how to read offline windows xp registry using bartpe

[ryuunami]

hey, guys

I've just created a full-unattened windows xp setup through Bartpe. But I am stuck on one problem. Before i format partition c into ntfs file system, I want to read ip addresses ,subnet mask and dns configurations from remote registry of the windows xp system resides on partition c and get thoses keys saved in partition d in ".reg" file format for later use. I just want it be done automaticlly. So, are there any solutions for me to use to read those keys through scripts , C programs or any other means that can be done automaticlly? I plan to use BartPE to be the enviroment for the solution to work. Thanks in advance!

Edited May 17, 2012 by ryuunami

[Kelsenellenelvian]

Please edit your post and REMOVE the custom font settings:

They will NOT get you helped any quicker

Just the opposite in fact your post will get ignored as it is very annoying.

[allen2]

Yes you should be able to load the "system" hive located in "C:\windows\system32\config" and then read the values or export settings you need with reg.exe (command line include with xp).

[ryuunami]

@allen2

can you show me a detailed tutorial as for how to load the hive with reg and export the setttings. I am new to it.

another thing that I am worried about is the permisstion to load the remote hive files.

I would run reg.exe within BartPE which is not the system resides on partition C.

Are there any limitations of reg.exe to read registry keys of remote system, that is system on partition c in my circumstances?

Thanks!

[submix8c]

I use a built LiveXP, run "Regedit", "Load Hive", export the Loaded (or a portion of it) to a REG file, then do a global edit of the Exported REG file (to remove the Temporary "folder" name I gave it during Load).

Load Hive

The Same (plus HIVE names).

[Tripredacus]

all the TCP/IP parameters are registry values that are located under one of two different subkeys of

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Tcpip\Parameters

Tcpip\Parameters\Interfaces\ID for Adapter

http://support.microsoft.com/kb/314053

Of course, an offline hive won't have a CurrentControlSet, so you'll likely be using 001.

Here is an example of how to use reg.exe with an offline hive:

[submix8c]

Be sure to note Posts#2+#4 (Tripredacus' MSFN link) - you need a TEMP "folder" (any name will do) to load a HIVE (same as using Regedit as in my post above).

[jaclaz]

Or use the offline registry library (and tool):

http://reboot.pro/11212/

http://reboot.pro/11312/

jaclaz