-2

I know how to recover files, that is using software Ontrack EasyRecovery, Stellar Phoenix Windows Data Recovery, iCare Format Recovery, etc.

But I need to recover an info that is in registry, from formatted disk.

How to do this?

  • Old OS is Windows XP, that I want to get an info from the registry.
  • New OS now is Windows 7 32 bit, but I'm not using it again now, to recover the disk in another computer.
2
  • 1
    doesn't windows still keep the registry in a file?
    – Xen2050
    Dec 19, 2014 at 16:25
  • There isn't a single file. So data recovery is unlikely for that reason. Here are the locations of those files
    – Ramhound
    Dec 19, 2014 at 16:25

2 Answers 2

1

I believe that you can not get the data from disk after you formatted the disk. You can only get the data using recovery software in case of data delete. Please check whether you are able to recover the whole data from the formatted disk .If you can then mount it as a secondary disk in any windows machine and copy the files from the location.

The registry files can be fetched from two different location default location and from repair folder.

copy drive_letter\windows\system32\config\system drive_letter\backup\windows\tmp\system.bak copy drive_letter\windows\system32\config\software drive_letter\backup\windows\tmp\software.bak copy drive_letter\windows\system32\config\sam drive_letter\backup\windows\tmp\sam.bak copy drive_letter\windows\system32\config\security drive_letter\backup\windows\tmp\security.bak copy drive_letter\windows\system32\config\default drive_letter\backup\windows\tmp\default.bak

copy drive_letter\windows\repair\system drive_letter\backup\windows\system32\config\system copy drive_letter\windows\repair\software drive_letter\backup\windows\system32\config\software copy drive_letter\windows\repair\sam drive_letter\backup\windows\system32\config\sam copy drive_letter\windows\repair\security drive_letter\backup\windows\system32\config\security copy drive_letter\windows\repair\default drive_letter\backup\windows\system32\config\default

0

I didn't check but I am sure the registry file is plain text.

So if you know maybe, the string was like "MySerialNumer=12345", you can run the following command, assuming you're on sda

dd if=/dev/sda | strings | grep -c 3 MySerialNumer

That will scan your disk ones and aextract any plaintext strings, and hopefully help you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .