How to recover registry (not just files) from formatted disk?

-2

I know how to recover files, that is using software Ontrack EasyRecovery, Stellar Phoenix Windows Data Recovery, iCare Format Recovery, etc.

But I need to recover an info that is in registry, from formatted disk.

How to do this?

Old OS is Windows XP, that I want to get an info from the registry.
New OS now is Windows 7 32 bit, but I'm not using it again now, to recover the disk in another computer.

Krain

Posted 2014-12-19T16:14:43.833

Reputation: 1

1doesn't windows still keep the registry in a file? – Xen2050 – 2014-12-19T16:25:52.117

There isn't a single file. So data recovery is unlikely for that reason. Here are the locations of those files

– Ramhound – 2014-12-19T16:25:55.777

Answers

I believe that you can not get the data from disk after you formatted the disk. You can only get the data using recovery software in case of data delete. Please check whether you are able to recover the whole data from the formatted disk .If you can then mount it as a secondary disk in any windows machine and copy the files from the location.

The registry files can be fetched from two different location default location and from repair folder.

copy drive_letter\windows\system32\config\system drive_letter\backup\windows\tmp\system.bak copy drive_letter\windows\system32\config\software drive_letter\backup\windows\tmp\software.bak copy drive_letter\windows\system32\config\sam drive_letter\backup\windows\tmp\sam.bak copy drive_letter\windows\system32\config\security drive_letter\backup\windows\tmp\security.bak copy drive_letter\windows\system32\config\default drive_letter\backup\windows\tmp\default.bak

copy drive_letter\windows\repair\system drive_letter\backup\windows\system32\config\system copy drive_letter\windows\repair\software drive_letter\backup\windows\system32\config\software copy drive_letter\windows\repair\sam drive_letter\backup\windows\system32\config\sam copy drive_letter\windows\repair\security drive_letter\backup\windows\system32\config\security copy drive_letter\windows\repair\default drive_letter\backup\windows\system32\config\default

vembutech

Posted 2014-12-19T16:14:43.833

Reputation: 5 693

I didn't check but I am sure the registry file is plain text.

So if you know maybe, the string was like "MySerialNumer=12345", you can run the following command, assuming you're on sda

dd if=/dev/sda | strings | grep -c 3 MySerialNumer

That will scan your disk ones and aextract any plaintext strings, and hopefully help you.

davidbaumann

Posted 2014-12-19T16:14:43.833

Reputation: 2 089