Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I can find the "Last write Time" of a windows registry key by right-clicking on it in regedit and exporting it to a .txt.

Is there any way to pull this information from a mounted windows hard-drive without booting the system?

share|improve this question
    
Mount the SAM registry hives in another windows system that can read data from the disk you want to examine. –  Darth Android Nov 14 '13 at 21:12
    
I'm really looking for a more programmatic way to do it, rather than just using the regedit GUI to export in that fashion. The data is obviously coming from somewhere I should be able to query/scrape, I just don't know where. –  DHandle Nov 14 '13 at 21:25
    
It's coming from the registry hives... what do you use to query/scrape those? AFAIK the hives are binary files, and are not easily queried. If there's no tool to do it, you'd need to find documentation on the fileformat and process the hives yourself –  Darth Android Nov 14 '13 at 21:37
    
That's exactly the kind of information I'm looking for. I have not been able to find it anywhere. There are tools to parse the hives, but they are not comprehensive it seems. –  DHandle Nov 14 '13 at 22:15

1 Answer 1

up vote 1 down vote accepted

What you want should be able to do with RegRipper.

It has a GUI but also a CLI for ripping the registry. You need to specify a hive-file so loading one from a mounted Windows-drive shouldn't be a problem (if you have the necessary permissions on the file)

The following is from this article about RegRipper. You can Google for more. (Don't follow the links on that page to RegRipper. It is outdated)

Here is a small excerpt from a system registry file:

ComputerName = testbox
----------------------------------------
ControlSet002\Control\Windows key, ShutdownTime value
ControlSet002\Control\Windows
LastWrite Time Mon Jan 19 23:03:52 2009 (UTC)
    ShutdownTime = Mon Jan 19 23:03:52 2009 (UTC)
----------------------------------------
ShutdownCount
ControlSet002\Control\Watchdog\Display
LastWrite Time Mon Jan 19 23:03:52 2009 (UTC)
    ShutdownCount = 218
----------------------------------------
TimeZoneInformation key
ControlSet002\Control\TimeZoneInformation
LastWrite Time Sun Nov  2 14:14:54 2008 (UTC)
    DaylightName   -> Eastern Daylight Time
    StandardName   -> Eastern Standard Time
    Bias           -> 300 (5 hours)
    ActiveTimeBias -> 300 (5 hours)
----------------------------------------
ControlSet002\Control\Terminal Server key, fDenyTSConnections value
LastWrite Time Fri Oct 24 20:53:51 2008 (UTC)
    fDenyTSConnections = 1
----------------------------------------

From the Forensicswiki.org page:

RegRipper — "the fastest, easiest, and best tool for registry analysis in forensics examinations."

On this page from Forensicswiki.org you can find a couple of others too. (at the bottom under "Open Source")

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.