How to Manipulate Unloaded Registry Hives Using RegFind

MORE INFORMATION

The syntax of the RegFind utility is:

   REGFIND [-h hivefile hiveroot | -w Win95 Directory | -m \\machinename]
      [-i n] [-o outputWidth]
      [-p RegistryKeyPath] [-z | -t DataType] [-b | -B] [-y] [-n]
      [searchString [-r ReplacementString]]
				

The -h option lets you specify:

• the registry hive file
• the keyroot name which references that hive in both the output and the command-line arguments

The -p option lets you specify the registry key path where the search starts.

Sample:

   regfind -h "c:\winnt\Profiles\UserX\ntuser.dat" KEYR -p KEYR\Software
   WINNT
				

In this sample, RegFind displays all keys containing the WINNT string in the data value. The search will start under the Software subkey in the UserX's registry hive The KEYR argument specifies the registry key name for the root key of this hive.