that can read data from the disk you want to examine. – Darth Android Nov 14 '13 at 21:12
I'm really looking for a more programmatic way to do it, rather than just using the regedit GUI to export in that fashion. The data is obviously coming from somewhere I should be able to query/scrape, I just don't know where. – DHandle Nov 14 '13 at 21:25
It's coming from the registry hives... what do you use to query/scrape those? AFAIK the hives are binary files, and are not easily queried. If there's no tool to do it, you'd need to find documentation on the fileformat and process the hives yourself – Darth Android Nov 14 '13 at 21:37
That's exactly the kind of information I'm looking for. I have not been able to find it anywhere. There are tools to parse the hives, but they are not comprehensive it seems. – DHandle Nov 14 '13 at 22:15
up vote 1 down vote accepted

What you want should be able to do with RegRipper.

It has a GUI but also a CLI for ripping the registry. You need to specify a hive-file so loading one from a mounted Windows-drive shouldn't be a problem (if you have the necessary permissions on the file)

The following is from this article about RegRipper. You can Google for more. (Don't follow the links on that page to RegRipper. It is outdated)

Here is a small excerpt from a system registry file:

ComputerName = testbox
ControlSet002\Control\Windows key, ShutdownTime value
LastWrite Time Mon Jan 19 23:03:52 2009 (UTC)
    ShutdownTime = Mon Jan 19 23:03:52 2009 (UTC)
LastWrite Time Mon Jan 19 23:03:52 2009 (UTC)
    ShutdownCount = 218
TimeZoneInformation key
LastWrite Time Sun Nov  2 14:14:54 2008 (UTC)
    DaylightName   -> Eastern Daylight Time
    StandardName   -> Eastern Standard Time
    Bias           -> 300 (5 hours)
    ActiveTimeBias -> 300 (5 hours)
ControlSet002\Control\Terminal Server key, fDenyTSConnections value
LastWrite Time Fri Oct 24 20:53:51 2008 (UTC)
    fDenyTSConnections = 1

From the page:

RegRipper — "the fastest, easiest, and best tool for registry analysis in forensics examinations."

On this page from you can find a couple of others too. (at the bottom under "Open Source")

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .