Out of curiosity and as a backup attempt, I've exported whole PC registry into several text files, all arranged in git repository (to be able to easily track registry changes).
To be more specific, I've automated it with a simple PowerShell script:
reg export HKEY_CLASSES_ROOT ./HKEY_CLASSES_ROOT.reg /y Get-Content ./HKEY_CLASSES_ROOT.reg | Set-Content -Encoding utf8 ./HKEY_CLASSES_ROOT.txt #convert to git friendly encoding git add *.txt git commit -m "$($date.ToString("yyyy-MM-dd"))"
So far so good, but I've noticed one strange thing when I started comparing
git diff between commits.
Even when I don't change anything in the system between commits it appears I still get over 100 diff changes in registry, in short timespans (few minutes), but the amount of these changes is mostly the same every time:
HKEY_CLASSES_ROOT\Local Settings => always 32 changed registry keys
HKEY_CURRENT_USER\SOFTWARE => 26 changes
HKEY_LOCAL_MACHINE\SOFTWARE => 27 changes
HKEY_LOCAL_MACHINE\SYSTEM => 25 changes
HKEY_USERS => 10 changes
Example of changed keys:
Example of changed values as shown by
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits] -"SecureTimeEstimated"=hex(b):6d,a3,54,d2,b8,3b,d8,01 -"SecureTimeHigh"=hex(b):6d,0b,19,34,c1,3b,d8,01 -"SecureTimeLow"=hex(b):6d,3b,90,70,b0,3b,d8,01 +"SecureTimeEstimated"=hex(b):8a,2e,04,38,ba,3b,d8,01 +"SecureTimeHigh"=hex(b):8a,96,c8,99,c2,3b,d8,01 +"SecureTimeLow"=hex(b):8a,c6,3f,d6,b1,3b,d8,01
I understand that some of these keys hold dates such as LastUpdate, but why so many keys (100+) are different every time I export the registry, even in short time intervals? It feels like some of these changes are just random values rather than timers.
Is this normal? I'm running Win 10 Professional.