[Question] Is thers a way to edit the registry on a slaved HDD?

[Sonic]

To ensure your modification, modify it in two ControlSet ...

You can't use CurrentcontrolSet from other system ... CurrentControlset is only for the "actual" system.

[ednetman]

Hey guys!

Instead of paying $200 for the Avast Bart CD, why not go to the source? BartPE is wahat the Avast disk is based on and it is free as long as you have a valid licensed copy of Windows XP or Server 2003.

http://nu2.nu/pebuilder/

Also, I belive that there has to be a way to edit the registry of an image. I am doing a little testing and hopefully will get this question resolved.

[ednetman]

OK, I have it now. Here is the deal:

1. Your image MUST BE fat32, not NTFS. This will enable you to edit the image file instead of just view and extract.

2. Extract the registry files. I just dumped the whole folder to a temp directory on my project machine. (%WinDir%\System32\Config)

3. Launch Regedit on your machine and highlight the HKLM hive.

4. Go to File, Load Hive and browse to the extracted config folder.

5. Load the following files as hives: default, sam, security, software, system, userdiff. I think you may only need default, software, and system. But we can all test and see what works. These files do not have extensions.

6. When you name them, be sure and make it obvious that they are from your image. For example I used IMAGE_default.

7. Make the appropriate changes to the registry files.

8. Unload the hives from the registry editor.

9. Delete the files from the ghost image.

10. Copy the files back into the image.

11. Select File, then choose compile.

12. Test your image and verify that the registry is correct now.

It would probably be a good idea to either work with a copy of the original image, or back up the files before changing them.

~Ed

[ednetman]

The steps would also work with a slaved hard drive that the image is on. In this case, just skip the steps regarding extracting, injecting, and compiling the image.