Is there a way to undo deletion of registry keys while the machine is still running?

Question

[ also posted from a programmer's POV at https://stackoverflow.com/questions/3299230 ]

I messed up big time and deleted a large portion of my registry during a programming experiment: As a result most of the contents of HKEY_CURRENT_USER\Software\ are gone.

I haven't logged off or shutdown since this happened. The applications that were already running seem to be coping fine so far but I suspect that after the next reboot there won't be much happiness left...

Also, System Restore tells me there are no restore points even though I'm pretty sure there should have been. Could this be another symptom of the purged registry? I wouldn't have expected this information to be stored under HKCU, though...

Does anybody know of a technique or utility that can possibly restore some or all of the deleted entries?

I'm on Windows 7 Enterprise 32bit.

I'm not really holding my breath but you can always hope, can't you?

Answer 1

HKEY_CURRENT_USER contains the registry keys for the user you're running as, i.e., your account. The system keeps all its data under the other hives like HKEY_LOCAL_MACHINE, etc.

In the worst case, you've hosed your user account. Right away, create a new user account which is an administrator, so if you can't log back in with your own account, you can still get in and fix the damage. If all goes to hell, use this second account to log in, delete your user profile folder, then log back in as your normal account. It will create a new profile directory with freshly-minted HKEY_CURRENT_USER hive.

In the best case, you might just lose some settings and preferences. The Software key is where applications are expected to store their own data, so they may just behave as if they've never been run before. Windows does store data related to your user account under HKCU\Software\Microsoft, so I suspect this might not be the case.